June 2007 - Freeradius-Users - lists.freeradius.org

rad_authlog , radlog
by Mahalakshmi Vijayakumar 22 Jun '07

22 Jun '07

hi, can anyone explain the purpose of functions rad_authlog, radlog and vradlog? thank you.....

1 0

proxy fallback?
by Christopher Fournier 21 Jun '07

21 Jun '07

Using freeradius 1.1.6: I'm trying to establish a sequential auth order, but it seems I'm missing the boat on something. The goal is the following auth order, in iteration: 1) Check for local users in MySQL table 2) Proxy the request to another server 3) Use the local 'users' file (that is to permit all users, by default) In the 'authorize' clause, I have tried several configurations, but none seem to work as expected. In its most basic form, it was: authorize { preprocess sql suffix files } I have also tried modifying the clause using the 'redundant' and 'group' token: authorize { preprocess redundant { sql { notfound = 4 fail = 4 } suffix { notfound = 1 reject = 2 updated = 3 fail = 4 } } files } And lots of variations thereof. What seems to happen consistently, is that the 'suffix' clause supersedes the 'files' module, that is configured to permit all by default. Below is the debug: rad_recv: Access-Request packet from host 127.0.0.1:44323, id=85, length=59 User-Name = "xyzuser" User-Password = "foo" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering group redundant for request 0 radius_xlat: 'xyzuser' rlm_sql (sql): sql_set_user escaped user --> 'xyzuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'xyzuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User xyzuser not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'xyzuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'xyzuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User xyzuser not found in radgroupcheck rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 rlm_realm: No '@' in User-Name = "xyzuser", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "xyzuser" rlm_realm: Proxying request from user xyzuser to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall: leaving group redundant (returns notfound) for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 Sending Access-Request of id 0 to [DELETED] port 1645 User-Name = "xyzuser" User-Password = "foo" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Proxy-State = 0x3835 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Reject packet from host [DELETED]:1645, id=0, length=73 Nortel-Attr-1 = 0x00000000 Nortel-Attr-2 = 0x756e6b6e6f776e5f7573657220 Nortel-Attr-4 = 0x4e6f20737563682075736572 Login incorrect (Home Server says so): [xyzuser/foo] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request If I move the 'files' module before the 'suffix' module in the 'authorize' clause, it works fine. Again, it seems that the proxy over-rides any further processing, despite changing the priorities. Could anyone provide some idea as to what I'm missing, or how to make this work? Thank you in advance for any help! - Chris

2 1

Compiling freradius 1.1.6 on Intel Xeon Mac os X server 10.4.9
by sandramr 21 Jun '07

21 Jun '07

We try to install freeradius 1.1.6 on Xserve 2 x 2.66 Ghz Dual-core Intel xeon with Mac OsX server 10.4.9 We have done these steps 1) ./configure --enable-developer --disable-shared 2) Edit file Make.inc and delete the rlm_perl in the MODULES section 3) make we have this error : ..................................... lssl -lcrypto i686-apple-darwin8-gcc-4.0.1: unrecognized option '-pie' /usr/bin/ld: warning fat file: ../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a does not contain an architecture that matches the specified -arch flag: i386 (file ignored) /usr/bin/ld: Undefined symbols: _rlm_sql_mysql collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 We tried the same things on 2 GHz Intel Core Duo with Mac OsX 10.4.9 and all worked. Have you any suggestion ??? Thanks Sandra e Francesco -- View this message in context: http://www.nabble.com/Compiling-freradius-1.1.6-on-Intel-Xeon-Mac-os-X-serv… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

