September 2006 - Freeradius-Users - lists.freeradius.org

rlm_sql functionality
by Nils Rønhovde 05 Sep '06

05 Sep '06

Hi, I am trying to do something with rlm_sql (driver: mysql) that does not seem to work as stated in the documentation. Consider this database: mysql> select * from radcheck; | id | UserName | Attribute | op | Value | | 1 | nar2 | Password | == | test | mysql> select * from radreply; | id | UserName | Attribute | op | Value | | 1 | nar2 | Fall-Through | = | Yes | mysql> select * from usergroup; | id | UserName | GroupName | priority | | 1 | nar2 | core-en | 2 | | 2 | nar2 | access-en | 1 | mysql> select * from radgroupcheck; | id | GroupName | Attribute | op | Value | | 1 | core-en | NAS-IP-Address | == | 10.1.1.1 | | 2 | access-en | NAS-IP-Address | == | 10.2.1.1 | mysql> select * from radgroupreply; | id | GroupName | Attribute | op | Value | prio | | 1 | core-en | Reply-Message | = | Core | 1 | | 2 | access-en | Reply-Message | = | Access | 1 | The sql.conf is unchanged from the default, except that the server connects to a database on a remote host. The idea is that when nar2 tries to login on the two different NAS'es, the authorization would become different. What happens with this setup is that a request from 10.2.1.1 is rejected even if the user supplies the right password. I then reversed the order of records in radgroupcheck. What happened was that the requests coming from 10.1.1.1 was rejected. (The NAS-IP-Address that matches the group with the lowest id was accepted, and the other rejected.) Also, even if I did that, the reply-items from the group with the lowest id in radgroupreply was returned, as long as the user and group are coupled in usergroup. I have been playing along with this for a while and I can't see that this makes sense in any way. I have also changed the ordering in radgroupreply and tried different priority's. The questions remaining are: 1. Can I populate the database differently so that the server does what I want? 2. Is there a way to rewrite the queries in sql.conf so the server does what I want? 3. Am I completely missing the point of having groups i RADIUS? What I want from rlm_sql is (this should probably be a bit refined): 1. check if user check-items match, add the reply-items. 2. if they match, check each usergroup coupling, if there are any. 3. a. if the check-items of the group match, add the reply-items from radgroupreply. b. if the check-items of the group do not match, skip to next group, but do not reject unless no groups match, or a group explictly says so. 4. if no group matches then Reject. -- best regards Nils Rønhovde

1 0

Problem in accounting with sql counter module max-all-session
by Bisal 05 Sep '06

05 Sep '06

Hi, I have setup freeradius 1.1.2 in FreeBSD 6.0 with mysql support. I have setup user in radcheck table as follows; 1403 | test01 | | | | Max-All-Session | := | 1500 | The user test001 is allowed to login total for 25hrs. After finishing 25hrs if the user recharge his account to 30hrs again and I updated max-all-session to 1800 seconds in radcheck table. Now when the user tries to connect he get disconneted after 5hrs and when he tried to reconnect, he couldnot get authenticate. In my radius log I see ; Mon Sep 4 17:43:56 2006 : Auth: Invalid user (rlm_sqlcounter: Maximum never usage time reached): [test01] (from client pppoe-bhw port 4448 cli 0:7:95:10:73:9e) What could be the problem with sql counter module? In my radiusd.conf settings I have setup max-all-session counter as follows; sqlcounter noresetcounter { driver = "rlm_sqlcounter" counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } All things are running well except rechargeable account. How could I make rechargeable sqlcounter module for hourly accounts? Do I need to create the seperate sqlcounter according to plan? Like if 25hrs then in sqlcounter section "reset=25h", if 50hrs "reset=50h" .... etc, Any suggestion? Bishal

