June 2007 - Freeradius-Users - lists.freeradius.org

rlm_sql_mysql Problem with Freeradius on Centos 5
by Andy Hughes 07 Jun '07

07 Jun '07

Hi Freeradius Users, I am having an issue with the rlm_sql_mysql driver on Centos 5. When I run radius from the init.d/radiusd the server presents the following error in the radius logs. --snip-- Fri Jun 8 02:58:42 2007 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Jun 8 02:58:42 2007 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius Fri Jun 8 02:58:42 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Jun 8 02:58:42 2007 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius Fri Jun 8 02:58:42 2007 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)' Fri Jun 8 02:58:42 2007 : Error: rlm_sql (sql): Failed to connect DB handle #0 -- snip -- -- snip -- netstat -a unix 3 [ ] STREAM CONNECTED 120857 /var/lib/mysql/mysql.sock tcp 0 0 *:mysql *:* LISTEN -- snip -- I have tried running the server as root and I still receive the same error. However, When I run the server in extended debug mode (as root) the server starts fine and will serve authentication from the MySQL database quite happily. --snip-- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) --snip-- I have also tried various variations of commands in sql.conf to configure the sql port. Can anyone tell me what the appropriate configuration command is? Can anyone shine any light on what might be the problem here? Regards, Andy Hughes

3 2

How to connect to backend DB
by Nitin Naveen 07 Jun '07

07 Jun '07

Hi, I am writing a new RLM called rlm_prop_protocol. It basically adds some attributes. The value for these attributes are pulled from a backend database (MYSQL). I wanted to know whether there is a provision in freeradius or some standard method that may be used to connect and fetch data from the MYSQL database. As of now I have added MYSQL specific code in my module. Regards Nitin *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

2 1

Re: EAP-TLS problem
by shantanu choudhary 06 Jun '07

06 Jun '07

hi all thanks for support, i have created certificates using openssl and scripts provided on link http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html i have created root.der(this is self signed certificate) file and clt.pem and using them with wpa_supplicant. even when my server starts it shows default eap type = md5 while i have given it to be TLS in my eap.conf file...... apart from it problem is when i start my server and client server is showing output :- rad_recv: Access-Request packet from host 192.168.2.183:1026, id=2, length=177 Ignoring request from unknown client 192.168.2.183:1026 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.2.183:1026, id=3, length=177 Ignoring request from unknown client 192.168.2.183:1026 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.2.183:1026, id=3, length=177 Ignoring request from unknown client 192.168.2.183:1026 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.2.183:1027, id=0, length=177 Ignoring request from unknown client 192.168.2.183:1027 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.2.183:1027, id=0, length=177 Ignoring request from unknown client 192.168.2.183:1027 --- Walking the entire request list --- Looking for people who are YOUR TYPE? Find them at in.groups.yahoo.com

3 2

Error with EAP-PEAP
by Vincenzo Agosti 06 Jun '07

06 Jun '07

Hi, i would to configure my server radius for 802.1x authentication. But when i modify my eap.conf file and then start radius i have this error message: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory What's happen? How can i remove these error? This is my eap.conf file... eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem #certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } #ttls { # default_eap_type = md5 # copy_request_to_tunnel = no # use_tunneled_reply = no #} peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } mschapv2 { } } Thanks -- Vincenzo Agosti Universita' degli Studi di Salerno Ufficio Sistemi Tecnologici Coordinamento Servizi Informatici via Ponte don Melillo 84084 Fisciano (SA) - Italia Tel. +39 089 96 6101 - 9776 Fax +39 089 96 6368 - 9806 Cell. +39 335 427674 ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 3

still can't find db_mysql.sql
by Carl aniams 06 Jun '07

06 Jun '07

hi, Am using freeradius 1.1.6 on a fedora core 4 with mysql server installed and up i've created radius database but can't create tables because i can't find the db_mysql.sql file neither in /doc/examples/ nor in *src/modules/rlm_sql/drivers/rlm_sql_mysql/ * i went through archives yet nothing please help -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

