February 2008 - Freeradius-Users - lists.freeradius.org

FreeRadius and LDAP/AD username/password check
by Mats Blomgren B 18 Feb '08

18 Feb '08

Hi, Today I check the "etc/passwd" for the usernames and passwords and fetches the users default group from "etc/passwd". In the "users" file I have the rights for each group. My current config: OS: Solaris 10 FreeRadius: 1.1.7 Mysql: 5.0.51 - For logging and NAS clients OS packages installed: db-4.2.52.NC-sol9-sparc-local OS packages installed: freeradius-1.1.7-sol10-sparc-local OS packages installed: gcc-3.4.6-sol10-sparc-local OS packages installed: gdbm-1.8.3-sol9-sparc-local OS packages installed: libiconv-1.11-sol10-sparc-local OS packages installed: libtool-1.5.24-sol10-sparc-local OS packages installed: make-3.81-sol10-sparc-local OS packages installed: mysql-5.0.51-sol10-sparc-local OS packages installed: ncurses-5.6-sol10-sparc-local OS packages installed: netsnmp-5.4.1-sol10-sparc-local OS packages installed: openldap-2.3.35-sol10-sparc-local OS packages installed: openssl-0.9.8f-sol10-sparc-local OS packages installed: perl-5.8.8-sol10-sparc-local OS packages installed: sasl-2.1.21-sol10-sparc-local OS packages installed: zlib-1.2.3-sol10-sparc-local OS packages installed: Freeradius: 1.1.7 #etc/passwd testuser:x:103:500:Test User:/home/testuser:/bin/bash #etc/group admin-network::500: user-network::600: #/usr/local/etc/raddb/users DEFAULT Group == "admin-network", Auth-Type = System Service-Type = Administrative-User, Fall-Through = No #/usr/local/etc/raddb/huntgroups defaultgroup NAS-IP-Address == 192.168.1.20 Group = admin-network, Group = user-network Today the user "testuser" would get Administrative rights on the nas with IP=192.168.1.20 since he is a member of the group "admin-network". I have been browsing the mailing list, wiki and google trying to find out if anyone has done the following: 1. I want to check the username/password against LDAP/AD instead of directly towards "etc/passwd". 2. After that I would like to continue by fetching the user's default group from the Solaris 10 system (/"etc/passwd") to give it rights depending on which group the user belongs to. 3. I know that this means I still have to have the username in the "/etc/passwd" but this will keep the users from having different logins in our infrastructure. Best regards Mats Blomgren B - IP Engineer

2 1

1.1.7 and rlm_sql_mysql duplicated query
by Georgi Alexandrov 18 Feb '08

18 Feb '08

Hello, I'm seeing duplicated queries made to the database when any (linux/pppoe) user logs in through freeradius 1.1.7. Log from mysql logger: 646 Query INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('47B769162F4300', '66cf2392669a4dc6', 'time160', '', 'xx.xx.xxx.22', '0', 'Async', '2008-02-17 00:52:10', '0', '0', 'RADIUS', '', '', '0', '0', '', '00:13:20:xx.xx.xx', '', 'Framed-User', 'PPP', 'xx.xx.xxx.110', '0', '0', '') 645 Query INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('47B7691A2F4301', '82cd8d24e280bd07', 'time160', '', 'xx.xx.xx.22', '0', 'Async', '2008-02-17 00:52:10', '0', '0', 'RADIUS', '', '', '0', '0', '', '00:13:20:xx.xx.xx', '', 'Framed-User', 'PPP', 'xx.xx.xx.110', '0', '0', '') After user logs off the following query is passed to mysql: 080217 0:54:21 663 Query UPDATE radacct SET AcctStopTime = '2008-02-17 00:54:21', AcctSessionTime = '135', AcctInputOctets = '0' << 32 | '2556', AcctOutputOctets = '0' << 32 | '1486', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '47B7691A2F4301' AND UserName = 'time160' AND NASIPAddress = 'xx.xx.xx.22' So when the user logs I have two queries inserting similar data with different sessions ids: 47B7691A2F4300 and 47B7691A2F4301 And when the user logs off I have only one query that notes the action in the database for session 47B7691A2F4301. So generally I get one "hanging" session in radacct table for a particular user where AcctStopTime is null. sql.conf is a default one with only db connect info changed. Tried to remove some of the insert statements but the only result I'm getting is no insert statement in radacct table at all or the double insert statement pointed above. I would really appreciate some guidance from this point on as I'm pretty much out of ideas. Thanks upfront

