September 2009 - Freeradius-Users - lists.freeradius.org

Authentication password used by client
by Christoph Schmidt 14 Sep '09

14 Sep '09

Hi *, I have a RADIUS client requesting an authorization and I would like to know which protocol this client is using. When running freeradius with -X I get the following output: ... modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 217 users: Matched entry 00139D0009CD at line 220 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password ... I assume "local" refers to the "users" file. But is there a way to see the actual authorization protocol used between client and server? Thanks a lot in advance for any help!

3 5

freeradius mysql errors
by ramesh p 14 Sep '09

14 Sep '09

Hello, I'm seeing the following errors in radius.log. Could anybody tell me how to fix those? Mon Sep 14 01:10:14 2009 : Error: rlm_sql_mysql: Socket not connected Mon Sep 14 01:10:14 2009 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@xx.xx.xx.xx:LWT Mon Sep 14 01:10:14 2009 : Error: rlm_sql_mysql: Mysql error 'Bad handshake' Mon Sep 14 01:10:14 2009 : Error: rlm_sql (sql): Failed to connect DB handle #10 Do i need to increase the number of sql sockets? (at present 15) Or do i need to increase the no of requests that radius can keep track of(At present 1024) Please suggest. Thanks.

3 2

MAC/IP/Identity correlation through AAA and DHCP
by Ben Jencks 14 Sep '09

14 Sep '09

Hi, First, this is in a wired/wireless WPA2/802.1x environment. I'm trying to create a log of who (real world identity) had what MAC and IP when. The plan is to periodically parse the FreeRADIUS AAA logs (identity to MAC mappings) and DHCP lease files (MAC to IP mappings) and correlate them. Before I dive into parsing these, has anyone written these scripts already? Alternatively, will the FreeRADIUS DHCP server do this without any extra work, and is it mature enough for production? I couldn't find any real documentation on it; just the feature page, and it says it only supports static addresses (I need to oversubscribe the address pool, so I can't do static). Thanks, Ben Jencks

3 7

Re: usename + password + MAC address
by Hilton Guaraldi 13 Sep '09

13 Sep '09

Let me ask something about attr_rewrite in order to give the possibility to work with my 6 APs, and to do a rewrite of MAC to EAP-PEAP authentication. Would it be possible to write in radius.conf and default files the following, avoiding many entries in the hints file? Scenario: AP1 ->Send client MAC 00-18-E7-41-AD-C2 AP2,...,AP6 ->Send client MAC 0018e741adc2 In radius.conf, attr_rewrite mac-phase1 { attribute = Calling-Station-Id new_attribute = no searchin = packet ignore_case = no searchfor = "-" # Possible here doing a hyphen search replacewith = "" # and replacing... append = no } attr_rewrite mac-phase2 { attribute = Calling-Station-Id new_attribute = no searchin = packet ignore_case = no searchfor = "???" # Possible here doing a lowercase letters search replacewith = "???" # and replacing by uppercase letters, a->A, c->C, d->D, e->E, etc... Apologize me for the ??? append = no } and in default: authorize { mac-phase1 mac-phase2 ... } But the problem is, I do not know how to do the replacement. Do you know how can I do this with an expression in mac-phase2? And in mac-phase1 the hyphen search is correct? The benefit would be one Calling-Station-Id with uppercase letters without hyphens entry in MySQL radcheck table for each user... The operator in MySQL radcheck table to work with Calling-Station-Id string is == . If MAC now is 0018E741ADC2, after running mac-phase2, the operator must change? Best regards, Guaraldi 2009/9/13 Ivan Kalik <tnt(a)kalik.net>: >> Ok, it works, but a new problem emerged.... >> >> I have 6 AP´s. One of them send the MAC in the following format: >> 00-18-E7-41-AD-C2. The others send 0018e741adc2... Here the letters >> are in lowercase and if changed to uppercase the authentication fails >> from 5 AP´s. > > Rewrite Calling-Station-Id in hints file to the format you want (probably > best without separators). You have examples for regex rewriting mac > address in other threads on the list. > > Ivan Kalik > Kalik Informatika ISP > >

