November 2009 - Freeradius-Users - lists.freeradius.org

The MySQL databases for Freeradius
by Peter Carlstedt 24 Nov '09

24 Nov '09

Hello everyone! I am sitting here trying to figure out how FreeRadius works towards MySQL. It is quite hard for me to try to explain what I want to do since Im not good with MySQL but I will try anyway and hope someone will understand what I mean. =) The database "radcheck" is for a singeluser if I have understood it correctly. What I want to do is that through MS Access make a form where I can add several attributes to the same row in the table. But since radcheck only seem to work with one attribute per row for one user I dont really know how to do. What I mean is that if I have a user called "test-user" and want to have two attributes for that user, in this case "Cleartext-Password" & "NAS-Port-Id" I need to have two rows for that user. The table looks like this in Access(when i want to use two or more attributes): radcheck: ------------------------------------------------------ |id|username |attribute |op |value | |1 |user-test |Cleartext-Password|== |test-pass | |2 |user-test |NAS-Port-Id |== |raket | ------------------------------------------------------- The reason I want to make a form is because I want others than me being able to add new users and have them connected to the correct group which then will have a separate VLAN and SSID. So then I thought that if i use the table called "radusergroup" and link the user to a specific group it should work in a way that all members of this group may only connect to the network if they try to connect to the correct SSID. It seems that did not work either. I am at a loss here and dont really know what I should do. Sorry if my explaination is bad but it is quite hard for me to explain. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

3 2

RADIUS session probelm
by toqeer ali 24 Nov '09

24 Nov '09

I am configuring RADIUS with openser and CDRtool. when i dial a number it loges into in mysql of RADIUS server but it gives the following error. and when i check CDRs of CDRtool it shows all calls "inprogress". Tue Nov 24 19:47:37 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '1000@ip address', nas 'ipaddress'] -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916 -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916

1 0

Re: Stripping Realms from SQL Accounting Queries
by Tim Gustafson 23 Nov '09

23 Nov '09

> ...erm, '%{%{Stripped-User-Name}:-%{User-Name}}', I think what > you have there is some really old depreated or bad syntax'ed > version. Same in your SQL queries too strangely. You will want > to make sure you use 'SQL-User-Name' instead too, and not > directly 'User-Name' (think SQL injection). Thanks for your suggestions. I tried using SQL-User-Name in the past, and it was always blank - an empty string. I tried using '%{%{Stripped-User-Name}:-%{User-Name}}' as you've suggested, but to no avail - it was still using the un-stripped user name. I've actually just changed the queries to use %{User-Name} for now to quell the warnings in the debug log about depreciated syntax. However this has not fixed my problem. :( Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

1 0

RE: Combine Proxy Answer with Local Information
by Dan Fisher | Fluidata 23 Nov '09

23 Nov '09

Hi, >> My problem is that the response I send to our LAC has to contain extra >> information depending on the domain. Is it possible to query a local >> mysql database for this extra information (these are cisco av pairs >> needed to establish the tunnels between the LAC and LNS) >Yes. See man unlang. >> and add it into >> the Access-Accept message that is returned to the LAC from the radius? >Use unlang in post-proxy. >Ivan Kalik Thanks for the guidance ivan, its given me a good starting point. I have managed to get new information into my accept requests by hard coding update reply sections in the unlang code (example below) : update reply { Tunnel-Client-Auth-ID = "fluidata" } However I am having real problems getting the mysql part working. I have tried using examples other people are using that work and they either just get treated as a string or the server wont even run in debug mode. I don't appear to be able to use the sql module itself as I get an error saying its not supported in the post-proxy configuration section. Can anyone suggest where I might be going wrong with this? Inside the post-proxy section I have: Where %{2} is the result of a regular expression to split a full username so I just have the domain to use later on. if ( "%{sql: SELECT Attribute from radreply where username ='%{2}' and attribute='Tunnel-Password'}" ) { ok } I have tried this with and without the Output looks like: WARNING: Unknown module "sql" in string expansion "%{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'}" expand: %{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'} -> ? Evaluating ("%{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'}" ) -> FALSE ++? if ("%{sql: SELECT Attribute from radreply where Username ='burst.net' and Attribute='Tunnel-Password'}" ) -> FALSE /etc/raddb/sites-enabled/default[562]: "SQL" modules aren't allowed in 'post-proxy' sections -- they have no such method. /etc/raddb/sites-enabled/default[512]: Errors parsing post-proxy section. If anyone has any thoughts on this or whether I can obtain the same information another way that would be much appreciated. I will be having potentially hundreds of different relams going through this freeradius instance and I need to add this information for each one Dan Fisher

