September 2006 - Freeradius-Users - lists.freeradius.org

Create-users.pl
by Nico Gazzano 18 Sep '06

18 Sep '06

I've used this script to generate a list of users, the script creates about 7 different files. What do I do with these now? I assume that the contents of radius.user will have to be added to the users file, but what of the other 6 files? Nico Gazzano Network & Systems Admin MIS Choice Inc. 1699 Wall ST Suite 602 Mount Prospect, IL 60056 Phone 847-690-1900 ext206 Fax 847-690-1350 nicog(a)mischoice.com

2 2

Troubel with Cisco Aironet 1130 and MAC authentication
by Christoffer Dahl Petersen 18 Sep '06

18 Sep '06

Hi! I'm trying to get a Cisco Aironet 1130 to do MAC authentication with freeradius and a pgsql as backend. I Have made my own table in the pgsql witch looks like this: radius=> select * from maskiner; mid | mnavn | mmac | mpwd | mattr | mop -----+--------------+-------------------+------------+-----------+----------+--------+ 9 | 0016cf0157f8 | 0016cf0157f8 | radius | Password | == | where mnavn is the name of the machine, mmac is the MAC of the machine, mpwd is a password field, mattr is the attribute field, mop is the operator. I have tried with an Avaya AP, and it works fine. Here is the authorize table: authorize_check_query = "SELECT mid, mmac, mattr, mpwd, mop \ FROM maskiner WHERE LOWER(mmac) = LOWER('%{SQL-User-Name}') ORDER BY mid" Here is the authenticate table: authenticate_query = "select mpwd from maskiner where mmac = '%{User-Name}'"; Here is the output from freeradius: rad_recv: Access-Request packet from host 192.168.250.28:6001, id=3, length=112 User-Name = "0016cf0157f8" User-Password = "radius" NAS-IP-Address = 192.168.250.28 Called-Station-Id = "00-20-a6-59-ce-93:GandrupII" Calling-Station-Id = "00-16-cf-01-57-f8" NAS-Port = 0 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT mid, mmac, mattr, mpwd, mop FROM maskiner WHERE LOWER(mmac) = LOWER('0016cf0157f8') ORDER BY mid rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 4 Login OK: [0016cf0157f8/radius] (from client Demo port 0 cli 00-16-cf-01-57-f8) Sending Access-Accept of id 3 to 192.168.250.28:6001 Now since the Cisco AP is sending the User-Name and User-Password in another format we have change freeradius configuration. Here is the authorize table: authorize_check_query = "SELECT mid, mmac, mattr, mmac, mop FROM maskiner \ WHERE LOWER(mmac) = LOWER('%{SQL-User-Name}') ORDER BY mid" Here is the authenticate table: authenticate_query = "select mmac from maskiner where mmac = '%{User-Name}'"; Here is the output from freeradius: rad_recv: Access-Request packet from host 192.168.250.35:1645, id=148, length=115 User-Name = "0016cf0157f8" User-Password = "0016cf0157f8" Called-Station-Id = "0017.0f84.8af0" Calling-Station-Id = "0016.cf01.57f8" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 531 NAS-IP-Address = 192.168.250.35 NAS-Identifier = "AP-07" rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT mid, mmac, mattr, mmac, mop FROM maskiner WHERE LOWER(mmac) = LOWER('0016cf0157f8') ORDER BY mid rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): No matching entry in the database for request from user [0016cf0157f8] rlm_sql (sql): Released sql socket id: 4 Login incorrect: [0016cf0157f8/0016cf0157f8] (from client Demo port 531 cli 0016.cf01.57f8) Why won't it work with the Cisco, does it use another dictionary or.... Any help is appreciated!! Thanks in advance, Christoffer

