January 2008 - Freeradius-Users - lists.freeradius.org

What is up with the SQL Groups
by Etienne Pretorius 21 Jan '08

21 Jan '08

Hello List, I am on FreeRadius 1.1.6-1 on debian etch. I have a user that belongs to both DSL and DIAL groups. mysql> select * from usergroup; +------------------------------+-----------+----------+ | UserName | GroupName | priority | +------------------------------+-----------+----------+ | adsl-04@example.com@dsl | DSL | 1 | | adsl-04@example.com@dsl | DIAL | 2 | +------------------------------+-----------+----------+ 2 rows in set (0.16 sec) mysql> select * from radreply; +----+------------------------------+--------------+----+-------+ | id | UserName | Attribute | op | Value | +----+------------------------------+--------------+----+-------+ | 1 | adsl-04@example.com@dsl | Fall-Through | = | Yes | +----+------------------------------+--------------+----+-------+ 1 row in set (2.26 sec) mysql> select * from radcheck; +----+------------------------------+----------------------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+------------------------------+----------------------------+----+------------------------------------+ | 1 | adsl-04@example.com@dsl | Crypt-Password | := | $1$54Bzhv&gsrta^ysgahTaWiUN7dNbxUp/UZ. | | 2 | adsl-04@example.com@dsl | Allow-Access-Blended | := | 1 | | 3 | adsl-04@example.com@dsl | Max-Monthly-Octets-Blended | := | 1073741824 | +----+------------------------------+----------------------------+----+------------------------------------+ 3 rows in set (1.07 sec) mysql> select * from radgroupcheck; +----+-----------+----------------------------+----+--------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------------------+----+--------+ | 1 | DISABLED | Auth-Type | := | Reject | | 2 | DSL | Service-Access-Type | == | DSL | | 3 | DSL | Allow-Access-Blended | := | 0 | | 4 | DSL | Allow-Access-Local | := | 0 | | 5 | DSL | Max-Monthly-Octets-Blended | := | 0 | | 6 | DSL | Max-Monthly-Octets-Local | := | 0 | | 7 | DIAL | Service-Access-Type | == | DIAL | +----+-----------+----------------------------+----+--------+ 7 rows in set (0.08 sec) Here is the debug log: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:37839, id=33, length=80 User-Name = "adsl-04@example.com@dsl" User-Password = "<some-password>" Service-Access-Type = "DIAL" <cut> radius_xlat: 'adsl-04@example.com@dsl' rlm_sql (sql): sql_set_user escaped user --> 'adsl-04@example.com@dsl' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'adsl-04@example.com@dsl' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 37 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'adsl-04@example.com@dsl' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'adsl-04@example.com@dsl' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'adsl-04@example.com@dsl' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 37 rlm_sql (sql): No matching entry in the database for request from user [adsl-04@example.com@dsl] modcall[authorize]: module "sql" returns notfound for request 1 Can someone please explain why the entry is not found. When I perform each quey all the groups are shown but rlm_sql only ever finds the user when asking for DSL group and then it returns all the attributes from all the groups... -- Kind Regards Etienne Pretorius

2 2

Re: MySQL accounting issue
by A.smith 21 Jan '08

21 Jan '08

Hi, ok this is an example of when its meant to do some accounting, in this example I have both detail and sql set for accounting in radiusd.conf. Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 89.107.16.10:35377, id=82, length=145 Acct-Status-Type = Failed Service-Type = IAPP-Register Attr-102 = 0x00000194 Error-Cause = 32 Event-Timestamp = "Jan 21 2008 13:05:11 GMT" Attr-105 = 0x61733738333035366464 Acct-Session-Id = "7f61550435f965005994af4a0b8687ad(a)89.107.16.9" Attr-108 = 0x38392e3130372e31362e39 Attr-109 = 0x35303630 NAS-Port = 5060 Acct-Delay-Time = 0 NAS-IP-Address = 89.107.16.10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 85 modcall[preacct]: module "preprocess" returns noop for request 85 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 85 modcall[preacct]: module "files" returns noop for request 85 modcall: leaving group preacct (returns noop) for request 85 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 85 radius_xlat: '/usr/local/var/log/radius/radacct/89.107.16.10/detail-20080121' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/89.107.16.10/detail-20080121 modcall[accounting]: module "detail" returns ok for request 85 rlm_sql (sql): Unsupported Acct-Status-Type = 15 modcall[accounting]: module "sql" returns noop for request 85 modcall: leaving group accounting (returns ok) for request 85 Sending Accounting-Response of id 82 to 89.107.16.10 port 35377 Finished request 85 Going to the next request At startup I see this from radiusd Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "password" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = yes sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT * FROM nas rlm_sql (sql): Read entry nasname=89.107.16.10,shortname=OpenSER,secret=password rlm_sql (sql): Adding client 89.107.16.10 (OpenSER) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ________________________________________________ Message sent using UK Grid Webmail 2.7.9

