January 2009 - Freeradius-Users - lists.freeradius.org

Static Proxy Accounting
by Francesco Toro XB 19 Jan '09

19 Jan '09

Hi All, I'm evaluating FreeRadius Server for my Company. I'm very interested in a specific functionality, as explained in the mail subject. I guess if it's possible to set FreeRadius to statically forward accounting request ( only Start, Stop and Interim ) still acting as Master Server, i.e. without waiting for the Home Server respose before sending the right response to the client (NAS). In other words,the FreeRadius behavior shall be the same it has when it works "stand alone", but, at same time, it shall forward to a particular home server, for example only for logging or statistic purpose, only the accounting requests mentioned above. Is possible to configure FreRadius in such way? Thank you for you attention, Francesco Toro.

3 8

help with freeradius + winxp
by Tomas D 19 Jan '09

19 Jan '09

Dear list, I'm new to the whole radius deal, so please excuse me if this sounds stupid/easy to you... I'm trying to setup freeradius system which would authenticate windows users. I'm not going for all bells and whistles at this point and only use users file for testing. I have following in my users file: steve Cleartext-Password := "testing" I've configured windows xp machine, HP procurve 2800 series and freeradius-server-2.1.3 server. It appears they all talk to each other, I'm so sure if it's the same language though (: Here's extract from my radiusd -X: radius@radius:~$ sudo ./sbin/radiusd -X [sudo] password for radius: FreeRADIUS Version 2.1.3, for host i686-pc-linux-gnu, built on Jan 7 2009 at 12:52:45 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /home/radius/etc/raddb/radiusd.conf including configuration file /home/radius/etc/raddb/proxy.conf including configuration file /home/radius/etc/raddb/clients.conf including files in directory /home/radius/etc/raddb/modules/ including configuration file /home/radius/etc/raddb/modules/etc_group including configuration file /home/radius/etc/raddb/modules/files including configuration file /home/radius/etc/raddb/modules/expiration including configuration file /home/radius/etc/raddb/modules/detail.log including configuration file /home/radius/etc/raddb/modules/smbpasswd including configuration file /home/radius/etc/raddb/modules/chap including configuration file /home/radius/etc/raddb/modules/mschap including configuration file /home/radius/etc/raddb/modules/ippool including configuration file /home/radius/etc/raddb/modules/digest including configuration file /home/radius/etc/raddb/modules/radutmp including configuration file /home/radius/etc/raddb/modules/realm including configuration file /home/radius/etc/raddb/modules/attr_rewrite including configuration file /home/radius/etc/raddb/modules/echo including configuration file /home/radius/etc/raddb/modules/policy including configuration file /home/radius/etc/raddb/modules/mac2vlan including configuration file /home/radius/etc/raddb/modules/sql_log including configuration file /home/radius/etc/raddb/modules/preprocess including configuration file /home/radius/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /home/radius/etc/raddb/modules/krb5 including configuration file /home/radius/etc/raddb/modules/pam including configuration file /home/radius/etc/raddb/modules/wimax including configuration file /home/radius/etc/raddb/modules/linelog including configuration file /home/radius/etc/raddb/modules/always including configuration file /home/radius/etc/raddb/modules/exec including configuration file /home/radius/etc/raddb/modules/inner-eap including configuration file /home/radius/etc/raddb/modules/checkval including configuration file /home/radius/etc/raddb/modules/passwd including configuration file /home/radius/etc/raddb/modules/expr including configuration file /home/radius/etc/raddb/modules/perl including configuration file /home/radius/etc/raddb/modules/detail.example.com including configuration file /home/radius/etc/raddb/modules/pap including configuration file /home/radius/etc/raddb/modules/ldap including configuration file /home/radius/etc/raddb/modules/unix including configuration file /home/radius/etc/raddb/modules/detail including configuration file /home/radius/etc/raddb/modules/counter including configuration file /home/radius/etc/raddb/modules/sradutmp including configuration file /home/radius/etc/raddb/modules/attr_filter including configuration file /home/radius/etc/raddb/modules/mac2ip including configuration file /home/radius/etc/raddb/modules/logintime including configuration file /home/radius/etc/raddb/modules/acct_unique including configuration file /home/radius/etc/raddb/eap.conf including configuration file /home/radius/etc/raddb/sql.conf including configuration file /home/radius/etc/raddb/sql/mysql/dialup.conf including configuration file /home/radius/etc/raddb/sql/mysql/counter.conf including configuration file /home/radius/etc/raddb/policy.conf including files in directory /home/radius/etc/raddb/sites-enabled/ including configuration file /home/radius/etc/raddb/sites-enabled/inner-tunnel including configuration file /home/radius/etc/raddb/sites-enabled/default including dictionary file /home/radius/etc/raddb/dictionary main { prefix = "/home/radius" localstatedir = "/home/radius/var" logdir = "/home/radius/var/log/radius" libdir = "/home/radius/lib" radacctdir = "/home/radius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/home/radius/var/run/radiusd/radiusd.pid" checkrad = "/home/radius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.106.152.0/22 { require_message_authenticator = no secret = "testing123" shortname = "private-network-1" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/home/radius/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/home/radius/etc/raddb/users" acctusersfile = "/home/radius/etc/raddb/acct_users" preproxy_usersfile = "/home/radius/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/home/radius/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/home/radius/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/home/radius/etc/raddb/huntgroups" hints = "/home/radius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/home/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/home/radius/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.106.152.201 port 1024, id=42, length=213 Framed-MTU = 1480 NAS-IP-Address = 10.106.152.201 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "steve" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-11-0a-fe-a9-3f" Calling-Station-Id = "00-17-a4-4e-77-47" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x0201000a017374657665 Message-Authenticator = 0xa925e02de0c1e7b264752f752e45e02b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 42 to 10.106.152.201 port 1024 EAP-Message = 0x010200160410da1bba70f6f6962ec82a1a0a2f629b6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x484324584841203e652bfcf703ca7fbb Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.106.152.201 port 1024, id=43, length=227 Framed-MTU = 1480 NAS-IP-Address = 10.106.152.201 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "steve" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-11-0a-fe-a9-3f" Calling-Station-Id = "00-17-a4-4e-77-47" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x484324584841203e652bfcf703ca7fbb EAP-Message = 0x020200060319 Message-Authenticator = 0x5fe652d65d59cb0545d6268a73ed8678 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> steve attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 43 to 10.106.152.201 port 1024 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 42 with timestamp +20 Waking up in 0.9 seconds. Cleaning up request 1 ID 43 with timestamp +20 Ready to process requests. I did not specify domain when putting username and password and I can see that in log this is called realm and it is set to NULL, how do I configure realm in users config? Thanks everyone for help

