May 2006 - Freeradius-Users - lists.freeradius.org

freeradius 1.1.1 and mysql issues
by simon＠434canada.com 31 May '06

31 May '06

Hi, I am having some issues getting users authenticated using a mysql database. Right now I simply have one user entered into the database, for testing purposes. If I use either NTRadPing from a remote machine or radtest on the actual server using the credentials in the database I get an Access-Accept packet. However, when I try to actually connect using a WinXP laptop, I continually get Access-Reject messages back. It looks like the password isn't making it across, even though I am entering this information on the laptop as it is trying to connect. When I use another user account (that is defined in the users file) to actually connect, everything works fine. Below is the output from the server running in debug mode when I tried to connect: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.10.1.1:2991, id=0, length=123 User-Name = "simon" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173696d6f6e Message-Authenticator = 0x45e7cf8668c2564bc36bea9616eced0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 51 modcall[authorize]: module "preprocess" returns ok for request 51 modcall[authorize]: module "chap" returns noop for request 51 modcall[authorize]: module "mschap" returns noop for request 51 rlm_realm: No '@' in User-Name = "simon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 51 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 51 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 51 radius_xlat: 'simon' rlm_sql (sql): sql_set_user escaped user --> 'simon' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 51 modcall: leaving group authorize (returns updated) for request 51 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [simon/<no User-Password attribute>] (from client linksys-434 port 56 cli 0013ce29c6d7) Delaying request 51 for 1 seconds Finished request 51 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.1.1 port 2991 Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 51 ID 0 with timestamp 447deb46 Nothing to do. Sleeping until we see a request. It seems as though the password isn't getting across, but only when I try to use credentials stored in the database. Any help here would be greatly appreciated. Thanks, Simon

2 1

huntgroups being processed no matter what
by Mark Jones 31 May '06

31 May '06

So far freeradius has been great and very versitile but one part has got me confused. 1. understanding is that the huntgroup file is used only if the huntgroupo attribute ia listed in the user file that the user matches. From my testing it appears that the huntgroup file gets processed no matter what and if it can't match anything it rejects the user. 2. I have also noticed that if I list nas-ip-address in more then one hunt group it will only work on the first one. the second one will never match. I have searched the mailing list and someone has touched on this problem in the past but there was not resolve. Any help would be greatly appreciated. Mark Jones

