August 2007 - Freeradius-Users - lists.freeradius.org

Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 02 Aug '07

02 Aug '07

Hello, Let me start off by saying I am new to this list and not very accomplished in freeradius administration. I am running a freeradius-1.1.0-19.6 setup to gather VoIP accounting information from a Cisco AS5350 router and insert this information into a mysql-5.0.18-16 database. The OS is SuSE Linux 10.1. I am having trouble populating the MySQL database with a certain attribute 'h323-remote-address'. A tail of the radius logs shows me that this attribute is being received by radius. It however does not appear in the database. I have tried altering the mysql statements in sql.conf to insert the value of this attribute in a field that was previously being populated with something else - to ensure that the sql statement is correct - (of the same type - i.e. varchar(32)) but that field stops being populated after the changes. I have also tried it with a field that was previously not being populated, with no success. The value is supposed to be an IP address. Could someone please help me? Thanks and regards, Timothy

3 2

proxy by Called-Station-ID problem
by Brian 01 Aug '07

01 Aug '07

I've got proxy working based on Called-Station-ID by adding the following to the users file: DEFAULT Called-Station-Id == "1234567890", Proxy-To-Realm := "somerealm.com" Fall-Through = No and in the proxy.conf: realm somerealm.com { type = radius authhost = 1.2.3.4:1645 accthost = 1.2.3.4:1646 secret = SeCrEtPaSsWoRd ldflag = round_robin } This works, the user dials in with just a username and password, it gets proxied off to the remote radius server who doesn't want to see the realm. All is good. The problem is that in my radacct table (and in the detail files) I'm not getting the realm unless the user is using user@realm in their log in. Any help would be greatly appreciated. Running Freeradius 1.1.6 -- Brian <brian(a)lonestarsupport.com>

1 0

sql failover doubt
by Francesco Cristofori 01 Aug '07

01 Aug '07

Hi all, I set up sql failover using the "redundant" feature as stated in the documentation, but I still have a doubt. When I start freeradius if all mysql backend servers are up everything goes fine. If one server is down, radiusd complains because it is unable to create the corresponding module: is there a way to avoid this behavior? Thanks in advance, Francesco Cristofori.

1 0

Re: Freeradius as a proxy to Windows IAS - reserved characters in shared secret?
by clive gould 01 Aug '07

01 Aug '07

Hi I've just been doing some research on the net and found this link on the GNU radius client reference page: http://www.gnu.org/software/radius/manual/html_chapter/radius_13.html#SEC262 It looks as if the radtest client has reserved characters. Does anyone know if this applies to shared secrets with the Freeradius server as well??? Thanks Clive

2 1

Freeradius + postgresql for cisco voip
by nix lynx 01 Aug '07

01 Aug '07

Dear all, I have successfully configured freeradius and posgtgresql sql according to doc that is in freeradius bundle. My cisco vsa is also inserted in the database. Now the problem here is how to retrieve the data from the database. Is there any pre-made front end of this kind of things? I need to calculate daily/weekly/monthly voip CDR. One more thing can i insert my syslog cisco CDR to above database? thanking you, regards, nik --------------------------------- Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV.

2 1

Re[2]: Freeradius as a proxy to Windows IAS - reserved
by clive gould 01 Aug '07

01 Aug '07

Brilliant Thanks Claudia :-))) Putting the shared secret in single quotes 'se\cret' in radclient and in double quotes with the backslash escaped in clients.conf and proxy.conf "se\\cret" worked fine with the radtest and what's more this now works too: Linux VLE <----------->FreeRadius<------------>Microsoft IAS Thank-you !!! Clive Message: 5 Date: Wed, 1 Aug 2007 13:26:35 +0300 From: Claudiu Filip <claudiu(a)globtel.ro> Subject: Re[2]: Freeradius as a proxy to Windows IAS - reserved characters in shared secret? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <10210589886.20070801132635(a)globtel.ro> Content-Type: text/plain; charset=us-ascii Hi clive, Wednesday, August 1, 2007, 11:10:41 AM, you wrote: > 2) If I use a secret key (similar to the one set on the IAS server) > containing characters such as $\[ then the key is rejected and Character "Escape from Alcatraz", a classic movie with Clint Eastwood.. Be careful with character escaping and bash cli (always use single quotes to pass to radtest what you want). Also avoid ${foo} as a secret client 127.0.0.1 { secret = "\044{prefix}" } radtest gigi kent 127.0.0.1 1 '/radiusd' => OK!! ($prefix = /radiusd) client 127.0.0.1 { secret = "\\testing123" } radtest gigi kent 127.0.0.1 1 '\testing123' => OK radtest gigi kent 127.0.0.1 1 "\testing123" => OK (because bash does not expand \t) radtest gigi kent 127.0.0.1 1 "\\testing123" => OK (because bash expands \\t to \t) radtest gigi kent 127.0.0.1 1 '\\testing123' => NOT ok client 127.0.0.1 { secret = "$\[" } radtest gigi kent 127.0.0.1 1 '$[' => OK client 127.0.0.1 { secret = "$\\[" } radtest gigi kent 127.0.0.1 1 '$\[' => OK Have fun!