3 2

catch-all line at the end of users file?
by Brian Johnson 06 Jun '07

06 Jun '07

Hello again all, Thanks to the folks who responded to my earlier plea with regards to authenticating many Cisco devices using radius. I'm trying to weigh my options and see which direction I want to go. One Idea I had after sending mail to the list was, have a sort of "catch-all" line at the end of the users file, so that if the radius server hears a request from a device where the client-ip-address isn't specified already in the file, it would look in our custom group file for authorized users and allow them entry. Here's an idea of what I'm thinking: DEFAULT Auth-Type = Kerberos Fall-Through = 1 DEFAULT Client-IP-Address == 10.0.0.60, Huntgroup-Name == group1 DEFAULT Client-IP-Address == 10.0.0.226, Huntgroup-Name == group2 DEFAULT Called-Station-Id == 5551234, Custom-Group == "dept800" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Session-Timeout = 28800, Idle-Timeout = 28800, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Called-Station-Id == 5551234, Auth-Type := Reject ... and at the end: DEFAULT Custom-Group == "routerfolk" DEFAULT Auth-Type := Reject My thinking is, if the request comes from a device where the client-ip-address is specified, then it will let it through. If it comes from a device where the client-ip-address is not specified, then it will hit the next to the last line of the file, check the custom-group file and see if the user exists in it. If they do, they're authenticated on the device. If they don't exist in the file, then they'll hit the last line and be rejected. However, what I've found in practice is, even if a request is heard from a device where the client-ip-address is specified above, they're still being rejected by the last line. Is there any way that I can tell the last line to reject *only* if there isn't a match previous to it? Thanks again for any help! Brian -- Brian Johnson "And I will be even more undignified than this, and will be humble in my own sight." (2 Samuel 6:22)

2 1

multiple server certificates in EAP-TLS
by Aller Ventosa, Manuel 06 Jun '07

06 Jun '07

Hi Has got Anybody a freeradius server working with multiple server certificates? I've tried the configuration explained below but freeradius returns error messages. Module: Instantiated eap (eap1) eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/home/certificados/store/CAX-CA2" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "test" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap2: Module instantiation failed. radiusd.conf[1597] Unknown module "eap2". radiusd.conf[1597] Failed to parse "eap2" entry. Any help is good Thanks Manel ------------------------------------------- 2. Re : Multiple server certificates in EAP-TLS or EAP-TTLS (Eshun Benjamin) Message: 2 Date: Wed, 30 May 2007 05:22:30 +0000 (GMT) From: Eshun Benjamin <bkeshun(a)yahoo.fr> Subject: Re : Multiple server certificates in EAP-TLS or EAP-TTLS To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <796452.32991.qm(a)web26001.mail.ukl.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" There was a post on this by Mike; You'll have to set up two instances of the EAP module. The first instance will have the TLS submodule set up with the information for Cert1.pem (and the appropriate key and CA cert). The second instance will have its TLS submodule set with the info for Cert2.pem. It will look something like this: modules { ... eap eap1 { ... tls { certificate = Cert1.pem ... } } eap eap2 { ... tls { certificate = Cert2.pem ... } } } authorize { ... eap1 } authenticate { ... eap1 eap2 } Then, this is one of the few instances where you'll need to manually specify the Auth-Type in the users file, like this: DEFAULT Called-Station-ID = "00112233445566:SSID1", Auth-Type := eap1 DEFAULT Called-Station-ID = "00112233445566:SSID2", Auth-Type := eap2 Or, better yet, use regexes (this should work): DEFAULT Called-Station-ID =~ ":SSID1$", Auth-Type := eap1 ================================================== Benjamin K. Eshun DISCLAIMER: Este mensaje contiene información propietaria de la cual parte o toda puede contener información confidencial o protegida legalmente. Esta exclusivamente destinado al usuario de destino. Si, por un error de envio o transmisión, ha recibido este mensaje y usted no es el destinatario del mismo, por favor, notifique de este hecho al remitente. Si no es el destinatario final de este mensaje no debe usar, informar, distribuir, imprimir, copiar o difundir este mensaje bajo ningún medio. --------- DISCLAIMER: This e-mail contains propietary information some or all of which may be legally protected. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail. If you are not the intended recipient you must not use, disclose, distribute, copy, print or relay this e-mail. ***************************************************************************

