May 2007 - Freeradius-Users - lists.freeradius.org

MySQL Authentication
by Joseph Sullivan 15 May '07

15 May '07

Hello Group, I am running OSX 10.4.9 Server, with Free Radius 1.1.6. I have FreeRadius setup to connect to my MySQL Server for authentication. That server is running MySQL 4.1 When I try loading radiusd -X I get a mysql link error. rlm_sql (sql): Could not link driver rlm_sql_mysql: dlopen(/usr/local/lib/rlm_sql_mysql-1.1.6.so, 9): no suitable image found. Did find: ?/usr/local/lib/rlm_sql_mysql-1.1.6.so: no matching architecture in universal wrapper ?/usr/local/lib/rlm_sql_mysql-1.1.6.so: no matching architecture in universal wrapper rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. >From what I read on the FAQ this is a library error on my system and has nothing to do with Freeradius. But my error differs slightly from what the FAQ says I could be seeing. I did run a ./configure | grep mysql_config and it came out saying MySQL = yes. Can someone help me resolve this? I greatly appreciate it. Joseph Sullivan

2 4

FreeRADIUS 2.0.0-pre1 has been released
by Alan T. DeKok 15 May '07

15 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The FreeRADIUS team is pleased to announce the release of FreeRADIUS 2.0.0-pre1. This is the first "pre" release in the process to release a full 2.0.0. It has been almost three years since 1.0.0 was released, and it's high time for the release of the next major version of the server. The notable changes between 1.x and 2.x are: * Debugging mode is much clearer and easier to read. * EAP-TLS and OpenSSL certificates "just work". See raddb/certs/README for details. * Proxying works much better than in 1.x. We mean *MUCH* better. See proxy.conf for details. * rlm_unix no longer has an "authenticate" section. See "man rlm_unix" for details. * The server has full support for IPv6. * The server has much more complete support for SNMP MIBs. * radiusd.conf has limited support for "if/then/else". See doc/configurable_failover for details. * "listen" sections can have per-socket clients. * Replaced "radrelay" and "radsqlrelay". See "man radrelay.conf" for details. * Post-Proxy-Type "Fail" section is executed when a home server fails to respond to a request. See "radiusd.conf" for details. * Configuration files CANNOT be copied directly from 1.x Some may work, most will require careful porting. There are a few known issues with 2.0.0-pre1 that will be fixed before the final 2.0.0 release. These issues are: * HUP handling still isn't correct. Almost anything may happen on HUP. * The "radrelay" integration into the server is not yet finalized Reading the detail files will work, mostly. We ask that everyone download and test 2.0.0-pre1, in order to validate it before the final release. Thanks to the people who spent time testing it over the last few months. They have contributed greatly to the stability of this release. As an additional note, this release is called "-pre1", because many sites had been using the CVS head for many years, which was called "-pre0". Giving this release a different name highlights the fact that this is an official release, rather than a snapshot from CVS. Alan DeKok. Chief Architect The FreeRADIUS Project -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGSbmaybq9jdZp9zURAmIqAJ9YOo7cNYiy+1xbTzsd9fG7Jv8URgCePTro 6gu5dyYohRgV8vWGcvIdAB4= =1kb2 -----END PGP SIGNATURE-----

