September 2008 - Freeradius-Users - lists.freeradius.org

User-Name Authorization Problem in ldap module
by Syed Anwarul Hasan 17 Sep '08

17 Sep '08

Dear Alan,Ivan and all, I am having the Problem in rlm_ldap module in FreeRadius. I am doing a MD5 based Authentication with a Windows XP Supplicant and a Alcatel Switch acting as Authenticator and FreeRadius2.0.5 build as Front end and OpenLDAP 2.3.32 as backend. When a Request is received the *FreeRadius rlm_ldap module is not able to Authorize the User-Name in Authorize section.* But when I tried with* radtest it was able to Authorize and bind the identity with server. and authorized password. I am unable to find the problem. Please comment in this regard. SYED Debugged output with RADIUS Access Request received from Authenticator:* rad_recv: Access-Request packet from host 192.168.1.2 port 1026, id=23, length=118 User-Name = "hasan" NAS-IP-Address = 192.168.1.2 State = 0xd2721542d2731113194d83152fbd73d0 NAS-Port = 1003 Calling-Station-Id = "000fb0ba868d" EAP-Message = 0x0201001b0410aa93c55c3f5fb6f41369d77838fad2a2686173616e Message-Authenticator = 0x6525206bdea6b09c81a5a3252e515782 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "hasan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 27 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize *rlm_ldap: Attribute "User-Name" is required for authorization.* *++[ldap] returns noop* ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 23 to 192.168.1.2 port 1026 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1. Going to the next request Debugged o/p with radtest: radtest hasan password 192.168.1.131 10 testing123 *rlm_ldap: - authorize rlm_ldap: performing user authorization for password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=hasan) expand: dc=thales,dc=com -> dc=thales,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=thales,dc=com/thales to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=thales,dc=com, with filter (uid=hasan) rlm_ldap: checking if remote access for password is allowed by uid rlm_ldap: Added User-Password = password in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user password authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0* ++[ldap] returns ok expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 27 to 192.168.1.131 port 1068

1 0

User-Name Authorization Problem in ldap module
by Syed Anwarul Hasan 17 Sep '08

17 Sep '08

Dear Alan,Ivan and all, I am having the Problem in rlm_ldap module in FreeRadius. I am doing a MD5 based Authentication with a Windows XP Supplicant and a Alcatel Switch acting as Authenticator and FreeRadius2.0.5 build as Front end and OpenLDAP 2.3.32 as backend. When a Request is received the *FreeRadius rlm_ldap module is not able to Authorize the User-Name in Authorize section.* But when I tried with* radtest it was able to Authorize and bind the identity with server. and authorized password. I am unable to find the problem. Please comment in this regard. SYED Debugged output with RADIUS Access Request received from Authenticator:* rad_recv: Access-Request packet from host 192.168.1.2 port 1026, id=23, length=118 User-Name = "hasan" NAS-IP-Address = 192.168.1.2 State = 0xd2721542d2731113194d83152fbd73d0 NAS-Port = 1003 Calling-Station-Id = "000fb0ba868d" EAP-Message = 0x0201001b0410aa93c55c3f5fb6f41369d77838fad2a2686173616e Message-Authenticator = 0x6525206bdea6b09c81a5a3252e515782 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "hasan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 27 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize *rlm_ldap: Attribute "User-Name" is required for authorization.* *++[ldap] returns noop* ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 23 to 192.168.1.2 port 1026 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1. Going to the next request Debugged o/p with radtest: radtest hasan password 192.168.1.131 10 testing123 *rlm_ldap: - authorize rlm_ldap: performing user authorization for password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=hasan) expand: dc=thales,dc=com -> dc=thales,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=thales,dc=com/thales to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=thales,dc=com, with filter (uid=hasan) rlm_ldap: checking if remote access for password is allowed by uid rlm_ldap: Added User-Password = password in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user password authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0* ++[ldap] returns ok expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 27 to 192.168.1.131 port 1068