3 2

Stripping Realms from SQL Accounting Queries
by Tim Gustafson 23 Nov '09

23 Nov '09

Hi, I'm using FreeRADIUS with LDAP for authentication and mySQL for logging. The LDAP queries seem to be stripping the realm name properly, whereas the mySQL queries are not. I'm running FreeRADIUS 2.1.6 on FreeBSD: FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd7.2, built on Nov 10 2009 at 08:34:04 Here's what I've got in my modules/ldap: ----- modules/ldap ----- ldap { server = "foo" basedn = "dc=foo" identity = "uid=foo" password = "foo" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = yes } access_attr = "uid" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = sambaNTPassword edir_account_policy_check = no groupname_attribute = "cn" groupmembership_attribute = "memberUid" groupmembership_filter = "(memberUid=%{Stripped-User-Name:-%{User-Name}})" } ----- modules/ldap ----- Here's what I've got in my sql/mysql/wpa.conf file: ----- sql/mysql/wpa.conf ----- accounting_start_query = "insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('%{Acct-Session-Id}', '%{Stripped-User-Name:-%{User-Name}}', '%{NAS-IP-Address}', '%{Calling-Station-Id}', '%S')" accounting_stop_query = "update RadiusLog set EndTime = '%S', BytesIn = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', BytesOut = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' where SessionID = '%{Acct-Session-Id}' and UserName = '%{Stripped-User-Name:-%{User-Name}}' and StartTime >= date_sub(now(), interval 30 day)" accounting_update_query = "update RadiusLog set BytesIn = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', BytesOut = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' where SessionID = '%{Acct-Session-Id}' and UserName = '%{Stripped-User-Name:-%{User-Name}}' and StartTime >= date_sub(now(), interval 30 day)" ----- sql/mysql/wpa.conf ----- And here are some sample queries from the SQL trace file: ----- /var/log/radacct/radius.sql ----- insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('0004F815', 'tjg@foo', '192.168.32.8', '0024.2b58.2f46', '2009-11-23 10:52:58'); update RadiusLog set EndTime = '2009-11-23 10:53:46', BytesIn = '0' << 32 | '2487', BytesOut = '0' << 32 | '1356' where SessionID = '0004F815' and UserName = 'tjg@foo' and StartTime >= date_sub(now(), interval 30 day); ----- /var/log/radacct/radius.sql ----- I tried adding a realm definition in proxy.conf, like this: ----- proxy.conf ----- realm foo { type = radius authhost = LOCAL accthost = LOCAL strip } ----- proxy.conf ----- But that didn't help at all. I know I must be missing something obvious. Most of the Google hits on this talk about creating realms and stuff, but that hasn't helped me. Can anyone share some wisdom here? Thanks! Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 2

ntlm_auth and AD authentication
by freeradius＠corwyn.net 23 Nov '09

23 Nov '09

freeradius2-2.1.7-2.el5 freeradius2-utils-2.1.7-2.el5 freeradius2-libs-2.1.7-2.el5 CentOS 5.2 I'm trying to get freeradius to authenticate with an AD server, using the instructions at http://deployingradius.com/documents/configuration/active_directory.html The initial confirmation of communication with AD is working. The instructions then say to try: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password to confirm, and it looks like it's working. However, the instructions also indicate you should also see the NT_KEY output, which is needed in order for FreeRADIUS to perform MS-CHAP authentication. However, whether I use ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password or ntlm_auth --domain=MYDOMAIN --username=user --password=password the output/response looks the same: NT_STATUS_OK: Success (0x0) which leads me to believe that the nt-key isn't being provided? What is the nt-key supposed to look like? If it's not showing up correctly, any ideas why? thanks Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

