February 2007 - Freeradius-Users - lists.freeradius.org

Problems with mysql and freeradius
by Marilene Lima 01 Feb '07

01 Feb '07

Hi, I am starting the freeradius with my mysql server and I noticed this erro: rlm_sql_mysql: Mysql error 'Host 'mysql1.wireless.intranet' is not allowed to connect to this MySQL server' But I already give the privileges to my user radius and add the server mysql1.wireless.intranet to my list of hosts knowed. I use linux Debian and mysql 5.0.33 and the both are in the same machine, but they have different ip adress. In the freeradius/sql.conf file I configured this: sql { # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "mysql1.wireless.intranet" # server = localhost login = "radius" password = "radius_password" #login = "root" # password = "mysql_password" # Database table configuration radius_db = "radius" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" Someone can help me? Thanks a lot, Marilene This the result of freeradius: freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@mysql1.wireless.intranet:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@mysql1.wireless.intranet:radius rlm_sql_mysql: Mysql error 'Host 'mysql1.wireless.intranet' is not allowed to connect to this MySQL server' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests.

1 0

Cisco VoIP Recording
by Chris Halverson 01 Feb '07

01 Feb '07

I have setup freeradius 1.1.4 to log Cisco VOIP records into Postgres as described in src/billing. I am getting records just fine, but I am getting 16 entries logged into the database (radacct table) per phone call. Is this normal? If so, how do I figure out what the final one (or pair if I need 2 entries) should be? I'm also not seeing anything logged in the {start|stop}voip tables if that's important. Thanks for any help. Chris -- Chris D. Halverson http://www.chrishalverson.com/ YIM/AIM: chrisdhal MSN Messenger: chris(a)chrishalverson.com

2 1

Removing characters from usernames
by Andrew Zirkel 01 Feb '07

01 Feb '07

Is there a way to parse the input of a username and password before it is passed to the back end database? I'm doing mac address authentication and some devices are passing the mac address with dashes, where I need to have no separation between the octets. I basically need to strip out these dashes from the input. Thanks Andy Zirkel

3 4

help
by Stephen Baker 01 Feb '07

01 Feb '07

3 2

?? PEAP MSChapv2 and Proxy to LDAP
by Thomas Sterber (tsterber) 01 Feb '07

01 Feb '07

Can the freeradius be used to work as a proxy between a PEAP_MSChapv2 request and a central LDAP server ? I read a lot in the mailing forum, but its not clear. regards, Thomas

2 1

Message in "radius.log"
by Jean Frontin 01 Feb '07

01 Feb '07

Hello, Here is two lines of the radius.log. Everything in tables looks like okay. Where must I search, I don't understand the first line below. So, why is the second line good ? What does mean "cli" at the end of the second line ? Wed Jan 31 15:45:05 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [frontin] Wed Jan 31 15:45:05 2007 : Auth: Login OK: [frontin/xxxxxx] (from client swsfspare port 0 cli ) Regards Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

