December 2009 - Freeradius-Users - lists.freeradius.org

Problem with rlm_realm
by kachin Agarwal 01 Dec '09

01 Dec '09

Hi, I M using freeradius-server 2.1.7. The authentication rate i m getting is just 4 or 5. when i put a timestamp in each of the modules, i found out that the module "rlm_realm" is called about 12 times in each authentication. That is in each handshake between the mobile unit and the radius server the rlm_realm is called many a times. how can i minimize this so that it is called only once. bcoz i m not using any realms. Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

Confused by id
by John Gardner 01 Dec '09

01 Dec '09

I'm trying to successfully use FreeRADIUS to help centrally authenticate some linux servers. I'm storing the credentials in a postgres db but I'm confused by the 'id' in the radcheck database. In the SQL HOWTO, they show the id as (mysql); +----+----------------+----------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+----------------+------------------+------+ | 1 | fredf | Password | wilma | == | | 2 | barney | Password | betty | == | | 2 | dialrouter | Password | dialup | == | +----+----------------+----------------+------------------+------+ Where as mine (postgres) looks like; id | username | attribute | op | value ----+---------------+---------------+----+------------ 1 | john.gardner | User-Password | := | xxxxxxxxxx 2 | joe.bloggs | User-Password | := | xxxxxxxxxx 3 | john.doe | User-Password | := | xxxxxxxxxx Is this really meant to be 1,2,2 or should this be 1,2,3 sequentially? i.e. as in a incrementing key? Thanks in advance John This email and any files transmitted with it are intended solely for the named recipient and may contain sensitive, confidential or protectively marked material up to the central government classification of ?RESTRICTED" which must be handled accordingly. If you have received this e-mail in error, please immediately notify the sender by e-mail and delete from your system, unless you are the named recipient (or authorised to receive it for the recipient) you are not permitted to copy, use, store, publish, disseminate or disclose it to anyone else. E-mail transmission cannot be guaranteed to be secure or error-free as it could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses and therefore the Council accept no liability for any such errors or omissions. Unless explicitly stated otherwise views or opinions expressed in this email are solely those of the author and do not necessarily represent those of the Council and are not intended to be legally binding. All Council network traffic and GCSX traffic may be subject to recording and/or monitoring in accordance with relevant legislation. South Tyneside Council, Town Hall & Civic Offices, Westoe Road, South Shields, Tyne & Wear, NE33 2RL, Tel: 0191 427 1717, Website: www.southtyneside.info

2 1

inner - outer identity
by lieven.stubbe＠b-holding.be 01 Dec '09

01 Dec '09

Dear, While trying to connect to an access point via peap, eap-tls the connection works successfully using user credentials entered manually. When asking to auth via Windows login, FR uses always the roaming id, how can I change this behaviour to use the windows login, instead of using the roaming id ? Thanx, Lieven Stubbe Belgian Railways

2 1

FreeRADIUS and PostgresSQL
by John Gardner 01 Dec '09

01 Dec '09

Hi everyone I'm using Oracle Enterprise Linux (Red Hat EL clone) and the packaged version of FreeRADIUS (1.1.3) to ultimately authenticate some Linux machines centrally. I've been following the HOWTO at http://wiki.freeradius.org/SQL_HOWTO but some of it does appear to be out of date. I've managed to successfully authenticate using the users file, but when I try to authenticate against the test data I've put in the database I'm getting the following in the logs; rad_recv: Access-Request packet from host 127.0.0.1:38929, id=223, length=64 User-Name = "john.gardner" User-Password = "xxxxxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "john.gardner", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 2 radius_xlat: 'john.gardner' rlm_sql (sql): sql_set_user escaped user --> 'john.gardner' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'john.gardner' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'john.gardner' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql: Failed to create the pair: Unknown attribute "Cleartext-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns fail for request 2 modcall: leaving group authorize (returns fail) for request 2 Finished request 2 Going to the next request Now, it appears that the problem is to do with 'Cleartext-Password' I've stored in the database, but this seems to be correct according to the HOWTO. Can anyone see the problem just from the log? Is there a list of all the correct data that could entered into the database? Thanks in advance John This email and any files transmitted with it are intended solely for the named recipient and may contain sensitive, confidential or protectively marked material up to the central government classification of ?RESTRICTED" which must be handled accordingly. If you have received this e-mail in error, please immediately notify the sender by e-mail and delete from your system, unless you are the named recipient (or authorised to receive it for the recipient) you are not permitted to copy, use, store, publish, disseminate or disclose it to anyone else. E-mail transmission cannot be guaranteed to be secure or error-free as it could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses and therefore the Council accept no liability for any such errors or omissions. Unless explicitly stated otherwise views or opinions expressed in this email are solely those of the author and do not necessarily represent those of the Council and are not intended to be legally binding. All Council network traffic and GCSX traffic may be subject to recording and/or monitoring in accordance with relevant legislation. South Tyneside Council, Town Hall & Civic Offices, Westoe Road, South Shields, Tyne & Wear, NE33 2RL, Tel: 0191 427 1717, Website: www.southtyneside.info

