May 2006 - Freeradius-Users - lists.freeradius.org

how can i response respectively to different users?
by yao guoxian 15 May '06

15 May '06

How can I use FreeRadius and MySql to response respectively to the different users? I need to give different permissons or rights to the logined uses.ShouldI maintain a table that map detailed permission to different uses? How to write the program which handle the tables? Btw, I want to use AES cryptographic algorithm to encrypt the user's password or ID, and store the encrypted results on the FreeRadius Server machine .How can I give different authorizations to different users according to their AES encypted password? Should I write EAP program? Thanks in advance.

1 0

Interaction cisco/radius
by Pierre LEONARD 15 May '06

15 May '06

hello all I would like to use freeradius server in order to authenticate vpn client. My cisco router run as NAS and VPN concentrator too. When the NAS send access-request to radius, the server return the ip config of the vpn client but the router don't use these informations to configure the vpn client !! some ideas ?? thanks in advance

1 0

rlm_sqlippool and few issues from 14.05.2006 snapshot
by RobertB 15 May '06

15 May '06

Hi All Today I have been testing rlm_sqlippool module from the current snapshot. Here are few problems/question?: 1. Seem like it is designed to work with Postgres db only. Shouldn't be difficult to fix it: Mysql doesn't like NOW() + 3600. Mysql needs NOW() + INTERVAL 3600 SECOND. 2. # lease_duration. fix for lost acc-stop packets - lease-duration = 3600 Seems like rlm_ippool handles this much better. rlm_ippool will free an ip address either on an accounting-stop or if a new authentication request comes on an allocated nas-ip/port. Can this be done in rlm_sqlippool? 3. DEFAULT as an pool name. Is there any way to tell rlm_sqlippool to pick up an ip from any pool available? Something like rlm_ipppool's DEFAULT for the pool name? Cheers RobertB

1 0

Mysql with freeradius Error
by Monsur Mannan 15 May '06

15 May '06

Dear Freeradius users , Would anyone please help me out of my problem ? I'm testing feeradius with mysql on Linux Enterprize edition 4.I did these following things with the help of internet users and members of this site. $INCLUDE ${confdir}/sql.conf authorize { preprocess auth_log chap sql #files mschap } accounting { acct_unique detail unix sql radutmp } session { sql } root@megaphone:~# mysql -u root -p mysql> create database freeradius mysql>insert into user (Host, User, Password) values ('localhost', 'radius','radius'); mysql>grant all on freeradius.* to radius mysql> exit I install the FreeRadius MySQL schema into the freeradius database within MySQL. root@megaphone:~# mysql -u root -p freeradius < /usr/local/src/freeradius-1.1.1/src/modules/example/mysql.sql ** I configure sql.conf file sql { driver = "rlm_sql_mysql" server = "localhost" login = "radius" password = "radius" radius_db = "freeradius" ** I configure clients.conf client 127.0.0.1 { secret = radiustest shortname = localhost } After running the command "Radiusd -X" the output is ------- [root@localhost ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:32769, id=180, length=56 User-Name = "radius" User-Password = "radius" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 180 to 127.0.0.1 port 32769 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 180 with timestamp 44660748 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=184, length=56 User-Name = "root" User-Password = "chishtia" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Sending Access-Accept of id 184 to 127.0.0.1 port 32769 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 184 with timestamp 4466078f Nothing to do. Sleeping until we see a request. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Can you find out the problem? radius is not accept request other than root user. Please help me ,I think this will be appreciated by everyone of freeradius user. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 2

Rewriting/Filtering Attributes based upon NAS-IP or NAS-Port-Type
by Bill Carr 14 May '06

14 May '06

I'm sure other have this problem, I've got Free-Radius Running for Wired Users against an OpenLDAP database, but need to now add some functionality for my Wireless Users. I need to (preferably based on NAS-Port-Type) look for an existing Filter-ID (passed from OpenLDAP) and remove it, but replace that attribute with three attributes to support RFC3580 Basically if the port is "Wireless", I want to trigger VLAN moves based upon the Filter ID already existing (and passed) by OpenLDAP. I saw the doc files on attr_rewrite but have been googling and searching from some example of how I implement this within the DEFAULT realm. Anybody with an example or insight into how this be accomplished, THANKS in ADVANCE!! Bill

