December 2009 - Freeradius-Users - lists.freeradius.org

Help, MS RAS as client radius
by Alessandro Agostini 15 Dec '09

15 Dec '09

Hello, I have this problem. I have configured my windows server 2008 with RAS to send authenticate request to my freeradius. The Authenticate method is PAP (insicure I know!). With "radiusd -X" I see the following request and response: rad_recv: Access-Request packet from host 149.xxx.xxx.xxx:51678, id=2, length=287 Acct-Session-Id = "41" NAS-Identifier = "WINPDC2" NAS-IP-Address = 149.xxx.xxx.xxx Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "149.xxx.xxx.xxx" Tunnel-Client-Endpoint:0 = "149.xxx.xxx.xxx" User-Name = "agostini" User-Password = "zzzzzz" Microsoft-Attr-47 = 0x00000002 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" Microsoft-Attr-35 = 0x4d5352415356352e323000 Microsoft-Attr-34 = 0x4d535241532d302d4e422d43454400 Microsoft-Attr-56 = 0x7b42454332384243412d343642442d343743342d393341462d3830464145383645413235447d Proxy-State = 0x1700000000000000fe8000000000000000000029 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 21 modcall[authorize]: module "preprocess" returns ok for request 21 modcall[authorize]: module "chap" returns noop for request 21 modcall[authorize]: module "mschap" returns noop for request 21 rlm_realm: No '@' in User-Name = "agostini", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 21 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 21 radius_xlat: 'agostini' rlm_sql (sql): sql_set_user escaped user --> 'agostini' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' AND scadenza-CURDATE()>=0 ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' AND scadenza-CURDATE()>=0 ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = 'agostini' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = 'agostini' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = 'agostini' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = 'agostini' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 21 modcall[authorize]: module "files" returns notfound for request 21 modcall: group authorize returns ok for request 21 auth: type Crypt Login OK: [agostini/zzzzzz] (from client WinPDC port 13 cli 149.xxx.xxx.xxx) Sending Access-Accept of id 2 to 149.xxx.xxx.xxx:51678 Service-Type := Framed-User Tunnel-Private-Group-Id:0 := "ifac" Framed-Protocol := PPP Tunnel-Type:0 := PPTP Proxy-State = 0x1700000000000000fe8000000000000000000029 Finished request 21 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... As you can see I have a mysql backend working with other clients(Wifi) and apparently also with this client is ok but on PC Windows I see an error and authentication is not succesfull. On "Event viewer" on Windows server I see this error message: "The tunnel type RADIUS attribute for this user is not correct" What is wrong? I have tried to change it but without result. Can you help me? I have to resolve this problem urgently. sigh! Thanks in advance Alessandro Agostini -- Servizio informatica e comunicazioni CNR - Istituto Fisica Applicata "N.Carrara" Via Madonna del Piano,10 Sesto Fiorentino (FI) --------------------------------------------- http://www.ifac.cnr.it - tel. 055 5226406

2 1

RE: Freeradius-Users Digest, Vol 56, Issue 88
by Nadir M. Aliyev 15 Dec '09

15 Dec '09

> > > Hello All, > > I did not fixed this problem. same configuration works on > server (ubuntu). but on another server (freebsd) not works :( > > Please look > to the 3 th line. its normally? (expand) > > +- entering group post-auth > {...} > > [sqlippool] No Pool-Name defined. > > [sqlippool] expand -> > > > ++[sqlippool] returns noop- > > Nadir Aliyev > Your configuration is OK. Your user entry isn't. What does your user entry > look like (password etc.)? > Ivan Kalik I use User-Password attribute in database. And chap method authentification. It's works normally. When I use radtest, auth successfully. But from windows machine this error appears: "Server did not assign ip address" Problem with ippool (or sqlippool), I think this is a bug, before radius v2 I installed v1, upgraded it to v2 because v1 is no longer supported(radius is not started with sqlippool module, received error undefined symbol) I tested it with ippool and sqlippool. Result is same: [main_pool] Could not find Pool-Name attribute. or [sqlippool] No Pool-Name defined.

