September 2008 - Freeradius-Users - lists.freeradius.org

authentication after accounting
by jose caceres 23 Sep '08

23 Sep '08

hello, I am breaking my mind now, i am trying to make the accounting of an sip/voip equipment but afte it succesfully starts the accounting it send another authentication request with some diferents AVPs and in my radiusd -X sais: rad_recv: Accounting-Request packet from host 200.X.X.X port 55576, id=0, length=292 Called-Station-Id = "3000" Acct-Status-Type = Start Cisco-Attr-100 = 0x7369702d73657475702d74696d653d536174205365702032302032323a32363a3031205045542032303038 Calling-Station-Id = "test" Acct-Session-Id = "98170424 104478101 55323532 61851730" Cisco-Attr-100 = 0x7369702d66726f6d2d7461673d35363635616438643831 NAS-Identifier = "nike.telestar.cl" Cisco-Attr-100 = 0x7369702d696e636f6d696e672d69703d3139302e34332e33362e3732 Service-Type = Sip-Session User-Name = "test" Cisco-Attr-100 = 0x7369702d636f6e662d69643d393831373034323420313034343738313031203535333233353332203631383531373330 NAS-Port = 5060 Sip-Method = INVITE +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 5060,Client-IP-Address = 200.X.X.X,NAS-IP-Address = 200.X.X.X,Acct-Session-Id = "98170424 104478101 55323532 61851730",User-Name = "test"' [acct_unique] Acct-Unique-Session-ID = "ef65cd74a6014dd0". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/200.X.X.X/detail-20080920 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/200.X.X.X/detail-20080920 expand: %t -> Sat Sep 20 22:35:53 2008 ++[detail] returns ok ++[unix] returns ok expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp expand: %{User-Name} -> test ++[radutmp] returns ok expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 0 to 200.X.X.X port 55576 Finished request 0. Cleaning up request 0 ID 0 with timestamp +13 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 200.X.X.X port 37772, id=1, length=192 NAS-Identifier = "nike.telestar.cl" Called-Station-Id = "3000" Cisco-Attr-100 = 0x7369702d7372632d616464726573733d3139302e34332e33362e3732 Calling-Station-Id = "test" User-Name = "test" NAS-Port = 5060 Cisco-Attr-100 = 0x7369702d636f6e662d69643d393831373034323420313034343738313031203535333233353332203631383531373330 Acct-Session-Id = "98170424 104478101 55323532 61851730" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry test at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 200.X.X.X port 37772 Reply-Message = "holamundo, test with digest" Waking up in 4.9 seconds. I assume that i need start with that, associating a previous accounting session in order to give in response some attributes, i would appreciate if any body can give me some guidance. thanks in advance -- Josexato

2 3

RE:..::Segmentation Fault::..
by Ing. Alfonso Reyes 23 Sep '08

23 Sep '08

Thanks for your help Alan, now it works. Right now I'm having another issue, but first I will check the mail archives before I send another alias. Thanks for your help. Have a great day. -----Original Message----- From: freeradius-users-bounces+alfonso.reyes=aztecagenecom.serveftp.net(a)lists.free radius.org [mailto:freeradius-users-bounces+alfonso.reyes=aztecagenecom.serveftp.net@li sts.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Martes, 23 de Septiembre de 2008 05:00 a.m. To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 41, Issue 99 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: ..::Segmentation Fault::.. (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 23 Sep 2008 08:05:41 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: ..::Segmentation Fault::.. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48D88735.9080801(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ing. Alfonso Reyes wrote: > This is my first alias, the reason of this alias is because I have a > freeradius server on my server to provide authentication, everything > was working fine until I tried to set it up to use mysql, after I > configure my server to check the mysql database I'm getting the > segmentation fault issue and I can't even start the radius server, any ideas? You've edited the default configuration files and broken them. Then, you've edited *another* set of configuration files, too. ... > including configuration file /usr/local/etc/raddb/sql.conf ... > =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2008.09.22 19:13:33 =~=~=~=~=~=~=~=~=~=~=~= > > "/etc/raddb/sql.conf" This isn't the same configuration file as above. You've edited /usr/local/etc/raddb/sql.conf to include itself. That's the reason why the text about including it is being printed so many times. Edit the *correct* configuration file: /usr/local/etc... not /etc/... Go back to the default "sql.conf". It's correct. Make the minimum number of changes required to get it working. and don't edit any lines that say "$INCLUDE". The last time you did that you broke it. Alan DeKok. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 41, Issue 99 ************************************************