1 0

Problems getting eap-mschapv2 working.
by Ian Walker 05 Sep '06

05 Sep '06

Been trying to get eap working with peap/mschapv2 but it doesn't seem to work. This is my radiusd.conf file: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var/run sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { eap { default_eap_type = md5 timer_expire = 60 md5 { } tls { private_key_password = private_key_file = /usr/local/etc/raddb/new.cert.key certificate_file = /usr/local/etc/raddb/new.cert.cert CA_file = /usr/local/etc/raddb/cacert.pem dh_file = /dev/urandom random_file = /dev/urandom fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 mschapv2 { authtype = mschapv2 use_mppe = yes require_encryption = yes require_strong = yes } } } files { usersfile = ${confdir}/users compat = no } exec cerb { wait = yes program = "/usr/local/bin/cerbauth -e freeradius" input_pairs = request output_pairs = reply } preprocess { } } authorize { preprocess eap files } authenticate { Auth-Type eap { eap } Auth-Type CERB { cerb } } as you can see, I'm currently working with md5 and this works perfectly well. But when I set the client and configure the server to default for peap/tls, then it fails saying: "No such EAP type mschapv2" I believe if I can get passed this, that my system will authenticate with peap/mschapv2 successfully. Hope you can help. Regards Ian

6 9

Re: Help to modify the reply list for accounting response packets.
by V.Kukushkin 05 Sep '06

05 Sep '06

You have to modify src/modules/rlm_sql/conf.h src/modules/rlm_sql/rlm_sql.c src/modules/rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c /etc/raddb/sql.conf .. and forget about RFC :-) -- regards, Vladimir

2 1

ippool causes Auth-Type error
by Sascha Djuric 04 Sep '06

04 Sep '06

Hello this is my second try: im using freeradius 1.1.3 under solaris10. i got it installed and configured with mysql. everything works fine, I added a user with Password and all and radtest works fine. next i configured an ippool and added it to post-auth and acct. ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.1.254 # netmask: The network mask used for the ip's netmask = 255.255.255.255 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = yes # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } still everything works fine. now i added a Pool-Name to the check attributes of my test user. Then I get: rad_recv: Access-Request packet from host 127.0.0.1:45506, id=185, length=55 User-Name = "SVD" User-Password = "secret" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "SVD", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 radius_xlat: 'SVD' rlm_sql (sql): sql_set_user escaped user --> 'SVD' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'SVD' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'SVD' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'SVD' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'SVD' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): No matching entry in the database for request from user [SVD] modcall[authorize]: module "sql" returns notfound for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [SVD/secret] (from client localhost port 0) Delaying request 1 for 1 seconds BTW: setting Auth-Type in radcheck for the user or in radgroupcheck for his group doesnt change anything. Anybody knows what im doing wrong? Thx in advance for your help.

3 3

Everything lookslike it works, but PC is not authentified
by Alexandros Gougousoudis 04 Sep '06