2 1

Ayuda (en español)
by Diego Chovares Moreno 15 Dec '09

15 Dec '09

Hola, a ver si hay alguien que hable español y me pueda ayudar. Tengo un freeradius instalado sobre un ubuntu server y en local me funciona, pero cuando quiero conectarme por wifi mediante un punto de acceso me sale: rad_recv: Access-Request packet from host 192.168.1.1 port 1084, id=1, length=206 Message-Authenticator = 0x789bf39c8f59de88701888fc6ed3a2f2 Service-Type = Framed-User User-Name = "diego\000" Framed-MTU = 1488 State = 0x734ffec0734ee45437bb08e87fc6420c Called-Station-Id = "00-15-E9-A3-01-CE:radius" Calling-Station-Id = "00-15-AF-9F-8D-E0" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060319 NAS-IP-Address = 192.168.1.1 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "diego", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> diego [sql] sql_set_user escaped user --> 'diego' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'diego' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'diego' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'diego' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> diego [sql] sql_set_user escaped user --> 'diego' expand: %{User-Password} -> expand: %{Chap-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}[image: Silbando despreocupadamente]%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'diego', '', 'Access-Reject', '2009-11-27 17:33:06') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'diego', '', 'Access-Reject', '2009-11-27 17:33:06') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok expand: %{User-Name} -> diego attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.1.1 port 1084 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +53 Waking up in 0.9 seconds. Cleaning up request 1 ID 1 with timestamp +53 Ready to process requests. No se porque me pasa esto: [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select La gente me dice que es porque no tengo librerias ssl instaladas, pero e instalado todas las que he encontrado, pero sigue sin funcionarme.... estoy desesperado. Gracias y saludos