3 3

vocera(with Peap)+AP+freeRADIUS
by Hangjun He 18 Feb '08

18 Feb '08

Hi, I am using freeRADIUS 1.1.7. Notebook with odyssey client (peap mschap-v2) can talk to freeRADUS well. But when I use Vocera client, which can support peap + mschap-v2, It does not work. debug message (see more debug message in attachment): ... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=55, length=233 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020a003919800000002f14030100010116030100248393f1d6391a86ab0605df998e0336f7c651a560328bf621b1ddebbfad332d8ea8796c49 State = 0xfd6f3b2761e20233acdc5d29ec63d11f Message-Authenticator = 0xc4ee170f5d47ee55bead80b4a36580cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 40 modcall[authorize]: module "preprocess" returns ok for request 40 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 40 modcall[authorize]: module "chap" returns noop for request 40 modcall[authorize]: module "mschap" returns noop for request 40 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 40 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 40 rlm_eap: EAP packet type response id 10 length 57 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 40 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 40 modcall: leaving group authorize (returns updated) for request 40 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 40 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 40 modcall: leaving group authenticate (returns reject) for request 40 auth: Failed to validate the user. Delaying request 40 for 1 seconds Finished request 40 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=56, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0x834864649ecf9fba4cbd71673b5bb042 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 41 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 41 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns ok) for request 41 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 41 for 1 seconds Finished request 41 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=57, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0xfe7dea9b1f1eb6e620980f6f09a97012 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 42 modcall[authorize]: module "chap" returns noop for request 42 modcall[authorize]: module "mschap" returns noop for request 42 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 42 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 42 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 42 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 42 modcall: leaving group authorize (returns ok) for request 42 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 42 for 1 seconds Finished request 42 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 51 to 10.50.1.38 port 1034 Sending Access-Reject of id 55 to 10.50.1.38 port 1034 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject of id 56 to 10.50.1.38 port 1034 --------------------------------- 雅虎邮箱传递新年祝福，个性贺卡送亲朋！ rad_recv: Access-Request packet from host 10.50.1.38:1034, id=51, length=184 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0205000819801503 State = 0xe84cfd135516709bf6abae7113b60657 Message-Authenticator = 0xa133f6434f2160a46099f9e0b27ed064 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 36 modcall[authorize]: module "preprocess" returns ok for request 36 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 36 modcall[authorize]: module "chap" returns noop for request 36 modcall[authorize]: module "mschap" returns noop for request 36 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 36 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 36 rlm_eap: EAP packet type response id 5 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 36 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 36 modcall: leaving group authorize (returns updated) for request 36 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 36 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 36 modcall: leaving group authenticate (returns invalid) for request 36 auth: Failed to validate the user. Delaying request 36 for 1 seconds Finished request 36 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=52, length=168 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0207000a016c77616e67 Message-Authenticator = 0xd91d607c57472b2b534944a8d6630d0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 37 modcall[authorize]: module "preprocess" returns ok for request 37 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 37 modcall[authorize]: module "chap" returns noop for request 37 modcall[authorize]: module "mschap" returns noop for request 37 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 37 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 37 rlm_eap: EAP packet type response id 7 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 37 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 37 modcall: leaving group authorize (returns updated) for request 37 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 37 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 37 modcall: leaving group authenticate (returns handled) for request 37 Sending Access-Challenge of id 52 to 10.50.1.38 port 1034 EAP-Message = 0x0108001604104a82c158ba7bb7e572bf085b0ae2a3ce Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b52e8b66679defae03d024f61db78a4 Finished request 37 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=53, length=184 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0208000803199fbb