October 2007 - Freeradius-Users - lists.freeradius.org

Stripping Username (EAP-TLS)
by s3b0＠gmx.de 26 Oct '07

26 Oct '07

Hi everyone, i am using Freeradius 1.1.7 on Suse Linux Enterprise 10. I try to authenticate user with EAP-TLS. Everything worked fine, until i activated the check of cert_cn. eap.conf: ------------------- # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # check_cert_cn = %{User-Name} ------------------- The problem is, that the username looks like "host/cl00006" but the cn is "cl00006". How can i strip the username? Thanks for your help. Kind regards Sebastian -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

2 1

rlm_sqlcounter and user realms
by Carlos A. Carnero Delgado 26 Oct '07

26 Oct '07

Hello, I'm trying to set rlm_sqlcounter up so that I can check for a monthly use quota. Everything works, except the checks. The NAS present the user names with a realm, which I'm processing (thus, user@realm becomes user.) Using SQL for accounting and such is working marvelous. Now, when I configured/activated rlm_sqlcounter as per the instructions at http://wiki.freeradius.org/Rlm_sqlcounter it will not work because the SQL checks are using the pre-processed user name: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}' will use 'user@realm' instead of just 'user'. My question is, how can I modify this query definition (and the others from sqlcounter.conf) so that they really check against the stripped user name. Thanks a lot, Carlos. -- <nick> grah windows just crashed again, unstable crap. <yukito> Windows isn't unstable, it's just spontaneous.

2 1

Re: Access-Reject in a php script
by manIP 25 Oct '07

25 Oct '07

Hi, I have put exit(2) but as Patric said, freeradius thinks that the script failed and does not respond to the access-request. In the client side, there is a server time out...I don't know if that server time out is assumed as an Access-Reject? May be the problem comes from PHP and I could use the UNIX system() function send back the code 2. Please, if you have a better solution, I would be very grateful! Cheers. Khalid Alan DeKok wrote: > > Patric wrote: > >> But when you exit(2) in PHP, freeradius thinks that the script failed > >> and does not respond to the access-request... > > > > It delays the Access-Reject. See the debug output. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > Ah is that what happens! That delay was causing the access requests time > out, and it appeared from the NAS point of view that it was getting no > response... > > Thanks Alan > > -- > > Q: I want to be a sysadmin. What should I do? > > A: Seek professional help. > > ---------------------------------------------------------------------- > Finally - A spam blocker that actually works. > http://www.bluebottle.com/tag/4 >

3 2

Sqlippool & debian - sql_get_socket unresolved symbol
by Francesco Cristofori 25 Oct '07

25 Oct '07

Hi all, I know the topic has been discussed about a year ago, but I'd like to know if it's going to be solved. I know that Alan said it's not a FR issue (http://lists.cistron.nl/pipermail/freeradius-users/2006-October/057588. html), but many people says that turning on RTLD_GLOBAL is a security weakness, so perhaps it's overall good to fix the code to make it work even with RTLD_GLOBAL turned off. What do you think? Regards, Francesco.

2 1

Are SHA-256 certificates supported?
by hannu.lammi＠wipsl.com 25 Oct '07

25 Oct '07

Hi, I need to set up a RADIUS server that accepts certificates which use SHA-256 as signature algorithm (OID sha256WithRSAEncryption). I have set up a FreeRADIUS 2.0.0-pre2 server to see if this would work out of the box. After verifying that EAP-TLS authentication works with SHA-1 certificates I switched to SHA-256 certificate that was created with OpenSSL 0.9.8b, the same that FreeRADIUS was compiled against. Here's a snippet of the log I got from my SHA-256 test: ===== --> verify error:num=7:certificate signature failure rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm ===== It would seem there's a problem somewhere. It may very well be in the client I'm using. So, I'd like to know if FreeRADIUS supports SHA-256 certificates? If it doesn't, is the support for them planned? thanks in advance, - Hannu

2 4

FR-2.0.0-pre2 - doubled sql accounting
by Tomasz Zieleniewski 25 Oct '07

25 Oct '07

Hi, I have the home_server configuration which points to my localhost. So the scenario is the following that when I receive the Accounting-Request with the user name of the form user@domain I check the realm for particular domain and strip the user name and proxy it again to my home_server localhost - partcular realm have the pool which points to the localhost home_server Problem is that there each accounting request is accounted twice. First time when request gets to freeradius and second after it enters again after proxing it through home_server pool. What can I do about it. How can I disable such behavior?? I know that I can do it by setting particular as local without specifying the acctpool - but i still would like to use the pool. Can I somehow disable the first or the second accounting, what is the right way to do it?? Thank you for any help Regards Tomasz

