January 2007 - Freeradius-Users - lists.freeradius.org

failed login accounting with dialup admin
by kemas 02 Feb '07

02 Feb '07

I have a small accounting problem with freeradius and dialup admin which I can't find a way to solve it. I've set freeradius to authenticate EAP-TLS, I want to log people who failed to authenticate to mysql with rlm_sql, which will show in dialup admin failed login page. I put in radiusd.con post-auth section the sql module: Post-Auth-Type REJECT { #insert-module-name-here sql } the post-auth query in sql.conf: postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap- Password}', '%{reply:Packet-Type}', NOW())" the sql query runs well, it put the failed login to the radpostauth table but the dialup admin failed login page is searching to the radacct table for the failed user which will never find it. am I doing the right way to put the sql module inside the post-auth? or should I put it in other section? I don't want to change the postauth_query but is there any way to add another query to put the data to radacct table? thanks in advance

5 5

Removing characters from usernames
by Andrew Zirkel 01 Feb '07

01 Feb '07

Is there a way to parse the input of a username and password before it is passed to the back end database? I'm doing mac address authentication and some devices are passing the mac address with dashes, where I need to have no separation between the octets. I basically need to strip out these dashes from the input. Thanks Andy Zirkel

3 4

Why Freeradius and Mysql dont work?
by yao guoxian 01 Feb '07

01 Feb '07

Platform and Environment: Freeradius:1.0.5 on Redhat 9 MySQL:MySQL-standard-5.0.20-linux-i686 Step: 1. create database radius; 2.mysql -uroot -prootpass radius < db_mysql.sql ; 3.Edit radiusd.conf and sql.conf; Debug Result: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 202.117.7.223:1490, id=6, length=47 User-Name = "barney" CHAP-Password = 0xad35a90d409c25b78b6d148a531358d9ac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "barney", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 radius_xlat: 'barney' rlm_sql (sql): sql_set_user escaped user --> 'barney' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'barney' ORDER BY id' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 2 modcall: group authorize returns fail for request 2 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 202.117.7.223:1490, id=6, length=47 Discarding duplicate request from client liv1:1490 - ID: 6 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 6 with timestamp 45bca7cb Nothing to do. Sleeping until we see a request. From the above results, I guess mysql doesnt work. But I can access databases from the command line .The Freeradius Server worked well when I use the "user", not using MySQL. Any suggestion?

8 19

FR not honoring AutzType
by Sam Schultz 01 Feb '07

01 Feb '07

I've been trying to set up FR in a realm-based configuration using only LOCAL realms that are passed to different MySQL tables via different instances. This setup, like several previous questions posted to this list for similar setups, requires conditional branching. The solution as suggested in those posts was to use an Autz-Type block within the authorize block, and an Auth-Type block within the authenticate block to use appropriate module instances for the given realm. The problem I am having is that no matter what I set Autz-Type to, or where I set it, FR doesn't seem to honor it. I've tried putting it in hints entries, user entries, and realm entries; all suggestions that had been posted in response to similar issues. Another problem that compounds this one is that different posters refer to Autz-Type differently: autztype, AutzType, & Autz-Type. Is the difference significant, or is this one of those cases where they ALL are valid, but do exactly the same thing? I would have thought there would be some way to use the Realm variable that the rlm_realm strips from the User-Name attribute directly within the Authorize & Authenticate blocks, but it appears the most straight-forward way of using a block like 'realm bogus {}' causes FR to confuse the block for another module instance definition. Any insights anyone may have on this would be appreciated. Following are the relevant configuration & output segments: radiusd.conf, authorize block: Autz-Type SQL-BOGUS { sql-bogus } radiusd.conf, authenticate block: Auth-Type SQL-BOGUS { sql-bogus } hints: DEFAULT Prefix == "BOGUS\", Strip-User-Name = Yes Hint = "MIE Login", Service-Type = Framed-User, Autz-Type := SQL-BOGUS, Auth-Type := SQL-BOGUS users: DEFAULT Realm == "bogus", Autz-Type := SQL-BOGUS mysql bogus realms' radcheck table: +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 6 | user | User-Password | == | password | | 7 | user | Auth-Type | := | Local | +----+----------+---------------+----+----------+ radiusd -X -A (snippet 1, module instantiation): rlm_sql (sql-bogus): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-bogus): Attempting to connect to root@localhost:/radius rlm_sql (sql-bogus): starting 0 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #0 rlm_sql (sql-bogus): Connected new DB handle, #0 rlm_sql (sql-bogus): starting 1 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #1 rlm_sql (sql-bogus): Connected new DB handle, #1 rlm_sql (sql-bogus): starting 2 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #2 rlm_sql (sql-bogus): Connected new DB handle, #2 rlm_sql (sql-bogus): starting 3 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #3 rlm_sql (sql-bogus): Connected new DB handle, #3 rlm_sql (sql-bogus): starting 4 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #4 rlm_sql (sql-bogus): Connected new DB handle, #4 Module: Instantiated sql (sql-bogus) radiusd -X -A (snippet 2, module *NOT* getting used): modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "bogus" for User-Name = "bogus\user" rlm_realm: Found realm "bogus" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Proxying request from user user to realm bogus rlm_realm: Adding Realm = "bogus" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 NOTE: My module order, and the fact that radius found the "bogus" realm means that there should be SQL auth lines appearing immediately after the "mschap returns noop" line. They don't show up, which means FR either wasn't seeing Autz-Type at that point, or some other module changed it. Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485