4 8

radgroupcheck v1.x and v2.x difference ?
by lamersons 19 Jan '09

19 Jan '09

upgraded freeradius from 1.x to 2.x version and some parts of radgroupcheck are now refusing to work as they did in first version. 1. i have user 'evdo(a)evdo.lattelecom' in usergroup it has 'LTK' group. 2. in radgroupcheck group 'LTK' has been given the attribute 'Calling-Station-Id' so the look is LTK|Calling-Station-Id|=~|14703371 The meaning of this(how i understend it) is that if calling-station-id in radgroupcheck differs from incoming calling-station-id it would give reject. But it doesnt. How can i limit one pool of Calling-Station-Ids from using different logins ? ------------------ Debug of how entered wrong calling-station-id(LTK|Calling-Station-Id|=~|14703371) to radgroupcheck, and it still returned ok --- rad_recv: Access-Request packet from host 192.168.145.1 port 1812, id=74, length=180 3GPP2-Correlation-Id = "36267509" 3GPP2-Service-Option = 59 User-Name = "evdo(a)evdo.lattelecom" CHAP-Challenge = 0x66853bea6d3cb9565a0fcdfcf212ac37 CHAP-Password = 0x01c9f14ad379679686d83e343590d84910 NAS-Port-Type = Virtual Calling-Station-Id = "247033715800852" Service-Type = Framed-User Framed-Protocol = PPP NAS-IP-Address = 192.168.145.1 Framed-IP-Address = 0.0.0.0 Framed-IP-Netmask = 0.0.0.0 Event-Timestamp = "Jan 19 2009 10:12:58 EET" 3GPP2-Prepaid-acct-Capability = 0x010600000003 +- entering group authorize {...} [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "evdo.lattelecom" for User-Name = "evdo(a)evdo.lattelecom" [suffix] No such realm "evdo.lattelecom" ++[suffix] returns noop [sql] expand: %{User-Name} -> evdo(a)evdo.lattelecom [sql] sql_set_user escaped user --> 'evdo(a)evdo.lattelecom' rlm_sql (sql): Reserving sql socket id: 18 [sql] expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'evdo(a)evdo.lattelecom' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' union SELECT id, UserName, Attribute, Value, op FROM station_id WHERE Username = '%{Calling-Station-Id}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'evdo(a)evdo.lattelecom' union SELECT id, UserName, Attribute, Value, op FROM station_id WHERE Username = '247033715800852' ORDER BY id [sql] expand: SELECT GroupName FROM usergroup WHERE UserName = '%{SQL-User-Name}' ORDER BY id -> SELECT GroupName FROM usergroup WHERE UserName = 'evdo(a)evdo.lattelecom' ORDER BY id [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'LTK' ORDER BY id [sql] expand: %{Calling-Station-Id} -> 247033715800852 [sql] User found in group LTK [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'LTK' ORDER BY id rlm_sql (sql): Released sql socket id: 18 ++[sql] returns ok [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP ---------------------- queries are: -------------- nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' union SELECT id, UserName, Attribute, Value, op FROM station_id WHERE Username = '%{Calling-Station-Id}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName = '%{SQL-User-Name}' ORDER BY id" -- View this message in context: http://www.nabble.com/radgroupcheck-v1.x-and-v2.x-difference---tp21538835p2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Huntgroups issue - every user is accepted
by Hanno Schupp 19 Jan '09

