March 2006 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

Freeradius authentication agains Domino
by Christoffer Dahl Petersen 06 Mar '08

06 Mar '08

Hi! I have a Domino (6.5.4FP3) ldap which I would like to use as a backend for freeradius. My clients (winxp) uses eap-mschapv2, would it be possible for freeradius to match the password from the domino with the one supplied by the client? If it ain't possible what would it take to achieve it? I'm sorry if the question has been asked too many times, but I can't find a answer on the net or in this list.... Thanks -CP

3 4

no DB handles
by Lucas Aimaretto 31 Oct '07

31 Oct '07

Hi all, I've seen many of these messages in the radius.log ... Wed Jun 15 15:10:23 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

11 23

windows XP computer WPA, TKIP, PEAP, EAP-MSCHAP v2 has "No User-Password or CHAP-Password attribute in the request"
by PoWah Wong 25 Aug '07

25 Aug '07

My freeradius client is a windows XP SP2 computer running 802.11 WPA, TKIP, PEAP, EAP-MSCHAP v2 and trying to connect to the linux Fedora Core 2 wireless server. I run the freeradius server in debugging mode # radiusd -sfxxyz -l stdout This is the output. How to fix this problem? rad_recv: Access-Request packet from host 127.0.0.1:52001, id=38, length=134 Framed-MTU = 1380 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "wifictrl" User-Name = "test" NAS-Port-Id = ":2:2" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 Called-Station-Id = "00-f0-00-06-67-a8" Calling-Station-Id = "00-20-a6-57-7a-e9" EAP-Message = 0x020100090174657374 Message-Authenticator = 0x737afc3b6c1fb17ad13ee348ca5fbf4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched test at 90 radius_xlat: 'Hello, test' modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 38 to 127.0.0.1:52001 Reply-Message = "Hello, test" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 38 with timestamp 43d1500d Nothing to do. Sleeping until we see a request. # radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Apr 15 2005 at 11:57:29 # uname -a Linux wifictrl 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux __________________________________________________________ Find your next car at http://autos.yahoo.ca

8 15

Backing up Mysql
by Sarkis Gabriel 10 Dec '06

10 Dec '06

Hi all i started backing up the db using a crontab job early in the morning which backs up everything, but i have had complains from users who try to logon after the backup process. What is the best way to backup an active database with radiusd waiting for connection? Thank you Sarky

6 9

FreeRadius and MySQL boot problem
by Diniz Da Rocha 26 Nov '06

26 Nov '06

HI, I have currently setup FreeRadius 1.0.4 with ldap authentication and authorization as well as mysql authorization and its all working fine. My only problem is that when I boot the server (Fedora Core 4) and radiusd starts up there is a rlm_sql_mysql error: Wed Feb 15 18:38:51 2006 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Wed Feb 15 18:38:51 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius_client@myip:radius Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on 'myip' (13)' Wed Feb 15 18:38:51 2006 : Error: rlm_sql (sql): Failed to connect DB handle #4 The MySQL server is on another server with ip "myip" I initially thought it was a firewall block but even with no firewall I get this error. But once the server has started and I run "service radiusd restart" from a terminal the connect to the MySQL server works fine and has no problems. I even tried running the service from rc.local but it still fails did anyone have this problem??? is anyone running the MySQL server on another machine???? Is there a fix for this??? thanks diniz

5 8

Managing connection on Freeradius
by Nataniel Klug 14 Aug '06

14 Aug '06

Hello all, I am quite new to freeradius and I am with a doubt. I have a PPPoE-Server that authenticate the users into my FreeRadius server. The problem is that if a client, by some reason, get lost of connection the freeradius mantain the log about that connection and, if the client try to connect again, it say that siomultaneos use is not allowed. So I have to delete radutmp and radwtmp, restart radius, and lost the track of connections. There is any tool to make it easier? Or some configuration that if there is no package coming from the cliente for 60 seconds it will disconect the client? Att, Nataniel Klug

3 5

Freeradius and prepaid extension
by deborah malka 14 Aug '06

14 Aug '06

Hello all, I have heard about Freeradius, that it is a very powerfull server. Thank you to all for the work you have done !! I need a Radius server to perform prepaid VOIP telephony. For that the server must implement the RFCs 2865, 2866, 3539, and the extension for Prepaid follows the specifications : X.S0011-005-C and X.S0011-006-C. Does Freeradius implements all this ? I need these informations, because I have to install a platform demo, so if someone can help me ... thank you so much by advance. Deborah ================= Déborah Malka --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