6 9

help: radiusd process quit automatically
by pangjiacai 23 Nov '09

23 Nov '09

radiusd process would quit automatically while doing authorization and accounting presure test about 150 times per second,can anyone tell me what the problem is？

2 1

Update of "No NAS-PORT seen"
by Peter Carlstedt 23 Nov '09

23 Nov '09

Hello again! I have an update of the problem. I also got an error which I´ve had before, then Ivan Kalik I think told me that i need to enable copy_request_to_tunnel = yes. Well I have that enabled so I can authenticate by peap. But now I get the same error when I try to authenticate the user which has been created in the MySQL database. The error I get is: (only mentioning the mschapv2 & mschap response from the output) "[mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for test-user with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Also as a side note, the user in the database has a Cleartext-Password := test-pass. I read on the wiki that I should use ":=" and not "==" to do the check of the password. Also I have not set a AUTH-TYPE, i let the server figure it out on its own. Best regards/ Peter > > Message: 5 > Date: Mon, 23 Nov 2009 14:03:41 +0000 > From: Peter Carlstedt <pc_007(a)hotmail.com> > Subject: "No NAS-PORT seen" > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <SNT120-W743F9B44DFAEDBDCB59F0B49E0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello everyone! > > After some work now I have succesfully got MySQL to work towards the Freeradius server or at least I think it does. > > But hurm.. I?ve added a user by adding a user in radcheck, ive written "insert into radcheck (id, username, attribute, op, value) VALUES (null, 'test-user', 'Cleartext-Password', ':=', 'test-pass'); > > and then I?ve written "select * from radcheck;" which shows the new user. > > > > Well all of that works but from that point and forward it doesnt, I cant get my new user to authenticate towards the radius server and I get from attr_filter that the request matched entry DEFAULT at line 11, which sends a reject message if I have understood it correctly. Also I?ve commented out that the radius server should use the users file to do checks against when someone tries to authenticate, well that dont seem to work because when i try to authenticate towards the radius server with a user in the users file I succeed while i do not succeed when i try to authenticate by using the user that i created in the mysql database. > > > > > > Have I missed something? > > > > But something i also noticed is that when i authenticate as the user who is in the users file and have commented out that it should use the users file it gets a message from rlm_radutmp saying "No NAS-Port seen. Cannot do anything." > > > > Have I done something terrible wrong? > > > > Ive installed and made my own build of Freeradius 2.1.7 after i installed mysql client and all those libraries and mysql server. also I installed OpenSSL 0.9.8l before installation of the Freeradius server. > > > > Since the log is so big from radiusd -X is there any possibility to save it into a file? And how do i do that? > > > > Best regards/ Peter Carlstedt > > > > _________________________________________________________________ > Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail?. > http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so… >