RE: a freeradious/wireless solution for a school
by John Wan 01 Feb '07

01 Feb '07

Hi Michael, I have setup the "chillispot"+"freeRadius"+"Win2k3AD" for my wireless network. Everything is working but the AD authentication. Apparently the reason not working is because AD does not like the CHAP authentication and AD likes MS-CHAP. I do not know how to configure and where to configure my Linux box to use MS-CHAP instead of CHAP. Have you done this before? If you do would you please teach me how to rectify this problem. Please see the following output from "$ Radius -X" when a wireless client uses "administrator" logon into the chillispot web logon page: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=223 User-Name = "administrator" CHAP-Challenge = 0xa784482e8ac92fd573e87bbbad9ca58f CHAP-Password = 0x00f54cc04e288eec67feff0b13e9448bd2 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.5 Calling-Station-Id = "00-16-6F-79-91-F4" Called-Station-Id = "00-05-5D-9E-0F-94" NAS-Identifier = "nas01" Acct-Session-Id = "45aec9a900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x97668bae73249b0dd4755ab03d364f34 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 153 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "administrator" with CHAP password rlm_chap: Could not find clear text password for user administrator modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=223 Sending Access-Reject of id 0 to 127.0.0.1:32772 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 45aecedc Nothing to do. Sleeping until we see a request. Many thanks in advance. John Wan > -----Original Message----- > From: > freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org > [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradiu > s.org] On Behalf Of gkalinec > Sent: Friday, 26 January 2007 2:06 AM > To: freeradius-users(a)lists.freeradius.org > Subject: RE: a freeradious/wireless solution for a school > > > The database is not a problem, since we have a huge one in > place, one stored in Active Directory (for which I can use > the freeradius LDAP module) or MySQL one. The database is > really our main strength, since we have tons of information > about every student, staff and parent in (its what my main > job responsibility entails). A quick question, however, > would this be just as eay to set up on a Macintosh? (since > many of my supplicants will be macs..) > > German Kalinec > > > King, Michael wrote: > > > > Without being too subtle, You've mis-understood much of the > research > > you've read. Don't worry about it, there is quite a bit of > > contradictory information out there. > > > > There's quite a bit of background information, so it'll be a little > > bit before I mention FreeRADIUS. > > > > First. It's WPA, not WAP. (Different fields of technology) > > > > Forget much of what you've read. > > > > First, This is what you have been doing. > > > > Its called MAC filtering. The AP will only talk to MAC's > that it has > > in it's table. > > In short, this is useless, since if I wanted to get on, I'd > just fire > > up a packet sniffer. > > (They're free and easy to get. http://www.wireshark.org/ > for example) > > Copy some poor souls MAC address, and I'm on. It's an > administrative > > nightmare. > > > > You should not do this. A second form of this, is to load > all the MAC > > addresses into a radius server, then the AP will > interrogate Radius to > > find out if it's on it's allow list. This is as useless as the way > > your doing it now, because I can still easily copy your MAC > address. > > You should not do this either. > > > > Second: > > You mention 802.1x with WEP. You do not enter WEP keys at all, the > > RADIUS server takes care of it. This is a standard way of doing > > wireless. However I'd highly recommend you DO NOT pursue this, as > > it's very insecure, and has been replaced by WPA. All the > benefits of > > doing this apply to WPA. But you can do this if you want, but I'd > > suggest not to. > > > > Third > > Now we're on to WPA. This is what you should implement. > > > > WPA comes in two forms. WPA and WPA2 > > > > The primary difference is the WPA was designed as a interim > protocol, > > with backward compatibility in mind. > > WPA2 was designed to be run on new hardware, and uses AES > encryption. > > If you are setting a new network up, just use WPA2. > > > > Both WPA and WPA2 come in two forms. PSK and Enterprise > > > > PSK (or Pre-Shared Key) is what you mentioned. You load a > secret key > > onto all your AP's, and then put the same key on all your users > > machines. It's designed for HOME Use. You do NOT want to > use this form. > > > > Enterprise is what you WANT to use. You have all your > usernames and > > passwords stored in a database. (Be it SQL, ActiveDirctory, LDAP, > > etc) This is where FreeRADIUS comes in. You configure all > your AP's > > to use RADIUS, and give it the radius IP. > > > > You configure RADIUS to perform either TTLS and/or PEAP. (This is > > site specific, you need to decide your backend database to > determine > > which one you can use) > > > > You configure your client to use TTLS or PEAP, and upon > connecting to > > the network, they will be prompted to enter username and > password. If > > they don't have one, they don't get on. If they do have > one, they get > > on. > > > > > > Now we're at RADIUS. What type of user database do you have? > > Activedirectory? Novell? No having one is an acceptable answer as > > well. > > > > Post back, it's a lot of info, but we're here to help. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > View this message in context: > http://www.nabble.com/a-freeradious-wireless-solution-for-a-sc > hool-tf3036221.html#a8626010 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

Why Freeradius and Mysql dont work?
by yao guoxian 01 Feb '07

01 Feb '07

Platform and Environment: Freeradius:1.0.5 on Redhat 9 MySQL:MySQL-standard-5.0.20-linux-i686 Step: 1. create database radius; 2.mysql -uroot -prootpass radius < db_mysql.sql ; 3.Edit radiusd.conf and sql.conf; Debug Result: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 202.117.7.223:1490, id=6, length=47 User-Name = "barney" CHAP-Password = 0xad35a90d409c25b78b6d148a531358d9ac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "barney", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 radius_xlat: 'barney' rlm_sql (sql): sql_set_user escaped user --> 'barney' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'barney' ORDER BY id' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 2 modcall: group authorize returns fail for request 2 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 202.117.7.223:1490, id=6, length=47 Discarding duplicate request from client liv1:1490 - ID: 6 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 6 with timestamp 45bca7cb Nothing to do. Sleeping until we see a request. From the above results, I guess mysql doesnt work. But I can access databases from the command line .The Freeradius Server worked well when I use the "user", not using MySQL. Any suggestion?