1 0

rlm_perl link error
by Alexander Serkin 18 Sep '06

18 Sep '06

Hi, i'm getting the following error while building rlm_perl module: make[6]: Entering directory `/opt/fr/src/freeradius-1.1.3/src/modules/rlm_perl' /opt/fr/src/freeradius-1.1.3/libtool --mode=link gcc -release 1.1.3 \ -module -export-dynamic -o rlm_perl.la \ -rpath /opt/fr/lib rlm_perl.lo rlm_perl.c /opt/fr/src/freeradius-1.1.3/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lsocket -lposix4 -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/local/lib/perl5/5.8.6/sun4-solaris/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared -Wl,-h -Wl,rlm_perl-1.1.3.so -o .libs/rlm_perl-1.1.3.so .libs/rlm_perl.o -R/opt/fr/src/freeradius-1.1.3/src/lib/.libs -R/opt/fr/lib /opt/fr/src/freeradius-1.1.3/src/lib/.libs/libradius.so -L/usr/local/lib /usr/local/lib/perl5/5.8.6/sun4-solaris/auto/DynaLoader/DynaLoader.a -L/usr/local/lib/perl5/5.8.6/sun4-solaris/CORE -lperl -ldl -lm -lc -lnsl -lresolv -lsocket -lposix4 -lpthread -lc Text relocation remains referenced against symbol offset in file <unknown> 0x2628 /usr/local/lib/perl5/5.8.6/sun4-solaris/CORE/libperl.a(perl.o) ... does it mean that perl is compiled incorrectly on the machine? It seem to be installed from SMCperl binary package for SunOS 5.8 -- Sincerely Yours, Alexander

2 1

denying access to user from device
by Rob Shepherd 18 Sep '06

18 Sep '06

Dear freeradiuseers, I have my wireless network working great... PEAP supplicants are authenticated from either LDAP or MySQL and the appropriate Tunnel-Private-Group-ID is set to allocate the correct vlan. I also have a cisco VPN concentrator. I must only allow ldap users to authenticate to this. mysql users mustn't get a look in... I tried making a huntgroup in raddb/huntgroups... ciscovpnc NAS-IP-Address == 10.1.33.4 then in raddb/users... DEFAULT HuntGroup-Name == ciscovpnc Autz-Type = ldap however sql is still checked. Could some body shove me in the right direction.. Cheers Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 077988 72480

5 8

Freeradius IODBC bug?
by Angelo Compagnucci 18 Sep '06

18 Sep '06

Hi to all! I'm desperate ;( ... I have to work with a MS SQL server from freeradius. Debian team removed feeradius-unixodbc (i've used only unixodbc until now) from repos and i installed freeradius-unixodbc. When i launch freeradius -X i see this errors (with trace enabled): ---------------------------------------------------- rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked rlm_sql (sql): Attempting to connect to wireless_admin@192.168.1.21:1433/Radius_DB rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 ** iODBC Trace file ** Trace started on Mon Sep 18 12:21:31 2006 ** Driver Manager: 03.52.0406.0126 [000000.000053] freeradius 2B88599C0250 ENTER SQLAllocEnv SQLHENV * 0x5b0ea0 [000000.000073] freeradius 2B88599C0250 EXIT SQLAllocEnv with return code 0 (SQL_SUCCESS) SQLHENV * 0x5b0ea0 (0x5b0ee0) [000000.000091] freeradius 2B88599C0250 ENTER SQLAllocConnect SQLHENV 0x5b0ee0 SQLHDBC * 0x5b0ea8 [000000.000105] freeradius 2B88599C0250 EXIT SQLAllocConnect with return code 0 (SQL_SUCCESS) SQLHENV 0x5b0ee0 SQLHDBC * 0x5b0ea8 (0x5b1030) [000000.000124] freeradius 2B88599C0250 ENTER SQLConnect SQLHDBC 0x5b1030 SQLCHAR * 0x63ac40 | Radius_DB | SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x5aee00 | wireless_admin | SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x2b885a32a700 | **** | SQLSMALLINT -3 (SQL_NTS) [000000.000552] freeradius 2B88599C0250 EXIT SQLConnect with return code -1 (SQL_ERROR) SQLHDBC 0x5b1030 SQLCHAR * 0x63ac40 SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x5aee00 SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x2b885a32a700 SQLSMALLINT -3 (SQL_NTS) [000000.000595] freeradius 2B88599C0250 ENTER SQLError SQLHENV 0x5b0ee0 SQLHDBC 0x5b1030 SQLHSTMT 0x0 (SQL_NULL_HANDLE) SQLCHAR * 0x7fffffa4e040 SQLINTEGER * 0x7fffffa4e148 SQLCHAR * 0x2b885a2e6b80 SQLINTEGER 256 SQLSMALLINT * 0x7fffffa4e14e [000000.000637] freeradius 2B88599C0250 EXIT SQLError with return code 0 (SQL_SUCCESS) SQLHENV 0x5b0ee0 SQLHDBC 0x5b1030 SQLHSTMT 0x0 (SQL_NULL_HANDLE) SQLCHAR * 0x7fffffa4e040 | IM002 | SQLINTEGER * 0x7fffffa4e148 (0) SQLCHAR * 0x2b885a2e6b80 | [iODBC][Driver Manager]Data source name | | not found and no default driver specifie | | d. Driver could not be loaded | SQLINTEGER 256 SQLSMALLINT * 0x7fffffa4e14e (109) sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. ---------------------------------------------------- My configuration worked well with unixodbc. If i try with iodbctest "DSN=MSSQL;UID=wireles_admin;PWD=***" everything works well. Why??? Please help me !!! Thanks!!!

