March 2006 - Freeradius-Users - lists.freeradius.org

Ignoring request from unknown client *.*.*.* 2244
by yao guoxian 22 Mar '06

22 Mar '06

I have configured FreeRadius to use Mysql.It seemed Mysql works well when I input "Radiusd -X". However when I use NtRadPing to test,I always get the following error: rad_recv: Access-Request packet from host 202.117.15.164:2244, id=0, length=43 Ignoring request from unknown client 202.117.15.164:2244 --- Walking the entire request list --- I insert items into the table 'nas' int the 'radius' database like : +----+----------------+-----------+-------+-------+------------+-----------+---------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+----------------+-----------+-------+-------+------------+-----------+---------------+ | 1 | 202.117.15.164 | liv1 | other | NULL | testing123 | NULL | RADIUS Client | +----+----------------+-----------+-------+-------+------------+-----------+---------------+ But it doesn't work.

1 0

RE: Table radacct is empty
by Vincent MARGUERIE 22 Mar '06

22 Mar '06

Hi, Yes, SQL is ok to query in accounting section. Here is a part of my radiusd.conf : # The rlm_sql_log module appends the SQL queries in a log # file which is read later by the radsqlrelay program. # # This module only performs the dynamic expansion of the # variables found in the SQL statements. No operation is # executed on the database server. (this could be done # later by an external program) That means the module is # useful only with non-"SELECT" statements. # # See rlm_sql_log(5) manpage. # sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" } ...... ...... $INCLUDE ${confdir}/sql.conf ...... ...... authorize { sql ... ... accounting { sql sql_log .... .... session sql .... .... post-auth { sql sql_log .... .... Moreover, the information are written in a file (sql-relay) which (is I have understand correctly) is used by the radsqlrelay binary to put the information in database. The fact is that for the post-auth part, it works bacause i get all the information of the post authorisation in the "radpostauth" table. But in this sql-relay file, there's only information about post-auth...nothing about accounting !! The strange thing is that there's some informations about accounting in others file "auth-detail" and "reply-detail", but not in sql format. some lines of the files : "sql-relay" INSERT INTO radpostauth (user, pass, reply, date) VALUES ('joseph', 'Chap-Password', 'Access-Accept', '2006-03-21 15:28:48'); ----------------- "reply-detail" Packet-Type = Access-Accept Wed Mar 22 18:04:18 2006 Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 10000 Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Login-User Session-Timeout = 1000 Idle-Timeout = 500 Port-Limit = 10 Reply-Message = "Bye Mr Joseph !" MS-MPPE-Recv-Key = 0x315cddbc0724d537fdb446a4fc50756d12cc3b005e452caeafe6e867a8a273da MS-MPPE-Send-Key = 0x99246dc1071a72f26b069f36cf13c4c865705471f3dbd0dfa1515615affd3004 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "joseph" ------------------ "auth-detail" Packet-Type = Access-Request Wed Mar 22 17:46:52 2006 User-Name = "joseph" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Identifier = "default\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Calling-Station-Id = "00-12-f0-4f-19-26" EAP-Message = 0x0201000b016a6f73657068 NAS-IP-Address = 192.168.0.50 Message-Authenticator = 0x3796599b7cebc6895c6a57f7444cccfc Client-IP-Address = 192.168.0.50 ------------------- Best regards, Vincent ------------------------------ Message: 3 Date: Wed, 22 Mar 2006 09:17:08 -0500 From: "Alex M" <radiussupport(a)lrcommunications.net> Subject: RE: Table radacct is empty To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <001c01c64dbb$4dc706f0$e102fe0a@Alexm> Content-Type: text/plain; charset="us-ascii" Did u authorize SQL in accounting section? -----Original Message----- From: freeradius-users-bounces+radiussupport=lrcommunications.net(a)lists.freeradius .org [mailto:freeradius-users-bounces+radiussupport=lrcommunications.net@lists.fr eeradius.org] On Behalf Of Vincent MARGUERIE Sent: Wednesday, March 22, 2006 4:14 AM To: freeradius Subject: Table radacct is empty Hi, I've installed freeradius 1.1.1 on a Debian Sarge distribution, and the connection works fine with my wireless windows XP client but I have a problem to get information into radacct table in my mysql database. Does anyone get solution for this ? Rq : I use a Dlink-DWL-2000AP+ as Acces Point Regards, Vincent - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Replicate Accounting Records
by Tye Lougheed 22 Mar '06