2 1

Error while trying to make root CA
by Peter Carlstedt 01 Dec '09

01 Dec '09

Hello everyone, it took a while for me to understand how to get root privileges in the terminal, i finally decided to login as root though I know I should not do that but I couldnt find a way around it since i need to get into raddb/certs with the terminal so i can remove some files and stuff that the readme say. Well I tried to runt the bootstrap command and got an error saying that it has problems making the Cert Request. Here down below is the output from the bootstrap command. How do I fix this, have I done something that I shouldnt have done? Best regards/ Peter Carlstedt root@peter-desktop:/usr/local/etc/raddb/certs# ./bootstrap openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ....................................+++ ......................+++ writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key .......+++ ........................................+++ writing new private key to 'ca.key' ----- problems making Certificate Request 9578:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 make: *** [ca.key] Error 1 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..............................................+..................................................................................+.+..........................................+............+............+......+..............................................................................+..........+...............................................................................................................+........+...........................................................................+...................+.......+.+......+............+.............................................................+........................+.................................................................................................................................................+.......................+......................................................................+..........................................................................................................................+............................................+.....+.................................................+.................................................................................................+............+...............+.............................................................................+........................+............+.................................+.+.....................................................+......................+...........................................................+..................................+...........+..................................................+............+........+...............+................................+........................+....................................................................................................................................................................................+........................................................................................+................+.................................................+.............................+..........................+........................................................................+...............+......................................+...............+.............................................+............+..................................+...............+............................+...........+..................++*++*++* Generating a 2048 bit RSA private key .............................................................................................................+++ ..........................................................................+++ writing new private key to 'server.key' ----- Generating a 2048 bit RSA private key ..............................................+++ .......................................................................+++ writing new private key to 'ca.key' ----- problems making Certificate Request 9587:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

1 0

Accounting SQL Entries
by Matt Martin 01 Dec '09

01 Dec '09

Hello list. I have been testing FreeRADIUS for a project we are looking at running to authenticate users for Giganews. I have got the authentication part working well, and the authentication attempts get logged correctly into MySQL. Now, I am trying to log the session details, such as data to and from the host. I've tried various configs, FAQs and similar without little luck. I am slightly stumped as to where to look now. Can anyone offer any help or advice. Thank you. M -- freeradius: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.

3 2

Session-Octets-Limit and sqlcounter
by Hamid Reza Hasani 01 Dec '09

01 Dec '09

Hi, I'm using freeradius-2.1.6, and I'm going to make a download limitation for my users. I used sqlcounter module and config it as follow: sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } According to the log messages, it shows anything is OK: rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok But in proceeding it shows me what it sent, and there isn't Session-Octets-Limit! as you can see bellow: Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Where is my problem? more log is available at the end of message. Thanks for you helps. ------ Ya Ali Hamid Reza Hasani More Log: Module: Linked to module rlm_sqlcounter Module: Instantiating monthlydownload sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Octets-Limit is number 3009 rlm_sqlcounter: Counter attribute Monthly-Download-Byte is number 11273 rlm_sqlcounter: Check attribute Max-Monthly-Download is number 11274 rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Next reset 1259613000 [2009-12-01 00:00:00] rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Prev reset 1257021000 [2009-11-01 00:00:00] Module: Checking preacct {...} for more modules to load . . . rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000')' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')}' [monthlydownload] sql_xlat [monthlydownload] expand: %{User-Name} -> hrh [monthlydownload] sql_set_user escaped user --> 'hrh' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [monthlydownload] expand: %{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')} -> 100213 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user hrh, check_item=600000000, counter=100213 rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok . . . Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Going to the next request Waking up in 4.9 seconds.

5 9

mySQL table creation file
by James Hankins 01 Dec '09

01 Dec '09

Greetings, I'm standing up a freeradius server on Centos 5.4 with the yum installed version of Freeradius. Where do I obtain the mysql file to create the default tables for the database? Thank you! Jim

2 1