19 Jan '09

Dear All, I am trying to implement huntgroups via MySQL according to http://wiki.freeradius.org/SQL_Huntgroup_HOWTO On difference is the assignment of huntgroups not according to NAS-IP, but to Called-Station-Id. The goal is to suppress roaming between hotspot routers, between groups of hotspots. For that purpose I have inserted the code ... update request { Huntgroup-Name := "%{sql02:select groupname from radhuntgroup where calledstationid = '%{Called-Station-Id}'}" } ... In lieu of the module 'preprocess' into group 'authorize', as advised in the HOWTO. I have maintained the following entries in SQL tables: `radhuntgroup` `id`, `groupname`, `calledstationid` 1, 'Test-Rejec', '00-1D-7E-E7-96-9F' `usergroup` `UserName`, `GroupName`, `priority` 'yubvef13', 'TestGroup', 1 `radgroupcheck` `id`, `GroupName`, `Attribute`, `op`, `Value` 1, 'TestGroup', 'Huntgroup-Name', ':=', 'Test' One would expect the user to be rejected if the user tries to log in to the router with the Called-Station-Id '00-1D-7E-E7-96-9F', However, the user is authenticated and not rejected. Here the relevant parts of the debug: ... Mon Jan 19 20:57:03 2009 : Info: sql_xlat Mon Jan 19 20:57:03 2009 : Debug: expand: %{User-Name} -> yubvef13 Mon Jan 19 20:57:03 2009 : Info: sql_set_user escaped user --> 'yubvef13' Mon Jan 19 20:57:03 2009 : Debug: expand: select groupname from radhuntgroup where calledstationid = '%{Called-Station-Id}' -> select groupname from radhuntgroup where calledstationid = '00-1D-7E-E7-96-9F' Mon Jan 19 20:57:03 2009 : Debug: expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Reserving sql socket id: 3 Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query: select groupname from radhuntgroup where calledstationid = '00-1D-7E-E7-96-9F' Mon Jan 19 20:57:03 2009 : Info: sql_xlat finished Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Released sql socket id: 3 Mon Jan 19 20:57:03 2009 : Debug: expand: %{sql02:select groupname from radhuntgroup where calledstationid = '%{Called-Station-Id}'} -> Test-Rejec Mon Jan 19 20:57:03 2009 : Info: ++[request] returns notfound Mon Jan 19 20:57:03 2009 : Info: ++[chap] returns noop Mon Jan 19 20:57:03 2009 : Info: ++[mschap] returns noop Mon Jan 19 20:57:03 2009 : Info: [suffix] No '@' in User-Name = "yubvef13", looking up realm NULL Mon Jan 19 20:57:03 2009 : Info: [suffix] No such realm "NULL" Mon Jan 19 20:57:03 2009 : Info: ++[suffix] returns noop Mon Jan 19 20:57:03 2009 : Info: [eap] No EAP-Message, not doing EAP Mon Jan 19 20:57:03 2009 : Info: ++[eap] returns noop Mon Jan 19 20:57:03 2009 : Info: ++- entering redundant-load-balance group sql0203 {...} Mon Jan 19 20:57:03 2009 : Debug: expand: %{User-Name} -> yubvef13 Mon Jan 19 20:57:03 2009 : Info: [sql02] sql_set_user escaped user --> 'yubvef13' Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Reserving sql socket id: 2 Mon Jan 19 20:57:03 2009 : Debug: expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'yubvef13' ORDER BY id Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'yubvef13' ORDER BY id Mon Jan 19 20:57:03 2009 : Info: [sql02] User found in radcheck table Mon Jan 19 20:57:03 2009 : Debug: expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'yubvef13' ORDER BY id Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'yubvef13' ORDER BY id Mon Jan 19 20:57:03 2009 : Debug: expand: SELECT groupname FROM usergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = BINARY 'yubvef13' ORDER BY priority Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query: SELECT groupname FROM usergroup WHERE username = BINARY 'yubvef13' ORDER BY priority Mon Jan 19 20:57:03 2009 : Debug: expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'TestGroup' ORDER BY id Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'TestGroup' ORDER BY id Mon Jan 19 20:57:03 2009 : Info: [sql02] User found in group TestGroup Mon Jan 19 20:57:03 2009 : Debug: expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'TestGroup' ORDER BY id Mon Jan 19 20:57:03 2009 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'TestGroup' ORDER BY id Mon Jan 19 20:57:03 2009 : Debug: rlm_sql (sql02): Released sql socket id: 2 Mon Jan 19 20:57:03 2009 : Info: +++[sql02] returns ok ... One thing I don't get is, why is the rlm_sql_mysql module finding the Hungroup-Name 'Test-Rejec' correctly, but module 'request' returns not found? The user is found in radgroupchek for the correct usergroup 'TestGroup'. As the values in radgroupcheck and radgroupreplycheck do not match, the user should be rejected, but the user is accepted. What am I doing wrong?

3 5

check certs parameters
by Dario 19 Jan '09

19 Jan '09

hi guys, i need to check certs of a client that connected to my radius server.for example i want to check only the state,the provence or only the organization unit.is it possible?the options check_cert_issuer and check_Cert_cn doesn't do this :( bye dario

2 1

Re: Authenticate users via AD and checking group membership:SOLVED
by Godfrey Peart 18 Jan '09

18 Jan '09

Thanks for that, can now see attributes being received by my NAS Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> radman02 [sql] sql_set_user escaped user --> 'radman02' [sql] expand: %{User-Password} -> [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (us ername, pass, reply, authdate) VALUES ( 'radman02', '', 'Access-Accept', ' 2009-01-18 22:43:47') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radman02', '', 'Access-Accept', '2009-01-18 22:43:47') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 180 to 140.97.3.29 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "staff" Tunnel-Type:0 = VLAN User-Name = "radman02" MS-MPPE-Recv-Key = 0x467fedcc7b18167ddb432067c80db040b838295c47071a357e2d53785a2d2968 MS-MPPE-Send-Key = 0x8e6e1ce87235db5f65d5b7fdee69157be77cd18cd311416462dc1194e325de8f EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 22. Going to the next request Waking up in 4.6 seconds.

