January 2009 - Freeradius-Users - lists.freeradius.org

mysql fail over
by Peter Ellens 22 Jan '09

22 Jan '09

Hi Everyone I've been trying to setup MySQL fail over with freeradius I've followed http://wiki.freeradius.org/SQL_HOWTO#Additional_Snippets But I get weird results. If I stop the first sql server service, freeradius starts to use the second sql server, as expected. But if I stop the entire first server (ie poweroff) freeradius still continues to try and use sql1, hanging... I have tryed this with real servers and with virtual servers, both react the same, if you take down the first sql service it will start to use the second, but if you power off or suspecd the first sql server, radius hangs trying to get to the server. I have tryed freeradius 2.1.0., 2.1.1 and 2.1.3, on redhat enterprise 4 compiled from source. Restarting freeradius it will notice the first sql server is down and use the second sql server. Can anyone confirm this behaviour? Any ideas how to get it working correctly? Secondly, I have been looking into sqlippool and MySQL fail over. We would really like to be able to use a read/write master and read only slave, but it looks to me that the sqlippool needs to be writeable to mark the IP address as used and avoid duplicate IP allocation. Can someone confirm this? Thanks Peter

2 3

Sending Access-Accept of id 14 to 148.85.32.5 port 1645
by Brian Ertel 22 Jan '09

22 Jan '09

Hi, I have freeradius configured to use port 1812 for auth. # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" port = 1812 I also have my Cisco Aironet 1230g configured to use 1812 and 1813: radius-server host 148.85.9.214 auth-port 1812 acct-port 1813 ...but, the radius debug reads: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 148.85.32.5 port 1645, id=4, length=108 User-Name = "002241faecc3" User-Password = "002241faecc3" Called-Station-Id = "001a.6d6b.f080" Calling-Station-Id = "0022.41fa.ecc3" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 260 NAS-IP-Address = 148.85.32.5 Sending Access-Accept of id 4 to 148.85.32.5 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "159" rad_recv on port 1645? and then sending access-accept port 1645? Am I missing something? Thanks, Brian

4 4

problem with Server Configuration
by Aggelidis Nikos 22 Jan '09

22 Jan '09

hi to all the list i 've install freeradius-server-2.1.3. I've build it from source to enable EAP support. I configure it like this: ./configure --with-rlm_eap_tls --with-rlm_eap_ttls --with-rlm_eap_peap --with-rlm_eap_tnc --without-rlm_otp --with-openssl --with-rlm_eap_ikev2 When i try to connect using EAP everything works ok! But when i try to connect using TTLS it fails. Here is the output: ... ... .... +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "nanouser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for nanouser with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. } # server [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\004E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> nanouser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 26 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 26 Sending Access-Reject of id 0 to 192.168.3.244 port 2056 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Any ideas why this is happening? also i read that you can connect to your radius server using localhost... without using an AP, how can i do this? thanks in advance for your time, -nicolas

2 4

Virtual Server with Multiple Databases
by Kelvin Chiang 22 Jan '09

22 Jan '09

Hi, I am currently using version 2.1.3-1. I was trying to create virtual servers accessing to different mysql databases. From some of the historical threads, I understood that the followings steps are needed: 1. Create an entry in /etc/raddb/dictionary. I had the line as: ATTRIBUTE My-DB 3000 String 2. I edit the sql.conf with the following: radius_db = %{control:My-DB} 3. In the virtual server section, I added the following at the top of the authorize and preacct sections: update control { My-DB = "my_radiusdb_name" } With the above 3 changes, I run radiusd -X and I get the below errors. Can anyone help to identify what went wrong? rad_recv: Access-Request packet from host 192.168.188.1 port 57018, id=206, length=138 NAS-IP-Address = 208.75.51.88 NAS-Identifier = "vpn.skywalk.net" User-Name = "kelvincrypt" User-Password = "test" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 3 Framed-IP-Address = 192.168.188.200 Called-Station-Id = "00:0d:48:36:2f:ff" Calling-Station-Id = "00:17:08:3e:a2:21" server radius_test { +- entering group authorize {...} ++[control] returns notfound ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.188.1/auth-detail-20090122 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.188.1/auth-detail-20090122 [auth_log] expand: %t -> Thu Jan 22 14:05:35 2009 ++[auth_log] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "kelvincrypt", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [radius_test_sql] expand: %{User-Name} -> kelvincrypt [radius_test_sql] sql_set_user escaped user --> 'kelvincrypt' rlm_sql (radius_test_sql): Ignoring unconnected handle 4.. rlm_sql (radius_test_sql): Ignoring unconnected handle 3.. rlm_sql (radius_test_sql): Ignoring unconnected handle 2.. rlm_sql (radius_test_sql): Ignoring unconnected handle 1.. rlm_sql (radius_test_sql): Ignoring unconnected handle 0.. rlm_sql (radius_test_sql): There are no DB handles to use! skipped 5, tried to connect 0 ++[radius_test_sql] returns fail } # server radius_test Using Post-Auth-Type Reject +- entering group Reject {...} ++[reply] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 206 to 192.168.188.1 port 57018 Reply-Message = "Authentication failed." Waking up in 4.9 seconds. _________________________________________________________________ See all the ways you can stay connected to friends and family http://www.microsoft.com/windows/windowslive/default.aspx

