February 2006 - Freeradius-Users - lists.freeradius.org

FreeRadius Features
by Mohammad Flaifel 24 Feb '06

24 Feb '06

Dears, I asked this question before but unfortunately I didn't get the answer yet, I hope this is not a negative sign :) Are the following features available in FreeRadius: - Change of Authorization while the subscriber's PPP session is still connected. - Radius initiated disconnect: Disconnect users based on download volume limitation Appreciate you answer. Flaifel

4 3

MySQL and users file... Difference???
by Alex Savguira 24 Feb '06

24 Feb '06

Hi to all... Does anyone have any idea why placing the following two lines into users file works perfectly with both PAP and CHAP users btest User-Password == Master1 btest Crypt-Password == "$1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1" whereas placing the same two records into radcheck table doesn't work for PAP it does however work for CHAP? username | att | op | val --------------+-------------------------+----+----------- btest | User-Password | == | Master1 btest | Crypt-Password | == | $1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 It seems that rlm_sql is hitting the unencrypted password only, whereas encryption-scheme in radiusd.conf is defined crypt... Am I missing something? Any help will be appreciated Alex Savguira radius -X (version 1.0.4 ) says rad_recv: Access-Request packet from host 192.168.0.8:4544, id=47, length=45 User-Name = "btest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 173 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'btest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "btest" with password Master1 rlm_pap: Using password "Master1" for user btest authentication. rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [btest/Master1] (from client rasdata port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 47 to 192.168.0.8:4544 Waking up in 4 seconds...

1 0

Help needed with MS-CHAP
by Charles Blake 24 Feb '06

24 Feb '06

Dear friends: I am trying to set up a freeradius-1.1.0 server for authenticating users using MS-CHAP passwords. I pretend to authenticate users against shadow. I am using the default radius.conf and users files. I have included the microsoft dictionary in radiusclient.conf file. radtest shows ok: # radtest mts mypassword localhost 0 testing123 Sending Access-Request of id 160 to 127.0.0.1 port 1812 User-Name = "mts" User-Password = "mypassword" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=160, length=20 But when I try to authenticate an user using MS-CHAP, I am getting this output: rad_recv: Access-Request packet from host 127.0.0.1:1027, id=5, length=146 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "mts" MS-CHAP-Challenge = 0x6b61b1ed954a289c0fa3aebedc329ac6 MS-CHAP2-Response = 0x8f0001684e1d34295e1232edb0682bd04e6e00000000000000002caaa9579823e00501812d3e2dce9225b7dd251c02e1fd89 Calling-Station-Id = "172.16.255.11" NAS-IP-Address = 192.168.181.254 NAS-Port = 0 Wed Feb 22 20:47:07 2006 : Debug: Processing the authorize section of radiusd.conf Wed Feb 22 20:47:07 2006 : Debug: modcall: entering group authorize for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "mschap" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_realm: No '@' in User-Name = "mts", looking up realm NULL Wed Feb 22 20:47:07 2006 : Debug: rlm_realm: No such realm "NULL" Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 152 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 171 Wed Feb 22 20:47:07 2006 : Debug: users: Matched entry DEFAULT at line 183 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall: leaving group authorize (returns ok) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rad_check_password: Found Auth-Type MS-CHAP Wed Feb 22 20:47:07 2006 : Debug: auth: type "MS-CHAP" Wed Feb 22 20:47:07 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Feb 22 20:47:07 2006 : Debug: modcall: entering group MS-CHAP for request 0 Wed Feb 22 20:47:07 2006 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: Told to do MS-CHAPv2 for mts with NT-Password Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Wed Feb 22 20:47:07 2006 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Wed Feb 22 20:47:07 2006 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall[authenticate]: module "mschap" returns reject for request 0 Wed Feb 22 20:47:07 2006 : Debug: modcall: leaving group MS-CHAP (returns reject) for request 0 Wed Feb 22 20:47:07 2006 : Debug: auth: Failed to validate the user. Wed Feb 22 20:47:07 2006 : Debug: Delaying request 0 for 1 seconds Wed Feb 22 20:47:07 2006 : Debug: Finished request 0 Wed Feb 22 20:47:07 2006 : Debug: Going to the next request Wed Feb 22 20:47:07 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:07 2006 : Debug: Waking up in 1 seconds... Wed Feb 22 20:47:08 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:08 2006 : Debug: Waking up in 1 seconds... Wed Feb 22 20:47:09 2006 : Debug: --- Walking the entire request list --- Sending Access-Reject of id 5 to 127.0.0.1 port 1027 Wed Feb 22 20:47:09 2006 : Debug: Waking up in 4 seconds... Wed Feb 22 20:47:13 2006 : Debug: --- Walking the entire request list --- Wed Feb 22 20:47:13 2006 : Debug: Cleaning up request 0 ID 5 with timestamp 43fd141b Wed Feb 22 20:47:13 2006 : Debug: Nothing to do. Sleeping until we see a request. What I am doing wrong? Thank you for your help, Charles