2 1

Re: Request for directions: WinXP + Samba + LDAP + 802.1x
by nf-vale 15 Dec '09

15 Dec '09

Have you defined Auth-Type in users file to mschapv2 (don't do it)? What is the configuration for this user in the users file? On Tuesday 15 December 2009 13:00:07 you wrote: > > As you can see, it says that it has stripped realm from username but > > it passes it along with username to ldap. How can I fix this? > > Never mind. ldap filter did the job. Sorry about that. > > Actually it's not working yet. > > rad_recv: Access-Request packet from host 192.168.205.29 port 49154, > id=0, length=178 > Cleaning up request 15 ID 0 with timestamp +1232 > NAS-IP-Address = 192.168.205.29 > NAS-Port-Type = Ethernet > NAS-Port = 2 > User-Name = "DOMAIN\\sti" > State = 0x9bb6fc759d93e55343410152d73b1dba > EAP-Message = > 0x0225005b1900170301005046c5a952e0ad6d2ea7d132dd3c00c1a132df2329a23561c760d > 4a45fb4f02e3bd1a848f5d4d3106ae52d4f442971b4c6aa4d0c157805647 > 9f03c76d350fc041b659e556368c4a63e30e09849d0aae29a > Message-Authenticator = 0xf9700c8c22d81ecdb12a8f6731151a38 > +- entering group authorize {...} > ++[preprocess] returns ok > [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\sti" > [ntdomain] Found realm "DOMAIN" > [ntdomain] Adding Stripped-User-Name = "sti" > [ntdomain] Adding Realm = "DOMAIN" > [ntdomain] Authentication realm is LOCAL. > ++[ntdomain] returns ok > [eap] EAP packet type response id 37 length 91 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] EAP type mschapv2 > [peap] Got tunneled request > EAP-Message = > 0x022500441a0225003f31a156d1579957b003643781fff8636e87000000000000000003367 > b7948111ad6081798c179995c91c0268edae3409ae30046454152505c737 469 > server { > PEAP: Setting User-Name to DOMAIN\sti > Sending tunneled request > EAP-Message = > 0x022500441a0225003f31a156d1579957b003643781fff8636e87000000000000000003367 > b7948111ad6081798c179995c91c0268edae3409ae30046454152505c737 469 > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "DOMAIN\\sti" > State = 0x7b5d7eb57b7864abf97396c9fbfa8cb4 > server { > +- entering group authorize {...} > ++[preprocess] returns ok > [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\sti" > [ntdomain] Found realm "DOMAIN" > [ntdomain] Adding Stripped-User-Name = "sti" > [ntdomain] Adding Realm = "DOMAIN" > [ntdomain] Authentication realm is LOCAL. > ++[ntdomain] returns ok > [eap] EAP packet type response id 37 length 68 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > [files] users: Matched entry DEFAULT at line 204 > ++[files] returns ok > [ldap] performing user authorization for sti > [ldap] WARNING: Deprecated conditional expansion ":-". See "man > unlang" for details > [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sti) > [ldap] expand: ou=Users,dc=domain,dc=br -> ou=Users,dc=domain,dc=br > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in ou=Users,dc=domain,dc=br, with filter > (uid=sti) [ldap] checking if remote access for sti is allowed by > radiusFilterId [ldap] looking for check items in directory... > rlm_ldap: userPassword -> User-Password == > "{SMD5}/S4d+fNkBFL3TnpjceYuUiDPd+Q=" rlm_ldap: sambaNtPassword -> > NT-Password == > 0x4443384142353837303246373432304532443042323537333343453938394634 > rlm_ldap: sambaLmPassword -> LM-Password == > 0x3245414443463036424438463531344541414433423433354235313430344545 > [ldap] looking for reply items in directory... > rlm_ldap: radiusFilterId -> Filter-Id = > "Enterasys:version=1:policy=Enterprise User" > [ldap] user sti authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > Found Auth-Type = EAP > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!!! !!! Replacing User-Password in config items with > Cleartext-Password. !!! > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!!!! !!! Please update your configuration so that the "known good" > !!! !!! clear text password is in Cleartext-Password, and not in > User-Password. !!! > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!!!! +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/mschapv2 > [eap] processing type mschapv2 > [mschapv2] WARNING: Unknown value specified for Auth-Type. Cannot > perform requested action. > [eap] Freeing handler > ++[eap] returns reject > Failed to authenticate the user. > Login incorrect: [DOMAIN\\sti/<via Auth-Type = EAP>] (from client > tplink port 0 via TLS tunnel) > } # server > [peap] Got tunneled reply code 3 > Filter-Id = "Enterasys:version=1:policy=Enterprise User" > EAP-Message = 0x04250004 > Message-Authenticator = 0x00000000000000000000000000000000 > [peap] Got tunneled reply RADIUS code 3 > Filter-Id = "Enterasys:version=1:policy=Enterprise User" > EAP-Message = 0x04250004 > Message-Authenticator = 0x00000000000000000000000000000000 > [peap] Tunneled authentication was rejected. > [peap] FAILURE > ++[eap] returns handled > Sending Access-Challenge of id 0 to 192.168.205.29 port 49154 > EAP-Message = > 0x012600261900170301001b5cfd418b7da0ea2be30d04270a1403956143966fe487e0870c4 > b57 Message-Authenticator = 0x00000000000000000000000000000000 State = > 0x9bb6fc759c90e55343410152d73b1dba > Finished request 16. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 192.168.205.29 port 49154, > id=0, length=125 > Cleaning up request 16 ID 0 with timestamp +1232 > NAS-IP-Address = 192.168.205.29 > NAS-Port-Type = Ethernet > NAS-Port = 2 > User-Name = "DOMAIN\\sti" > State = 0x9bb6fc759c90e55343410152d73b1dba > EAP-Message = > 0x022600261900170301001b21b51585f6a2a91a76b4b00b320ac2a87db1c24bf9bfa298197 > bf1 Message-Authenticator = 0x30d1290632d45610b95a3253910ba83b +- entering > group authorize {...} > ++[preprocess] returns ok > [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\sti" > [ntdomain] Found realm "DOMAIN" > [ntdomain] Adding Stripped-User-Name = "sti" > [ntdomain] Adding Realm = "DOMAIN" > [ntdomain] Authentication realm is LOCAL. > ++[ntdomain] returns ok > [eap] EAP packet type response id 38 length 38 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Received EAP-TLV response. > [peap] Had sent TLV failure. User was rejected earlier in this session. > [eap] Handler failed in EAP/peap > [eap] Failed in EAP select > ++[eap] returns invalid > Failed to authenticate the user. > Login incorrect: [DOMAIN\\sti/<via Auth-Type = EAP>] (from client tplink > port 2) Using Post-Auth-Type Reject > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> DOMAIN\sti > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 17 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 17 > Sending Access-Reject of id 0 to 192.168.205.29 port 49154 > EAP-Message = 0x04260004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 4.9 seconds. > Cleaning up request 17 ID 0 with timestamp +1232 > Ready to process requests. > > > And how can I set XP for it to try authenticate during logon proccess? > > That first question remains.... >

