June 2007 - Freeradius-Users - lists.freeradius.org

Re: Problems using freeradius+postgresql
by Daniel Bojczuk 30 Jun '07

30 Jun '07

Yes!!! You're right Freeradius doesn't have permission to select the tables. Now it's working fine. Thanks Daniel 2007/6/29, Pshem Kowalczyk <pshem.k(a)gmail.com>: Hi, You haven't pasted the whole log, but judging from the following lines: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN I suspect that freeradius can't talk to the database. Have a look at the beginning of the debug messages, you should be able to see the lines referring to the db connection. It's possible that even thought the connection is fine freeradius doesn't have rights to select from the tables. regards pshem - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: sqlippool reject authentication if no IP?
by Hugh Messenger 30 Jun '07

30 Jun '07

Peter Nixon <listuser(a)peternixon.net> said: > On Thu 28 Jun 2007, Hugh Messenger wrote: > > Peter Nixon <listuser(a)peternixon.net> said: > > > On Thu 28 Jun 2007, Alan DeKok wrote: > > > > Hugh Messenger wrote: > > > > > With my current configuration, if sqlippool cannot assign an IP, > the > > > > > authentication still succeeds. > > > > > > > > The module returns NOOP. It could arguable return "fail". > > > > Just a nitpick, but for pool depletion it returns 'notfound'. > > Can you suggest a better return code? Not at all. I was just responding to Alan's comment above that "the module returns NOOP". My bad, trying to respond to two people in one email. > I am assuming you have already read: > http://wiki.freeradius.org/Rlm_sqlippool > > If not please do so :-) I had read it (several times) but as is often the case I misunderstood some of it. I now realize the failover example does do what I'd expect (not failing over on a notfound). > > Speaking of which. What would be the simplest way of having an email > > alert if a 'notfound' happens? This is all for PPPOE wireless clients, > > which are carefully provisioned. So we should never end up running out > of > > dynamic pool space, and I need to know about it if we do. > > logwatch/swatch/splunk etc ;-) I'm a splunker, as it happens. Which was indeed what I figured I'd use if there was no built in mechanism. [inserted from your followup mail] > Of course you COULD write an external mail script and run it as a > radiusd "exec" module. (or something with rlm_perl/rlm_python) I've been looking for a simple test case to try out rlm_perl, I might give that a go. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc As usual, thanks for your help. -- hugh

4 8

compile problem
by ram 30 Jun '07

30 Jun '07

Hi iam compiling on FC5 radius 1.1.6 iam getting the following error any help s.lo proxy.lo radiusd.lo radius_snmp.lo request_list.lo session.lo smux.lo threads.lo util.lo valuepair.lo version.lo timestr.lo xlat.lo \ -dlpreopen ../modules/rlm_python/rlm_python.la -lnsl -lresolv -lpthread ../lib/libradius.la \ /usr/local/src/cdrtools/freeradius-1.1.6/libltdl/libltdl.la -lcrypto -lssl -lcrypto libtool: link: cannot find the library `../modules/rlm_python/rlm_python.la' or unhandled argument `../modules/rlm_python/rlm_python.la' gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6 /src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/cdrtools/freeradius-1.1.6'

1 1

How to convert a users file into a rlm_sql one?
by Pshem Kowalczyk 30 Jun '07

30 Jun '07

Hi I have a setup like this for most of the users in the users file: rokky Huntgroup-Name == "ADSL", Password == "xyx" Framed-Protocol = PPP, Framed-IP-Address = 203.173.162.107, IHUG-Speed-Down = 5000, Service-Type = Framed-User rokky Huntgroup-Name == "DIALUP", Password == "xyx" Framed-Protocol = PPP, Service-Type = Framed-User, Session-Timeout = 600 - so depending on the used method of connection they get different replies. Is it possible to store such a setup in the database? I know i can organise users into groups, but then the answer is group-specific, not group-and-user-specific. Or have I missed something obvious? kind regards pshem