State = 0x5b52e8b66679defae03d024f61db78a4 Message-Authenticator = 0xf6e209d24fc80cc9a970212ec3452143 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 38 modcall[authorize]: module "preprocess" returns ok for request 38 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 38 modcall[authorize]: module "chap" returns noop for request 38 modcall[authorize]: module "mschap" returns noop for request 38 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 38 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 38 rlm_eap: EAP packet type response id 8 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 38 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 38 modcall: leaving group authorize (returns updated) for request 38 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 38 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 38 modcall: leaving group authenticate (returns handled) for request 38 Sending Access-Challenge of id 53 to 10.50.1.38 port 1034 EAP-Message = 0x010900061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1f71ceb729cf8dd843503ad3d1143fbd Finished request 38 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=54, length=270 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0209005e198000000054160301004f0100004b030100000b2e660b4d53b6904c9388b8333940d93bc9ddd92253aab97b6a046d003d2039ea6005dca4832f4ca678e7364aa617fa1a73d878d6d18fadd5214fe89e87d30004000500040100 State = 0x1f71ceb729cf8dd843503ad3d1143fbd Message-Authenticator = 0x9a47dcdd414b0e3405f5ba80472d5996 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 39 rlm_eap: EAP packet type response id 9 length 94 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 004f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read finished A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 39 modcall: leaving group authenticate (returns handled) for request 39 Sending Access-Challenge of id 54 to 10.50.1.38 port 1034 EAP-Message = 0x010a00841900160301004a02000046030147b20435b84f8a3cf519ad0182abd419e199aedc74339134db68fdaded807fb22039ea6005dca4832f4ca678e7364aa617fa1a73d878d6d18fadd5214fe89e87d30005001403010001011603010024ca6d41fd9f4101a29f5cf01683b78485d2275ea68bc1b30b0c5b0e7021280ae33c84373b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd6f3b2761e20233acdc5d29ec63d11f Finished request 39 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=55, length=233 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020a003919800000002f14030100010116030100248393f1d6391a86ab0605df998e0336f7c651a560328bf621b1ddebbfad332d8ea8796c49 State = 0xfd6f3b2761e20233acdc5d29ec63d11f Message-Authenticator = 0xc4ee170f5d47ee55bead80b4a36580cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 40 modcall[authorize]: module "preprocess" returns ok for request 40 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 40 modcall[authorize]: module "chap" returns noop for request 40 modcall[authorize]: module "mschap" returns noop for request 40 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 40 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 40 rlm_eap: EAP packet type response id 10 length 57 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 40 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 40 modcall: leaving group authorize (returns updated) for request 40 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 40 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 40 modcall: leaving group authenticate (returns reject) for request 40 auth: Failed to validate the user. Delaying request 40 for 1 seconds Finished request 40 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=56, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0x834864649ecf9fba4cbd71673b5bb042 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 41 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 41 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns ok) for request 41 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 41 for 1 seconds Finished request 41 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=57, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0xfe7dea9b1f1eb6e620980f6f09a97012 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 42 modcall[authorize]: module "chap" returns noop for request 42 modcall[authorize]: module "mschap" returns noop for request 42 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 42 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 42 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 42 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 42 modcall: leaving group authorize (returns ok) for request 42 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 42 for 1 seconds Finished request 42 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 51 to 10.50.1.38 port 1034 Sending Access-Reject of id 55 to 10.50.1.38 port 1034 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject of id 56 to 10.50.1.38 port 1034

2 1

Re: 2 different authorization?
by Evgeney Bakhtin 18 Feb '08

18 Feb '08

Hello, I just need to configure FreeRadius to manage auth & acct for 2 different users too. I have create 2 instances of the sql module, in my sql.conf: sql instance1 { ... } sql instance2 { ... } But I don't understand how and where I can use this instances. In radiusd.conf I have: [authorize] { ... instance1 ... } [accounting] { ... instance1 ... } Where I need to indicate different sql instances for different users? Regards, Evgeney Bakhtin.