22 Mar '06

I am running FreeRadius version 0.9.3 and need to determine the method for replicating an accounting record and forwarding it to a secondary accounting server. I am also not clear on how to specify the secondary accounting server in order to accomplish this. I am only interested in receiving the start/stop packets no other updates are required. Thanks,

2 1

Error building version 1.1.1
by Sandworm 22 Mar '06

22 Mar '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi While attempting to build the RPMs for FreeRadius version 1.1.1, I get an error during the build of libradius. Extract of the output is shown below. Build being done with 'rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec', where the spec file is taken from the 'redhat' directory in the tarball. The build is being done on Redhat Enterprise Server 3 (ES) Update 6. Looks like the Makefile in the tarball's src/lib directory is removing the '/var/tmp/freeradius-root/usr/lib/' directory and the symbolic link creation then does not find it. Making install in lib... gmake[4]: Entering directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src/lib' /usr/bin/libtool --mode=install /usr/src/redhat/BUILD/freeradius- 1.1.1/install-sh -c -c libradius.la /var/tmp/freeradius- root/usr/lib /usr/src/redhat/BUILD/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /var/tmp/freeradius-root/usr/libradius- 1.1.1.so (cd /var/tmp/freeradius-root/usr && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /usr/src/redhat/BUILD/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /var/tmp/freeradius-root/usr/libradius.la /usr/src/redhat/BUILD/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /var/tmp/freeradius-root/usr/libradius.a ranlib /var/tmp/freeradius-root/usr/libradius.a chmod 644 /var/tmp/freeradius-root/usr/libradius.a libtool: install: warning: remember to run `libtool --finish /usr/lib' rm -f /var/tmp/freeradius-root/usr/lib/libradius-1.1.1.la; ln -s libradius.la /var/tmp/freeradius-root/usr/lib/libradius- 1.1.1.la ln: creating symbolic link `/var/tmp/freeradius- root/usr/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1' make: *** [install] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.72933 (%install) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.72933 (%install) -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQfptQACgkQmw4BJyaatJ3CjQCgkE3PssxUgCxIgcQCyCOF/7akj1cA n3uM4/Yu6y5ko1XNO+2j9dfwvd3j =Kl6m -----END PGP SIGNATURE-----

4 7

Want to use 2 different authentication-methods
by Hans-Peter Fuchs 22 Mar '06

22 Mar '06

I use freeradius 1.0.5 for a special NAS I want to use 2 user databases. requests from nas-special should first verified per sql If and only if sql does not verify the user try pam. In users I have: ##### new DEFAULT NAS-IP-Address == special, Autz-Type := SQL Idle-Timeout = 3600, Session-Timeout= 7200, Fall-Through = yes #### end new #### begin old config: works DEFAULT Auth-Type = Pam Service-Type = Framed-User, Nomadix-Bw-Up = 128, Fall-Through = yes ### end old config ### begin new config # pam-authentified users from ssg get Ainternet-attribute DEFAULT NAS-IP-Address == special Service-Type = Framed-User, Idle-Timeout = 3600, Session-Timeout= 7200, Cisco-Account-Info += "KW0", Fall-Through = yes ### end new config But with this users who are verified by sql are also checked against pam. Do you have some tips? Output from radiusd -X: rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: group Autz-Type returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radius> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <test>. Reason: Permission denied modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RZKR, Zimmer 20 Zentrum fuer angewandte Informatik - Universitaetsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 1