1.1.6 initial testing
by Andrew Long 21 Jun '07

21 Jun '07

1st run, using MYSQL. Testing on localhost, I find I cannot authenticate using an entry in user or one in the sql... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sqlcounter.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radiusd" sql: password = "********" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiusd@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded SQL Counter sqlcounter: counter-name = "Max-All-Session-Time" sqlcounter: check-name = "Max-All-Session" sqlcounter: reply-name = "(null)" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" sqlcounter: reset = "never" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 1830 rlm_sqlcounter: Check attribute Max-All-Session is number 1831 rlm_sqlcounter: Current Time: 1182427829 [2007-06-21 08:10:29], Next reset 0 [2007-06-21 08:00:00] rlm_sqlcounter: Current Time: 1182427829 [2007-06-21 08:10:29], Prev reset 0 [2007-06-21 08:00:00] Module: Instantiated sqlcounter (noresetcounter) sqlcounter: counter-name = "Daily-Session-Time" sqlcounter: check-name = "Max-Daily-Session" sqlcounter: reply-name = "(null)" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "daily" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1832 rlm_sqlcounter: Check attribute Max-Daily-Session is number 1833 rlm_sqlcounter: Current Time: 1182427829 [2007-06-21 08:10:29], Next reset 1182484800 [2007-06-22 00:00:00] rlm_sqlcounter: Current Time: 1182427829 [2007-06-21 08:10:29], Prev reset 1182398400 [2007-06-21 00:00:00] Module: Instantiated sqlcounter (dailycounter) sqlcounter: counter-name = "Monthly-Session-Time" sqlcounter: check-name = "Max-Monthly-Session" sqlcounter: reply-name = "(null)" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sqlcca3" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "monthly" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Monthly-Session-Time is number 1834 rlm_sqlcounter: Check attribute Max-Monthly-Session is number 1835 rlm_sqlcounter: Current Time: 1182427829 [2007-06-21 08:10:29], Next reset 1183262400 [2007-07-01 00:00:00] rlm_sqlcounter: Current Time: 1182427829 [2007-06-21 08:10:29], Prev reset 1180670400 [2007-06-01 00:00:00] Module: Instantiated sqlcounter (monthlycounter) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ============================================================================ rad_recv: Access-Request packet from host 127.0.0.1:40620, id=221, length=57 User-Name = "along" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "along", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry along at line 218 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [along]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 ============================================================================ >From "users" file: # Test Entries along Cleartext-Password := "testing" ============================================================================ Thanks for any help... - Andrew Long

5 5

Re : Off-topic: DHCP server with radius support
by Eshun Benjamin 21 Jun '07

21 Jun '07

Slightly off-topic. Is anyone aware of a DHCP server with radius support. Or even just with exec support? I 'd like to setup a DHPC that will ask a radius server for IP instead of assigning it itself A radius server assigning IPs .......that is not radius (!) . May be you mean the radius server authenticating (MACs and/or IPs) before the dhcp assigns it; this you have to configure and write your own scripts on the dhcp server to authenticate against the radius. Radius is for AAA ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Kostas Kalevras <kkalev(a)noc.ntua.gr> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 20 Juin 2007, 14h18mn 09s Objet : Off-topic: DHCP server with radius support Slightly off-topic. Is anyone aware of a DHCP server with radius support. Or even just with exec support? I 'd like to setup a DHPC that will ask a radius server for IP instead of assigning it itself -- Kostas Kalevras - Network Operations Center National Technical University of Athens http://kkalev.wordpress.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