1 0

[bug 571 PATCH] make rlm_sqlipool escape properly
by Phil Mayers 17 Sep '08

17 Sep '08

This is an updated patch to the one in bug 571 --- src/modules/rlm_sql/rlm_sql.c | 3 +-- src/modules/rlm_sql/rlm_sql.h | 1 + src/modules/rlm_sqlippool/rlm_sqlippool.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c index 1987d81..de9cd53 100644 --- a/src/modules/rlm_sql/rlm_sql.c +++ b/src/modules/rlm_sql/rlm_sql.c @@ -123,7 +123,6 @@ static int fallthrough(VALUE_PAIR *vp) * Yucky prototype. */ static int generate_sql_clients(SQL_INST *inst); -static size_t sql_escape_func(char *out, size_t outlen, const char *in); /* * sql xlat function. Right now only SELECTs are supported. Only @@ -355,7 +354,7 @@ static int generate_sql_clients(SQL_INST *inst) /* * Translate the SQL queries. */ -static size_t sql_escape_func(char *out, size_t outlen, const char *in) +size_t sql_escape_func(char *out, size_t outlen, const char *in) { size_t len = 0; diff --git a/src/modules/rlm_sql/rlm_sql.h b/src/modules/rlm_sql/rlm_sql.h index 54cc6ee..40cd526 100644 --- a/src/modules/rlm_sql/rlm_sql.h +++ b/src/modules/rlm_sql/rlm_sql.h @@ -89,4 +89,5 @@ int rlm_sql_select_query(SQLSOCK *sqlsocket, SQL_INST *inst, char *query); int rlm_sql_query(SQLSOCK *sqlsocket, SQL_INST *inst, char *query); int rlm_sql_fetch_row(SQLSOCK *sqlsocket, SQL_INST *inst); int sql_set_user(SQL_INST *inst, REQUEST *request, char *sqlusername, const char *username); +size_t sql_escape_func(char *out, size_t outlen, const char *in); #endif diff --git a/src/modules/rlm_sqlippool/rlm_sqlippool.c b/src/modules/rlm_sqlippool/rlm_sqlippool.c index b9df57b..ab0e5b6 100644 --- a/src/modules/rlm_sqlippool/rlm_sqlippool.c +++ b/src/modules/rlm_sqlippool/rlm_sqlippool.c @@ -318,7 +318,7 @@ static int sqlippool_command(const char * fmt, SQLSOCK * sqlsocket, return RLM_MODULE_FAIL; } - if (!radius_xlat(query, sizeof(query), expansion, request, NULL)) { + if (!radius_xlat(query, sizeof(query), expansion, request, sql_escape_func)) { radlog(L_ERR, "sqlippool_command: xlat failed on: '%s'", query); return 0; } @@ -364,7 +364,7 @@ static int sqlippool_query1(char * out, int outlen, const char * fmt, return RLM_MODULE_FAIL; } - if (!radius_xlat(query, sizeof(query), expansion, request, NULL)) { + if (!radius_xlat(query, sizeof(query), expansion, request, sql_escape_func)) { radlog(L_ERR, "sqlippool_command: xlat failed."); out[0] = '\0'; return 0; -- 1.5.4.3

2 1

sqlcounter problem after upgrading to 2.1.0
by J M Toms 17 Sep '08

17 Sep '08

Hi All, I've been using freeradius 1.1.5 for sometime. I use mysql for storing users and I have enabled sqlcounter module for restricitng monthly access time. Each user is member of a group and group's Max-Monthly-Session is set in radgroupcheck table. I have a script which is invoked from cron every month which calculates remaining time of users and does a insert/update/delete on radcheck so that there will be a record in radcheck if the user has any time left from the prevois month. Attribute is Max-Monthly-Session and value = (remaining + group's Max-Monthly-Session). This way I have implemented a session time carry over system. Recently I have upgraded freeradius to version 2.1.0. Everything is working well as expected other than sqlcounter. In new version it is ignoring the Max-Monthly-Session from radcheck table. I have installed radius in a new server but the same result. The radius debug output and sql table are available at http://pastebin.ca/1204050 Is there any config item for sqlcounter to process radcheck table? Thanks, JT