3 7

Re: Client certs with MSCHAPV2 in PEA
by Dave Huff 24 Feb '06

24 Feb '06

. >From: "Alan DeKok" <aland(a)ox.org> >Robert Myers <ccrider(a)whiterose.net> wrote: >> The reason I ask, is that I'm using a client cert signed by my CA to do >> eap/tls, and it's working. I have not implemented the server cert as of >> yet. > Then it *should* work with PEAP. But I don't know of many people >that use client certs with PEAP. I suspect no one has tested that, >and that the client may be doing something different than with EAP-TLS. > My suggestion is don't use client certs with PEAP. > Alan DeKok. Ah well, I'm trying to authenticate both a machine (cert) and a user (password) to prevent people from using unchecked machines on the network. PEAP sort of does that I guess since the internal CA isn't set up on a client, but that's not a very secure method. Any suggestions appreciated and thanks for your help.

2 2

IPpool & EAP?
by Palmer J.D.F. 24 Feb '06

24 Feb '06

Hello, Just a quick question, is it possible to allocate client IP details using ippools within FreeRADIUS when using EAP(PEAP)? Many thanks, Jezz Palmer.

2 1

Re: Duplicate entries and incorrect accounting and authorization (Cont'd)
by bdab＠hushmail.com 24 Feb '06

24 Feb '06

Alan, Thank you so much. It was a firewall problem indeed. Running tcpdump on both sides really helped to spot the problem. -Bill On Thu, 23 Feb 2006 18:51:51 -0300 Alan DeKok <aland(a)ox.org> wrote: ><bdab(a)hushmail.com> wrote: >> Thank you for your response. As you pointed out, by watching >> tcpdump outcome I see no Radius Responses coming back to the NAS >(I >> do see Radius Requests going out the NAS though). The shared >secret >> is fine and I use chillispot with the right configuration >(pointing >> at the right radius server). Also, I did not introduce any >changes >> at the NAS side from my previous working version. All changes >were >> introduced at the Radius server side. Any more suggestions? > > You have a firewall on the RADIUS server that's blocking >outgoing >packets. Or, the packets are going somewhere else. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485

1 0

Re: Log file format
by Walter Reynolds 24 Feb '06

24 Feb '06

> Date: Mon, 20 Feb 2006 13:44:05 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: Log file format > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060220184405.5BEB016E17(a)mail.nitros9.org> > > Walter Reynolds <waltr(a)umich.edu> wrote: >> We have some tools that currently run some statistics on the radius >> accounting file. Well, we currently use a different radius server. With >> that in mind the log format is different. Is there a way to modify the >> format of the accounting log format? > > Which accounting log? The detail file? That's pretty much > unchanged since the original Livingston format 13 years ago. > > Could you be more specific, and say what should be changed, and to > what it should be changed? > > Alan DeKok. I apologize for not giving all the info, I am new to radius and am still learning. Yes I am refering to the detail file. Currently we have implemented a version of MERIT Radius. I know less about that than Freeradius, so forgive me if I do not give you what you need. Currently we have two files that appear to be accounting data to me. Following are what we get (I have removed IP info for safty sake) These two lines are from logfile.20060220 Mon Feb 20 13:07:12 2006: Received-Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP Mon Feb 20 13:07:12 2006: Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP - OK -- total 0, holding 0 No, what is more important to me os from the session.20060220.las file (mainly the first line) This is strange though as because Pre-Auth the accounting data is sent to the merit radius then forwarded to a freeradius and back. Either way this is the format of the merit radius and our scripts. NA NA 1140458855 20 20 waltr@ NA 'PROFILE' NA NA XXX.XXX.XXX.XXX/9126 NA NA Framed/PPP/XXX.XXX.XXX.XXX ## User-Name:0='waltr' Calling-Station-Id:0='XXX.XXX.XXX.XXX' Acct-Status-Type:1=Stop ## Acct-Input-Octets:1=1208 Acct-Output-Octets:1=1648 Acct-Session-Id:0='0B901E52' ## Acct-Input-Packets:1=11 Acct-Output-Packets:1=9 Acct-Terminate-Cause:1=User-Request ## Tunnel-Client-Endpoint:10=:49:'XXX.XXX.XXX.XXX' Acct-Authentic:1=RADIUS Acct-Delay-Time:1=0 ## NAS-IP-Address:2=XXX.XXX.XXX.XXX NAS-Port-Type:1=Virtual I hope this helps clear up my question.