2 1

Re: Traffic volume accounting
by Spam Eater 21 Jan '08

21 Jan '08

Thanks! It turns out that my problem was in fact, another one. I was using radreply with custom parameters that I check against in bash scripts. The problem was freeRadius not sending to the NAS the correct parameters in radreply. Somehow, freeRadius ignores all parameters in radreply as sson as it sees one custom parameter. This issue was solved creating a clone of radreply, to be used exclusively by bash scripts. Thank you! On Jan 18, 2008 2:22 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at> wrote: > >Is it possible to have a counter setup to achieve this? > > > > Yes. It is. > > > > >I'd like to know if someone has implemented realtime upload/download > limitations and what methods were used. > > > > Realtime traffic accounting would have to be supported by your NAS. Any > kind of traffic/bandwidth limitations has to be supported by you NAS, you > have to tell freeRADIUS what data to store and how to calculate the values.. > and of course, what attributes should it answer to NAS ! > > > > Regards, > > E:S > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

freeradius + ldap + cisco sslvpn
by satish patel 21 Jan '08

21 Jan '08

Dear all I have requirement of sslvpn authentication with freeradius + ldap server is there anyone have worked on freeradius + ldap or authenticate with goruping and other features... $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Why delete messages? Unlimited storage is just a click away.

1 0

MySQL accounting issue
by Andy Smith 21 Jan '08

21 Jan '08

Hi List, ok next issue I have :P I have attempted to configure freeradius to write accounting data to MySQL, however currently its not working. No data is being written to MySQL and the Radius client is complaining its not recieving a reply for accounting requests. I subsituted the "detail" setting in the "accounting" config section of radiusd.conf for "sql" and modifyied the sql.conf as seemed necessary. As soon as I switch this back to "detail" my Radius client starts recieving replies from freeradius once again :S I can see from the MySQL log that radiusd is successfully establishing a connection to MySQL at startup: 080120 19:14:49 61 Connect root@localhost on radius 62 Connect root@localhost on radius 63 Connect root@localhost on radius 64 Connect root@localhost on radius 65 Connect root@localhost on radius 65 Query SELECT * FROM nas But after that there is no activity in the MySQL log :S And I have no errors logged from MySQL or radiusd, nor can I see any errors when running "radiusd -Xf" anyone any ideas what more I can do to identify the issue?? thanks Andy.

2 1

Unknown syslog chosen but no facility spedified
by Stuart Kendrick 21 Jan '08

21 Jan '08

hi, i'm installing freeradius-2.0.0 and seeing the following when i try to start radiusd: Starting RADIUS server: radiusd: Error: Unknown syslog chosen but no facility spedified relevant lines from radiusd.conf: logdir = ${localstatedir}/log/radius log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } i claim that logging to syslog worked fine under 2.0.0-pre2, using the following radiusd.conf lines: logdir = ${localstatedir}/log/radius log_file = ${logdir}/radius.log log_destination = syslog log { syslog_facility = daemon } log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no insights? --sk stuart kendrick fhcrc P.S. spedified ==> specified