3 7

case sensitivity
by Alexandre Chapellon 22 Jan '09

22 Jan '09

HEllo, Is there a way to make usernames stored n users file be case non-sensitive? regards.

3 2

Need to store only accounting stop packet!
by ramesh p 22 Jan '09

22 Jan '09

Hi All, I need a help to store only accounting stop packets in sql database. So i have commented out start queries and update queries. Only the active accounting queries are stop and stop alt. Will this works fine?? or do i need to have accounting update queries also?? Thanks in advance for your help.. Regards, Ramesh.

3 4

Freeradius sybase
by Francesco Toro XB 22 Jan '09

22 Jan '09

Hi All, I'm unsing freeRadius 2.1.3 over SUSE Linux. I'm trying to set SQL accounting with a sybase DB, but unsuccesfully. Anyone can tell me what sybase pluging I have to use? Thnks in advance, Francesco Toro.

1 0

Fwd: Re: Users-file and LDAP backend mixing questions
by tnt＠kalik.net 21 Jan '09

21 Jan '09

>>> I've checked the sources - rlm_ldap NEVER sets Ldap-Group attribute. It is used for comparison only :( >>> >>> >>> Only option seems to be testing for Ldap-Group != "". >>> >>> Ivan Kalik >> >>It will not work. Quote from rlm_ldap.c: >>static int ldap_groupcmp(void *instance, REQUEST *req, >> UNUSED VALUE_PAIR *request, VALUE_PAIR *check, >>... >> if (check->vp_strvalue == NULL || check->length == 0){ >> DEBUG("rlm_ldap::ldap_groupcmp: Illegal group name"); >> return 1; >> } >> >>It seems to me, that writing some patch is the only solution for my problem :) > >I have a feeling that the same (you can check the value but not use it as >an attribute) applies to SQL-Group. I will check that one. > Yes, SQL-Group is the same. Ivan Kalik Kalik Informatika ISP

1 0

local auth always fails
by Duki46 21 Jan '09

21 Jan '09

Hi I am using the latest radiusclient And I'm using radlogin for authentication Radius authentication works fine But local auth always fails (against /etc/passwd /etc/shadow) If I use normal login (e.g /bin/login) Everything works fine When use radlogin as local auth instead ,It always fails, Any help?ASAP!

2 1

Strage problem
by Dajka Tamás 21 Jan '09

21 Jan '09

Hi all, I'm facing a really strange problem. The setup: IAS+RRAS on Windows 2k3 server - FW with proxy - FREERADIUS on linux There are to clients for the freeradius: - Linksys WRT300N ( 802.1x + WPA2 on wifi ) - Cisco 3750G ( 802.1x on wired port ) The freeradius is configured as a proxy for IAS, and with the Wrt300N and the wifi it's working fine! But with the Cisco I'm getting this: Thu Jan 15 11:19:36 2009 : Error: WARNING: Malformed RADIUS packet from host [fwproxy_IP]: received 1500 octets, packet length says 1581 Thu Jan 15 11:19:41 2009 : Error: WARNING: Malformed RADIUS packet from host [fwproxy_IP]: received 1500 octets, packet length says 1581 Thu Jan 15 11:19:47 2009 : Error: WARNING: Malformed RADIUS packet from host [fwproxy_IP]: received 1500 octets, packet length says 1581 Thu Jan 15 11:19:50 2009 : Error: Rejecting request 21 due to lack of any response from home server [fwproxy_IP] port 1812 The tcpdump on the freeradius server shows: 11:19:47.389332 IP [freerad_server_ip].1814 > [fwproxy_ip].1812: RADIUS, Access Request (1), id: 0xdd length: 225 11:19:47.392714 IP [fwproxy_ip].1812 > [freerad_server_ip].1814: RADIUS, Access Challenge (11), id: 0xdd length: 1472 Sniffing on the FW's inside leg, the IAS sends back Access-challenge for the Access-Request. What's the matter? Cheers, Tamas

2 2