2 1

Re: radiusd -X
by kachin Agarwal 15 Dec '09

15 Dec '09

Ok. 1 last thing. I have done some experiments bcoz my auth-rate is low. i ve included timestamps in the freeradius code and in some modules. and i found out - Finished Request 0 : Tue, 15 Dec 2009 07:08:35 0.788477 Going to the next Request : Tue, 15 Dec 2009 07:08:35 0.788649 Waking up in 4.9 seconds : Tue, 15 Dec 2009 07:08:35 0.788866 rad_recv: Access-Request packet from host 127.0.0.1 port 10004, id=9, length=306 : Tue, 15 Dec 2009 07:08:35 0.857346 As u can see from the above timestamp.. when it reaches the finished request 0 the timestamp in milli sec is 788.4ms.so till "waking up in 4.9 sec" it hardly takes 0.4ms But after this "Waking up in 4.9 sec" till the next request "rad_recv" it takes about 70ms. 0.857346 - 0.788866 = ~70 ms What does it do for such a long time till the next request comes in?? Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

4 3

Re: radiusd -X
by kachin Agarwal 15 Dec '09

15 Dec '09

Hi, radiusd -Xx does not work in my case. It shows the timestamp but before it authenticates it gets timed out. It takes a hell lot of time to authenticate when i use radiusd -X. So i itself included all the timestamp code.. Thanx & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

3 2

Re: radiusd -X
by kachin Agarwal 15 Dec '09

15 Dec '09

Hi, I have a doubt. If the entire authentication ends in milli seconds then how can it wait for about 4.9 seconds in each handshake.??? Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

radiusd -X
by kachin Agarwal 15 Dec '09

15 Dec '09

Hi, Whenever i use radiusd -X i get the following : This is a part of radiusd -X Sending Access-Challenge of id 8 to 127.0.0.1 port 10004 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Symbol-User-Group = "moto" Symbol-Downlink-Limit-Kbps = 0 Symbol-Uplink-Limit-Kbps = 0 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89c2dbc689c0c2620c47c6a69e0623a2 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 10004, id=9, length=306 User-Name = "kach" Called-Station-Id = "00-15-70-23-F5-34:xtest" Calling-Station-Id = "00-15-70-37-8D-05" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RFS4000" Symbol-Wlan-Index = "xtest" Symbol-Attr-4 = "1" NAS-Port-Id = "WLAN1" Connect-Info = "CONNECT 54Mbps 802.11a" State = 0x89c2dbc689c0c2620c47c6a69e0623a2 and etc etc... i did not understand the "waking up in 4.9 sec" ?? Why does it wait for.? can we remove this? Thanx & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