04 Sep '06

Hi, I'am running Freeradius 1.1.0 on Suse 10.1 with certificates. After a lot of help from that list and a good FAQ I'am so far, that I generated the certs for server and client and that the communication between Client, Server and AP (Linksys Switch) works. My problem is, that looking in the logs, the client should be authentified, but it isn't. The AP doesn't open the port. I assume the problem is windows, submitting the username as "host/computername" which brakes the certs (but I have no hint on the logfile). The PC tries to autheticate 13 times (I get at least 13 requests to the radius), but I get no error... My users files contains that: testuser User-Password == "test2" "host/vinfo-t1" Auth-Type:= EAP "vinfo-t1" Auth-Type:= EAP # On no match, the user is denied access. DEFAULT Auth-Type := Reject Reply-Message = "Bye" Please have a short look on my debuglog. I don't know where to look further. TIA Alex Debuglog: radius:/etc/raddb # radiusd -A -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/ssl/radius-neuer-cert-key.pem" tls: certificate_file = "/etc/raddb/certs/ssl/radius-neuer-cert-key.pem" tls: CA_file = "/etc/raddb/certs/ssl/ServiceCenter-IT_KHB_HfM_HfS-cacert.pem" tls: private_key_password = "secret" tls: dh_file = "/etc/raddb/certs/ssl/dh" tls: random_file = "/etc/raddb/certs/ssl/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.48.244.21:49154, id=0, length=91 NAS-IP-Address = 10.48.244.21 NAS-Port-Type = Ethernet NAS-Port = 3 User-Name = "host/vinfo-t1" EAP-Message = 0x0202001201686f73742f76696e666f2d7431 Message-Authenticator = 0xc1f35f98d7fadcae44c1da0404dfb946 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: EAP packet type response id 2 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry host/vinfo-t1 at line 219 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa888eb3548ccbf70991a8073e4917860 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.244.21:49154, id=0, length=171 NAS-IP-Address = 10.48.244.21 NAS-Port-Type = Ethernet NAS-Port = 3 User-Name = "host/vinfo-t1" State = 0xa888eb3548ccbf70991a8073e4917860 EAP-Message = 0x020300500d800000004616030100410100003d030144f82ec02d87663894bd52ff81b6e458129ee76d422652e5d90c0184b3ab2c4b00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x393361b2d5cc0e7f8caf5a584d4aab7d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry host/vinfo-t1 at line 219 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ef8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00bd], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x0104040a0dc00000100e160301004a02000046030144cbfc6ec473fda5a1d6059b489343f31dc6ce6ead7e88eaa9f0529253a6b97720dccbf137a27e973554fc428b8a2f075a212e34712e6ed1721fb1e456c90e62640004001603010ef80b000ef4000ef100077f3082077b30820563a003020102020128300d06092a864886f70d01010505003081aa310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543 EAP-Message = 0x656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e6465301e170d3036303831303039333334335a170d3037303831303039333334335a3081ac310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e31143012060355040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312730250603550403131e7261646975732e76657277616c74756e672e6b682d6265726c696e2e64653121301f06092a864886f70d010901161273632d6974406b682d EAP-Message = 0x6265726c696e2e646530820222300d06092a864886f70d01010105000382020f003082020a02820201009d061598c850223454cb70a58cae0a1ac2db0b6a963d25c96c632b1eb2a9177e3e8a066fa9c3596c4a1b035def3b6c589a12209a6d7ab7aa4144de890803c34cb5239cdb3b7266426049d475ed3e354fe494dee46a17e7478065c7332f6ac621d9b754d46812dc4ffda7a39bf33987fbe6951a591aee791c9468cc70f5a821683640675bafea24fe5291d6750c30a1b0a4c52cbeb6a18ce514038432f3dc83ce12657de67976dff9a7643b7ad340240e5e69385355b64d3e77f4bb0dfbc8fd63258a308c2a6e82f9c0c92e7e4ccadf848cc3bb EAP-Message = 0x57d592dcf46930c794fa0b338c9db103b9a7162352ff8cac3b680d64ec0b865bf74778839cd1530d79ba553a2bd9ffb112534cd758bb3b3dba26037ed1c158089af8903e9f5b684061ddd413fb192cfc5024c03b177184101d68bc7111ccdcb6bee8c98d1642bbc547e8211dab2fd5d45488da089a17edaa9b4dd4357d4adcb0e33553210a5ad0e84edc9f9a769297649672d5f78e2f3687e99c411abea88e0363fe1afb7dcf05a8838ef07cec88337f903a94a6207893b5e9ff80441a12b6847ff008eb8c257878f6711a8f8c053315d4ae87b36661cdee73a3cbaca92d14f480804c7476d36665c417db9c954795423ca49de599eb3ed3a6cc55f03b