2 1

Re: Troube with matching LDAP group membership in authorize
by Richard Hesse 31 Jan '07

31 Jan '07

Nevermind I found the problem. There's a limitation in ldap_groupcmp() such that only the last LDAP module instantiated is actually checked -- ignoring whatever you specify. I found this info from http://lists.cistron.nl/pipermail/freeradius-users/2004-June/033220.html. "In any case the ldap module which will be instantiated last will be the one that will handle ldap-group comparisons. If we add a check that will change to the first ldap module which is instantiated. I think it's more or less a matter of personal taste, which module we 'd like to handle ldap-group comparisons. Is it really worth the effort. Users can just change the order in which the ldap modules are instantiated in order to achieve what they want." Rather disappointing that this limitation still exists from 2 years ago. Does FR2.0 have some sort of object-based virtualization that would support this? Like, a "LDAP group" object which you could tie LDAP instances to and make the check there? -richard ----- Original Message ---- From: Richard Hesse <rhesse(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, January 30, 2007 12:40:36 PM Subject: Troube with matching LDAP group membership in authorize I'm trying to setup radius authentication for enable access on our networking gear and having a tough time getting a working config. I'd like to have FR check a group in LDAP for membership before authorizing. That is, I only want user's listed in the "uniquemember" attribute of the Operations group object to be granted access. Reading the FR docs this is possible -- I must be missing something. First, here are the relevant portions of my configs: Hint file: DEFAULT NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User, ldap_enable-Ldap-Group := "operations", Autz-Type := ldap_enable, Auth-Type := LDAP radius.conf: ldap ldap_enable{ server = "fds1.hq.powerset.com" basedn = "dc=powerset,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/starfield.pem tls_require_cert = "demand" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # ldap_debug = 1 # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" timeout = 4 timelimit = 3 net_timeout = 3 # compare_check_items = yes # do_xlat = yes access_attr_used_for_allow = no set_auth_type = no } I have several LDAP instances defined in radius.config, but this is the one I want to use. I instantiate it first in radius.config so that hints can use it: instantiate { ldap_enable exec expr } And a corresponsing Autz-Type in radius.config: authorize { preprocess suffix ntdomain eap autztype ldap{ redundant { fds1 # fds2 } } autztype ldap_enable{ ldap_enable } files pap } Here's the debug output from when I try and connect: rad_recv: Access-Request packet from host 64.13.145.238:1024, id=96, length=71 User-Name = "dick" User-Password = "$$$$$$$$" NAS-IP-Address = 64.13.145.238 NAS-Identifier = "h2848-1" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 <--- This is the correct entry modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 It appears that FR is ignoring the Autz-Type I set in hints and just processes the entries in authorize in sequential order. This is the default behavior unless an Autz-Type is explicitly set (which I do in hints). How do I get the Autz-Type to kick-in and have FR send the request to the proper LDAP entry? Thanks in advance, -richard ____________________________________________________________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/features_spam.html ____________________________________________________________________________________ Now that's room service! Choose from over 150,000 hotels in 45,000 destinations on Yahoo! Travel to find your fit. http://farechase.yahoo.com/promo-generic-14795097

3 2

Re: Troube with matching LDAP group membership in authorize
by Richard Hesse 31 Jan '07

31 Jan '07

> In any case, if you carefully read the text you quoted, you'll see a > solution that doesn't require patches: List ALL ldap modules in the >"instantiate" section, and list "ldap_enable" last. > Alan DeKok. Yes, that's what I ended up doing. However, I lose the ability to do load-balance and redunancy constructs. rlm_ldap indicates that I can list multiple LDAP servers for the host in radius.conf. How exactly does that work compared to redundancy or load-balance? Does it try the first, then the second, etc every time? Does it round-robin? Thanks, -richard ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

2 1

Troube with matching LDAP group membership in authorize
by Richard Hesse 30 Jan '07