1 0

FreeRadius & phpMyPrepaid
by hohgch＠streamyx.com 31 May '06

31 May '06

1 0

1.1.2 Build Problems - "rlm_eap-1.1.2.soT" - "ld: skipping incompatible"
by Alan 31 May '06

31 May '06

When I compile the latest stable FreeRadius build version 1.1.2. I came across a few problems. I noticed the eap library file has a "T" appended to the end of it (rlm_eap-1.1.2.soT) and some "ld" warnings after running "make". Please advise. ~Alan OS: Red Hat Enterprise v.3 AMD64 --- Make ld warnings: sql_mysql.c: In function `sql_error': sql_mysql.c:333: warning: return discards qualifiers from pointer target type /usr/bin/ld: skipping incompatible /usr/lib/libz.so when searching for -lz /usr/bin/ld: skipping incompatible /usr/lib/libz.a when searching for -lz /usr/bin/ld: skipping incompatible /usr/lib/libpthread.so when searching for -lpthread /usr/bin/ld: skipping incompatible /usr/lib/libpthread.a when searching for -lpthread /usr/bin/ld: skipping incompatible /usr/lib/libcrypt.so when searching for -lcrypt /usr/bin/ld: skipping incompatible /usr/lib/libcrypt.a when searching for -lcrypt /usr/bin/ld: skipping incompatible /usr/lib/libnsl.so when searching for -lnsl /usr/bin/ld: skipping incompatible /usr/lib/libnsl.a when searching for -lnsl /usr/bin/ld: skipping incompatible /usr/lib/libm.so when searching for -lm /usr/bin/ld: skipping incompatible /usr/lib/libm.a when searching for -lm /usr/bin/ld: skipping incompatible /usr/lib/libpthread.so when searching for -lpthread /usr/bin/ld: skipping incompatible /usr/lib/libpthread.a when searching for -lpthread /usr/bin/ld: skipping incompatible /usr/lib/libc.so when searching for -lc /usr/bin/ld: skipping incompatible /usr/lib/libc.a when searching for -lc radius_snmp.c: In function `radServReset': radius_snmp.c:263: warning: passing arg 2 of `asn_parse_int' from incompatible pointer type smux.c: In function `smux_getresp_send': smux.c:257: warning: passing arg 2 of `asn_build_sequence' from incompatible pointer type smux.c:262: warning: passing arg 2 of `asn_build_int' from incompatible pointer type smux.c:268: warning: passing arg 2 of `asn_build_int' from incompatible pointer type smux.c:273: warning: passing arg 2 of `asn_build_int' from incompatible pointer type smux.c:279: warning: passing arg 2 of `asn_build_sequence' from incompatible pointer type smux.c:283: warning: passing arg 6 of `snmp_build_var_op' discards qualifiers from pointer target type smux.c:283: warning: passing arg 7 of `snmp_build_var_op' from incompatible pointer type smux.c:286: warning: passing arg 2 of `asn_build_sequence' from incompatible pointer type smux.c:289: warning: passing arg 2 of `asn_build_sequence' from incompatible pointer type smux.c: In function `smux_var': smux.c:310: warning: passing arg 2 of `asn_parse_header' from incompatible pointer type smux.c:318: warning: passing arg 7 of `snmp_parse_var_op' from incompatible pointer type smux.c: In function `smux_set': smux.c:432: warning: passing arg 3 of pointer to function from incompatible pointer type smux.c: In function `smux_get': smux.c:492: warning: passing arg 3 of pointer to function from incompatible pointer type smux.c: In function `smux_getnext': smux.c:577: warning: passing arg 3 of pointer to function from incompatible pointer type smux.c: In function `smux_parse_rrsp': smux.c:700: warning: passing arg 2 of `asn_parse_int' from incompatible pointer type smux.c: In function `smux_parse': smux.c:723: warning: passing arg 2 of `asn_parse_header' from incompatible pointer type smux.c: In function `smux_open': smux.c:869: warning: passing arg 2 of `asn_build_header' from incompatible pointer type smux.c:875: warning: passing arg 2 of `asn_build_int' from incompatible pointer type smux.c:881: warning: passing arg 2 of `asn_build_objid' from incompatible pointer type smux.c:887: warning: passing arg 2 of `asn_build_string' from incompatible pointer type smux.c:893: warning: passing arg 2 of `asn_build_string' from incompatible pointer type smux.c:897: warning: passing arg 2 of `asn_build_header' from incompatible pointer type smux.c: In function `smux_register': smux.c:922: warning: passing arg 2 of `asn_build_header' from incompatible pointer type smux.c:928: warning: passing arg 2 of `asn_build_objid' from incompatible pointer type smux.c:934: warning: passing arg 2 of `asn_build_int' from incompatible pointer type smux.c:940: warning: passing arg 2 of `asn_build_int' from incompatible pointer type smux.c:947: warning: passing arg 2 of `asn_build_header' from incompatible pointer type /usr/bin/ld: skipping incompatible /usr/lib/libnsl.so when searching for -lnsl /usr/bin/ld: skipping incompatible /usr/lib/libnsl.a when searching for -lnsl /usr/bin/ld: skipping incompatible /usr/lib/libresolv.so when searching for -lresolv /usr/bin/ld: skipping incompatible /usr/lib/libresolv.a when searching for -lresolv /usr/bin/ld: skipping incompatible /usr/lib/libpthread.so when searching for -lpthread /usr/bin/ld: skipping incompatible /usr/lib/libpthread.a when searching for -lpthread /usr/bin/ld: skipping incompatible /usr/lib/libcrypt.so when searching for -lcrypt /usr/bin/ld: skipping incompatible /usr/lib/libcrypt.a when searching for -lcrypt /usr/bin/ld: skipping incompatible /usr/lib/libdl.so when searching for -ldl /usr/bin/ld: skipping incompatible /usr/lib/libdl.a when searching for -ldl /usr/bin/ld: skipping incompatible /usr/lib/libc.so when searching for -lc /usr/bin/ld: skipping incompatible /usr/lib/libc.a when searching for -lc radrelay.c: In function `main': radrelay.c:875: warning: passing arg 1 of `free' discards qualifiers from pointer target type Make install errors: libtool: install: warning: relinking `rlm_eap.la' (cd /home/user/freeradius-1.1.2/src/modules/rlm_eap; /bin/sh /home/user/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_eap.la -rpath /software/freeradius-1.1.2/lib rlm_eap.lo eap.lo mem.lo state.lo rlm_eap.c eap.c mem.c state.c /home/user/freeradius-1.1.2/src/lib/libradius.la libeap/libeap.la -lltdl -lnsl -lresolv -lpthread) *** Warning: This library needs some functionality provided by -lltdl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: libtool could not satisfy all declared inter-library *** dependencies of module rlm_eap. Therefore, libtool will create *** a static module, that should work as long as the dlopening *** application is linked with the -dlopen flag. ar cru .libs/rlm_eap.a rlm_eap.o eap.o mem.o state.o ranlib .libs/rlm_eap.a creating rlm_eap.la (cd .libs && rm -f rlm_eap.la && ln -s ../rlm_eap.la rlm_eap.la) /home/user/freeradius-1.1.2/install-sh -c -c .libs/rlm_eap-1.1.2.soT /software/freeradius-1.1.2/lib/rlm_eap-1.1.2.so install: .libs/rlm_eap-1.1.2.soT does not exist gmake[6]: *** [install] Error 1 gmake[6]: Leaving directory `/home/user/freeradius-1.1.2/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/user/freeradius-1.1.2/src/modules' gmake[4]: *** [install] Error 2 gmake[4]: Leaving directory `/home/user/freeradius-1.1.2/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/user/freeradius-1.1.2/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/user/freeradius-1.1.2/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/user/freeradius-1.1.2' make: *** [install] Error 2