1 0

ip address manipulation
by slanckma 23 Sep '08

23 Sep '08

Hi, I'm wondering what would be the best method do to math on IP addresses. I want to build my returned ip address based on the username and the NAS IP address. The NAS IP is simply a mapping from the source ip to a number Z The layout of the username is: userX(a)Y.com The resulting IP address would then be 2Z.Y.X (where X is converted from a number to the last two subnets of the ip address) For example NAS IP: 10.10.10.10 -> maps to 3 (there's only four NAS'ses so a simply array or list will suffice) USERNAME: user500(a)4.com Resulting IP address : 23.4.2.244 ("2.244" being the 500th ip address if we start at counting "1.1") Do I need to use an external script for this? What would you recommend? Thanks, Sven. -- View this message in context: http://www.nabble.com/ip-address-manipulation-tp19630827p19630827.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

freeRADIUS proxy to RSA Securid
by Chris Haskins 23 Sep '08

23 Sep '08

Hello, My company has purchased several of the RSA Securid appliances to provide OTP for our environment. The architecture calls for proxying from a central freeRADIUS server (on RHEL 5) to the RSA Securid appliances. I am new to the RADIUS protocol (1 week now), but I have my freeRADIUS setup to proxy all requests to the RSA appliance. Using tethereal, I see the RADIUS (UDP) packets going to the RSA appliance, but I do not receive a response. Another Engineering group is responsible for the RSA appliance setup, so I have very little insight into the workings of the RADIUS server running on them. My question is do we setup the central freeRADIUS server as a client on the RSA appliance, and is there instructions out there (possible from RSA) on how to accomplish this? Thank you for your time, Chris