4 8

Using MySQL with FreeRADIUS.
by Twanny Azzopardi 17 Sep '08

17 Sep '08

Hello list, Can anyone help me with this. From what I gather, radcheck and radreply tables are sufficient to get an Access-Accept packet? Is there a way for radiusd to *not* check the radgroupcheck? Below is the output of radtest, my radcheck and radreply tables, and the output of radiusd -X. All help will be greatly appreciated. Best regards, Twanny. [root@webby ~]# /usr/bin/radtest barney betty localhost 1812 testing123 Sending Access-Request of id 136 to 127.0.0.1 port 1812 User-Name = "barney" User-Password = "betty" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=136, length=20 [root@webby ~]# --- mysql> select * from radcheck; +----+------------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+------------+-----------+----+--------+ | 1 | fredf | password | == | wilma | | 2 | barney | password | == | betty | | 3 | dialrouter | password | == | dialup | +----+------------+-----------+----+--------+ 3 rows in set (0.00 sec) mysql> select * from radreply; +----+------------+-------------------+----+-------------------------+ | id | UserName | Attribute | op | Value | +----+------------+-------------------+----+-------------------------+ | 1 | barney | Framed-IP-Address | := | 1.2.3.4 | | 2 | dialrouter | Framed-IP-Address | := | 2.3.4.1 | | 3 | dialrouter | Framed-IP-Netmask | := | 255.255.255.255 | | 4 | dialrouter | Framed-Routing | := | Broadcast-Listen | | 5 | dialrouter | Framed-Route | := | 2.3.4.0 255.255.255.248 | | 6 | dialrouter | Idle-Timeout | := | 900 | +----+------------+-------------------+----+-------------------------+ 6 rows in set (0.00 sec) --- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "shadow" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "xxxx" sql: password = "xxxx" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = yes sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeside@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32774, id=136, length=58 User-Name = "barney" User-Password = "betty" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "barney", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'barney' rlm_sql (sql): sql_set_user escaped user --> 'barney' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = 'barney' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = 'barney' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = 'barney' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = 'barney' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 136 to 127.0.0.1 port 32774 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 136 with timestamp 48d0d716 Nothing to do. Sleeping until we see a request. --- Best regards, Twanny Azzopardi. +356 79713618. _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 2

log incorrect login to mysql
by sub 17 Sep '08

17 Sep '08

Hi boys, I'd like to log to my mysql server every authentication request that reach my freeradius server. Actually I log the Access-Accept requests to radpostauth table but I'd like to have, into a table, the Access-Reject requests. Until now I've not found anything useful.... Thanks a lot! sub

4 6

NAS list with MySQL
by fibie roosadhy 17 Sep '08

17 Sep '08

dear all, i use command 'radiusd -X' to debug.i found this : rlm_sql (hotspot): - generate_sql_clients rlm_sql (hotspot): Query: SELECT * FROM nas_10 rlm_sql (hotspot): Reserving sql socket id: 7 rlm_sql_mysql: query: SELECT * FROM nas_10 rlm_sql (hotspot): Read entry nasname=10.11.12.0/24,shortname=gsd-lt7,*secret=gsd** lantai 7* rlm_sql (hotspot): Adding client 10.11.12.0/24 (gsd-lt7) to clients list rlm_sql (hotspot): Read entry nasname=10.11.21.0/24,shortname=gsd-lt14,*secret=**untuk** training* rlm_sql (hotspot): Adding client 10.11.21.0/24 (gsd-lt14) to clients list rlm_sql (hotspot): Released sql socket id: 7 fact,in my nas_10 table are : mysql> select * from nas_10 \G; *************************** 1. row *************************** id: 1 nasip: 10.11.12.0/24 shortname: gsd-lt7 secret: telkom community: mabes description: gsd lantai 7 tgl_pasang: 2008-09-11 *************************** 2. row *************************** id: 2 nasip: 10.11.21.0/24 shortname: gsd-lt14 secret: telkom community: lt14 description: untuk training tgl_pasang: 2008-09-11 2 rows in set (0.00 sec) can you help me please, thanks. fibie roosadhy indonesia

2 4

multiple DB
by baboda 16 Sep '08

16 Sep '08

Hi, I installed freeradius and mysql. Cause I have several database how can I change sql.conf and radiusd.conf to make freeradius to connect to more then one DB?