2 1

Re: "No NAS-PORT seen"
by Peter Carlstedt 23 Nov '09

23 Nov '09

> ------------------------------ > > Message: 2 > Date: Mon, 23 Nov 2009 15:25:32 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: "No NAS-PORT seen" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4B0A9B5C.6000102(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Peter Carlstedt wrote: > > Well all of that works but from that point and forward it doesnt, I cant > > get my new user to authenticate towards the radius server and I get from > > attr_filter that the request matched entry DEFAULT at line 11, which > > sends a reject message if I have understood it correctly. Also I?ve > > commented out that the radius server should use the users file to do > > checks against when someone tries to authenticate, well that dont seem > > to work because when i try to authenticate towards the radius server > > with a user in the users file I succeed while i do not succeed when i > > try to authenticate by using the user that i created in the mysql database. > > > > Have I missed something? > > It shouldn't be that hard. If you change the configuration, re-start > the server. I re-start the server all the time when I change the configuration...so that is not the case. I´ve checked if it works with radtest and it does. So in my mind it feels like i´ve missed something in the peap configuration? > > And READ the debug output. There's a lot of text in it, but it > describes which modules its using, and what it's doing. The ONLY answer > to configuration problems is in the debug output. > > > But something i also noticed is that when i authenticate as the user who > > is in the users file and have commented out that it should use the users > > file it gets a message from rlm_radutmp saying "No NAS-Port seen. Cannot > > do anything." > > That only comes from accounting traffic, not from authentication > traffic. Please do NOT confuse the two. > > > Ive installed and made my own build of Freeradius 2.1.7 after i > > installed mysql client and all those libraries and mysql server. also I > > installed OpenSSL 0.9.8l before installation of the Freeradius server. > > > > Since the log is so big from radiusd -X is there any possibility to save > > it into a file? And how do i do that? > > $ script radius.log > $ radiusd -X .... > (run) > $ exit > > And then look at the file "radius.log" > > Alan DeKok. Ok thanks! I´ll do that. Peter Carlstedt > > > ------------------------------ > > > Message: 4 > Date: Mon, 23 Nov 2009 14:53:42 +0000 > From: Peter Carlstedt <pc_007(a)hotmail.com> > Subject: Update of "No NAS-PORT seen" > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <SNT120-W79B8526AA982DAA24E059B49E0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello again! > > I have an update of the problem. > > > > I also got an error which I?ve had before, then Ivan Kalik I think told me that i need to enable copy_request_to_tunnel = yes. Well I have that enabled so I can authenticate by peap. But now I get the same error when I try to authenticate the user which has been created in the MySQL database. The error I get is: (only mentioning the mschapv2 & mschap response from the output) > > > > "[mschapv2] +- entering group MS-CHAP {...} > > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > > [mschap] Told to do MS-CHAPv2 for test-user with NT-Password > > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > > [mschap] FAILED: MS-CHAP2-Response is incorrect > > ++[mschap] returns reject > > > > Also as a side note, the user in the database has a Cleartext-Password := test-pass. > > I read on the wiki that I should use ":=" and not "==" to do the check of the password. > > Also I have not set a AUTH-TYPE, i let the server figure it out on its own. > > > > Best regards/ Peter > > _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

1 0

"No NAS-PORT seen"
by Peter Carlstedt 23 Nov '09

23 Nov '09

Hello everyone! After some work now I have succesfully got MySQL to work towards the Freeradius server or at least I think it does. But hurm.. I´ve added a user by adding a user in radcheck, ive written "insert into radcheck (id, username, attribute, op, value) VALUES (null, 'test-user', 'Cleartext-Password', ':=', 'test-pass'); and then I´ve written "select * from radcheck;" which shows the new user. Well all of that works but from that point and forward it doesnt, I cant get my new user to authenticate towards the radius server and I get from attr_filter that the request matched entry DEFAULT at line 11, which sends a reject message if I have understood it correctly. Also I´ve commented out that the radius server should use the users file to do checks against when someone tries to authenticate, well that dont seem to work because when i try to authenticate towards the radius server with a user in the users file I succeed while i do not succeed when i try to authenticate by using the user that i created in the mysql database. Have I missed something? But something i also noticed is that when i authenticate as the user who is in the users file and have commented out that it should use the users file it gets a message from rlm_radutmp saying "No NAS-Port seen. Cannot do anything." Have I done something terrible wrong? Ive installed and made my own build of Freeradius 2.1.7 after i installed mysql client and all those libraries and mysql server. also I installed OpenSSL 0.9.8l before installation of the Freeradius server. Since the log is so big from radiusd -X is there any possibility to save it into a file? And how do i do that? Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1