6 11

Another RPM build issue with version 1.1.1
by Sandworm 08 Jun '06

08 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello There appears to be a conflict with the Makefiles in the doc directories and the behaviour of RPM. With version 1.1.0, this was OK as they were both consistent, but are not with version 1.1.1. Now when the RPMs are built (on RHEL3 U6), the build bombs out with: RPM build errors: Installed (but unpackaged) file(s) found: /usr/share/doc/freeradius/Acct-Type /usr/share/doc/freeradius/Autz-Type /usr/share/doc/freeradius/CYGWIN /usr/share/doc/freeradius/ChangeLog /usr/share/doc/freeradius/DIFFS /usr/share/doc/freeradius/MACOSX etc... This is because the Makefiles in the doc directories have lines like this: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius whereas version 1.1.0 had lines like: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius- $(RADIUSD_VERSION) RPMs %doc macro, however (AFAIK), uses the version in the path, and the documentation seems to say this too (from http://www.rpm.org/max-rpm-snapshot/s1-rpm-inside-files-list- directives.html, "When the package is installed, RPM creates a directory in the documentation directory named the same as the package (ie, <software>-<version>-<release>)"). This is what I am seeing during the RPM build - a relevant extract: Processing files: freeradius-1.1.1-0 Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.18818 + umask 022 + cd /usr/src/redhat/BUILD + cd freeradius-1.1.1 + DOCDIR=/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.1 + export DOCDIR Incidentally, apart from this, even if the Makefile/RPM conflict were resolved, not all files get copied into the doc directory, I think, and this was true with version 1.1.0 as well. The only files seen there are: ls /usr/share/doc/freeradius-1.1.0 ChangeLog COPYRIGHT INSTALL README todo To get the other files there, it would unfortunately need a more detailed list in the %files section of the SPEC file as shown below: %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL Regards SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQp19gACgkQmw4BJyaatJ3xhgCgsjwbq8mP6XhQpsqSTLCBFena9fUA nAvGkYPRHnlRzCnV+FMt5R6F5lOm =jS3p -----END PGP SIGNATURE-----

4 3

v1.1.1 rlm_eap compile problem (no prob in v1.1.0)
by Aaron Paetznick 15 May '06

15 May '06

I'll save people a lot of time and just paste the bomb out below. Help??? Otherwise, can I simple choose to not compile rlm_eap (I don't use it). I've tried --disable-eap and similar arguements. Thanks. --Aaron /usr/local/src/freeradius-1.1.1/libtool --mode=compile gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c mkdir .libs gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c -fPIC -DPIC -o .libs/rlm_eap_peap.lo In file included from eap_peap.h:25, from rlm_eap_peap.c:24: ../../libeap/eap_tls.h:138: error: parse error before "SSL" ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:141: error: parse error before '*' token ../../libeap/eap_tls.h:141: warning: type defaults to `int' in declaration of `into_ssl' ../../libeap/eap_tls.h:141: warning: data definition has no type or storage class ../../libeap/eap_tls.h:142: error: parse error before '*' token ../../libeap/eap_tls.h:142: warning: type defaults to `int' in declaration of `from_ssl' ../../libeap/eap_tls.h:142: warning: data definition has no type or storage class ../../libeap/eap_tls.h:172: error: parse error before '}' token ../../libeap/eap_tls.h:172: warning: type defaults to `int' in declaration of `tls_session_t' ../../libeap/eap_tls.h:172: warning: data definition has no type or storage class ../../libeap/eap_tls.h:182: error: parse error before "tls_session_t" ../../libeap/eap_tls.h:186: error: parse error before "SSL" ../../libeap/eap_tls.h:188: error: parse error before '*' token ../../libeap/eap_tls.h:371: error: parse error before "SSL_CTX" ../../libeap/eap_tls.h:371: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:372: warning: type defaults to `int' in declaration of `eap_tls_t' ../../libeap/eap_tls.h:372: warning: data definition has no type or storage class ../../libeap/eap_tls.h:383: warning: type defaults to `int' in declaration of `SSL' ../../libeap/eap_tls.h:383: error: parse error before '*' token ../../libeap/eap_tls.h:384: error: parse error before "X509_STORE_CTX" ../../libeap/eap_tls.h:386: error: parse error before "SSL" ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: warning: type defaults to `int' in declaration of `cbtls_rsa' ../../libeap/eap_tls.h:387: warning: data definition has no type or storage class ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: warning: type defaults to `int' in declaration of `eaptls_new_session' ../../libeap/eap_tls.h:390: warning: data definition has no type or storage class ../../libeap/eap_tls.h:391: error: parse error before '*' token ../../libeap/eap_tls.h:392: error: parse error before '*' token ../../libeap/eap_tls.h:393: error: parse error before '*' token ../../libeap/eap_tls.h:397: error: parse error before '*' token ../../libeap/eap_tls.h:398: error: parse error before '*' token In file included from rlm_eap_peap.c:24: eap_peap.h:52: error: parse error before "tls_session_t" rlm_eap_peap.c: In function `eappeap_authenticate': rlm_eap_peap.c:165: error: `tls_session' undeclared (first use in this function) rlm_eap_peap.c:165: error: (Each undeclared identifier is reported only once rlm_eap_peap.c:165: error: for each function it appears in.) rlm_eap_peap.c:165: error: parse error before ')' token gmake[9]: *** [rlm_eap_peap.lo] Error 1 gmake[9]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_peap' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/freeradius-1.1.1' make: *** [all] Error 2

4 3