EAP-Message = 0xad529359b0a55e5bffa9cf65b3034d48c263c491b24a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ada72f87d56fd2eeffabef3ec09dc62 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.244.21:49154, id=0, length=97 NAS-IP-Address = 10.48.244.21 NAS-Port-Type = Ethernet NAS-Port = 3 User-Name = "host/vinfo-t1" State = 0x8ada72f87d56fd2eeffabef3ec09dc62 EAP-Message = 0x020400060d00 Message-Authenticator = 0x8d34aa0b0247b80bb0bc1f1fcb163af7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry host/vinfo-t1 at line 219 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x0105040a0dc00000100ed9f9f74b6ea9cea17710efc22bc0d77f58b0a5d3589ab19f13f90203010001a38201a6308201a230090603551d1304023000301106096086480186f8420101040403020640302b06096086480186f842010d041e161c54696e7943412047656e657261746564204365727469666963617465301d0603551d0e0416041442a94a9f048871b178d41a5d00a5668e78c045ff3081df0603551d230481d73081d48014b939b6ce8a52912eaece162418b1f4d8303d042ea181b0a481ad3081aa310b3009060355040613024445310f300d060355040813064265726c696e310f300d060355040713064265726c696e311430120603 EAP-Message = 0x55040a130b4b48422048664d2048665331193017060355040b13105365727669636543656e7465722d4954312530230603550403141c5365727669636543656e7465722d49545f4b48425f48664d5f4866533121301f06092a864886f70d010901161273632d6974406b682d6265726c696e2e6465820900890d6f61ac0ce005301d0603551d1204163014811273632d6974406b682d6265726c696e2e6465301d0603551d1104163014811273632d6974406b682d6265726c696e2e646530160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d01010505000382020100c0925f1aa48825e5c192abc4a792cb36b69953 EAP-Message = 0x782adc04d3e24436b4322312505087f51371012554b69768c152ed7083dba76437cc2bd09ed94b2a08a9ce1ad303a04ee2459c219c6e8341c44175cdcf5426ab7d10b9512877be1cd89204061f78c7f9296b5c73bcc315b281029163cd1f05d9fff0f772fd26964959a4493ef045f91dda761420537f2845a12d7a0f7f04502390dd6fb1e7cbff2891d8eee5abcf7da435ab6b163e2475fad3ccf8cfdc7ad019fbbe1deb47fbcad40dd4f57d2ed127665ca99cc035d93bf5df6ad79529fa142cb7f03eedd1aca47ad648db900e6dcd1966efb52a2c9dfa5ce5148ad4bd37716414c3a82bcb9a8cd805f1ea4e66f0171174e8099310d720186c2774cdc2 EAP-Message = 0xf80283f897fa84a1281e34c77148ca68508cd2eaf3f9167f76b41df115df8bcf02746dac891da3f58b4a45e5085dcbb3e9129106bb999f2b6b4722b86a32e18732260fa1093643a982b52951d7011141f3ea9ec18429482b3977620aa50aa40cd30eb3ed16f1a1c77d07df0672abdf64d608ff85a9076b95afb5a12a3a1fc231024403628b1db8cf04d474be335f83e230d506eb574b91fd672e092dd86088ea95edbe95aaecc00f4610520cd6a624103c64d1e8f6ebb8027ec42fa27ff3fdad82731a8511b8a68751452ebcbd13e11a0abe6d1f82fd5ce98af910ce7e62a69e9ac2383ee9b3dc0a973af95706a3a1c700076c3082076830820550a003 EAP-Message = 0x020102020900890d6f61ac0ce005300d06092a864886 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a47ab7f9de113ebbe793cdba4b8eac5 Finished request 2 [...] Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.244.21:49154, id=0, length=97 NAS-IP-Address = 10.48.244.21 NAS-Port-Type = Ethernet NAS-Port = 3 User-Name = "host/vinfo-t1" State = 0x02e56d8de12a870049b3b02e1f4ad162 EAP-Message = 0x021100060d00 Message-Authenticator = 0x8a9e680cc21b98a2835861c9ef08faea Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 rlm_eap: EAP packet type response id 17 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 13 users: Matched entry host/vinfo-t1 at line 219 modcall[authorize]: module "files" returns ok for request 13 modcall: leaving group authorize (returns updated) for request 13 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 13 modcall: leaving group authenticate (returns handled) for request 13 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x0112000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f9387f3adb41ddea578c30fd328358f Finished request 13 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 13 ID 0 with timestamp 44cbfc94 Nothing to do. Sleeping until we see a request. -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445