1 0

Proxy based on username
by Loffredo Tullio 06 Jun '07

06 Jun '07

Hello, I need to proxy AA request from some users. Therfore, the proxy is based on the string "username@realm", and non only on the realm... Do you have any suggestion in order to configure such feature? Thank you and regards Tullio Loffredo -------------------------------------------------------------------- CONFIDENTIALITY NOTICE This message and its attachments are addressed solely to the persons above and may contain confidential information. If you have received the message in error, be informed that any use of the content hereof is prohibited. Please return it immediately to the sender and delete the message. Should you have any questions, please contact us by replying to webmaster(a)telecomitalia.it. Thank you www.telecomitalia.it --------------------------------------------------------------------

3 2

Re: sql groups authorization
by Happyfrog 06 Jun '07

06 Jun '07

Hello Ivan, Thanks for the reply. I've tried that configuration too, but there was some problem (don't remember exactly), and finally decided to keep all the information in the database. With best regards, Andrew. > Why not you use huntgroups: > > HGdial NAS-IP-Address == dial NAS IP > SQL-Group = dialup, > ... other dial groups > > HGWiFi NAS-IP-Address == WiFi NAS IP > SQL-Group = wifi, > ... other wifi groups > > etc. > > Ivan Kalik > Kalik Informatika ISP

1 0

sql groups authorization
by Happyfrog 06 Jun '07

06 Jun '07

Hello Gurus, I need to set up FR with SQL (Postgres) backend storing all users/groups information except clients.conf. Groups are mission-critical, because the same user can come from different NASes (WiFi, Dial-Up, VPDN) and should get different settings (IP addresses etc). Access to different services is granting through radusergroup table, where user belong or not belong to corresponding group. If user doesn't belong do group 'dialup' but come from Dial-Up NAS, it should be rejected even with correct password. That access idea seems to me very simple, but I've spend many days getting it to work state. First of all, i realized that documented rlm_sql `read_groups' directive don't affect on sql_config structure read_groups member. This patch fixes that issue: diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c 104a105,106 > {"read_groups", PW_TYPE_BOOLEAN, > offsetof(SQL_CONFIG,read_groups), NULL, "yes"}, Well, that didn't fix the problem. Now rlm_sql successfully find the user in radcheck table, setting found=1, and then check groups. The problem is that found remains =1 in case of group check failure (rlm_sql_process_groups returns 0). diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c This patch fixes that issue (line numbers are correct for original file without first patch): 988a989,991 > } else { > /* no matched group found => decline the user */ > found = 0; Well, that also didn't fix the problem. Now rlm_sql returns RLM_MODULE_NOTFOUND, but for FR it doesn'd mean 'reject the user immediately', and after processing of next modules, the user is accepted without any groups. This patch fixes that issue: diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c 1044c1044 < return RLM_MODULE_NOTFOUND; --- > return RLM_MODULE_REJECT; After that patch the FR (CVS 20070605) is working as expected. here is some database data: radchek table contains only user passwords: # select * from radcheck; id | username | attribute | op | value ----+-------------+----------------+----+------------------------------------ 1 | guest | Crypt-Password | == | $....... ... radreply table is empty radusergroup table contains user to groups mappings: # select * from radusergroup; username | groupname | priority -------------+---------------+---------- guest | dialup_guests | 3 ... radgroupcheck table contains attributes to distinguish NASes, set Pool-Names and some other unimportant things: # select * from radgroupcheck; id | groupname | attribute | op | value ----+----------------+------------------+----+------------------ 3 | dialup_guests | NAS-IP-Address | == | 192.168.0.1 7 | dialup_guests | Pool-Name | := | dialup_pool ... radgroupreply table contains nothing special: # select * from radgroupreply; id | groupname | attribute | op | value ----+---------------+-----------------+----+------- 1 | dialup_guests | Session-Timeout | := | 900 ... I'm pretty sure that there is more straight way to do the same thing. If someone have another solution, please tell. I would be happy if this info will help somebody. Any comments are greatly appreciated. Best regards, Andrew.

2 1