2 1

Failed to validate user
by abhishek singh 01 Aug '07

01 Aug '07

Hi, I am trying to establish EAP-TLS communication. My client having certificate ( rsauser1(a)abc-inc.com) sends HELLO to free radius, via a pass through server having IP address 172.25.13.61. Free radius gets the hello via pass through server and bails out saying it fails to authenticate user. I think i am making some mistake in configuration files. Any help will be appreciated. Rgds, Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/root/temp/freeradius- 1.1.6/raddb/certs/cert- srv.pem" tls: certificate_file = "/root/temp/freeradius-1.1.6/raddb/certs/cert- srv.pem" tls: CA_file = "/root/temp/freeradius-1.1.6/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/root/temp/freeradius-1.1.6/raddb/certs/dh" tls: random_file = "/root/temp/freeradius-1.1.6/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.25.13.61:32772, id=188, length=115 EAP-Message = 0x023a001d01727361757365723140736166656e65742d696e632e636f6d User-Name = " rsauser1(a)abc-inc.com" Framed-MTU = 1400 Message-Authenticator = 0x307eb1018a6a1b9c57aa5db62e37df5d NAS-Identifier = "172.25.13.61 " Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm " abc-inc.com" for User-Name = "rsauser1(a)abc-inc.com " rlm_realm: No such realm "abc-inc.com" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 58 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 188 to 172.25.13.61 port 32772 Tunnel-Type:0 = VLAN EAP-Message = 0x013b00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x216eb80f704ffae95f7f4d51cf1da6be Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772, id=24, length=167 EAP-Message = 0x023b003f0d00160301003501000031030146af9dc8d5f85d77011e4c6abb647dcdd7478e5b393d104e85ca3c79af85cb7000000a0004000500070009000a01 User-Name = " rsauser1(a)abc-inc.com" Framed-MTU = 1400 State = 0x216eb80f704ffae95f7f4d51cf1da6be Message-Authenticator = 0xd44eabaa42b7599afd123e6f36a2e4d6 NAS-Identifier = " 172.25.13.61" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm " abc-inc.com" for User-Name = "rsauser1(a)abc-inc.com " rlm_realm: No such realm "abc-inc.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 59 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: Need to read more data: SSLv3 read client hello B In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772, id=24, length=167 Sending Access-Reject of id 24 to 172.25.13.61 port 32772 EAP-Message = 0x043b0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 24 with timestamp 46b04eac Cleaning up request 0 ID 188 with timestamp 46b04eac Nothing to do. Sleeping until we see a request.

1 0

Re: Freeradius as a proxy to Windows IAS - reserved characters in shared secret?
by clive gould 01 Aug '07

01 Aug '07

Hi Thanks once again for all the advice :-) Does anyone know if there some characters that are reserved i.e cannot be used in secret keys with a freeradius server. If so what are they? I've been experimenting with the radtest client and the freeradius server using local unix validation with interesting results. 1) If I use a secret key (16+ characters and the same key in both the radtest client and freeradius clients.conf) that contains pure alpha characters the key is accepted and authorisation is successful. 2) If I use a secret key (similar to the one set on the IAS server) containing characters such as $\[ then the key is rejected and authorisation is unsuccessful. I have tried enclosing the key in single and double quotes, but the key is still rejected. Hopefully getting nearer to a solution... Thanks very much Clive

2 1

Radius proxy: Assertionfailed problem
by Janne Peltonen 01 Aug '07

01 Aug '07

Hi! I seem to be getting errors such as Tue Jul 31 11:50:23 2007 : Error: Assertion failed in request_list.c, line 1012 in my Radius logs from time to time, especially during high load. This assertion failure leads to Radius server getting stuck, which in turn results in my clients getting stuck... My Radius server functions solely as a proxy to an another server. Any suggestions would be greatly appreciated. Cheers, --Janne Peltonen -- Janne Peltonen <janne.peltonen(a)helsinki.fi>

3 3

Re: Freeradius as a proxy to Windows IAS - not solved after all :-(
by Clive Gould 01 Aug '07

01 Aug '07

Hi everyone Thanks for all the help and advice so far :-) I have installed freeradius 1.1.7 and get the appended message when I try to use it as a proxy between a Linux/Moodle/PHP radius client and a Windows IAS server. The shared secrets are definitely the same. The Linux/Moodle/PHP radius client authenticates directly with the Windows IAS server without any problems, but it will not authenticate with the freeradius proxy in between! I need a working freeradius proxy. Help... Clive Sending Access-Request of id 0 to 10.200.0.2 port 1812 NAS-Identifier = "vle.bromley.ac.uk" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "cliveg(a)staff.bromley.local" MS-CHAP2-Response = removed from message MS-CHAP-Challenge = removed from message NAS-IP-Address = 10.200.0.14 Proxy-State = 0x3832 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.200.0.2:1812, id=0, length=235 Received Access-Accept packet from client 10.200.0.2 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.

4 3