2 1

Access-Reject in a php script
by manIP 25 Oct '07

25 Oct '07

Hi all! I am using a script for the authentication and it is working well. I can send a list of attributes without any problem. Now I want to send an "Access-Reject" if the authentication fails but I do not know how...I would be very grateful if someone could tell me how to do so. herein is a test script: #!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo "Session-Timeout:=100"; else echo "Access-Reject"; //NOT WORKING!!!!!! ?> Thanks a lot for your assistance Khalid :)

4 5

Number of requests for Free radius
by Anoop 25 Oct '07

25 Oct '07

Hi I am using free radisu 1.1.7 and eap tls authentication.I would like to know the maximum number of users/ authentication requests that it can handle? Regards Anoop -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Thursday, October 25, 2007 11:02 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 30, Issue 91 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Access-Reject in a php script (manIP) 2. FR-2.0.0-pre2 - virtual server configuration problem - how to use client and listen (Tomasz Zieleniewski) 3. Re: Access-Reject in a php script (Alan DeKok) 4. FR-2.0.0-pre2 - doubled sql accounting (Tomasz Zieleniewski) 5. Re: FR-2.0.0-pre2 - virtual server configuration problem - how to use client and listen (Alan DeKok) 6. Re: Access-Reject in a php script (A.L.M.Buxey(a)lboro.ac.uk) 7. Re: AW: AW: Newbie Question o.O (Sebastian Wild) 8. Re: AW: AW: Newbie Question o.O (Andy Billington) 9. Fw: FreeRadius Server: Installation problem (j v) ---------------------------------------------------------------------- Message: 1 Date: Wed, 24 Oct 2007 17:34:09 +0200 From: manIP <manvoip(a)gmail.com> Subject: Access-Reject in a php script To: freeradius-users(a)lists.freeradius.org Message-ID: <f90cb76b0710240834t4b984356s3ce45d2ec2677692(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi all! I am using a script for the authentication and it is working well. I can send a list of attributes without any problem. Now I want to send an "Access-Reject" if the authentication fails but I do not know how...I would be very grateful if someone could tell me how to do so. herein is a test script: #!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo "Session-Timeout:=100"; else echo "Access-Reject"; //NOT WORKING!!!!!! ?> Thanks a lot for your assistance Khalid :)

2 1

Fw: FreeRadius Server: Installation problem
by j v 25 Oct '07

25 Oct '07

Please guide from where to get these tools libtool is needed by freeradius-1.1.6-0.i586 libtool-ltdl-devel is needed by freeradius-1.1.6-0.i586 ----- Forwarded Message ---- From: j v <mr_developer_india(a)yahoo.co.in> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, 24 October, 2007 11:16:47 AM Subject: FreeRadius Server: Installation problem Hey all, > > I am trying to install 1.1.6. When i try to make the SUSE Linux Package > and run the rpm build command then an error message comes which reads: > freeRadius 1.1.5.gz file not present. > > Please guide. > > Now you can chat without downloading messenger. Click here to know how. -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Chat on a cool, new interface. No download required. Go to http://in.messenger.yahoo.com/webmessengerpromo.php - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

authentication problem with sql
by hadi golestani 24 Oct '07

24 Oct '07

Hi, my freeradius works well with users files users but when I test it with one of my users that is stored in db, the authentication fails. what is needed to authenticate users that are stored in db. two debug mode output is attached: it's debug response for a user that is stored in db: rad_recv: Access-Request packet from host 127.0.0.1:1029, id=90, length=58 User-Name = "n2test" User-Password = "n2test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "n2test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'n2test' rlm_sql (sql): sql_set_user escaped user --> 'n2test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'n2test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'n2test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'n2test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'n2test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 90 to 127.0.0.1 port 1029 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 90 with timestamp 471de1e9 Nothing to do. Sleeping until we see a request. and it's the output for a normal user that is stored in users file: rad_recv: Access-Request packet from host 127.0.0.1:1029, id=43, length=62 User-Name = "normaltest" User-Password = "normaltest" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "normaltest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry normaltest at line 1 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'normaltest' rlm_sql (sql): sql_set_user escaped user --> 'normaltest' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'normaltest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User normaltest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'normaltest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'normaltest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User normaltest not found in radgroupcheck rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "pap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password normaltest rlm_pap: Using clear text password "normaltest". rlm_pap: User authenticated successfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: 'normaltest' rlm_sql (sql): sql_set_user escaped user --> 'normaltest' radius_xlat: 'INSERT into radpostauth (user, pass, reply, date) values ('normaltest', 'normaltest', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (user, pass, reply, date) values ('normaltest', 'normaltest', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 modcall[post-auth]: module "sql" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 43 to 127.0.0.1 port 1029 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 43 with timestamp 471de179 Nothing to do. Sleeping until we see a request.

7 16