30 Jan '07

I'm trying to setup radius authentication for enable access on our networking gear and having a tough time getting a working config. I'd like to have FR check a group in LDAP for membership before authorizing. That is, I only want user's listed in the "uniquemember" attribute of the Operations group object to be granted access. Reading the FR docs this is possible -- I must be missing something. First, here are the relevant portions of my configs: Hint file: DEFAULT NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User, ldap_enable-Ldap-Group := "operations", Autz-Type := ldap_enable, Auth-Type := LDAP radius.conf: ldap ldap_enable{ server = "fds1.hq.powerset.com" basedn = "dc=powerset,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/starfield.pem tls_require_cert = "demand" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # ldap_debug = 1 # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" timeout = 4 timelimit = 3 net_timeout = 3 # compare_check_items = yes # do_xlat = yes access_attr_used_for_allow = no set_auth_type = no } I have several LDAP instances defined in radius.config, but this is the one I want to use. I instantiate it first in radius.config so that hints can use it: instantiate { ldap_enable exec expr } And a corresponsing Autz-Type in radius.config: authorize { preprocess suffix ntdomain eap autztype ldap{ redundant { fds1 # fds2 } } autztype ldap_enable{ ldap_enable } files pap } Here's the debug output from when I try and connect: rad_recv: Access-Request packet from host 64.13.145.238:1024, id=96, length=71 User-Name = "dick" User-Password = "$$$$$$$$" NAS-IP-Address = 64.13.145.238 NAS-Identifier = "h2848-1" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 <--- This is the correct entry modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 It appears that FR is ignoring the Autz-Type I set in hints and just processes the entries in authorize in sequential order. This is the default behavior unless an Autz-Type is explicitly set (which I do in hints). How do I get the Autz-Type to kick-in and have FR send the request to the proper LDAP entry? Thanks in advance, -richard ____________________________________________________________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/features_spam.html

1 0

LAN accounting
by Mohsen Pahlevanzadeh 30 Jan '07

30 Jan '07

I'm newbie,I wanna know that can i use FreeRadius+Dialup_admin as a LAN accounting? --Mohsen

4 5

strange error in freeradius
by Semenenko Pavel 30 Jan '07

30 Jan '07

I have 2.6.18-gentoo-r6 kernel, and freeradius-1.1.3-r2 I correctly configure radius for working with certificates in debug mode (radiusd -fX), then add it into init scripts, and try to start... Ooops!.. it don't start ;( # /usr/sbin/radiusd Sun Jan 28 20:58:13 2007 : Info: Starting - reading configuration files ... # In log only: # cat /var/log/radius/radius.log | tail -n 1 Sun Jan 28 20:58:13 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain # I'll read closely all comments in radiusd.conf, and I check that all rlm_ libs is accessible for radius... I try start radius with root:root user and group, without result. All permissions (/etc/raddb, /var/log, /var/run) set radiusd:radiusd. It won't work. But in debug mode all work correct. strace -f /usr/sbin/radiusd shows that cloned process can't open pipe (I also check all rlm_*'s load correct) clone(Process 25483 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7df66f8) = 25483 [pid 25483] getsockname(3, {sa_family=AF_INET, sin_port=htons(36102), sin_addr=inet_addr("192.168.1.5")}, [16]) = 0 [pid 25482] exit_group(0) = ? [pid 25483] getpeername(3, Process 25482 detached {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("192.168.1.5")}, [16]) = 0 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) dup(3) = 6 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 7 close(3) = 0 fcntl64(7, F_GETFD) = 0 dup2(7, 3) = 3 fcntl64(3, F_SETFD, 0) = 0 close(7) = 0 write(3, "\25\3\1\0 \256\376\323d\204\16\217\227\337\343oX\237\5"..., 37) = -1 EPIPE (Broken pipe) --- SIGPIPE (Broken pipe) @ 0 (0) --- Process 25483 detached I try rebuild radius, try version 1.1.4, without result. Any ideas?..

2 3

Freeradius and Oracle under Cygwin
by Brian Atkins 30 Jan '07

30 Jan '07

I'm working on using Freeradius with Chillispot to authenticate from an Oracle database. Freeradius is running on W2K3 server and Oracle is installed on the local machine. At this point, I'm trying to compile the rlr_sql_oracle module, but keep getting: $ ./configure --with-oracle-home-dir=/cygdrive/d/oracle/ora92 ... "configure: WARNING: oracle headers not found. Use \ --with-oracle-home-dir=<path> configure: WARNING: sql submodule 'oracle' disabled" ... I have set ORACLE_HOME to the Cygwin path: ORACLE_HOME=/cygdrive/d/oracle/ora92/ Is anyone currently authenticating against Oracle that might be able to offer pointers? I do have the alternative of compiling on a true linux server as opposed to a W2K3 box, but the architecture is different (AMD em64T instead of x86). -- Brian "An adventure is never an adventure when it's happening. Challenging experiences need time to ferment, and an adventure is simply physical and emotional discomfort recollected in tranquility." -- Tim Cahill

3 3