1 1

Problems in EAP-TLS in new Windows XP clients
by Jose Marcos Lopez Caravaca 18 Sep '06

18 Sep '06

Hi. I have been stuck in this problem for a quite a long time, I hope you can help me. I have a wireless network using WPA-Enterprise, with EAP-TLS using radius 1.0.2. The system has been working good so far, using Windows XP clients and Linux with wpasupplicant with no problems. On the last month I'm having problems making new Windows XP clients connect to the network, even when old instalations of Windows XP SP2 are working good so far. The OEM Windows XP on the new machines don't interoperate correctly with freeradius, or seems so. Then non-working machines get stuck on the autentication phase and seem to loop the requests all the time. I've tried upgrading freeradius from 1.0.2 to 1.1.3, but the problem still persists, "old" machines connect without any problem but new ones get stuck. Both client and server certificate have the OID's refered in the documentation: Client: # /home/soft-local/openssl-0.9.8c/bin/openssl x509 -in /tmp/personal.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 206 (0xce) Signature Algorithm: md5WithRSAEncryption Issuer: C=ES, ST=Barcelona, L=Barcelona, O=Universitat Politecnica de Catalunya, OU=Departament de Llenguatges i Sistemes Informatics, CN=Laboratori de Calcul de LSI/emailAddress=lclsi(a)lsi.upc.edu Validity Not Before: Sep 5 10:15:15 2006 GMT Not After : Dec 1 08:00:00 2006 Subject: C=ES, ST=Barcelona, L=Barcelona, O=UPC, OU=LSI, CN=marcos/emailAddress=marcos(a)lsi.upc.edu Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d7:f7:ba:f3:d0:69:ca:bf:c9:33:28:71:a6:cd: 08:1a:74:3e:e4:f1:e1:ed:00:7e:8c:76:1c:d0:43: 7b:1e:32:c0:3f:ad:a5:da:ea:38:96:c9:69:a2:4d: cc:cb:a4:62:24:34:0f:a9:bc:ca:9f:38:d9:84:c3: d9:bd:4d:98:d9:ad:92:82:82:59:2c:0c:64:17:97: 00:d4:c4:f3:b1:03:f4:88:05:de:1e:1b:22:ea:47: 1c:16:b5:f7:65:0f:17:6f:a9:e1:e4:ce:99:96:e5: eb:40:7c:28:d8:e6:b3:be:71:3e:e0:e9:1a:56:d3: e2:44:f7:3d:28:6e:d3:29:3d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication Signature Algorithm: md5WithRSAEncryption a1:26:ae:7b:43:33:3e:40:87:20:68:24:00:13:e2:37:2c:ae: f9:e4:17:1f:11:32:53:b2:14:3e:11:f4:d9:1a:c5:b7:2e:37: 3b:41:5d:75:13:c7:0d:be:bc:51:97:b8:06:48:07:de:5f:02: 8f:27:5b:c9:7d:33:bf:84:8c:db:9f:74:3c:2e:42:f6:96:1b: 6a:c4:47:b7:62:53:8d:22:6f:14:32:9a:67:5e:9d:8f:d8:b4: ca:fc:e9:ab:fd:16:4f:c7:f9:91:9b:65:43:e7:b2:35:6a:a2: 9c:0b:0f:3a:1d:d9:75:ea:3b:4a:68:98:22:de:ba:f2:3e:f7: a4:a8 Server: # /home/soft-local/openssl-0.9.8c/bin/openssl x509 -in /home/soft-local/freeradius-1.1.3/etc/raddb/certs/cert-srv.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 153 (0x99) Signature Algorithm: md5WithRSAEncryption Issuer: C=ES, ST=Barcelona, L=Barcelona, O=Universitat Politecnica de Catalunya, OU=Departament de Llenguatges i Sistemes Informatics, CN=Laboratori de Calcul de LSI/emailAddress=lclsi(a)lsi.upc.edu Validity Not Before: Mar 15 11:13:27 2006 GMT Not After : Mar 15 11:13:27 2007 GMT Subject: C=ES, ST=Barcelona, L=Barcelona, O=Departament de Llenguatges i Sistemes Informatics, OU=Laboratori de Caulcul de LSI, CN=Servei Wireless de LCLSI/emailAddress=lclsi(a)lsi.upc.edu Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:aa:eb:d5:19:3d:63:4b:ee:b2:ae:c2:73:24:69: cd:61:0a:44:66:45:fe:e9:2e:c0:90:be:1a:c5:39: 2a:95:9e:53:ee:0f:29:01:28:43:6e:e6:11:44:09: 1c:e7:ae:b8:72:22:9d:03:60:26:6f:90:92:cf:bb: 22:66:61:3f:ba:5a:89:62:c0:aa:09:aa:9c:2f:05: b9:67:c1:b2:0e:ad:5e:9d:ab:c4:45:79:51:97:fd: 15:da:ba:29:06:5f:fb:4a:d0:7d:80:2e:7d:b9:91: 58:32:56:a8:69:36:7e:9c:54:66:ac:25:10:62:be: e1:60:f0:aa:9b:02:fc:b6:8b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Signature Algorithm: md5WithRSAEncryption bb:b0:de:06:6a:03:fd:34:f7:38:8d:07:e7:b7:ee:97:0a:94: f2:82:ab:10:6b:08:cf:4c:9f:97:e7:be:a3:1b:12:e5:9a:b1: 86:35:85:20:06:4a:a9:51:f3:83:de:69:6e:e5:c4:22:e5:88: 17:f4:23:e7:70:5b:f6:d2:ae:50:c5:e6:c4:fd:93:f4:b8:61: 92:df:1d:9d:01:1b:16:87:02:6c:a5:02:87:7b:ad:bc:a3:65: 26:7c:82:81:48:e9:62:60:ab:c5:63:fc:9f:17:d0:d9:7f:53: 3d:e7:bc:85:f9:01:a9:97:e7:88:2a:d9:b2:a2:8a:7c:1c:bd: 85:4a And the traces of the server: - Working on an "old" machine attached as http://www.lsi.upc.edu/~marcos/correcto.txt - Non-Working on a "new" machine attached as http://www.lsi.upc.edu/~marcos/incorrecto.txt Thank you all.