Version 1.1.1 has been released
by Alan DeKok 22 Mar '06

22 Mar '06

Version 1.1.1 has just been released. http://www.freeradius.org/security.html Upgrade now, or disable EAP-MSCHAPv2. That's a bad bug. ChangeLog: Security fixes * Additional state checking in the EAP-MSCHAPv2 module. Bug found by Steffen Schuster. Feature improvements * More dictionary updates * Additional tests and fixes for Digest module from Phillipe Sultan. * Add new "phone" response mode to rlm_otp/cryptocard. * Put the eap sessions into a tree, so that looking them up is very fast, and no longer O(n) in the number of sessions. * Install the schema examples for a set of backends with the rest of the documentation. * Add support for xlat expansion of attributes from LDAP. Bug fixes * Fix rlm_perl crash. (closes: #348) * Fix handling of CoA-Request packets (close #344). Also correct name of CoA packets. * Fix an error on x86_64 machines when reading dictionaries. (closes: #312) * Fix compilation errors on FreeBSD and NetBSD because of rlm_otp module. (closes: #314 #328) * Workaround Cisco bug in State attribute handling in rlm_otp. * Support LP64 for async mode in rlm_otp. * Fix libtool problems on Debian with rlm_eap_peap and rlm_eap_ttls modules. (closes: #75) * Make "use_tunneled_reply" work properly for PEAP. * Copy the whole string when getting a one-to-one-mapped attribute from LDAP (closes: #261) * Fix net-snmp's ucd-snmp compatibility mode.

5 6

request object pointer offset
by jasonatx0001 22 Mar '06

22 Mar '06

I am having some difficulty accessing the data in the request object inside my module. It seems the pointers are offset ... inside the authenticate method of my module ... DEBUG ("MYMODULE: request->config_items->name = %s", request->config_items->name); DEBUG ("MYMODULE: request->config_items->strvalue = %s", request->config_items->strvalue); if (!request->username) { DEBUG ("MYMODULE: no username found\n"); } else { DEBUG ("MYMODULE: request->username->strvalue = %s\n", request->username->strvalue); } if (!request->password) { DEBUG ("MYMODULE: no password found\n"); } else { DEBUG ("MYMODULE: request->password->strvalue = %s\n", request->password->strvalue); } DEBUG ("MYMODULE: request->number = %d\n", request->number); return RLM_MODULE_REJECT; ... and this is the output i get from radiusd -X ... auth: type "mymodule" Processing the authenticate section of radiusd.conf modcall: entering group mymodule for request 0 MYMODULE: request->config_items->name = User-Name MYMODULE: request->config_items->strvalue = testuser MYMODULE: request->username->strvalue = test MYMODULE: no password found MYMODULE: request->number = 0 modcall[authenticate]: module "mymodule" returns reject for request 0 modcall: leaving group mymodule (returns reject) for request 0 auth: Failed to validate the user. ... As you can see, the config_items VP* points to the User-name VP and the username VP* points to the password and the password VB* is NULL. Any ideas ? -- View this message in context: http://www.nabble.com/request-object-pointer-offset-t1325410.html#a3537076 Sent from the FreeRadius - User forum at Nabble.com.