1 0

Re: Authenticate users via AD and checking group membership:SOLVED
by Godfrey Peart 18 Jan '09

18 Jan '09

I would like to say thanks to the forum, my problem was solved for information this is what I had to configure to get it all working my only bit of concern was a warning message: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details but I'll check that out later. Make sure everything else is working fine via your AD + ntlm_auth I added additional items to the ldap attributes file /etc/raddb/ldap.attrmap ldap.attrmap-file amendments #added Tunnel attributes 17-01-09 replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId replyItem Tunnel-Type radiusTunnelType #I added the Ldap-Group attribute to the top of my users file /etc/raddb/users #I have two groups configured on my test AD, and will search both DEFAULT Ldap-Group == "dmwc-m" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = videoNet, Tunnel-type = VLAN DEFAULT Ldap-Group == "dmwc-s" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = staff, Tunnel-type = VLAN ## I have cisco kit so use the name of the vlan not it's vlan number## ## My amendements to /etc/raddb/modules/ldap ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "10.10.6.131" #identity = "cn=admin,o=My Org,c=UA" identity = "cn=Administrator,cn=users,dc=MYDOMAIN,dc=co,dc=uk" password = yourADpassword basedn = "cn=users,dc=MYDOMAIN,dc=co,dc=uk" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" # Group membership checking. Disabled by default. groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" * ##My groupmembership differs from the example due to the way AD names it's objects##* groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn})))" ##My groupmembership_attribute differs from the example due to the way AD names it's objects## *##If you see my ldapsearch from the earlier post you'll know why##* # groupmembership_attribute = radiusGroupName groupmembership_attribute = memberOf #ldap_debug = 0x0028 #I wanted to see more detail from the ldap function so enabled debug## ldap_debug = 0xFFFF } I changed nothing else in this file, since I'm testing so not using LDAPS ## The only change in /etc/raddb/sites-enabled/default was uncomment the ldap section ## I left the authenticate section well alone, it stopped EAP when I started LDAP bit of it authorize { chap mschap eap { ok = return } # I have users in a SQL database, don't want AD messing it up# sql if (ok) { update control { MS-CHAP-Use-NTLM-Auth := No } } # I uncommented the ldap section## ldap files expiration logintime pap } ## The only change in /etc/raddb/sites-enabled/inner-tunnel was uncomment the ldap section authorize { authorize { chap mschap update control { Proxy-To-Realm := LOCAL } eap { ok = return } sql if (ok) { update control { MS-CHAP-Use-NTLM-Auth :=No } } # I uncommented the ldap section## ldap # Read the 'users' file files expiration logintime pap } This is an edited output from the radius debug [ldap] performing user authorization for radman02 [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=radman02)) [ldap] expand: cn=users,dc=crosstalk,dc=co,dc=uk -> cn=users,dc=crosstalk,dc=co,dc=uk rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=users,dc=crosstalk,dc=co,dc=uk, with filter (&(sAMAccountName=radman02)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user radman02 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_ldap: Entering ldap_groupcmp() [files] expand: cn=users,dc=crosstalk,dc=co,dc=uk -> cn=users,dc=crosstalk,dc=co,dc=uk [files] expand: (|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=))(&(objectClass=top)( uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=users,dc=crosstalk,dc=co,dc=uk, with filter (&(cn=dmwc-m)(|(&(objectClass=group)(member=))(&(objectClass=top)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=radman02,CN=Users,DC=crosstalk,DC=co,DC=uk, with filter (objectclass=*) rlm_ldap: performing search in CN=DMWC-S,CN=Users,DC=crosstalk,DC=co,DC=uk, with filter (cn=dmwc-m) rlm_ldap: object not found or got ambiguous search result rlm_ldap::groupcmp: Group dmwc-m not found or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: cn=users,dc=crosstalk,dc=co,dc=uk -> cn=users,dc=crosstalk,dc=co,dc=uk [files] expand: (|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=))(&(objectClass=top)( uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=users,dc=crosstalk,dc=co,dc=uk, with