6 7

Nokia IP 260 and User-Password
by david.suarezdelis＠telefonica.es 21 Jun '07

21 Jun '07

Greetings, We are receiving the attached information from a Nokia IP 260 Firewall and VPN appliance, The Access-Request is processed by a Perl program (through rlm_perl), and AR::RADIUSRequest is the class of objects that represent a generic RADIUS packet (don't mind the empty attributes). The password sent is 'AAAAAAAA' but we just get gibberish on our end (and the tethereal capture also looks weird). The VPN is using PAP, as we are. Any hints on what can be wrong? (shared key is okay on both sides, and no other NAS is doing this weird thing). I'm thinking in some configuration options that may be hurting with this NAS, but, frankly... Server is 1.1.3 on a Debian 3.1 intel box. Thanks for any help david PS- tethereal capture: Frame 4 (101 bytes on wire, 101 bytes captured) Arrival Time: Jun 21, 2007 10:32:18.545587000 Time delta from previous packet: 5.050255000 seconds Time since reference or first frame: 10.108408000 seconds Frame Number: 4 Packet Length: 101 bytes Capture Length: 101 bytes Protocols in frame: eth:ip:udp:radius Ethernet II, Src: 00:17:cb:5a:81:7e, Dst: 00:11:0a:2f:61:3b Destination: 00:11:0a:2f:61:3b (HewlettP_2f:61:3b) Source: 00:17:cb:5a:81:7e (00:17:cb:5a:81:7e) Type: IP (0x0800) Internet Protocol, Src Addr: 10.235.236.14 (10.235.236.14), Dst Addr: 10.235.244.133 (10.235.244.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 87 Identification: 0x79dc (31196) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 55 Protocol: UDP (0x11) Header checksum: 0x1350 (correct) Source: 10.235.236.14 (10.235.236.14) Destination: 10.235.244.133 (10.235.244.133) User Datagram Protocol, Src Port: 2305 (2305), Dst Port: radius (1812) Source port: 2305 (2305) Destination port: radius (1812) Length: 67 Checksum: 0xa4c4 (correct) Radius Protocol Code: Access Request (1) Packet identifier: 0x41 (65) Length: 59 Authenticator: 0x9FE8712917FDD893EF8E416B424D0E89 Attribute value pairs t:User Name(1) l:9, Value:"user1" User-Name: un41814 t:User Password(2) l:18, Value:A0EB498C3FAD6541B06C0785F76F04C2 t:Service Type(6) l:6, Value:Login(1) Service-Type: Login (1) t:NAS IP Address(4) l:6, Value: xxx.xxx.xxx.xxx Nas IP Address: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx) PPS- Perl Data::Dumper dump: User-Password = 'AAAAAAAA' 'REQUEST' => bless( { 'MODIFICATION_TIME' => '1182414728.493002', 'ATTR' => { 'Acct-Input-Octets' => '', 'NAS-Port-Type' => '', 'Acct-Session-Id' => '', 'Service-Type' => 'Login-User', 'Called-Station-Id' => '', 'Client-IP-Address' => '10.235.236.14', 'Tunnel-Client-Endpoint' => '', 'Acct-Authentic' => '', 'Acct-Status-Type' => '', 'Acct-Output-Packets' => '', 'NAS-IP-Address' => 'xxx.xxx.xxx.xxx', 'Acct-Output-Octets' => '', 'Acct-Tunnel-Client-Endpoint:0' => '', 'Acct-Terminate-Cause' => '', 'Acct-Session-Time' => '', 'Calling-Station-Id' => '', 'Framed-Protocol' => '', 'User-Name' => 'user1', 'User-Password' => 'x\\264\\343\\023y\\232\\004\\211\\357\\333\\010\\214\\2163U\\217', 'Tunnel-Client-Endpoint:0' => '', 'Acct-Input-Packets' => '', 'Framed-IP-Address' => '', 'Class' => '', 'NAS-Port' => '', 'Acct-Delay-Time' => '' }, 'CREATION_TIME' => '1182414728.493002' }, 'AR::RADIUSRequest' ),

2 1

Need help with 802.1X authentication to Active Directory
by Bryant Marsh 21 Jun '07

21 Jun '07

I have FreeRadius setup as outlined by the Howto at this link. http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO I am using CENTOS 5 as the host system actiing as the SAMBA/RADIUS server. All the *.conf files are configured as directed. I have joined the radius server to the Active Directory domain and configured the radius server with custom SSL certificates. The Radius server starts correctly but I cannot get my supplicant to authenticate. Any Ideas? Here is the output of RADIUSD -X [root@cl-radius ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. http://www.nabble.com/file/p11131716/radius-auth.doc radius-auth.doc -- View this message in context: http://www.nabble.com/Need-help-with-802.1X-authentication-to-Active-Direct… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 20

rlm-digest - devel question
by UriCALL Support 21 Jun '07

21 Jun '07

Hi All, I have noticed that in latest versions of rlm_digest the part with converting of the attributes to something useful (DEBUG(" rlm_digest: Converting Digest-Attributes to something sane...")) was moved from authorize section to authenticate section. There was even a discussion a while back on the mailing list that this could be moved again to authorize part (so it can be used by other modules as well), but still nothing has happened. I am building a module which will make use of the conversion of those attributes and using right now the old version of rlm_digest.c file. Is there any reason for which the conversion of the attributes is not moved back to authorize section in standard distribution? I am asking this because I must instruct my users to patch freeradius every time they use my module. Thxs in advance for any answer I would get. Cheers, DanB