1 0

Wifi and Client-Side authentication
by Bill Farina 18 Feb '08

18 Feb '08

Here's the scenario, I have a Linksys WRT54GS running DD-WRT RC5 which is fully configured for Radius. I have a small FreeBSD server running FreeRadius-1.1.7_2. HTTPD (or Apache) has not been installed on the system and in it's current configuration would be difficult to do so. The BSD box is also running PAP which makes it very easy to configure accounts and it's a account creation method that I'm familiar and comfortable with. The two machines are currently communicating. What I'm trying to do is figure out a way that I can authenticate enduser machines using this setup. What I would like to see is upon the initial login attempt, a popup comes up and asks for username and password. From that point on, everything would be automatic on the user-side and individual client machines would store all of the login information. I'm not opposed to adding software to client machines to facilitate the login.

3 2

rlm_python & freeradiusd 2.0.2
by Alexander Demidoff 17 Feb '08

17 Feb '08

Hello all! I want to use python possibilities to authorize users with freeradius. So, I compiled freeradius with options: --with-experimental-modules \ --with-rlm_python created config files and my pythom module "radiusd_isp", put it python path freeradius -X out me: python { mod_instantiate = "radiusd_isp" func_instantiate = "instantiate" mod_authorize = "radiusd_isp" func_authorize = "authorize" mod_authenticate = "radiusd_isp" func_authenticate = "authenticate" mod_preacct = "radiusd_isp" func_preacct = "preacct" mod_accounting = "radiusd_isp" func_accounting = "accounting" mod_detach = "radiusd_isp" func_detach = "detach" } exceptions.ImportError: No module named radiusd_isp Failed to import python module "radiusd_isp" /etc/freeradius/python.conf[32]: Instantiation failed for module "python" /etc/freeradius/radiusd.conf[1824]: Failed to find module "python". /etc/freeradius/radiusd.conf[1793]: Errors parsing authorize section. help me anybody, please !?

3 5

one username and 2 NAS
by enrico fanti 16 Feb '08

16 Feb '08

Hi , I have freeradius configured with Mysql. I would like to have a user can ssh login to 2 server linux (i.e. 2 NAS , same username). Freeradius must make the control if NAS-IP Address is ok for this user in the radcheck table.. I use the "==" operator end my radcheck table is: mysql> SELECT id, UserName, Attribute, Value, op from radcheck WHERE Username = 'pippo' order by id; +----+----------+----------------+---------------+----+ | id | UserName | Attribute | Value | op | +----+----------+----------------+---------------+----+ | 39 | pippo | NAS-IP-Address | 10.0.0.52 | == | | 40 | pippo | NAS-IP-Address | 10.0.0.49 | == | | 41 | pippo | Expiration | 1203325200 | == | | 42 | pippo | Crypt-Password | v7fawImvQUoXM | == | +----+----------+----------------+---------------+----+ It doesn't work...... Some ideas ??? Thank you Enrico

3 2

Could not link driver rlm_sql_mysql.so
by johnson elangbam 15 Feb '08

15 Feb '08

hi, I couldn't be able to link the driver of mysql 5 with free radius 2.0.2due to this file "rlm_sql_mysql.so". I couldn't locate this file in my entire system. I've gone througe all the faq's, but it doesn't work. the error's still there. The errors look like this. rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[124]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[34]: Errors parsing authorize section. With Regards Elangbam Johnson

4 3

Non capturing parenthesis in regexp causes seg fault.
by Arran Cudbard-Bell 15 Feb '08