filter (&(cn=dmwc-s)(|(&(objectClass=group)(member=))(&(objectClass=top)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=radman02,CN=Users,DC=crosstalk,DC=co,DC=uk, with filter (objectclass=*) rlm_ldap: performing search in CN=DMWC-S,CN=Users,DC=crosstalk,DC=co,DC=uk, with filter (cn=dmwc-s) rlm_ldap::ldap_groupcmp: User found in group dmwc-s rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 7 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "staff" Tunnel-Type:0 = VLAN EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radman02" [peap] Got tunneled reply RADIUS code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "staff" Tunnel-Type:0 = VLAN EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radman02" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 149 to 10.10.3.29 port 1645 EAP-Message = 0x010c002b19001703010020728cf1296a7fbd29a4fbdd91f4eb91f41556edff389bd508e76784386de2a70a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1092235a199e3a66f6b5d4d498ec03a0 Finished request 10. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.10.3.29 port 1645, id=150, length=222 User-Name = "radman02" Framed-MTU = 1400 Called-Station-Id = "0021.55ac.f2d2" Calling-Station-Id = "0013.498d.a61f" Service-Type = Login-User Message-Authenticator = 0xad3bca4d90af3e257cb1d6e093ce61b4 EAP-Message = 0x020c005019001703010020ed5d9b0cbdb88826957605ccde2fc1e9c6665da024547d82af4f555fafffad1c1703010020efd0be4bf53aa8c267d8f19e58f80f8bd907076fc9e236e910f4aff6b3 4f3027 NAS-Port-Type = Wireless-802.11 NAS-Port = 4380 NAS-Port-Id = "4380" State = 0x1092235a199e3a66f6b5d4d498ec03a0 NAS-IP-Address = 10.10.3.29 NAS-Identifier = "THEO" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "radman02", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> radman02 [sql] sql_set_user escaped user --> 'radman02' [sql] expand: %{User-Password} -> [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (us ername, pass, reply, authdate) VALUES ( 'radman02', '', 'Access-Accept', ' 2009-01-18 22:01:43') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radman02', '', 'Access-Accept', '2009-01-18 22:01:43') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 150 to 10.10.3.29 port 1645 MS-MPPE-Recv-Key = 0x5624be3ba66dd23cd25917c57661775be5c44b565056f613bed23f4c00734d99 MS-MPPE-Send-Key = 0x6aed0e4c2a8dceafd68d6647931ec43eaa0b5ba7b9048c50b70702b86f9e6e59 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radman02" Finished request 11. Going to the next request Waking up in 4.6 seconds. rad_recv: Accounting-Request packet from host 10.10.3.29 port 1646, id=31, length=223 Acct-Session-Id = "000010F0" Called-Station-Id = "0021.55ac.f2d2" Calling-Station-Id = "0013.498d.a61f" Cisco-AVPair = "ssid=metnet01" Cisco-AVPair = "vlan-id=40" Cisco-AVPair = "nas-location=unspecified" User-Name = "radman02" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 NAS-Port = 4380 NAS-Port-Id = "4380" Service-Type = Framed-User NAS-IP-Address = 10.10.3.29 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 4380,Client-IP-Address = 10.10.3.29,NAS-IP-Address = 10.10.3.29,Acct-Session-Id = "000010F0",User-Name = "radman02"' [acct_unique] Acct-Unique-Session-ID = "bca4df300dada0d6". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "radman02", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.10.3.29/detail-20090118 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.10.3.29/detail-20090118 [detail] expand: %t -> Sun Jan 18 22:01:43 2009 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> radman02 ++[radutmp] returns ok [sql] expand: %{User-Name} -> radman02 [sql] sql_set_user escaped user --> 'radman02' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutput octets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acct stopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{ NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '% {Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> radman02 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 31 to 10.10.3.29 port 1646 Finished request 12. Cleaning up request 12 ID 31 with timestamp +12 Going to the next request Waking up in 4.5 seconds. Cleaning up request 1 ID 140 with timestamp +12 Cleaning up request 2 ID 141 with timestamp +12 Cleaning up request 3 ID 142 with timestamp +12 Cleaning up request 4 ID 143 with timestamp +12 Cleaning up request 5 ID 144 with timestamp +12 Waking up in 0.1 seconds.