5 13

RE: Freeradius-Users Digest, Vol 17, Issue 8
by Ravi S M 04 Sep '06

04 Sep '06

Hi Alan DeKok Thanks for Answers, actually I was replied for your questions but those were bouncing back. So you have mistaken. Any how sorry for that. Thanks & Regards Ravi -----Original Message----- From: freeradius-users-bounces+smravi=techmahindra.com(a)lists.freeradius.or.g [mailto:freeradius-users-bounces+smravi=techmahindra.com@lists.freeradius.or.g] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Saturday, September 02, 2006 10:08 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 17, Issue 8 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Everything lookslike it works, but PC is not authentified (Alexandros Gougousoudis) 2. Re: Everything lookslike it works, but PC is not authentified (Alexandros Gougousoudis) 3. Regarding handling of threads (Ravi S M) 4. Re: Everything lookslike it works, but PC is not authentified (Alan DeKok) 5. Re: Regarding handling of threads (Alan DeKok) 6. Proxy IP Address (Doug Hardie) ---------------------------------------------------------------------- Message: 1 Date: Sat, 02 Sep 2006 12:58:48 +0200 From: Alexandros Gougousoudis <gougousoudis(a)kh-berlin.de> Subject: Re: Everything lookslike it works, but PC is not authentified To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <44F963E8.6060803(a)kh-berlin.de> Content-Type: text/plain; charset=ISO-8859-15; format=flowed Hi, Stefan Winter schrieb: > this list, is that the server cert doesn't have the MS TLS Web Server > Authentication OID in the cert. Please read the various documentation about Nope, the cert has this extension. I checked that again and again. Server is in DNS and the CN of the cert is the FQDN of the server. The CN of the PC is the netbios-name. Both certs have their extenstion (Webserver and Client). Maybe it's something else? TIA Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445 ------------------------------ Message: 2 Date: Sat, 02 Sep 2006 13:03:29 +0200 From: Alexandros Gougousoudis <gougousoudis(a)kh-berlin.de> Subject: Re: Everything lookslike it works, but PC is not authentified To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <44F96501.5070700(a)kh-berlin.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi, K. Hoercher schrieb: > 1. Don't set Auth-Type. See > http://deployingradius.com/documents/configuration/auth_type.html Thanks to your reply. The problem is, there are now a lot of partial howtos in the net, but not even one covers all. I did that, because it was in an howto... I'll try something else. and finally what the supplicant sends. What is "host/vinfo-t1" > supposed to be? vinfo-t1 is the netbiosname of the client, the realm(?) host/ comes from Windows or the AP, I don't know. Probably it breaks the cert, because the name differs and this bothers EAP/TLS. But I don't know how to handle or shorten this. Maybe somebody has a good idea to handle that. TIA Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445 ------------------------------ Message: 3 Date: Sat, 2 Sep 2006 16:53:32 +0530 From: "Ravi S M" <smravi(a)TechMahindra.com> Subject: Regarding handling of threads To: <freeradius-users(a)lists.freeradius.org> Cc: aland(a)deployingradius.com Message-ID: <1BC030D8DE6BC042B3F33EE14CA2B8FA03158BD9(a)SINPUNEX002.TechMahindra.com> Content-Type: text/plain; charset="us-ascii" Hi I have some doubts regarding free radius server. 1) When we run server parent exits by spawning a child to handle client's requests, so during this time purify also exits but shows 95 leaks. (leak report shows from "src/main/modules.c" from line num "207") * My doubt is whether these leaks which are shown with purify are freed in child or how these leaks get rid off?? * Or when parents calls exit(0), do all memory are freed ?? 2) For handling multiple requests, is threads implemented? If so how? 3) If threads are not implemented how multiple requests are handled? Please I am grateful if you can provide some information. Thanks & Regards Ravi.S.M ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