Re: YanÄ±t: Re: Freeradius db.ippool is FULL Error : rlm _ippool: No available ip addresses in pool.
by tnt＠kalik.net 14 Dec '09

14 Dec '09

> I know. But cant control many pos or devices power down directly. How db > pool release active ip. I use rlm tool In the crontab every 30 minutes. > But I think wrong way. Can you give for active session on the db ippool > time out value or any way? > > Or different configuration. > > Note: this devices is POS. On the gprs network. I have lease line gsm > provider and my client is gsm NAS server. No, there is no lease duration in ippool. Perhaps you should consider DHCP. Ivan Kalik

1 0

Group and SQL issue
by David Peterson 14 Dec '09

14 Dec '09

I am using the latest freeradius code with WiMax, Daloradius and MySQL. I am getting group rejects with the server complaining that it can't use MSCHAPv2. The confounding thing is that I had this working last week and it's now acting differently. Here is the debug: Mon Dec 14 12:32:14 2009 : Info: Finished request 4. Mon Dec 14 12:32:14 2009 : Debug: Going to the next request Mon Dec 14 12:32:14 2009 : Debug: Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=86, length=393 User-Name = "{am=1}3ad1bc65fb314eb48f1606c0d23b1459(a)example.com" EAP-Message = 0x020600cc150016030100861000008200807017cf3a79f3fb411e2d6fd7407a0b146f5533cc 4ed1d262b63dc0113c12a37cd3dfdcd78c72324c7de0b95be31d39052b19d0573d97720ddb99 cbe195507cda4f494a8262712f1cf2c6547345a0c45d57451c70a9314d51504ad0027b49b194 495daf09f9d6eb5a6e9b663fb3419c9096209abd019557a31d3c39445633744b140301000101 16030100303a11c06474e810489e444268805b8ba59a82c0a00f83e5fbc9988a776d40aced1b 1b33674fce86da0e709034954a39c0 Message-Authenticator = 0x41ad7a4eb07c8f349351859e8eccd107 NAS-Identifier = "WC_LAB" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-12-CF-C7-4C-F2" WiMAX-BS-Id = 0x000002030209 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 State = 0x1e32147e1a3401ed241a0e7b266a26bd Mon Dec 14 12:32:15 2009 : Info: +- entering group authorize {...} Mon Dec 14 12:32:15 2009 : Info: ++[preprocess] returns ok Mon Dec 14 12:32:15 2009 : Info: ++[chap] returns noop Mon Dec 14 12:32:15 2009 : Info: ++[mschap] returns noop Mon Dec 14 12:32:15 2009 : Info: ++[wimax] returns ok Mon Dec 14 12:32:15 2009 : Info: [suffix] Looking up realm "example.com" for User-Name = "{am=1}3ad1bc65fb314eb48f1606c0d23b1459(a)example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Found realm "example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Adding Realm = "example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Authentication realm is LOCAL. Mon Dec 14 12:32:15 2009 : Info: ++[suffix] returns ok Mon Dec 14 12:32:15 2009 : Info: [eap] EAP packet type response id 6 length 204 Mon Dec 14 12:32:15 2009 : Info: [eap] Continuing tunnel setup. Mon Dec 14 12:32:15 2009 : Info: ++[eap] returns ok Mon Dec 14 12:32:15 2009 : Info: Found Auth-Type = EAP Mon Dec 14 12:32:15 2009 : Info: +- entering group authenticate {...