2 1

Authentication using postfix user password
by Tanya Muluw 16 Sep '08

16 Sep '08

Dear all. I am trying to use Chillispot for captive portal with freeradius v 1.188.2.4.2.16 as the radius server. I am new to both Chillispot and freeradius. Since most users of our organization have mail account in our postfix mail server, I tried to use postfix user password that stored in mysql for authentication. Therefore there will be two types of user, i.e users with postfix user password (encrypted password) and users with cleartext password as normally created using voucher generator. I inserted a user in radcheck with cleartext password, and a user from postfix mysql mailbox table. So my radcheck is : +-----+----------+---------------+----+------------------------------------+ | id | username | attribute | op | value | +-----+----------+---------------+----+------------------------------------+ | 223 | testman | User-Password | := | 123456 | | 225 | testman1 | User-Password | := | $1$bbf49e0f$MAcN54vB4L0wcKuYOCnQv/ | +-----+----------+---------------+----+------------------------------------+ The usergroup table : +----------+-----------+----------+ | username | groupname | priority | +----------+-----------+----------+ | testman | voucher | 1 | | testman1 | postfix | 1 | +----------+-----------+----------+ Test for user with cleartext password was successful. $ sudo radtest testman 123456 localhost 22 easyhotspot Sending Access-Request of id 142 to 127.0.0.1 port 1812 User-Name = "testman" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=142, length=20 Test for user with postfix user password was unsuccessful $ sudo radtest testman1 123456 localhost 22 easyhotspot Sending Access-Request of id 161 to 127.0.0.1 port 1812 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=161, length=20 from debugging : rad_recv: Access-Request packet from host 127.0.0.1:32817, id=161, length=60 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 11 modcall[authorize]: module "preprocess" returns ok for request 11 radius_xlat: 'testman1' rlm_sql (sql): sql_set_user escaped user --> 'testman1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testman1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testman1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 11 modcall: leaving group authorize (returns ok) for request 11 auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 11 for 1 seconds Finished request 11 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 161 to 127.0.0.1 port 32817 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 11 ID 161 with timestamp 48ced6ba Then I put Auth-Type:=PAP in radgroupcheck table +----+-----------+-----------+----+-------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+-------+ | 21 | postfix | Auth-Type | == | PAP | +----+-----------+-----------+----+-------+ However user with postfix user password still fail to authenticate $ sudo radtest testman1 123456 localhost 22 easyhotspot Sending Access-Request of id 157 to 127.0.0.1 port 1812 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=157, length=20 from debugging : rad_recv: Access-Request packet from host 127.0.0.1:32816, id=157, length=60 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 radius_xlat: 'testman1' rlm_sql (sql): sql_set_user escaped user --> 'testman1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testman1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testman1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 10 modcall: leaving group authorize (returns ok) for request 10 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 10 rlm_pap: login attempt with password 123456 rlm_pap: Using clear text password "$1$bbf49e0f$MAcN54vB4L0wcKuYOCnQv/". rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 10 modcall: leaving group PAP (returns reject) for request 10 auth: Failed to validate the user. Delaying request 10 for 1 seconds Finished request 10 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 157 to 127.0.0.1 port 32816 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 10 ID 157 with timestamp 48ced617 Nothing to do. Sleeping until we see a request. Radiusd.conf was unchanged. Is there any method to use user password of postfix mysql mailbox data to authenticate freeradius user? Thanks in advance, and sorry for my bad English. Best regards TM

2 2

Custom values for Post-Auth-Type
by Matthias Witte 16 Sep '08

16 Sep '08

I am not sure, whether this is the correct way to do this: I would like to use a custom Post-Auth-Type section like post-auth { Post-Auth-Type SQL { sqlmainpool } ... The corresponding line in users is: DEFAULT Service-Type == Framed-User, User-Profile := "framed", Post-Auth-Type := SQL This results in 'Parse error (check) for entry DEFAULT: Unknown value SQL for attribute Post-Auth-Type' unless I add an entry like VALUE Post-Auth-Type SQL 129 to the dictionary. I am using version 2.0.4. Mit freundlichem Gru�, -- Matthias Witte - witte(a)netzquadrat.de Telefon: +49 (0)211-30 20 33-18 Telefax: +49 (0)211-30 20 33-22 [netzquadrat] GmbH - Gladbacher Str. 74 - 40219 D�sseldorf HRB D�sseldorf 36121 - Gesch�ftsf�hrer: Thilo Salmon, Tim Mois Steuernummer: 106/5719/1836, Umsatzsteuer-ID: DE246863050 billiger-telefonieren.de - billiger-surfen.de - stromseite.de - sms.de

2 2