2 1

freeradius install issue
by Jason L. Ellison 14 May '06

14 May '06

When installing freeradius version 1.1.1 from source I ran into a problem with the make files. Using --prefix=/usr/local/freeradius-1.1.1 fails to create the libs directory and places the lib files files in ${prefix}. Using --prefix=/usr/local works just fine. Summary: FAILS: ./configure --prefix=/usr/local/freeradius-1.1.1 WORKS: ./configure --prefix=/usr/local Error: ./configure --prefix=/usr/local/freeradius-1.1.1 --with-large-files make make install Making install in lib... gmake[4]: Entering directory `/usr/local/src/freeradius-1.1.1/src/lib' /usr/local/src/freeradius-1.1.1/libtool --mode=install /usr/local/src/freeradius-1.1.1/install-sh -c -c libradius.la /usr/local/freeradius-1.1.1/lib /usr/local/src/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /usr/local/freeradius-1.1.1/libradius-1.1.1.so (cd /usr/local/freeradius-1.1.1 && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /usr/local/src/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /usr/local/freeradius-1.1.1/libradius.la /usr/local/src/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /usr/local/freeradius-1.1.1/libradius.a ranlib /usr/local/freeradius-1.1.1/libradius.a chmod 644 /usr/local/freeradius-1.1.1/libradius.a libtool: install: warning: remember to run `libtool --finish /usr/local/freeradius-1.1.1/lib' rm -f /usr/local/freeradius-1.1.1/lib/libradius-1.1.1.la; ln -s libradius.la /usr/local/freeradius-1.1.1/lib/libradius-1.1.1.la ln: creating symbolic link `/usr/local/freeradius-1.1.1/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/lib' gmake[3]: *** [common] Error 2 -Jason Ellison

2 2

Several passwords for a user
by Santiago Balaguer García 13 May '06

13 May '06

Hi, I use freeradius-1.1.0. Where is any problem an account has two or more entries in radcheck table??? I use : 11:22:33:44:55:66 := '' 11:22:33:44:55:66 := mypassword I change the op := instead of ==. Is there any problem??? _________________________________________________________________ Horóscopo, tarot, numerología... Escucha lo que te dicen los astros. http://astrocentro.msn.es/

3 5

rlm_sql Segmentation Fault
by Shawn Hamman 13 May '06

13 May '06

Ok, I am going insane. This is the story: I have two IDENTICAL servers, HP DL320, Intel P4 I have Fedora Core 5 installed on both with IDENTICAL packages. I downloaded, extracted the freeradius-1.1.1.tar.gz and proceeded to configure with the exact same configure statement. I installed IDENTICAL perl modules on both servers. I use IDENTICAL radius.conf, sql.conf etc. configuration files. Server 1 works fine. No problems what so ever. Server 2 throws a seg fault when loading the rlm_sql module. I have: - enabled and disabled shared modules and packages - make clean, make distclean, manually remove every freeradius file - re-loaded the server from scratch - changed the processor from a P4 to a XEON to a P4 FreeRadius works just fine, right up until I load the rlm_sql module. Setup: Linux rad2. .net 2.6.15-1.2054_FC5smp #1 SMP Tue Mar 14 16:05:46 EST 2006 i686 i686 i386 GNU/Linux mysql-5.0.18-2.1 ./configure --with-logdir=/var/log --with-radacctdir=/var/log --with-raddbdir=/etc/raddb --enable-developer Debug: ... ... Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "192.168.0.8" sql: port = "" sql: login = "root" sql: password = "mysql" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" ... ... ... sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Segmentation fault (core dumped) Core dump: Reading symbols from /usr/local/lib/rlm_eap_mschapv2-1.1.1.so...done. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-1.1.1.so Reading symbols from /usr/local/lib/rlm_sql-1.1.1.so...done. Loaded symbols for /usr/local/lib/rlm_sql-1.1.1.so #0 0x00d789c9 in lt_dlsym (handle=0x88de758, symbol=0x88dd158 "rlm_sql_mysql") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) bt #0 0x00d789c9 in lt_dlsym (handle=0x88de758, symbol=0x88dd158 "rlm_sql_mysql") at ltdl.c:3330 #1 0x00fb65fa in rlm_sql_instantiate (conf=0x88307e0, instance=0x88dcb40) at rlm_sql.c:696 #2 0x0805303b in find_module_instance (instname=0x88339c8 "sql") at modules.c:358 #3 0x08053e1a in do_compile_modsingle (component=0, ci=0x88339a8, filename=0x805e931 "radiusd.conf", grouptype=0, modname=0xbf835314) at modcall.c:1005 #4 0x080536f3 in setup_modules () at modules.c:570 #5 0x080566db in main (argc=2, argv=0xbf8365a4) at radiusd.c:960 Does anybody out there have any ideas? Shawn

4 4

Segmentation fault when launching freeradius 1.1.1 with sql authorization on debian 1:3.3.5-13
by Antoine Cavalié 13 May '06

13 May '06

Hi all, radiusd doesn't want to start when I uncomment "sql" form radiusd.conf authorize section. What I did is : download and freeradius 1.1.1 ./configure make make install radiusd -X works radtest xx yy localhost 0 testing123 works Create mysql database and tables from doc/mysql.sql edit radiusd.conf to - set correct mysql login , password and radius_db - uncomment "sql" from authorize section radiusd -X doesn't work: it ends with sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Segmentation fault Coud somebody help me ? Thank's Antoine

2 1

Discarding new request - Due to live requests
by Andrew Grimmett 13 May '06

13 May '06

Sat May 13 07:14:53 2006 : Error: Discarding new request from client remotehost:1 027 - ID: 17 due to live request 112 I received the above error this morning, after the event no additional requests were processed or events logged through radius. I stop and started the radius server and requests started working again. I checked the mail-archive and found a couple of references to this, backend not responding and cpu load. I checked the backend (ldap) and seen that it was processing requests ok from other devices. Any ideas of were the problem occurred or where I can find more info on this error? Thanks for your help, Andrew

2 1