2 1

Framed-IP-Address Question
by Stefan Puch 18 Jan '09

18 Jan '09

Hello everyone, I've got a (maybe stupid) question concerning the Framed-IP-Address which is shown when using "radwho". I'm using freeradius in our club to authenticate several Notebooks using EAP-TLS certificates. The IP-addresses are given from a local dhcp-server. I'm further using access-points from Netgear (WG102) as they provide Accounting informations when using with freeradius. With the tool radwho which is provided from freeradius a can easily see which clients are connected to the different access-points. Now I recognized that for some clients also the local IP-address, which was given to the clients from the local dhcp-server, is shown as "Framed-IP-Address" when running "radwho -R" but only for SOME clients not for ALL. I would like to write a small script using radwho in order to log the ip-adress for each client on login/logout. Sure I could get the ip-address from logfile of the dhcp-server, but I would like to do it as easy as possible. Can anyone tell me why the "Framed-IP-Address" is only shown for some clients and what I would have to do that it is show for all clients which are connected to local network? Best regards and thanks in advance Stefan Puch

3 4

First steps on RADIUS and fisrt doubts
by Calos Lopez 18 Jan '09

18 Jan '09

Hi all, I've an Ubuntu distro installation (distribution 8.10 server) and I want to setup on my home wireless network a FreeRadius server using EAP/PEAP MSChap authentication with a LDAP server. I followed the instructions is this link http://www.linuxinsight.com/building-debian-freeradius-package-with-eap-tls… to enable EAP on RADIUS. After all configured I runned freeradius -X wich terminated with the following error: rlm_eap: Failed to link EAP-Type/tls: file not found /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Errors initializing modules What I'm I doing wrong? Didn't I build or configured correctly FreeRadius. Thanks a lot for your help, I'm gust a beginner in this steps. Attached is all the output. Any other files need to post here, please let me know.