2 1

FreeRadius 1.13 support Dual Stack IPv4/IPv6 ?????
by 나종현 18 Sep '06

18 Sep '06

3 3

The First Step
by Abel Monzon 17 Sep '06

17 Sep '06

Hello everyone, am new with freeradius, and I have install the freeradius, but, i have try this command: server:/etc/freeradius# radtest test test2 localhost 0 testing123 and this is the answer: Sending Access-Request of id 111 to 127.0.0.1:1812 User-Name = "test" User-Password = "test2" NAS-IP-Address = server NAS-Port = 0 Re-sending Access-Request of id 111 to 127.0.0.1:1812 User-Name = "test" User-Password = "w"\367\3468\213>\372\302:Nl/\241v\217" NAS-IP-Address = server NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=111, length=20 Where I configure the user-name and his passwd? Is in the file clients.conf? Thanx for all, Abel Monzon..

3 2

RE: Pattern Matching in users file
by Garber, Neal 16 Sep '06

16 Sep '06

> You can't use the Group attribute that way. It's for checking Unix >groups. You'll have to create another attribute for your local groups. Do I need to predefine the attribute name somewhere before I attempt to create it in the users file? >> Also, the Group attribute was added to %RAD_CHECK as opposed to >> %RAD_REQUEST (Group was not an attribute in the original request). > The "users" file is documented as behaving this way. Are you referring to the doc/processing_users_file? If so, perhaps I misunderstood the bullet within it that reads: - The check pairlist of the request is replaced by the tmpcheck pairlist (this is the same as: the check pairlist from the usersfile entry is appended to the pairlist of the request) The phrase in parentheses is what made me think I could add attributes to the request. Is this statement incorrect or am I interpreting it differently than the author intended? The first part of the bullet matches what you said and what I experienced. > If you want to add an attribute to the request, you have to use the >"hints" file. I don't think that will work for me because the hints file doc. states it adds attributes solely based upon prefix or suffix of the username. I want to add an attribute based upon the value of Cisco-AVPair. Am I misinterpreting the doc. for hints also? Thanks again for your help Alan.

2 1

Proxy.conf & clients.conf
by Cliff Hayes 15 Sep '06

15 Sep '06

Hello, I am a new FreeRADIUS user. The server is working for us. However, I am wondering why it won't start if I comment out the includes for clients.conf and proxy.conf. Even setting to debug level 3 doesn't tell me why. We are not proxying, and I have proxying turned off. Also, the clients file is almost completely commented out except for the 127.0.0.1 section, which the directions say should be commented out anyway after testing. Thanks in advance, Cliff

4 10