1 0

rlm_perl still looses tags for tagged attributes even after upgrade to 2.1.6
by Alexandr Kovalenko 13 Sep '09

13 Sep '09

Hello, It has been stated in release notes for FR 2.1.6 that loosing of tags for tagged attributes is fixed in rlm_perl in this version, but it is not. Look at the example below: -------- $ radiusd -v | head -1 radiusd: FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd7.2, built on Aug 18 2009 at 12:31:54 $ perl -V Summary of my perl5 (revision 5 version 8 subversion 9) configuration: Platform: osname=freebsd, osvers=7.2-release-p2, archname=i386-freebsd-64int uname='freebsd mile.office.tsu 7.2-release-p2 freebsd 7.2-release-p2 #0: fri jun 26 10:01:50 eest 2009 root@mile.office.tsu:usrobjusrsrcsysmile i386 ' config_args='-sde -Dprefix=/usr/local -Darchlib=/usr/local/lib/perl5/5.8.9/mach -Dprivlib=/usr/local/lib/perl5/5.8.9 -Dman3dir=/usr/local/lib/perl5/5.8.9/perl/man/man3 -Dman1dir=/usr/local/man/man1 -Dsitearch=/usr/local/lib/perl5/site_perl/5.8.9/mach -Dsitelib=/usr/local/lib/perl5/site_perl/5.8.9 -Dscriptdir=/usr/local/bin -Dsiteman3dir=/usr/local/lib/perl5/5.8.9/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Ui_malloc -Ui_iconv -Uinstallusrbinperl -Dcc=cc -Duseshrplib -Dinc_version_list=none -Dccflags=-DAPPLLIB_EXP="/usr/local/lib/perl5/5.8.9/BSDPAN" -Doptimize=-O2 -fno-strict-aliasing -pipe -march=pentium4 -Ud_dosuid -Ui_gdbm -Dusethreads=n -Dusemymalloc=y -Duse64bitint' hint=recommended, useposix=true, d_sigaction=define usethreads=undef use5005threads=undef useithreads=undef usemultiplicity=undef useperlio=define d_sfio=undef uselargefiles=define usesocks=undef use64bitint=define use64bitall=undef uselongdouble=undef usemymalloc=y, bincompat5005=undef Compiler: cc='cc', ccflags ='-DAPPLLIB_EXP="/usr/local/lib/perl5/5.8.9/BSDPAN" -DHAS_FPSETMASK -DHAS_FLOATINGPOINT_H -fno-strict-aliasing -pipe -I/usr/local/include', optimize='-O2 -fno-strict-aliasing -pipe -march=pentium4', cppflags='-DAPPLLIB_EXP="/usr/local/lib/perl5/5.8.9/BSDPAN" -DHAS_FPSETMASK -DHAS_FLOATINGPOINT_H -fno-strict-aliasing -pipe -I/usr/local/include' ccversion='', gccversion='4.2.1 20070719 [FreeBSD]', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=12345678 d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12 ivtype='long long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8 alignbytes=4, prototype=define Linker and Libraries: ld='cc', ldflags =' -Wl,-E -L/usr/local/lib' libpth=/usr/lib /usr/local/lib libs=-lgdbm -lm -lcrypt -lutil perllibs=-lm -lcrypt -lutil libc=, so=so, useshrplib=true, libperl=libperl.so gnulibc_version='' Dynamic Linking: dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags=' -Wl,-R/usr/local/lib/perl5/5.8.9/mach/CORE' cccdlflags='-DPIC -fPIC', lddlflags='-shared -L/usr/local/lib' Characteristics of this binary (from libperl): Compile-time options: MYMALLOC PERL_MALLOC_WRAP USE_64_BIT_INT USE_FAST_STDIO USE_LARGE_FILES USE_PERLIO Locally applied patches: defined-or Built under freebsd Compiled at Aug 18 2009 14:56:36 @INC: /usr/local/lib/perl5/5.8.9/BSDPAN /usr/local/lib/perl5/site_perl/5.8.9/mach /usr/local/lib/perl5/site_perl/5.8.9 /usr/local/lib/perl5/5.8.9/mach /usr/local/lib/perl5/5.8.9 . -------- Following code is used in sub authorize {} in perl module I'm trying