4 7

RADIUSD amnesia!
by Dean, Barry 23 Sep '08

23 Sep '08

I am somewhat confused. My RADIUS server forgot about some clients, all by itself, honest! Users stopped being able to authenticate (I say users, we had one!), using eduroam from Portugal, turns out that some time after September 5th, the RADIUS server stopped recognising the JANET roaming RADIUS servers! I had to restart the servers on September 8th after a failure of our Active Directory servers. RADIUS/Winbind did not recover without help when AD came back. It was the same config however. There had been a restart on 17th March, 8th Sep and 23rd Sep, so RADIUS was running at the time it developed its amnesia. -X output attached, with error at the bottom I am seeing when trying to authenticate from off-site. Anyone got any ideas? ---cut here # /usr/radius/sbin/radiusd -X FreeRADIUS Version 2.0.2, for host i386-pc-solaris2.10, built on Mar 7 2008 at 09:52:42 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/radius/etc/raddb/radiusd.conf including configuration file /usr/radius/etc/raddb/proxy.conf including configuration file /usr/radius/etc/raddb/snmp.conf including configuration file /usr/radius/etc/raddb/eap.conf including configuration file /usr/radius/etc/raddb/sql.conf including configuration file /usr/radius/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/radius/etc/raddb/sql/mysql/counter.conf including configuration file /usr/radius/etc/raddb/policy.conf including files in directory /usr/radius/etc/raddb/sites-enabled/ including configuration file /usr/radius/etc/raddb/sites-enabled/janet-roaming including configuration file /usr/radius/etc/raddb/jrs-clients.conf including configuration file /usr/radius/etc/raddb/sites-enabled/local-auth including configuration file /usr/radius/etc/raddb/local-clients.conf including dictionary file /usr/radius/etc/raddb/dictionary main { prefix = "/usr/radius" localstatedir = "/usr/radius/var" logdir = "/usr/radius/log" libdir = "/usr/radius/lib" radacctdir = "/usr/radius/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/radius/var/run/radiusd/radiusd.pid" user = "radius" group = "radius" checkrad = "/usr/radius/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm LOCAL { authhost = LOCAL accthost = LOCAL } realm NULL { authhost = LOCAL accthost = LOCAL } realm liv.ac.uk { authhost = LOCAL accthost = LOCAL } realm liverpool.ac.uk { authhost = LOCAL accthost = LOCAL } realm DEFAULT { nostrip authhost = roaming0.ja.net:1812 accthost = roaming0.ja.net:1813 secret = <roaming0-secret> } realm DEFAULT { authhost = roaming1.ja.net:1812 accthost = roaming1.ja.net:1813 secret = <roaming1-secret> } # realm DEFAULT realm DEFAULT { authhost = roaming2.ja.net:1812 accthost = roaming2.ja.net:1813 secret = <roaming2-secret> } # realm DEFAULT radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server jrsradius { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/sfw/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/radius/log/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "<ldapserver>" port = 389 password = "<password>" identity = "CN=<ldap-user>,OU=UOL,DC=liv,DC=ac,DC=uk" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "OU=UOL,DC=liv,DC=ac,DC=uk" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/radius/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/radius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 80946e8 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/radius/etc/raddb/certs/cert-radius2.pem" certificate_file = "/usr/radius/etc/raddb/certs/cert-radius2.pem" CA_file = "/usr/radius/etc/raddb/certs/demoCA/cacert.pem" private_key_password = "<password>" dh_file = "/usr/radius/etc/raddb/certs/dh" random_file = "/usr/radius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/radius/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/radius/etc/raddb/huntgroups" hints = "/usr/radius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/usr/radius/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/radius/etc/raddb/users" acctusersfile = "/usr/radius/etc/raddb/acct_users" preproxy_usersfile = "/usr/radius/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/radius/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/radius/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/radius/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/radius/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server radius { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = jrsradius2.liv.ac.uk IP address [138.253.100.222] port = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "<password>" nastype = "other" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "dot1x" nastype = "cisco" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "wism1" nastype = "cisco" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "wism2" nastype = "cisco" } client roaming0.ja.net { require_message_authenticator = no secret = "<password>" shortname = "roaming0.ja.net" nastype = "other" } client roaming1.ja.net { require_message_authenticator = no secret = "<password>" shortname = "roaming1.ja.net" nastype = "other" } client roaming2.ja.net { require_message_authenticator = no secret = "<password>" shortname = "roaming2.ja.net" nastype = "other" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "roamnet1.liv.ac.uk" nastype = "other" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "campus" nastype = "other" } } listen { type = "acct" ipaddr = jrsradius2.liv.ac.uk IP address [138.253.100.222] port = 0 } listen { type = "auth" ipaddr = radius2.liv.ac.uk IP address [138.253.100.220] port = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "<password>" nastype = "other" } client 138.253.100.121 { require_message_authenticator = no secret = "<password>" shortname = "EZProxy" nastype = "other" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "wism1" nastype = "cisco" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "wism2" nastype = "cisco" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "vpn3000" nastype = "cisco" } client 138.253.xxx.xxx { require_message_authenticator = no secret = "<password>" shortname = "blueskt" nastype = "other" } } listen { type = "acct" ipaddr = radius2.liv.ac.uk IP address [138.253.100.220] port = 0 } Listening on authentication address 138.253.100.222 port 1812 as server jrsradius Listening on accounting address 138.253.100.222 port 1813 as server jrsradius Listening on authentication address 138.253.100.220 port 1812 as server radius Listening on accounting address 138.253.100.220 port 1813 as server radius Listening on proxy address 138.253.100.222 port 1814 Ready to process requests. Ignoring request to authentication address 138.253.100.222 port 1812 as server jrsradius from unknown client 194.83.56.233 port 61020 --------------- Barry Dean Networks Team Computing Services Department Web: http://pcwww.liv.ac.uk/~bvd/ --- Nice boy, but about as sharp as a sack of wet mice. -- Foghorn Leghorn