SQL User in multiple group
by Pavel D. Kuzin 04 Sep '06

04 Sep '06

Hello! I`m have strange trouble. Radius using Oracle as backend. in sql i`m have 2 users 500 User belongs in two groups Local and Users I`m trying to check Service-Type in groups When User Appears in group Users, auth is ok, but seems it aslo check group Local Becouse Reply items from this group have in radius answer Help please. Why radius checks Local group? SELECT a.id, a.username, a.attribute, a.value, a.op FROM hosting.voip_user_check_attrs a 500 User-Password 12345 == 400 User-Password 12345 == SELECT a.id, a.username, a.groupname FROM hosting.voip_user_group a 2 500 Local 1 500 Users SELECT a.id, a.groupname, a.attribute, a.op, a.value FROM hosting.voip_group_check_attrs a 2 Local Service-Type == SIP-Caller-AVPs 1 Users Service-Type == Sip-Session SELECT a.id, a.groupname, a.attribute, a.op, a.value FROM hosting.voip_group_reply_attrs a 3 Local SIP-AVP += next_gw:192.168.39.253 4 Local SIP-AVP += have_local:1 Debug: rad_recv: Access-Request packet from host 127.0.0.1:46998, id=188, length=234 User-Name = "500(a)panda.nodex.ru" Digest-Attributes = "\n\005500" Digest-Attributes = "\001\020panda.nodex.ru" Digest-Attributes = "\002*44fbfed76560873b8901225aab710aeb385d84ed" Digest-Attributes = "\004\024sip:panda.nodex.ru" Digest-Attributes = "\003\nREGISTER" Digest-Response = "9917dd6f660e3a05c6337e0c808f6faa" Service-Type = Sip-Session Sip-URI-User = "500" User-Name = "call-id=0-13c4-3881eda0-1b1c-21d" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Mon Sep 4 14:19:23 2006 : Debug: Processing the authorize section of radiusd.conf Mon Sep 4 14:19:23 2006 : Debug: modcall: entering group authorize for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Mon Sep 4 14:19:23 2006 : Debug: hints: Matched DEFAULT at 39 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '/usr/local/radius/var/log/radius/radacct/127.0.0.1/auth-detail-20060904' Mon Sep 4 14:19:23 2006 : Debug: rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct/127.0.0.1/auth-detail-20060904 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rlm_digest: Adding Auth-Type = DIGEST Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "digest" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '500' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> '500' Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM VOIP_USER_CHECK_ATTRS WHERE Username = '500' ORDER BY id' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT VOIP_GROUP_CHECK_ATTRS.id,VOIP_GROUP_CHECK_ATTRS.GroupName,VOIP_GROUP_CHECK_ATTRS.Attribute,VOIP_GROUP_CHECK_ATTRS.Value,VOIP_GROUP_CHECK_ATTRS.op FROM VOIP_GROUP_CHECK_ATTRS,VOIP_USER_GROUP WHERE VOIP_USER_GROUP.Username = '500' AND VOIP_USER_GROUP.GroupName = VOIP_GROUP_CHECK_ATTRS.GroupName ORDER BY VOIP_GROUP_CHECK_ATTRS.id' Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM VOIP_USER_REPLY_ATTR WHERE Username = '500' ORDER BY id' Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: 'SELECT VOIP_GROUP_REPLY_ATTRS.id,VOIP_GROUP_REPLY_ATTRS.GroupName,VOIP_GROUP_REPLY_ATTRS.Attribute,VOIP_GROUP_REPLY_ATTRS.Value,VOIP_GROUP_REPLY_ATTRS.op FROM VOIP_GROUP_REPLY_ATTRS,VOIP_USER_GROUP WHERE VOIP_USER_GROUP.Username = '500' AND VOIP_USER_GROUP.GroupName = VOIP_GROUP_REPLY_ATTRS.GroupName ORDER BY VOIP_GROUP_REPLY_ATTRS.id' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): Released sql socket id: 1 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall: leaving group authorize (returns ok) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rad_check_password: Found Auth-Type DIGEST Mon Sep 4 14:19:23 2006 : Debug: auth: type "digest" Mon Sep 4 14:19:23 2006 : Debug: Processing the authenticate section of radiusd.conf Mon Sep 4 14:19:23 2006 : Debug: modcall: entering group authenticate for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authenticate]: calling digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "500" Digest-Realm = "panda.nodex.ru" Digest-Nonce = "44fbfed76560873b8901225aab710aeb385d84ed" Digest-URI = "sip:panda.nodex.ru" Digest-Method = "REGISTER" Mon Sep 4 14:19:23 2006 : Debug: A1 = 500:panda.nodex.ru:12345 Mon Sep 4 14:19:23 2006 : Debug: A2 = REGISTER:sip:panda.nodex.ru Mon Sep 4 14:19:23 2006 : Debug: KD = 519a37878f13e1a70683019d3507c065:44fbfed76560873b8901225aab710aeb385d84ed:dc143550193dc2a4ad1c2f68d31dac39 Mon Sep 4 14:19:23 2006 : Debug: modsingle[authenticate]: returned from digest (rlm_digest) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[authenticate]: module "digest" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall: leaving group authenticate (returns ok) for request 3 Mon Sep 4 14:19:23 2006 : Debug: Processing the post-auth section of radiusd.conf Mon Sep 4 14:19:23 2006 : Debug: modcall: entering group post-auth for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: calling reply_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '/usr/local/radius/var/log/radius/radacct/127.0.0.1/reply-detail-20060904' Mon Sep 4 14:19:23 2006 : Debug: rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct/127.0.0.1/reply-detail-20060904 Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: returned from reply_log (rlm_detail) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[post-auth]: module "reply_log" returns ok for request 3 Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: calling sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): Processing sql_postauth Mon Sep 4 14:19:23 2006 : Debug: radius_xlat: '500' Mon Sep 4 14:19:23 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> '500' Mon Sep 4 14:19:23 2006 : Debug: modsingle[post-auth]: returned from sql (rlm_sql) for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall[post-auth]: module "sql" returns noop for request 3 Mon Sep 4 14:19:23 2006 : Debug: modcall: leaving group post-auth (returns ok) for request 3 Sending Access-Accept of id 188 to 127.0.0.1 port 46998 SIP-AVP += "next_gw:192.168.39.253" SIP-AVP += "have_local:1" Mon Sep 4 14:19:23 2006 : Debug: Finished request 3 -- Pavel D.Kuzin System Administrator Nodex ISP St. Petersburg, Russia pk(a)nodex.ru http://nodex.ru

1 0

Dynamic port assignment to exec program
by Shankar Ganesh C 04 Sep '06

04 Sep '06

Hi , I have a requirment to have a socket communication in the exec program from freeradius for an accounting start. I understand that for evey accounting request from free radius a exec program will be executed. How can i assign the exec program a dynamic port from the freeradius when it is invoked ? Is there any configuration needs to be done ? Thanks and regards Shankar ganesh

1 0

freeradius for cisco network device login authentication
by Vinay Kumar 04 Sep '06

04 Sep '06

I am trying to move my network device authentication from Microsoft IAS and Active directory. To Freeradius and AD. I have followed the freeradius AD integration document. Is anybody using freeradius and AD combination for login authentication into cisco network devices ? Can they share there freeradius configuration, or any tips to make this work ? thanks /vinay

4 3