March 2009 - Freeradius-Users - lists.freeradius.org

Re: rlm_perl authentication override
by Henry 20 Nov '12

20 Nov '12

Quoting tnt(a)kalik.net: >>>> Is there a way to change the reply from Access-Reject, to Access-Accept? >>>> > > Change freeradius.internal attribute Packet-Type in Post-Auth-Type Reject > section. Changing freeradius.internal Packet-Type from Access-Reject to Access-Accept would affect ALL logins - even logins which *should* be rejected. I'm referring to changing Access-Reject to Access-Accept under certain circumstances only -- not globally for all logins. ...or am I misunderstanding what you're suggesting? Thanks Henry

5 13

EAP-TTLS-PAP-LDAP
by Rohaizam Abu Bakar 12 Jun '12

12 Jun '12

Trying to do EAP-TTLS-PAP with CRYPT passwd in LDAP.. The tunelling seems fine.. but up to comparing the password it will failed. Refer below logs & config Some says (http://felipe-alfaro.org/blog/category/radius/) PAP is tunneled inside EAP-TTLS through EAP-GTC... Tried that as well.. still same error.. gtc { auth_type = PAP [even trying to change to LDAP/OCE - still same error) } Error ==== auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [jaroce2(a)ocemy015.com] (from client localhost port 0) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: leaving group authenticate (returns invalid) for request 9 auth: Failed to validate the user. Login incorrect: [jaroce2(a)ocemy015.com] (from client OCE_JARING port 241 cli 00-11-5b-2d-b2-8e) With setting:- a) radiusd.conf ldapOCE { --some setting } authorize { eap Autz-Type OCE { ldapOCE } } authenticate { Auth-Type OCE { ldapOCE } eap } b) eap.conf eap { default_eap_type = ttls tls { --some setting } ttls { default_eap_type = md5 } c) users:- DEFAULT Realm == "my015.com", Autz-Type := OCE

9 16

Daily accounting
by David Roze 02 Dec '11

02 Dec '11

Hi everyone, I have seen a lot of people who are trying to get traffic accounting collected at regular intervals to generate graphs and view per day/month etc... I have made a few modifications in order to achieve this. You can see it at http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html It works on Mysql setup but can be adapted to any db. I'd be grateful to get some feedback on this. A lot of ISPs are running into this problem. Hope this helps Regards, David

2 1

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61

rlm_sql: "NUMERIC VALUE OUT OF RANGE" error
by Vegard Svanberg 07 Jul '11

07 Jul '11

Freeradius 2.1.0. I have a NAS which sends a NAS-Port-Id attribute in the range 2147483648..2164260863. PostgreSQL doesn't like the query Freeradius performs. It's choking when trying to insert for instance '2163214239::integer' into the radacct table. $ select 2163214239::integer; ERROR: integer out of range Example: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('80f0079f', '5c9f0b7076dcc9c0', 'username', NULLIF('', ''), '1.2.3.4', 2163214239::integer, 'Wireless-802.11', ('2008-09-26 09:52:52'::timestamp - '1'::interval - '3382'::interval), ('2008-09-26 09:52:52'::timestamp - '1'::interval), NULLIF('3382', '')::bigint, '', '', (('0'::bigint << 32) + '57743'::bigint), (('0'::bigint << 32) + '294709'::bigint), 'hotspot', 'XX:XX:XX:XX:XX:XX', 'Lost-Service', '', '', NULLIF('192.168.12.94', '')::inet, 0) rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error integer out of range rlm_sql_postgresql: Postgresql Fatal Error: [22003: NUMERIC VALUE OUT OF RANGE] Occurred!! [sql] Couldn't insert SQL accounting STOP record - ERROR: integer out of range rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Quick fixes...? -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

6 6

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

Password in Radius Debug
by Cody Jarrett 17 Mar '10

17 Mar '10

I notice the password during supplicant connects to the radius server are displayed in plain text. Is there a way to disable this? -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

5 5

Different realms for different databases
by liran tal 20 Dec '09

20 Dec '09

Hey, To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows: authenticate { ... Autz-Type SQL_EXAMPLE2 { sql_example2 } ... } Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section. What would be the way to configure accounting for the different realms in their correct databases? FreeRADIUS 1.1.7 and MySQL 5. Regards, Liran.

3 9

Re:Help with md5 database encryption (Oscar Trejo)
by Oscar Trejo 11 Oct '09

11 Oct '09

The version of the freeradius is v 1.1.0 I hope these is what you ask me. Thanks !!! > What freeradius version is this? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 23/9/2008, "Oscar Trejo" <racso83(a)gmail.com> piše: > > >Hi, I had a freeradius server working, but only when the password are > saved > >on the database on plain-text with out encryption, my question is about > how > >to save the instructions on the table radcheck and radgroupcheck to work > >with Password encryption MD5. > > > >My working free radius tables had > > > >radcheck > >+----+----------+-----------+----+--------+ > >| id | UserName | Attribute | op | Value | > >+----+----------+-----------+----+--------+ > >| 3 | oscar | Password | == | uno | > >+----+----------+-----------+----+--------+ > > > >radgroupcheck > >+----+-----------+-----------+----+-------+ > >| id | GroupName | Attribute | op | Value | > >+----+-----------+-----------+----+-------+ > >| 1 | dinamico | Auth-Type | := | Local | > >+----+-----------+-----------+----+-------+ > > > > > > > >When i had the password with simple plaint text with out encryption the > >result is the next > > > >Auth: Login OK: [oscar/uno] (from client ##### port ########## cli > >##:##:##:##:##:##) > > > > > > > >But I want to save the password with MD5 encryption, the freeradius load > >correctly the module pap, chap and eap with out errors, but when i try to > >change the configuration for example : > > > >radcheck > >+----+----------+-----------+----+--------+ > >| id | UserName | Attribute | op | Value | > >+----+----------+-----------+----+--------+ > >| 3 | oscar | MD5-Password | == | 1eaa8bb195869a23f081acbb5bf08527 | > >+----+----------+-----------+----+--------+ > > > >radgroupcheck > >+----+-----------+-----------+----+-------+ > >| id | GroupName | Attribute | op | Value | > >+----+-----------+-----------+----+-------+ > >| 1 | dinamico | Auth-Type | := | PAP | > >+----+-----------+-----------+----+-------+ > > > > > >the free radius log gave me the next error: > > > > > >Error: rlm_sql_getvpdata: database query error > >Info: rlm_sql (sql): No matching entry in the database for request from > user > >[oscar] > >Auth: Login incorrect: [oscar/uno] (from client ##### port ########## cli > >##:##:##:##:##:##) > > > > > > > > > >But i need the encryption with MD5, any suggestion > > > >Before any answer I gave you thanks for the help > > >

5 6

Problem with radzap
by Pierre-henri Baraffe 01 Oct '09

01 Oct '09

Hello, I have a mistake with my freeradius. On server with 1.1.7 the command : "radzap -u username -P port-nas 127.0.0.1 secret" work with no problem On a new server with FR 2.0.5, with the same command i have this error radclient:: failed to get value I have no more message with the "-x" option and nothing in the log. I have the same things if i replace "127.0.0.1" by "localhost" my client.conf client localhost { ipaddr = 127.0.0.1 secret = secret require_message_authenticator = no shortname = localhost nastype = other # localhost isn't usually a NAS... } I don't understand. Thanks for your help. ph

3 3