2 2

Identity does not match User-Name, setting from EAP Identity.
by Giovanni Lovato 30 Jun '07

30 Jun '07

I'm trying to get Windows XP authenticating using logon username/password. # freeradius -X [...] rad_recv: Access-Request packet from host 192.168.12.3:1048, id=0, length=217 Message-Authenticator = 0xdbb... Service-Type = Framed-User User-Name = "TELPERION\\heruan" Framed-MTU = 1488 Called-Station-Id = "00-19-5B-XX-XX-XX:Telperion" Calling-Station-Id = "00-13-02-XX-XX-XX" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02... NAS-IP-Address = 192.168.12.3 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "heruan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 0 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for heruan radius_xlat: '(|(uid=heruan)(cn=heruan))' radius_xlat: 'dc=aldu,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=aldu,dc=net, with filter (|(uid=heruan)(cn=heruan)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 0DBF... & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value 5388... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user heruan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.12.3:1048, id=0, length=217 Sending Access-Reject of id 0 to 192.168.12.3 port 1048 I wonder what "Identity does not match User-Name, setting from EAP Identity." means... Enabling/disabling "ntdomain_hack" on mschap module didn't change anything :( G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

2 2

Problems using freeradius+postgresql
by Daniel Bojczuk 29 Jun '07

29 Jun '07

Hi, I'm using Freeradius 1.1.6 with PostgreSQL 8.1. When I try to do #radtest joao senhasecreta 127.0.0.1:1812 0 testing123 Te radiusd (in debug mode) returns: #rad_recv: Access-Request packet from host 127.0.0.1:32779, id=220, length=56 # User-Name = "joao" # User-Password = "senhasecreta" # NAS-IP-Address = 255.255.255.255 # NAS-Port = 0 # Processing the authorize section of radiusd.conf #modcall: entering group authorize for request 0 # modcall[authorize]: module "preprocess" returns ok for request 0 # rlm_realm: No '@' in User-Name = "joao", looking up realm NULL # rlm_realm: No such realm "NULL" # modcall[authorize]: module "suffix" returns noop for request 0 #radius_xlat: 'joao' #rlm_sql (sql): sql_set_user escaped user --> 'joao' #radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ??ORDER BY id' #rlm_sql (sql): Reserving sql socket id: 4 #rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ? ORDER BY id #rlm_sql_postgresql: Status: PGRES_FATAL_ERROR #rlm_sql_postgresql: affected rows = #rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN #rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 #rlm_sql (sql): Connected new DB handle, #4 #rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ??ORDER BY id #rlm_sql_postgresql: Status: PGRES_FATAL_ERROR #rlm_sql_postgresql: affected rows = #rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN #rlm_sql (sql): failed after re-connect #rlm_sql_getvpdata: database query error #rlm_sql (sql): SQL query error; rejecting user #rlm_sql (sql): Released sql socket id: 4 # modcall[authorize]: module "sql" returns fail for request 0 #modcall: leaving group authorize (returns fail) for request 0 #Finished request 0 When I saw the "??" int the queries i changed te query in postgresql.conf putting al the query on the same line (deleting the "/")... but it doesn't work. I'm new on using freeradius, I don't know what I can do. Thank you.. Daniel Bojczuk

2 1

Re: load balancing problem
by Hugh Messenger 29 Jun '07

29 Jun '07

"EXT / GFI REBOLJ Jean-Pierre" <ext.gfi.rebolj(a)sncf.fr> said: [snip] > ldflag = round_robin [snip] > the problem is that I see the Authentication request and response then > Accounting start on the fisrt back-end server and the accounting stop > on the second backend server. That sounds like round_robin is doing its job. >From the example proxy.conf: # If there is no ldflag attribute, or it is set to 'fail_over', then # the realms are treated as "fail-over". That is, the first matching # realm is used, unless it is down, in which case the realm "fails # over" to the second matching realm. The process continues until an # active matching realm is found, OR the DEFAULT realm is returned. # # If the ldflag attribute is set to 'round_robin', then all active # realms of the same name are put into a pool internally in the # server, and the proxied requests are evenly divided among the # realms in the pool. For this to work, all realms of the same name # MUST have the same value of their 'ldflag' attributes. Mixing up # different types of load balancing schemes for the same realm will # cause problems. If you are trying to truly load balance, rather than just failover, I don't think this can be done just in the realms config. You should probably read doc/load-balance.txt. > JPR -- hugh