3 3

problems in jradius+freeradius+oracle
by Zhou Yong Jun 31 May '06

31 May '06

The last problem is caused by the user reply message attribute is depracted. Now, I think get multiple reply message attributes, so I add a new dictionary file, the below is my ut codes: RadiusPacket reply = null; try { reply = rc.authenticate(request, new MSCHAPv2Authenticator(), 5); } catch (UnknownAttributeException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch(Exception e) { e.printStackTrace(); } if (reply == null) return; // Request Timed-out System.out.println("Received:\n" + reply.toString()); boolean isAuthenticated = (reply instanceof AccessAccept); Long replyMessage = null; try { AttributeList al = reply.getAttributes(); String replyMessage1 = (String) reply.getAttributeValue("Auth-Type"); replyMessage = (Long) reply.getAttributeValue("TDTech-ACL"); } catch (Exception e) { // TODO Auto-generated catch block e.printStackTrace(); } if (replyMessage != null) { System.out.println("Reply Message: " + replyMessage); } but the exception is Received: Class: class net.sf.jradius.packet.AccessAccept Attributes: Framed-IP-Address = 192.168.162.219 Unknown-VSAttribute(8888:1) = [Binary Data (length=13)] MS-CHAP2-Success = [Binary Data (length=43)] MS-MPPE-Recv-Key = [Binary Data (length=34)] MS-MPPE-Send-Key = [Binary Data (length=34)] MS-MPPE-Encryption-Policy = [Binary Data (length=4)] MS-MPPE-Encryption-Types = [Binary Data (length=4)] net.sf.jradius.exception.UnknownAttributeException: Unknown attribute TDTech-ACL at net.sf.jradius.packet.attribute.AttributeFactory.getTypeByName(AttributeFactory.java:320) at net.sf.jradius.packet.attribute.AttributeList.get(AttributeList.java:195) at net.sf.jradius.packet.RadiusPacket.findAttribute(RadiusPacket.java:227) at net.sf.jradius.packet.RadiusPacket.getAttributeValue(RadiusPacket.java:256) at test.security.jradius.JRadiusClient.main(JRadiusClient.java:74) Thanks! 周勇军 TD-TECH OMC 021-50992135 -----Original Message----- From: freeradius-users-bounces+yongjun.zhou=td-tech.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+yongjun.zhou=td-tech.com@lists.freeradius.org] On Behalf Of Zhou Yong Jun Sent: 2006年5月31日 11:27 To: FreeRadius users mailing list Subject: Testing jradius+freeradius+oracle I get the reply message in java application from freeradius, but the reply message have only usergroup reply message and no user reply message. Why? Thanks! 周勇军 TD-TECH OMC 021-50992135 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Thanks! 周勇军 TD-TECH OMC 021-50992135