2 1

Re : 2.0.0-pre : Failed to open socket.
by Eshun Benjamin 21 Jun '07

21 Jun '07

ERROR: Failed to open socket: check the port 1812 if it is being used. Or you can also run radius on the old school port 1645 for testing. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Debashis Prusty <dprusty(a)systemsfusion.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 20 Juin 2007, 18h02mn 39s Objet : 2.0.0-pre : Failed to open socket. I am trying to rum Freeradius on Solaris with MySQL. Logs are pasted below. Its working fine for earlier versions of Freeradius. Do any one have the solution? Thanks in advance, Debashis ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ freeradius/sbin # ./radiusd -X Config: including file: /opt/sf/freeradius/etc/raddb/radiusd.conf Config: including file: /opt/sf/freeradius/etc/raddb/proxy.conf Config: including file: /opt/sf/freeradius/etc/raddb/clients.conf Config: including file: /opt/sf/freeradius/etc/raddb/snmp.conf Config: including file: /opt/sf/freeradius/etc/raddb/eap.conf Config: including file: /opt/sf/freeradius/etc/raddb/sql.conf Config: including file: /opt/sf/freeradius/etc/raddb/sql/mysql-dialup.conf FreeRADIUS Version 2.0.0-pre1, for host i386-pc-solaris2.10, built on Jun 19 2007 at 10:29:22 Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/opt/sf/freeradius" localstatedir = "/opt/sf/freeradius/var" logdir = "/opt/sf/freeradius/var/log/radius" libdir = "/opt/sf/freeradius/lib" radacctdir = "/opt/sf/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no log_stripped_names = no log_file = "/opt/sf/freeradius/var/log/radius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/opt/sf/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/opt/sf/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" } proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } home_server localhost { ipaddr = 127.0.0.1 IP address [127.0.0.1] port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } server_pool my_auth_failover { type = my_auth_failover home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { ldflag = fail_over } port = 1812 listen { type = "auth" ipaddr = * port = 0 ERROR: Failed to open socket: /opt/sf/freeradius/etc/raddb/radiusd.conf[195]: Error binding to port for 0.0.0.0 port 1812 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

6 6

RE: Freeradius-Users Digest, Vol 26, Issue 79
by Hugh Messenger 20 Jun '07

20 Jun '07

Alan DeKok wrote: > Hugh Messenger wrote: > > So far the only errors I'm seeing are these: > > > > ==29820== Thread 2: > > ==29820== Invalid write of size 1 > > ==29820== at 0x4819294: strNcpy (misc.c:187) > > ==29820== by 0x4CC43F3: sqlippool_postauth (rlm_sqlippool.c:527) > > That's... fairly broken. Oh dear. I think you just made that wind sucking tsk-tsk sound favored by auto mechanics. FYI, these errors only seem to happen on the first handful of logins. Then it seems to run error free. Not much help, but an observation none the less. > Barring severe code changes to rlm_sqlippool, I would suggest not > using it in 1.1.6. Sorry. No apologies necessary. Hey, I get what I pay for. :) > > Try 2.0.0-pre, at least the rlm_sqlippool module is fixed there. Okie Dokie. Is 2.0.0 ready for prime time, assuming the bits I need work? Given that my choice is to keep running 1.1.6 in debug mode from a terminal session, I'd take a slightly fragile v2. Load would be very light for a few months while we migrate to PPPOE. > Alan DeKok. -- hugh

1 0