1 0

SIP UAC authentication using Digest-HA1 and Ldap
by Stadler Karel 15 May '07

15 May '07

Hello We have a setup with Active Directory and there we used a field for the Digest-HA1 hash (testpurpose). This field contains a md5-hashed value of "username:realm:password". FreeRadius is configured to do a Ldap query to the AD and pullout this value, which works very well. I've configured the ldap.attrmap for "checkItem Digest-HA1 ADFIELD" and commented out the "password_attribute=" in modules{} as described on a FreeRadius Wiki. Now the problem is that FreeRadius produces this error. "rlm_digest: Configuration item "User-Password" is required for authentication." How can this be solved and please don't say "tell the server what the password is". I need to know how it can be configured. We're using FreeRadius Version 1.0.1. best rgds -Karel Stadler ------------------------------------------------------------------------ --------------- rad_recv: Access-Request packet from host 127.0.0.1:33040, id=237, length=196 User-Name = "mueller(a)foo.net" Digest-Attributes = 0x0a09737461646c6572 Digest-Attributes = 0x01087073692e6368 Digest-Attributes = 0x022a343634343735353636376136383965393834373832373930303739653336346331 31396365346630 Digest-Attributes = 0x04147369703a3132392e3132392e3139322e3234 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "2f9bcef76be40b7a3a2c78367ae24e8b" Service-Type = IAPP-Register Sip-URI-User = "mueller" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 37 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "mueller" Digest-Realm = "foo.net" Digest-Nonce = "4644755667a689e984782790079e364c119ce4f0" Digest-URI = "sip:10.10.10.24" Digest-Method = "REGISTER" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 8 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for mueller radius_xlat: '(sAMAccountName=mueller)' radius_xlat: 'ou=users,ou=foo,dc=m,dc=foo,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 129.129.193.110:389, authentication 0 rlm_ldap: bind as cn=mueller,ou=users,ou=foo,dc=m,dc=foo,dc=net/PaSw0R$D to 10.10.10.110:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=foo,dc=m,dc=foo,dc=net, with filter (sAMAccountName=mueller) rlm_ldap: looking for check items in directory... rlm_ldap: Adding title as Digest-HA1, value 8e041f49c9e4a473d58c0f7700e7049d & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user mueller authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Configuration item "User-Password" is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... ----------------------------------- Karel Stadler Network Technician Paul Scherrer Institute CH-5332 Villigen Switzerland ----------------------------------- PGP KeyId:0x1B740D81

3 3

How can I get all values of Cisco AVpair from NAS if there are multiple values
by Александр Никулин 15 May '07

15 May '07

Hello How can I get all values of Cisco AVpair from NAS if there are multiple values, for example May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 54 "faxrelay-start-time=16:03:58.021 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 59 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 53 "faxrelay-stop-time=16:04:37.161 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 38 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 32 "faxrelay-max-jit-buf-depth=506" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 33 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 27 "faxrelay-jit-buf-ovflow=0" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 41 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 35 "faxrelay-init-hs-mod=V.27ter/4800" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 39 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 33 "faxrelay-mr-hs-mod=V.27ter/4800" and so on.

1 0

freeradius+mysql
by Hermidio A. Rodrguez Chavez 15 May '07

15 May '07

Hellow friends I'm new user in freeradius, and I've installed in my server freeradius with mysql support,but i like to add ras user or test the server with someone user inside the Mysql DB , because in the docs i not see any info about it. i add the mysql server conf to the sql.conf file, import all tables into a new bd and my version is 1.1.3-3 Thanks Hermidio