} Mon Dec 14 12:32:15 2009 : Info: [eap] Request found, released from the list Mon Dec 14 12:32:15 2009 : Info: [eap] EAP/ttls Mon Dec 14 12:32:15 2009 : Info: [eap] processing type ttls Mon Dec 14 12:32:15 2009 : Info: [ttls] Authenticate Mon Dec 14 12:32:15 2009 : Info: [ttls] processing EAP-TLS Mon Dec 14 12:32:15 2009 : Info: [ttls] eaptls_verify returned 7 Mon Dec 14 12:32:15 2009 : Info: [ttls] Done initial handshake Mon Dec 14 12:32:15 2009 : Info: [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Mon Dec 14 12:32:15 2009 : Info: [ttls] TLS_accept: SSLv3 read client key exchange A Mon Dec 14 12:32:15 2009 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Mon Dec 14 12:32:15 2009 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Mon Dec 14 12:32:15 2009 : Info: [ttls] TLS_accept: SSLv3 read finished A Mon Dec 14 12:32:15 2009 : Info: [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] Mon Dec 14 12:32:15 2009 : Info: [ttls] TLS_accept: SSLv3 write change cipher spec A Mon Dec 14 12:32:15 2009 : Info: [ttls] >>> TLS 1.0 Handshake [length 0010], Finished Mon Dec 14 12:32:15 2009 : Info: [ttls] TLS_accept: SSLv3 write finished A Mon Dec 14 12:32:15 2009 : Info: [ttls] TLS_accept: SSLv3 flush data Mon Dec 14 12:32:15 2009 : Info: [ttls] (other): SSL negotiation finished successfully Mon Dec 14 12:32:15 2009 : Debug: SSL Connection Established Mon Dec 14 12:32:15 2009 : Info: [ttls] eaptls_process returned 13 Mon Dec 14 12:32:15 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 86 to 172.16.4.2 port 1812 EAP-Message = 0x0107004515800000003b14030100010116030100304b7f87751994ad5c4518d22e1b233a6a 30020ffd0d5a730904158eb7101a15696164fe1a50f24a526b2dc181690de5f0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1e32147e1b3501ed241a0e7b266a26bd Mon Dec 14 12:32:15 2009 : Info: Finished request 5. Mon Dec 14 12:32:15 2009 : Debug: Going to the next request Mon Dec 14 12:32:15 2009 : Debug: Waking up in 3.8 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=87, length=381 User-Name = "{am=1}3ad1bc65fb314eb48f1606c0d23b1459(a)example.com" EAP-Message = 0x020700c015001703010020707edef0cc349370aca5964515a8be4538df0f153227178f706d e7533978e29917030100909acee26fddaca59612e605c32c57624fd42a6d929430c67520757f e01507bc4cf848203010af0367c64264c99fe07abe5460c6cb5f731cfea51e57879eabe1e18d 64876c5737b71aebcd5334b972e985c9203d861cc026279d9e7c0c2393b2e1d1ad960fe985a5 a0593083aa0fe26c20f7315f541b092e3745802a504e5a773679d1fabacb3471138c73243845 2aafdd Message-Authenticator = 0x906e115a16639fc8239a67adaa9011cb NAS-Identifier = "WC_LAB" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-12-CF-C7-4C-F2" WiMAX-BS-Id = 0x000002030209 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 State = 0x1e32147e1b3501ed241a0e7b266a26bd Mon Dec 14 12:32:15 2009 : Info: +- entering group authorize {...} Mon Dec 14 12:32:15 2009 : Info: ++[preprocess] returns ok Mon Dec 14 12:32:15 2009 : Info: ++[chap] returns noop Mon Dec 14 12:32:15 2009 : Info: ++[mschap] returns noop Mon Dec 14 12:32:15 2009 : Info: ++[wimax] returns ok Mon Dec 14 12:32:15 2009 : Info: [suffix] Looking up realm "example.com" for User-Name = "{am=1}3ad1bc65fb314eb48f1606c0d23b1459(a)example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Found realm "example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Adding Realm = "example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Authentication realm is LOCAL. Mon Dec 14 12:32:15 2009 : Info: ++[suffix] returns ok Mon Dec 14 12:32:15 2009 : Info: [eap] EAP packet type response id 7 length 192 Mon Dec 14 12:32:15 2009 : Info: [eap] Continuing tunnel setup. Mon Dec 14 12:32:15 2009 : Info: ++[eap] returns ok Mon Dec 14 12:32:15 2009 : Info: Found Auth-Type = EAP Mon Dec 14 12:32:15 2009 : Info: +- entering group authenticate {...