2 2

Re: Freeradius-Users Digest, Vol 45, Issue 60
by obaid ghaznawi 18 Jan '09

18 Jan '09

Hi all, it is solved now, everything was OK except some configuration mistakes, during configuration i followed freeradius.org HOWTO here: http://wiki.freeradius.org/SQL_HOWTO and this HOWTO is for versions before 2 i guess, because it says: Edit /etc/raddb/radiusd.conf and add a line saying 'sql' to the authorize{} > section (which is towards the end of the file). The best place to put it is > just after the 'files' entry. Indeed, if you'll just be using SQL, and not > falling back to text files, you could comment out or delete the 'files' > entry altogether. > i did this in radiusd.conf, so there were duplicate authrize{}, session{}, one in radiusd.conf and other one in the include file /etc/freeradius/sql/mysql/sites-enabled/default. just removing lines of authorize{} and session{} from radiusd.conf and configuring properly at /etc/freeradiusd/sql/mysql/sites-enabled/default everything works fine now. thank you for your support Leigh Martell. and thanks to freeradius.org team. update http://wiki.freeradius.org/SQL_HOWTO so new users can follow. On Fri, Jan 16, 2009 at 5:14 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Freeradius + MySQL problem (obaid ghaznawi) > 2. Re: Freeradius + MySQL problem (Leigh Martell) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 16 Jan 2009 16:49:11 +0300 > From: obaid ghaznawi <onaogh(a)gmail.com> > Subject: Freeradius + MySQL problem > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <b8f8e85f0901160549y545cb350ucbf11e3af785a103(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > hi, first of all, i thank all people who are giving thier time to help. > > before i subscribe here and post my email, i am searching around in > internet since a week > and trying my best to solve it, i have learned many things,but there is one > problem i cannot get it solved. > i am trying to make hotspot for some building, i choosed: > Freeradius + Mysql = running on 1 computer (ubuntu server 8.10) as backend > server > and CoovaAP on WRT54GL sending user credentials to backend server for > authentication > my configs (default settings not showed, lines i changed showed) > > freeradius radiusd.conf > ================================================ > . > . all default > . > log { > . > . > #at the end of log{ > auth = yes > auth_badpass = yes > auth_goodpass = yes > } > > modules { > . > . > . > $INCLUDE sql.conf #already there > $INCLUDE sql/mysql/counter.conf #already there > . > . > . > } > > authorize{ > preprocess > chap > mschap > suffix > eap > sql #if i comment out sql and use file, it works, i recive > Packet-Accept, with SQL see the pap warning in debug text > pap > } > > accounting{ > detail > sql > } > > session{ > sql > } > ================================================== > clients.conf > > client localhost { > ipaddr = 127.0.0.1 > secret = clientradsec36365 > require_message_authenticator = no > nastype = other > > } > ================================================== > sql.conf > sql { > database = "mysql" > driver = "rlm_sql_${database}" > server = "localhost" > login = "radius" > password = "frsqldblogin36365" > radius_db = "radius" > . > . > . > sqltrace = yes > sqltracefile = ${logdir}/sqltrace.sql > . > . > } > > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > > /etc/freeradius/sql/mysql/schema.sql and nas.sql has been imported into > mysql "radius" database, radius@localhost user granted all on radius.