8 19

return-codes on reject
by Guido 01 Feb '07

01 Feb '07

Hello list, Im using freeradius-1.1.2 whit ms-sql. I'm having serius problems with return-codes on reject messages. All was working fine with previus version of freeradius. I was reading something about that is not allowed return-codes on reject, but I think it is wrong because most of return-codes goes on reject messages. Only return-code = 0 (authorization succeeded) goes on access=accept. The rest, for example 2 (invalid pin), 9 destination number blocked, 12 insufficient balance, etc etc, are return-codes that go on reject. Please, I need solve this ASAP, Regards, Guido

2 1

FR not honoring AutzType
by Sam Schultz 01 Feb '07

01 Feb '07

I've been trying to set up FR in a realm-based configuration using only LOCAL realms that are passed to different MySQL tables via different instances. This setup, like several previous questions posted to this list for similar setups, requires conditional branching. The solution as suggested in those posts was to use an Autz-Type block within the authorize block, and an Auth-Type block within the authenticate block to use appropriate module instances for the given realm. The problem I am having is that no matter what I set Autz-Type to, or where I set it, FR doesn't seem to honor it. I've tried putting it in hints entries, user entries, and realm entries; all suggestions that had been posted in response to similar issues. Another problem that compounds this one is that different posters refer to Autz-Type differently: autztype, AutzType, & Autz-Type. Is the difference significant, or is this one of those cases where they ALL are valid, but do exactly the same thing? I would have thought there would be some way to use the Realm variable that the rlm_realm strips from the User-Name attribute directly within the Authorize & Authenticate blocks, but it appears the most straight-forward way of using a block like 'realm bogus {}' causes FR to confuse the block for another module instance definition. Any insights anyone may have on this would be appreciated. Following are the relevant configuration & output segments: radiusd.conf, authorize block: Autz-Type SQL-BOGUS { sql-bogus } radiusd.conf, authenticate block: Auth-Type SQL-BOGUS { sql-bogus } hints: DEFAULT Prefix == "BOGUS\", Strip-User-Name = Yes Hint = "MIE Login", Service-Type = Framed-User, Autz-Type := SQL-BOGUS, Auth-Type := SQL-BOGUS users: DEFAULT Realm == "bogus", Autz-Type := SQL-BOGUS mysql bogus realms' radcheck table: +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 6 | user | User-Password | == | password | | 7 | user | Auth-Type | := | Local | +----+----------+---------------+----+----------+ radiusd -X -A (snippet 1, module instantiation): rlm_sql (sql-bogus): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-bogus): Attempting to connect to root@localhost:/radius rlm_sql (sql-bogus): starting 0 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #0 rlm_sql (sql-bogus): Connected new DB handle, #0 rlm_sql (sql-bogus): starting 1 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #1 rlm_sql (sql-bogus): Connected new DB handle, #1 rlm_sql (sql-bogus): starting 2 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #2 rlm_sql (sql-bogus): Connected new DB handle, #2 rlm_sql (sql-bogus): starting 3 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #3 rlm_sql (sql-bogus): Connected new DB handle, #3 rlm_sql (sql-bogus): starting 4 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #4 rlm_sql (sql-bogus): Connected new DB handle, #4 Module: Instantiated sql (sql-bogus) radiusd -X -A (snippet 2, module *NOT* getting used): modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "bogus" for User-Name = "bogus\user" rlm_realm: Found realm "bogus" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Proxying request from user user to realm bogus rlm_realm: Adding Realm = "bogus" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 NOTE: My module order, and the fact that radius found the "bogus" realm means that there should be SQL auth lines appearing immediately after the "mschap returns noop" line. They don't show up, which means FR either wasn't seeing Autz-Type at that point, or some other module changed it. Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485

2 1