} Mon Dec 14 12:32:15 2009 : Info: [eap] Request found, released from the list Mon Dec 14 12:32:15 2009 : Info: [eap] EAP/ttls Mon Dec 14 12:32:15 2009 : Info: [eap] processing type ttls Mon Dec 14 12:32:15 2009 : Info: [ttls] Authenticate Mon Dec 14 12:32:15 2009 : Info: [ttls] processing EAP-TLS Mon Dec 14 12:32:15 2009 : Info: [ttls] eaptls_verify returned 7 Mon Dec 14 12:32:15 2009 : Info: [ttls] Done initial handshake Mon Dec 14 12:32:15 2009 : Info: [ttls] eaptls_process returned 7 Mon Dec 14 12:32:15 2009 : Info: [ttls] Session established. Proceeding to decode tunneled attributes. TTLS tunnel data in 0000: 00 00 00 01 40 00 00 1a 53 69 6c 76 65 72 40 65 TTLS tunnel data in 0010: 78 61 6d 70 6c 65 2e 63 6f 6d 00 00 00 00 00 0b TTLS tunnel data in 0020: c0 00 00 1c 00 00 01 37 8e fc 4f 90 b9 c9 af bb TTLS tunnel data in 0030: e2 85 67 5a c1 59 10 df 00 00 00 19 c0 00 00 3e TTLS tunnel data in 0040: 00 00 01 37 35 00 fe f7 66 bb 3b ea 86 dc ef 09 TTLS tunnel data in 0050: c6 ea ff 22 c9 c3 00 00 00 00 00 00 00 00 0d 2a TTLS tunnel data in 0060: 12 6b b1 3e 4d 46 b6 b0 cb 1b 75 f1 98 6c ea d8 TTLS tunnel data in 0070: 41 20 ad b7 e3 70 00 00 Mon Dec 14 12:32:15 2009 : Info: [ttls] Got tunneled request User-Name = "Silver(a)example.com" MS-CHAP-Challenge = 0x8efc4f90b9c9afbbe285675ac15910df MS-CHAP2-Response = 0x3500fef766bb3bea86dcef09c6eaff22c9c300000000000000000d2a126bb13e4d46b6b0cb 1b75f1986cead84120adb7e370 FreeRADIUS-Proxied-To = 127.0.0.1 Mon Dec 14 12:32:15 2009 : Info: [ttls] Sending tunneled request User-Name = "Silver(a)example.com" MS-CHAP-Challenge = 0x8efc4f90b9c9afbbe285675ac15910df MS-CHAP2-Response = 0x3500fef766bb3bea86dcef09c6eaff22c9c300000000000000000d2a126bb13e4d46b6b0cb 1b75f1986cead84120adb7e370 FreeRADIUS-Proxied-To = 127.0.0.1 NAS-Identifier = "WC_LAB" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-12-CF-C7-4C-F2" WiMAX-BS-Id = 0x000002030209 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 server inner-tunnel { Mon Dec 14 12:32:15 2009 : Info: +- entering group authorize {...} Mon Dec 14 12:32:15 2009 : Info: ++[chap] returns noop Mon Dec 14 12:32:15 2009 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Mon Dec 14 12:32:15 2009 : Info: ++[mschap] returns ok Mon Dec 14 12:32:15 2009 : Info: ++[unix] returns notfound Mon Dec 14 12:32:15 2009 : Info: [suffix] Looking up realm "example.com" for User-Name = "Silver(a)example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Found realm "example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Adding Realm = "example.com" Mon Dec 14 12:32:15 2009 : Info: [suffix] Authentication realm is LOCAL. Mon Dec 14 12:32:15 2009 : Info: ++[suffix] returns ok Mon Dec 14 12:32:15 