1 0

Need help reg free radius server
by Balajee Muggalla 24 Feb '06

24 Feb '06

Hi, I am new to free radius server. I installed Radius server on my Linux platform. It is authenticating the user name and password successfully. But when I add the vendor specific attributes, it is not sending those attributes to the Radius server so that I am not able to login to the box. I added these attributes in the dictionary and user files successfully. Still, I could not able to make it. Can you tell me the reason why it is not happening with attributes. Thanks in advance... -- Thanks, Balajee

1 0

FreeBSD 6.0 and mysql
by Alan Craig 24 Feb '06

24 Feb '06

Hi all, I have recently encountered this problem on one of my FreeBSD 6.0 boxes. After many recompiles reinstalls and even an upgrade of MySQL to 4.1 I still run into a core dump when enabling the sql option. Here is the debug. ---------------- START ----------------- radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "rad-user" sql: password = "" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Fatal error 'Spinlock called when not threaded.' at line 87 in file /usr/src/lib/libpthread/thread/thr_spinlock.c (errno = 2) Abort trap: 6 (core dumped) ------------------ END ------------------------------- GDB debug gdb /usr/local/sbin/radiusd GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)... (gdb) set args -X (gdb) run Starting program: /usr/local/sbin/radiusd -X (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...warning: Unable to get location for thread creation breakpoint: generic error [New LWP 100212] (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib [New Thread 0x8078000 (LWP 100212)] (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) (no debugging symbols found)...Module: Loaded expr Module: Instantiated expr (expr) (no debugging symbols found)...Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) (no debugging symbols found)...Module: Loaded CHAP Module: Instantiated chap (chap) (no debugging symbols found)...Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) (no debugging symbols found)...Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) (no debugging symbols found)...Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "rad-user" sql: password = "" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...[New LWP 100150] suspend_thread_callback generic error suspend error: debugger service failed [Switching to LWP 100150] Stopped due to shared library event (gdb) backtrace #0 0x28069b96 in r_debug_state () from /libexec/ld-elf.so.1 #1 0x2806ca0e in dlopen () from /libexec/ld-elf.so.1 #2 0x282ab8b6 in sys_dl_open () from /usr/local/lib/libltdl.so.4 #3 0x282ac07d in tryall_dlopen () from /usr/local/lib/libltdl.so.4 #4 0x282aeb52 in try_dlopen () from /usr/local/lib/libltdl.so.4 #5 0x282af1a5 in lt_dlopen () from /usr/local/lib/libltdl.so.4 #6 0x282af239 in lt_dlopenext () from /usr/local/lib/libltdl.so.4 #7 0x282af0ed in try_dlopen () from /usr/local/lib/libltdl.so.4 #8 0x282af2c3 in lt_dlopenext () from /usr/local/lib/libltdl.so.4 #9 0x284e7506 in rlm_sql_instantiate () from /usr/local/lib/rlm_sql-1.1.0.so #10 0x08055a33 in find_module_instance () #11 0x0805707d in modcallable_free () #12 0x0805608e in setup_modules () #13 0x0804cd9f in main () Could anybody shed some light on this? Thank you. -- View this message in context: http://www.nabble.com/FreeBSD-6.0-and-mysql-t1168311.html#a3067926 Sent from the FreeRadius - User forum at Nabble.com.

2 2

RE: Help needed with MS-CHAP
by King, Michael 24 Feb '06

24 Feb '06

Just to further my own knowledge. > -----Original Message----- > > Charles Blake wrote: > > > I am trying to set up a freeradius-1.1.0 server for authenticating > > users using MS-CHAP passwords. > > > > I pretend to authenticate users against shadow. > > You can't do that. > > MS-CHAP requires the NT hash, the plaintext password from > which it can derive the NT hash, or Samba configured as a > domain member and use of the "ntlm_auth" helper. > Does this also apply to MS-CHAPv2?

2 1