2 2

Issue with a new module and radiusd: symbol lookup error
by Luca Adamo 23 Sep '08

23 Sep '08

Hi everybody, I'm using a self compiled version of FreeRADIUS 2.1.0 on a Linux x86 box running ubuntu 8.04 updated. I've been able to succesfully install and configure the server and to run some test using a D-Link access-point getting a regular Access- Accept. My troubles started when I decided to implement a new module. My module has a structure similar to the sql module in fact it is used to query a MySQL database. I have been able to make this module connect to the database and to perform some operation on the reply packet during the postauth phase (basically adding attributes). I also wanted to use this module, rlm_wimax_qos, in the authorize phase but here I got stuck because a symbol lookup error. I'm providing all the details I can, first of all the final part of radiusd -X command: Module: Linked to module rlm_wimax_qos Module: Instantiating wimax_qos wimax_qos { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "rootpass" radius_db = "radiusDB" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '% {reply:Packet-Type}', NOW())" qos_profile_query = "SELECT qos_id FROM class_table WHERE EAP_Inner_GID='%{reply:EAP-Inner-GID}' AND EAP_Outer_GID='%{reply:EAP- Outer-GID}'" qos_get_attribute_query = "SELECT id,qos_id,attribute,value,op FROM qos_profile_table WHERE qos_id=%{reply:Qos_Id}" nas_capability_query = "SELECT NAS_DHCP_Support,DHCP_Proxy_Relay,MIP_FA_Address,type,nasname FROM nas_table WHERE nasname='%{NAS-IP-Address}'" dhcp_sec_assoc_query = "SELECT DHCP_RK_Key_ID,DHCP_RK_Lifetime,DHCP_RK FROM dhcp_handling_table WHERE DHCPv4_Server='%{reply:WiMAX-DHCPv4-Server}'" dhcp_sec_existid_query = "SELECT DHCP_RK_Key_ID,DHCP_RK_Lifetime,DHCP_RK FROM dhcp_handling_table WHERE DHCP_RK_Key_ID ='%{packet:WiMAX-DHCP-RK-Key-Id}'" dhcp_sec_update_query = "INSERT INTO dhcp_handling_table (DHCPv4_Server,DHCP_RK_Key_ID,DHCP_RK_Lifetime,DHCP_RK) VALUES ('% {reply:WiMAX-DHCPv4-Server}','%{reply:gen_WiMAX-DHCP-RK-Key-ID}','% {reply:gen_WiMAX-DHCP-RK-Lifetime}','%{reply:gen_WiMAX-DHCP-RK}')" dhcp_rm_old_key_query = "DELETE FROM dhcp_handling_table WHERE DHCPv4_Server='%{reply:WiMAX-DHCPv4-Server}'" static_only_config = "1" dhcp_rk_timeout = "36000" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (wimax_qos): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (wimax_qos): Attempting to connect to root@localhost:/radiusDB radiusd: symbol lookup error: /usr/local/lib/rlm_wimax_qos-2.1.0.so: undefined symbol: sql_init_socketpool Then I'm also providing the relevant portion of the radiusd.conf file. Please note that no problems occur if I only "call" the module during postauth. In this phase the module's behaviour is the one expected. authorize { preprocess auth_log wimax_qos eap } authenticate { eap mschap } preacct { preprocess acct_unique suffix files } accounting { detail radutmp sql } session { radutmp sql } post-auth { wimax_qos } Finally I can provide the last part of the module code, the one where I set the function that serves as an entry point during the authorize phase. module_t rlm_wimax_qos = { RLM_MODULE_INIT, "wimax_qos", RLM_TYPE_THREAD_SAFE, /* type */ wimax_qos_instantiate, /* instantiation */ wimax_qos_detach, /* detach */ { NULL, /* authentication */ wimax_qos_authorize, /* authorization */ NULL, /* preaccounting */ NULL, /* accounting */ NULL, /* checksimul */ NULL, /* pre-proxy */ NULL, /* post-proxy */ wimax_qos_postauth, /* post-auth */ }, }; I have tried by best to understand where the error below comes from. Compiling goes fine, no errors are found. If I put the module under authorize in radiusd.conf the error happen, otherwise everything is going fine (but nothing of what i want is performed during authorize). I'm keeping saying this because I want to point out that the issue is configuration dependent and that my code works in certain circumstances (i.e. the symbol is not missing from the dynamic library). rlm_sql (wimax_qos): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (wimax_qos): Attempting to connect to root@localhost:/radiusDB radiusd: symbol lookup error: /usr/local/lib/rlm_wimax_qos-2.1.0.so: undefined symbol: sql_init_socketpool If someone has a clue everything is welcome, and If more details are needed I can do my best to provide them. Thank you, Lu