2 1

MySQL
by Anthony McGarry 21 Jan '08

21 Jan '08

Hi, I downloaded the latest version 2.0.0. Installed and tested ok. I want to integrate with MySQL. However when I follow the procedure on the howto to create the radius db on mysql I run into a problem. The howto says to enter the following commands mysql -uroot -p CREATE DATABASE radius; GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "radpass"; exit This works fine and I can see the newly created db and user. However then it tells me to run mysql.sql cd /usr/share/doc/packages/freeradius/doc/examples/ mysql -uroot -p radius < mysql.sql I have looked everywhere on my system for this file but it is not present. I checked the tar for 2.0.0 and still no joy I downloaded and checked the tar for 1.1.7 and its in the doc/example folder. Is there a new way of updating the radius db in MySQL or where can I get the mysql.sql script for ver 2.0.0 Thanks Anthony

4 3

rlm_dbm segfault debug
by Patrick Medina 21 Jan '08

21 Jan '08

Hello list, Newbie and non-programmer here, though I've been a user of this very useful program for a year now (currently on v.2.0.0, CentOS 4.6, x86_64). I'm trying to get a MAC and SSID -based system to work with rlm_dbm. The system already works with the "users" file as follows: 00:12:ab:34:cd:56 Called-Station-Id =~ ".*:WLAN0", Auth-Type := Accept Unfortunately, after converting the above to the prescribed dbm format, a segfault results whenever a user is matched (no problem with a reject). Here's the output of radiusd -X: ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.234 port 25939, id=66, length=214 User-Name = "00:12:ab:34:cd:56" Called-Station-Id = "00-AB-12-CD-34-EF:WLAN0" Calling-Station-Id = "00-12-AB-34-CD-56" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.0.1.234 NAS-Identifier = "WS5100" Vendor-388-Attr-2 = 0x4c53574c414e30 Vendor-388-Attr-4 = 0x31 NAS-Port-Id = "WLAN0" Connect-Info = "CONNECT 54Mbps 802.11g" User-Password = "00:12:ab:34:cd:56" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "00:12:ab:34:cd:56", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rlm_dbm: try open database file: /usr/local/etc/raddb/wlan0-users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add 00:12:ab:34:cd:56 to user list sm_parse_user: start parsing: user: 00:12:ab:34:cd:56 parse buffer: <<Called-Station-Id =~ ".*:WLAN0", Auth-Type := Accept>> rlm_dbm: recod parsed process pattern Program received signal SIGSEGV, Segmentation fault. -------- I've run gdb and here's the content of the log file: Starting program: /usr/local/sbin/radiusd -X [Thread debugging using libthread_db enabled] [New Thread 182915782400 (LWP 23734)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 182915782400 (LWP 23734)] 0x000000000041d3c7 in request_data_get (request=0x0, unique_ptr=0x0, unique_int=-1379995904) at util.c:145 145 for (last = &(request->data); *last != NULL; last = &((*last)->next)) { -------- I've been scouring the documentation and list, trying various running and compiling configuration options, all to no avail. Moreover, the same segfault happens with v.1.1.7, though I haven't run gdb on that. Any help or push in the right direction would be much appreciated. Thank you. Chris ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 2

freeradius authenticate over ldap database
by Renato Gregio de Souza Filho 20 Jan '08

20 Jan '08

I'm trying to install and configure my freeradius at rhel 5 to authenticate in ldapdatabase. i read the rml_ldap and configure then according i understand. I start my server with no problem, but i'm not sure if its working good or bad. I create a test user at ldap database with username and passowrd are "teste" and try to test it from radtest, but it won't work. The password at ldap database are crypt. [root@poseidon raddb]# radtest teste teste localhost:1812 testing123 Usage: radtest user passwd radius-server[:port] nas-port-number secret [ppphint] [nasname] [root@poseidon raddb]# When i start my radiusd, they start without problens. What i need to do to put it working fine over ldap database? [root@poseidon raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=admin,dc=radius,dc=com,dc=br" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "pcistl00" ldap: basedn = "dc=radius,dc=com,dc=br" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x555574851690 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. att Renato Gregio

2 1

NAS list with MySQL
by Pawel Cieplinski 20 Jan '08

20 Jan '08

Hi there... i am new to free radius. I already successfully installed freeradius 1.1.7 with mysql5.1. The point is NAS's IPs and secrets are configured in clients.conf. I cannot find anything how to put those data to SQL database. Sql.conf doesn't describe any table or value for clients, can anyone give any clue how to store those data in SQL database Pawel Cieplinski

4 5