4 7

FR with MySQL - Stored Procedures
by Gunther 14 May '07

14 May '07

Despite that several people reported that their FreeRadius 1.x installation is working fine with MySQL Stored Procedures, I run into quite some problems. Here my environment: - CentOS 4.4 on Xen Server 3.1 - FreeRadius 1.1.6 - MySQL 5.0.37 Community Edition with INNODB Tables I used a very simple stored procedure to track down the problem: --------------- DELIMITER // DROP PROCEDURE IF EXISTS CheckIt // CREATE PROCEDURE CheckIt () BEGIN SELECT 12345; END// --------------- This routine will always return the value 12345. Anyhow, when I called this procedure from FreeRadius I always go an error: "PROCEDURE myDB.CheckIt can't return a result set in the given context" ----- Sun May 6 07:23:10 2007 : Debug: rlm_sql_mysql: query: CALL CheckIt() Sun May 6 07:23:10 2007 : Debug: rlm_sql_mysql: MYSQL check_error: 1312 received Sun May 6 07:23:10 2007 : Error: rlm_sql (sql): database query error, CALL CheckIt(): PROCEDURE myDB.CheckIt can't return a result set in the given context ----- I then tried to call the same function via a PHP script (w/o FreeRadius involved) and run into the same problem. Then I found the information that it is required for MySQL Stored Procedures to function the client_flag 'CLIENT_MULTI_STATEMENTS' (refer to mysql.h) has to be added to the mysql_real_connect call. After adding it to the call within PHP all worked fine. Then I added the flag to freeradius-1.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c : ----- if (!(mysql_sock->sock = mysql_real_connect(&(mysql_sock->conn), config->sql_server, config->sql_login, config->sql_password, config->sql_db, atoi(config->sql_port), NULL, CLIENT_FOUND_ROWS|CLIENT_MULTI_STATEMENTS))) { ----- ./configure; make; make install Note: CLIENT_MULTI_STATEMENTS automatically also sets CLIENT_MULTI_RESULTS within MySQL Started FreeRadius and procedure calls were accepted and results were correct. ----- Sun May 6 21:29:08 2007 : Debug: rlm_sql_mysql: query: CALL CheckIt() Sun May 6 21:29:08 2007 : Debug: rlm_sql (sql): - sql_xlat finished Sun May 6 21:29:08 2007 : Debug: rlm_sql (sql): Released sql socket id: 0 Sun May 6 21:29:08 2007 : Debug: radius_xlat: '12345' ----- A user can now login and things seem to work fine. But then consecutive MySQL queries started showing new error results: ----- Sun May 6 21:41:42 2007 : Debug: rlm_sql_mysql: MYSQL check_error: 2014 received Sun May 6 21:41:42 2007 : Error: rlm_sql (sql): database query error, <SELECT ... my sql query> : Commands out of sync; you can't run this command now ----- MySQL seems to track the state of each call and when the order of this state is incorrect, MySQL responds with 'CR_COMMANDS_OUT_OF_SYNC' = 'Commands out of sync; you can't run this command now'. >From what I found on the net ... "When the result of a statement isn't freed MySQL gives an error when trying to process a new query" Could it be that there is somewhere a 'mysql_free_result' missing? This is what the MySQL documentation is saying: -------------------- B.1.2.13. Commands out of sync If you get Commands out of sync; you can't run this command now in your client code, you are calling client functions in the wrong order. This can happen, for example, if you are using mysql_use_result() and try to execute a new query before you have called mysql_free_result(). It can also happen if you try to execute two queries that return data without calling mysql_use_result() or mysql_store_result() in between. -------------------- 2.4.16. Upgrading MySQL If, after an upgrade, you experience problems with recompiled client programs, such as Commands out of sync or unexpected core dumps, you probably have used old header or library files when compiling your programs. In this case, you should check the date for your mysql.h file and libmysqlclient.a library to verify that they are from the new MySQL distribution. If not, recompile your programs with the new headers and libraries. -------------------- ... Did that ... When I leave some time between a login/logout/login it works ... Looks like the MySQL status information times out after a short while. Any hints on getting this up and running without changing O/S ? Thanks!

6 27

FreeRADIUS authfile equivalent
by Steve Forman 14 May '07

14 May '07

Greetings, I'm attempting to migrate a RADIUS service from Interlink RADIUS to FreeRADIUS and am running into a bit of a problem I was hoping you could help out with. Basically, I have several different domains which would all be separated by an @ sign plus the name of the domain. What I'd like to do is use separate local "users" files for each of these domains. In Interlink RADIUS, I simply use the "authfile" as the "glue" to make this work. e.g. domain1.com FILE users.domain1.com domain2.com FILE users.domain2.com domain3.com FILE users.domain3.com Each "users.domain.com" file would then contain the username and password for every user in that domain such that if joesmith(a)domain1.com logs in, he will be authenticated with the "joesmith" password contained in "users.domain1.com". However, there is no authfile in FreeRADIUS so the question is: How do I accomplish this same task with FreeRADIUS? Any information would be greatly appreciated. Thanks in advance.

2 1

Freeside Modifications for FreeRADIUS
by Matthew Neumark 14 May '07

14 May '07

Hello, I was wondering if anyone has any modifications that they are willing to share that they have done for freeradius. Such as added attributes and such when provisioning radius accounts. A good example is like Filter-ID for freeradius. I would like to be able to assign users to a specific filter. Another good example would be assigning different dns servers to different clients. I already know how to add it to radreply to give the specific users the information I want I was just wondering if anyone else has anything like this already done. Matt

2 1

Inserting Authentication Packet Attribute at Post-Auth Packet
by Erico Augusto 14 May '07

14 May '07

Hi, is it possible to insert an authentication attribute(from auth packet) to post-auth packet? - I'd like to insert the Authentication Packet : Calling-Station-Id:<User-MAC> at post-auth packet ... Thanks, Erico. __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0

External script problem
by Sándor Szabó 14 May '07

14 May '07

Hi! I have the following problem. I use FreeRadius v1.1.6 on an Ubuntu Edgy Linux I'd like to use authentication and accounting with an external PHP script. I think the radius server is configured well. The radius server send the request to the script, I can read it through the $_ENV variable, but there is the problem. In the request I have more than one 'Digest-Attributes' fields and in the $_ENV variable I see only the last one, because in the array the 'DIGEST_ATTRIBUTES' key's values overwrite each other. How can solve this? Thanks. Regards, Sandor

2 1