2 3

No response from FreeRadius server
by Tomislav Goluza 23 Sep '08

23 Sep '08

Hi, I have configured FreeRadius on Centos 5. It is configured properly and ready to process requests. I get following output in log file: Tue Sep 23 14:26:04 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 23 14:26:04 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 23 14:26:04 2008 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 23 14:26:04 2008 : Info: Ready to process requests. I don't get any response after I send Access-Request. What could be possible cause(s) for this? Thank you for help, Tomislav.

3 3

freeradius 2.1.0 default mysql schema don't have nasidentifier table
by piston 23 Sep '08

23 Sep '08

freeradius 2.1.0 default mysql schema don't have nasidentifier table. And the mysql query in dialup.conf also don't have nasidentifier value. It is purposely left out the nasidentifier? My work around is adding nasidentifier and it's value as below. accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasidentifier, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Identifier}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_stop_query_alt = " \ INSERT INTO ${acct_table2} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasidentifier, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Identifier}', '%{NAS-Port}', \ '%{NAS-Port-Type}', \ DATE_SUB('%S', \ INTERVAL (%{%{Acct-Session-Time}:-0} + \ %{%{Acct-Delay-Time}:-0}) SECOND), \ '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', \ '%{Connect-Info}', \ '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ '%{%{Acct-Input-Octets}:-0}', \ '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ '%{%{Acct-Output-Octets}:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', \ '%{Acct-Terminate-Cause}', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '0', '%{%{Acct-Delay-Time}:-0}')"

2 1

SQL and ippool
by Xiaochen Jing 23 Sep '08

23 Sep '08

Hello all, The scenario will be: when Freeradius receives a user request, it forwards it to SQL server (local or remote) for authenticating the username/password. If the username/password is valid, then Freeradius will use a certain ippool to assign IP address to the user, based on username. Can this be accomplished? I am wondering, when SQL sends a reply back to Freeradius, how can Freeradius knows what ippool it should use to assign IP based on user name? Can anyone shed some light on it? Thanks in advance

5 5

..::Segmentation Fault::..
by Ing. Alfonso Reyes 23 Sep '08

23 Sep '08

Hi Team. This is my first alias, the reason of this alias is because I have a freeradius server on my server to provide authentication, everything was working fine until I tried to set it up to use mysql, after I configure my server to check the mysql database I'm getting the segmentation fault issue and I can't even start the radius server, any ideas? Configuration files and error attached. Thanks for your help. Have a great day. Alfonso.

2 1