2009 : Info: ++[control] returns ok Mon Dec 14 12:32:15 2009 : Info: [eap] No EAP-Message, not doing EAP Mon Dec 14 12:32:15 2009 : Info: ++[eap] returns noop Mon Dec 14 12:32:15 2009 : Info: ++[files] returns noop Mon Dec 14 12:32:15 2009 : Info: [sql] expand: %{User-Name} -> Silver(a)example.com Mon Dec 14 12:32:15 2009 : Info: [sql] sql_set_user escaped user --> 'Silver(a)example.com' Mon Dec 14 12:32:15 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Mon Dec 14 12:32:15 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Silver(a)example.com' ORDER BY id Mon Dec 14 12:32:15 2009 : Info: [sql] User found in radcheck table Mon Dec 14 12:32:15 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Silver(a)example.com' ORDER BY id Mon Dec 14 12:32:15 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'Silver(a)example.com' ORDER BY priority Mon Dec 14 12:32:15 2009 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Silver' ORDER BY id Mon Dec 14 12:32:15 2009 : Info: [sql] User found in group Silver Mon Dec 14 12:32:15 2009 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Silver' ORDER BY id Mon Dec 14 12:32:15 2009 : Debug: rlm_sql (sql): Released sql socket id: 1 Mon Dec 14 12:32:15 2009 : Info: ++[sql] returns ok Mon Dec 14 12:32:15 2009 : Info: ++[expiration] returns noop Mon Dec 14 12:32:15 2009 : Info: ++[logintime] returns noop Mon Dec 14 12:32:15 2009 : Info: [pap] Found existing Auth-Type, not changing it. Mon Dec 14 12:32:15 2009 : Info: ++[pap] returns noop Mon Dec 14 12:32:15 2009 : Info: Found Auth-Type = MSCHAP Mon Dec 14 12:32:15 2009 : Info: +- entering group MS-CHAP {...} Mon Dec 14 12:32:15 2009 : Info: [mschap] Told to do MS-CHAPv2 for Silver(a)example.com with NT-Password Mon Dec 14 12:32:15 2009 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Mon Dec 14 12:32:15 2009 : Info: ++[mschap] returns reject Mon Dec 14 12:32:15 2009 : Info: Failed to authenticate the user. } # server inner-tunnel Mon Dec 14 12:32:15 2009 : Info: [ttls] Got tunneled reply code 3 Framed-Filter-Id := "Silver" MS-CHAP-Error = "5E=691 R=1" Mon Dec 14 12:32:15 2009 : Info: [ttls] Got tunneled Access-Reject Mon Dec 14 12:32:15 2009 : Info: [eap] Handler failed in EAP/ttls Mon Dec 14 12:32:15 2009 : Info: [eap] Failed in EAP select Mon Dec 14 12:32:15 2009 : Info: ++[eap] returns invalid Mon Dec 14 12:32:15 2009 : Info: Failed to authenticate the user. Mon Dec 14 12:32:15 2009 : Info: Using Post-Auth-Type Reject Mon Dec 14 12:32:15 2009 : Info: +- entering group REJECT {...} Mon Dec 14 12:32:15 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> {am=1}3ad1bc65fb314eb48f1606c0d23b1459(a)example.com Mon Dec 14 12:32:15 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Dec 14 12:32:15 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Dec 14 12:32:15 2009 : Info: Delaying reject of request 6 for 1 seconds Mon Dec 14 12:32:15 2009 : Debug: Going to the next request Mon Dec 14 12:32:15 2009 : Debug: Waking up in 0.9 seconds. Mon Dec 14 12:32:16 2009 : Info: Sending delayed reject for request 6 Sending Access-Reject of id 87 to 172.16.4.2 port 1812 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000

2 2