2 1

Re: Session-Octets-Limits
by Mordor Networks 31 May '06

31 May '06

ok thanks a lit edvin but one more question please Session-Octets-Limit := 1000 for example the "1000" = byte or kbyte or MB ? coz everything thing seems to be working i can see the attribute in the radius log and in the raddattr file and in the sql table but it is not disconnecting the user :| On 5/31/06, Seferovic Edvin <edvin.seferovic(a)kolp.at> wrote: > > shall i added it to the radclient on the nas box ? > > > > YES ! Both server and client have to know about what attribute are you > "talking about". > > > > Regards, > > > > Edvin > > > ------------------------------ > > *From:* Mordor Networks [mailto:mordor.networks@gmail.com] > *Sent:* Mittwoch, 31. Mai 2006 08:46 > *To:* edvin.seferovic(a)kolp.at; FreeRadius users mailing list > *Subject:* Re: Session-Octets-Limits > > > > > > On 5/31/06, *Seferovic Edvin *<edvin.seferovic(a)kolp.at> wrote: > > > Hi Edvin > > Session-Octets-Limit should only be in the reply table ( it is not a value > that should be checked – right ? ). > > yes youre right > > If the freeradius replies the attribute – the freeradius is finished with > his task. Now your RP-PPPoE server and the radiusclient should do the rest > of the work. Traffic limiting is done with PPProtocol on your NAS ( your > pppoe server ). Be sure that the radiusclient also has the attribute in his > dictionary file. Look at the output of the ppp and pppoe ( increase the log > level – or put both in debug mode ). > > i added the attributes to the /usr/local/share/dictionary file shall i > added it to the radclient on the nas box ? > > > Regards > > > > It seems that this is not problem of freeradius anymore ! > > > > Regards, > > > > Edvin > > > ------------------------------ > > *From:* freeradius-users-bounces+edvin.seferovic= > kolp.at(a)lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic=kolp.at@lists.freeradius.org > ] *On Behalf Of *Mordor Networks > *Sent:* Dienstag, 30. Mai 2006 22:56 > *To:* FreeRadius users mailing list > *Subject:* Session-Octets-Limits > > > > Hello users > > I'm trying to add Session-Octets-Limit to limit the user bandwidth i add > Session-Octets-Limit := 1000 in radcheck and radreply > and i can see it in the radiusd -X and in the radattr file : > > Framed-IP-Address > > <http://70.70.70.70> > > *70.70.70.70* > > Session-Octets-Limit 825241648 > > Framed-Protocol PPP > > Framed-IP-Netmask 255.255.255.255 > > Framed-MTU 1500 > > Session-Timeout 43200 > > > > Idle-Timeout 1200 > > Port-Limit 1 > > > > But it is not disconnecting the user when reach the limit , can someone help me please? > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > >

2 6

How to upgrade Freeradius?
by elimachi＠entelsa.entelnet.bo 31 May '06

31 May '06

Dear list: I don´t have experience installing and uninstalling applications as freeradius from source code. I´d like to upgrade my freeradius version from 1.1.1 to 1.1.2, however I don´t know what steps have I to do. I´ll be very grateful with your guide becauase I have fear to erase some files or damage my actual installation. Thank you. Edu.

4 3

Server Distro
by Craig Main 31 May '06

31 May '06

Hi all, Is there a distro that implements freeradius with a nice web gui etc. like the smoothwall/ipcop firewall disto's? Thanks and Regards Craig

2 1

Session-Octets-Limits
by Mordor Networks 31 May '06

31 May '06

Hello users I'm trying to add Session-Octets-Limit to limit the user bandwidth i add Session-Octets-Limit := 1000 in radcheck and radreply and i can see it in the radiusd -X and in the radattr file : Framed-IP-Address 70.70.70.70 Session-Octets-Limit 825241648 Framed-Protocol PPP Framed-IP-Netmask 255.255.255.255 Framed-MTU 1500 Session-Timeout 43200 Idle-Timeout 1200 Port-Limit 1 But it is not disconnecting the user when reach the limit , can someone help me please?

3 4

Re: Testing jradius+freeradius+oracle
by David Bird 31 May '06

31 May '06

Hello, please use the correct mailing list for these questions: jradius-users(a)lists.sourceforge.net Thanks David

1 0