1 0

load balancing problem
by EXT / GFI REBOLJ Jean-Pierre 29 Jun '07

29 Jun '07

hi, i've a proxy with freeradius 1.1.6 in load balacing with two back-end radius 1.1.6 my proxy is configured like this realm APPLI1 { type = radius authhost = xx.xx.xx.xx:1820 accthost = xx.xx.xx.xx:1821 ldflag = round_robin secret = mysecret } # Server Canna PROD Accellio GPRS de Test avec Realm realm APPLI1 { type = radius authhost = yy.yy.yy.yy:1820 accthost = yy.yy.yy.yy:1821 ldflag = round_robin secret = mysecret } I see the Authentication request and response then Accounting start an some hours later accounting stop on the proxy the problem is that I see the Authentication request and response then Accounting start on the fisrt back-end server and the accounting stop on the second backend server. is this a bug or a problem of configuration ? thanks in advance. Regards JPR

3 4

RE: [meta] admin tools and utilities
by Josh Howlett 29 Jun '07

29 Jun '07

> -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Phil Mayers > Sent: 29 June 2007 10:35 > To: FreeRadius users mailing list > Subject: Re: [meta] admin tools and utilities > > On Thu, 2007-06-28 at 12:16 -0500, Hugh Messenger wrote: > > Forgive me if meta-discussions are frowned upon. > > > > > > > > I was just wandering what tools and utilities (not shipped with > > freeradius) people find useful in day to day admin and testing. > > eapol_client from the wpa_supplicant distro was invaluable > for testing EAP I found I agree with Phil, this is an invaluable tool for testing EAP; although it's really called eapol_test :-) josh.

1 0

Wired Ethernet EAP-TLS
by Darren Maden 29 Jun '07

29 Jun '07

I'm having problems connecting a wired Ethernet machine authenticating with EAP-TLS, I'm connecting via a Lindy switch with 802.1x port authentication forced on the port that the machine is connecting to, that port is also on the same VLAN as the RADIUS server. This FreeRADIUS setup is working for wireless clients over 802.1x using EAP-TLS. My wpa_supplicant config is: ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel ap_scan=0 network={ key_mgmt=IEEE8021X identity="hostname" eapol_flags=0 eap=TLS ca_cert="/etc/certs/cacert.pem" client_cert="/etc/certs/clientcert.pem" private_key="/etc/certs/clientkey.pem" private_key_passwd="password" } (Identity and Password changed for privacy) I'm initiating this with the following command: wpa_supplicant -Dwired -ieth1 -c/etc/wpa_supplicant.conf -d The RADIUS server is not receiving the request, here is an output from wpa_supplicant: State: DISCONNECTED -> ASSOCIATED Associated to a new BSS: BSSID=01:80:c2:00:00:03 No keys have been configured - skip key clearing Network configuration found for the current AP WPA: clearing AP WPA IE WPA: clearing AP RSN IE WPA: clearing own WPA/RSN IE EAPOL: External notification - portControl=Auto Associated with 01:80:c2:00:00:03 WPA: Association event - clear replay counter EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart EAPOL: idleWhile --> 0 EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 CTRL-EVENT-TERMINATING - signal 2 received Removing interface eth1 State: ASSOCIATED -> DISCONNECTED No keys have been configured - skip key clearing EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 No keys have been configured - skip key clearing Cancelling scan request Is there anything special I need to do in my FreeRADIUS config? Supporting Windows wired clients is not necessary but when trying with a Windows client, it didn't work either.

4 11