2 2

Questions about FreeRadius proxy
by Dovelet 22 Mar '06

22 Mar '06

Hi all, I am new in FreeRadius and I hope someone can kindly help me. I have several questions: Q1) I just setup a FreeRadius server and I want to set it as a Radius Proxy server. I know Realm can do it but I found that to use Realm, the user needs to append the domain @xxx.com (i.e. user01(a)xxx.com) at the end. Is it true? Can I skip the domain @xxx.com? (i.e. user just type the username [user01] and the FreeRadius can proxy to another RADIUS server). Q2) Can I setup a table in the FreeRadius server with username only so that when the Application server request for authentication, the FreeRadius will proxy to another RADIUS server only if the username is listed in the table? Q3) If Q2 is feasible, can I have several Application Servers and I limit the users from the Application servers? i.e. If user01 login Appliation server1, Application Server1 request the FreeRadius server. The FreeRaidus server check the user01 is belongs to Application Server1 group and it proxy the request to another RADIUS server. Application Server1 - user01 - user02 Application Server2 - user03 - user04 Any suggestions are welcome. Sorry for so many questions. Regards, Dovelet -- View this message in context: http://www.nabble.com/Questions-about-FreeRadius-proxy-t1297096.html#a34536… Sent from the FreeRadius - User forum at Nabble.com.

3 4

Load-balance and Auth-Type
by Evil I_Am 22 Mar '06

22 Mar '06

Hi all I have this scenario: 2 radius servers must point to 2 ldap servers with a load-balancing and fault-tolerant configuration. I tried to implement this on one of the radius servers this way: modules { ldap ldap1 { ........... authtype = ldap #added later but seems not to work } ldap ldap2 { ........... authtype = ldap #added later but seems not to work } } authorize { preprocess load-balance { # between two redundant sections below redundant { ldap1 ldap2 } redundant { ldap2 ldap1 } } } authenticate { Auth-Type LDAP { load-balance { # between two redundant sections below redundant { ldap1 ldap2 } redundant { ldap2 ldap1 } } } but if i try to authenticate a user i see this in debug: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:25702, id=169, length=77 User-Name = "XXXXXX" User-Password = "XXXXXX" NAS-IP-Address = XXX.XXX.XXX.XXX NAS-Identifier = "login" NAS-Port = 24677 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering load-balance group for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for XXX radius_xlat: '(uid=XXX)' radius_xlat: 'dc=XXXXXXX,dc=XX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to XXX.XXX.XXX.XXX:389, authentication 0 rlm_ldap: bind as / to XXX.XXX.XXX.XXX:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=XXXXXXX,dc=XX, with filter (uid=XXX) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusServiceType as Service-Type, value Shell-User & op=11 rlm_ldap: extracted attribute Cisco-AVPair from generic item cisco-avpair="shell:priv-lvl=15" rlm_ldap: user futhwo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: load-balance group returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 169 to XXX.XXX.XXX.XXX port 25702 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 169 with timestamp 44212404 Nothing to do. Sleeping until we see a request. If i keep only 1 module,call it simply ldap and give up on load balancing everything works ok. How can i resolv this issue?

2 1

Failed Compilation of Freeradius with Mysql since 1.1.0 (Works on 1.0.5)
by Philippe JOYEZ 22 Mar '06

22 Mar '06

Hello All, I've seen many topics about that problem but no one of them has solved my problem. I'm trying to upgrade my 1.0.5 Freeradius server to 1.1.1 on my Solaris 8 system but it fails to find mysql libs. On the same server, I use the same configure scripts options: ./configure --localstatedir=/var --with-logdir=/var/log/radius/log --with-radacctdir=/var/log/radius/radacct --with-mysql-lib-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc/l- ib --with-mysql-include-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-spa- rc/include --with-mysql-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc It works for 1.0.5 but not for 1.1.1 (and also KO for 1.1.0): configuring in ./drivers/rlm_sql_mysql running /bin/sh ./configure --localstatedir=/var --with-logdir=/var/log/radius/log --with-radacctdir=/var/log/radius/radacct --with-mysql-lib-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc/l- ib --with-mysql-include-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-spa- rc/include --with-mysql-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for mysql_config... (cached) no checking for pthread_create in -lpthread... (cached) yes checking for mysql_init in -lmysqlclient_r... no configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql/mysql.h... yes configure: warning: sql submodule 'mysql' disabled creating ./config.status creating Makefile creating config.h config.h is unchanged Best regards -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

4 3