15 Feb '08

Hi, Got this on my 32bit intel box running Ubuntu Linux 6.10 if("%{User-Name}" =~ /(?:.*)/){ } --- ++? if ("%{User-Name}" =~ /(?:.*)/) expand: %{User-Name} -> anonymous Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1213196608 (LWP 6433)] 0xb7bc9492 in regexec () from /lib/tls/i686/cmov/libc.so.6 (gdb) bt #0 0xb7bc9492 in regexec () from /lib/tls/i686/cmov/libc.so.6 #1 0x0806d6a9 in ?? () #2 0xbfb2e650 in ?? () #3 0xbfb2ee84 in ?? () #4 0x00000009 in ?? () #5 0xbfb2e608 in ?? () #6 0x00000000 in ?? () Normal expressions work fine. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 4

Acct-Authentic & changing usernames
by Phil Mayers 15 Feb '08

15 Feb '08

We're bringing a Cisco (formerly Airespace) lightweight wireless system online, and I'm seeing some odd things in the accounting. Specifically, the usernames can change in the accounting packets. This causes the default SQL queries (at least, the ones for Postgres under 1.1.7) to generate duplicate entries for the session, because the "where" clause includes the username. For example, I might see this: User-Name = "unknown" NAS-Port = 29 NAS-IP-Address = 172.16.x.x Framed-IP-Address = 192.168.x.x NAS-Identifier = "wlan-wism-1-1" Airespace-Wlan-Id = 2 Acct-Session-Id = "47b3193c/00:aa:bb:cc:dd:ee/5746" Acct-Authentic = Remote Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3602" Acct-Status-Type = Start Calling-Station-Id = "00:aa:bb:cc:dd:ee" Called-Station-Id = "00:1b:d5:08:01:00" ...then a few seconds later User-Name = "THEUSER" NAS-Port = 29 NAS-IP-Address = 172.16.x.x Framed-IP-Address = 192.168.x.x NAS-Identifier = "wlan-wism-1-1" Airespace-Wlan-Id = 2 Acct-Session-Id = "47b3193c/00:aa:bb:cc:dd:ee/5746" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3602" Acct-Status-Type = Interim-Update Acct-Input-Octets = 105078 Acct-Output-Octets = 72551 Acct-Input-Packets = 754 Acct-Output-Packets = 300 Acct-Session-Time = 74 Acct-Delay-Time = 0 Calling-Station-Id = "00:aa:bb:cc:dd:ee" Called-Station-Id = "00:1b:d5:08:01:00" If the user is on e.g. a windows XP laptop and logs out, I might finally see: User-Name = "host/thelaptop.domain.com" NAS-Port = 29 NAS-IP-Address = 172.16.x.x Framed-IP-Address = 192.168.x.x NAS-Identifier = "wlan-wism-1-1" Airespace-Wlan-Id = 2 Acct-Session-Id = "47b3193c/00:aa:bb:cc:dd:ee/5746" Acct-Authentic = Remote Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3602" Acct-Status-Type = Stop Acct-Input-Octets = 1852445 Acct-Output-Octets = 5401691 Acct-Input-Packets = 17608 Acct-Output-Packets = 8630 Acct-Terminate-Cause = User-Request Acct-Session-Time = 30517 Acct-Delay-Time = 0 Calling-Station-Id = "00:aa:bb:cc:dd:ee" Called-Station-Id = "00:1b:d5:08:01:00" It seems the NAS is having a changing view of the authentication username as various events take place, presumably at the EAPOL layer. However it seems to consistently set Acct-Authentic to RADIUS for "real" usernames, and "Remote" for unknown or non-authenticated usernames, so it sort of "knows" this is happening. Now the Cisco WLC (nee Airespace) is a weird bit of kit anyway; it sort of "holds onto" client sessions in case they come back shortly (not unusual for wireless) but I'm wondering if this behaviour is legal, sane or what? I can probably fix our SQL queries, but I thought people might be interested; for interest, what was the original rationale behind the where clause in the default SQL queries: where username='%{SQL-User-Name}' ??

3 3