* > > dummy data in tables: > > mysql> SELECT * FROM radcheck; > +----+----------+--------------------+----+-------+ > | id | username | attribute | op | value | > +----+----------+--------------------+----+-------+ > | 1 | obaid | Cleartext-Password | := | 36365 | > +----+----------+--------------------+----+-------+ > 1 row in set (0.00 sec) > > mysql> SELECT * FROM radusergroup; > +----------+-----------+----------+ > | username | groupname | priority | > +----------+-----------+----------+ > | obaid | hotspot | 0 | > +----------+-----------+----------+ > 1 row in set (0.01 sec) > > mysql> SELECT * FROM radgroupcheck; > +----+-----------+-----------+----+-------+ > | id | groupname | attribute | op | value | > +----+-----------+-----------+----+-------+ > | 2 | hotspot | Auth-Type | := | Local | > +----+-----------+-----------+----+-------+ > 1 row in set (0.00 sec) > > > mysql> SELECT * FROM radreply; > +----+----------+---------------+----+-------+ > | id | username | attribute | op | value | > +----+----------+---------------+----+-------+ > | 1 | obaid | Reply-Message | := | Hello | > +----+----------+---------------+----+-------+ > 1 row in set (0.00 sec) > > mysql> SELECT * FROM radgroupreply; > +----+-----------+-----------------+----+-------------+ > | id | groupname | attribute | op | value | > +----+-----------+-----------------+----+-------------+ > | 1 | hotspot | Framed-Protocol | := | PPP | > | 2 | hotspot | Service-Type | := | Framed-User | > +----+-----------+-----------------+----+-------------+ > 2 rows in set (0.00 sec) > > @#$@#$@#$@#$@#$@#$@#$@#$@#$@#$@#$@#$@#$@#$@#$ > > now when running /usr/sbin/freeradius -X and send auth request with radtest > i get > radtest obaid 36365 localhost 1812 clientradsec36365 > > Sending Access-Request of id 96 to 127.0.0.1 port 1812 > User-Name = "obaid" > User-Password = "36365" > NAS-IP-Address = 192.168.1.100 > NAS-Port = 1812 > rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=96, > length=20 > > freeradius -X: > > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on proxy address * port 1814 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1 port 40386, id=96, > length=57 > User-Name = "obaid" > User-Password = "36365" > NAS-IP-Address = 192.168.1.100 > NAS-Port = 1812 > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "obaid", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > No authenticate method (Auth-Type) configuration found for the request: > Rejecting the user > Failed to authenticate the user. > Login incorrect: [obaid/36365] (from client server port 1812) > Using Post-Auth-Type Reject > +- entering group REJECT {...} > expand: %{User-Name} -> obaid > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 0 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 0 > Sending Access-Reject of id 96 to 127.0.0.1 port 40386 > Waking up in 4.9 seconds. > Cleaning up request 0 ID 96 with timestamp +17 > Ready to process requests. > > -========================================================= > have you noticed that debug output doesnt talk about sql queries ???, and > nothing about sql queries in log files. > > i have used ntradping to send authentication request with CHAP ticked/not > ticked, and i get the same rad+recv:Access-Reject. > > but with all same config (except commenting sql and uncomment file in > radius.conf) and radtesting it works fine. > > it is probably radius cant query mysql, but i used mtop (mysql monitoring > tool) and it showes that radius queried mysql > > or it might be wrong dummy data... > ----- > > i will appreciate it very much if some one will guide me through this. > > thanks for reading. > > Obaid Ghaznawi >

2 1