to use -------- if (($RAD_REQUEST{'User-Name'} eq 'admin') and ($RAD_REQUEST{'User-Password'} eq 'test')) { $RAD_REPLY{'ERX-Service-Activate:1'} = "telesys"; $RAD_REPLY{'ERX-Service-Statistics:1'} = "time-volume"; $RAD_REPLY{'ERX-Qos-Parameters'}[0] = "internet_tr_value 2097152"; $RAD_REPLY{'ERX-Qos-Parameters'}[1] = "internet_tr_value_in 2097152"; $RAD_REPLY{'ERX-Service-Activate:2'} = "deny"; $RAD_REPLY{'ERX-Qos-Profile-Name'} = "SP_Tele_Internet"; $RAD_REPLY{'Framed-IP-Address'} = '10.0.112.2'; $RAD_REPLY{'Framed-IP-Netmask'}= "255.255.255.255"; $RAD_REPLY{'ERX-Primary-DNS'} = "1.2.3.4"; $RAD_REPLY{'ERX-Secondary-DNS'} = "1.2.3.5"; return RLM_MODULE_OK; }; -------- This gives following results: # radtest admin test 10.3.1.252 12 huawei Sending Access-Request of id 70 to 10.3.1.252 port 1812 User-Name = "admin" User-Password = "test" NAS-IP-Address = 10.1.2.13 NAS-Port = 12 rad_recv: Access-Accept packet from host 10.3.1.252 port 1812, id=70, length=188 ERX-Qos-Parameters = "internet_tr_value 2097152" ERX-Qos-Parameters = "internet_tr_value_in 2097152" ERX-Service-Activate:0 = "deny" ERX-Service-Activate:0 = "telesys" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:1 = time-volume ERX-Primary-Dns = 1.2.3.4 ERX-Secondary-Dns = 1.2.3.5 Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 -------- Output from radiusd -X: rad_recv: Access-Request packet from host 10.3.1.252 port 52845, id=70, length=57 User-Name = "admin" User-Password = "test" NAS-IP-Address = 10.1.2.13 NAS-Port = 12 server radoss { +- entering group authorize {...} ++[preprocess] returns ok ++[control] returns ok rlm_perl: $VAR1 = {}; rlm_perl: defined rlm_perl: Added pair User-Name = admin rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-Port = 12 rlm_perl: Added pair NAS-IP-Address = 10.1.2.13 rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Activate:2 = deny rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value_in 2097152 rlm_perl: Added pair ERX-Service-Statistics:1 = time-volume rlm_perl: Added pair ERX-Secondary-DNS = 1.2.3.5 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair ERX-Service-Activate:1 = telesys rlm_perl: Added pair ERX-Primary-DNS = 1.2.3.4 rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok Found Auth-Type = Perl +- entering group Perl {...} rlm_perl: Added pair User-Name = admin rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-IP-Address = 10.1.2.13 rlm_perl: Added pair NAS-Port = 12 rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value_in 2097152 rlm_perl: Added pair ERX-Service-Activate = deny rlm_perl: Added pair ERX-Service-Activate = telesys rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Statistics:1 = time-volume rlm_perl: Added pair ERX-Primary-Dns = 1.2.3.4 rlm_perl: Added pair ERX-Secondary-Dns = 1.2.3.5 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok +- entering group post-auth {...} ++[exec] returns noop } # server radoss Sending Access-Accept of id 70 to 10.3.1.252 port 52845 ERX-Qos-Parameters += "internet_tr_value 2097152" ERX-Qos-Parameters += "internet_tr_value_in 2097152" ERX-Service-Activate:0 += "deny" ERX-Service-Activate:0 += "telesys" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:1 = time-volume ERX-Primary-Dns = 1.2.3.4 ERX-Secondary-Dns = 1.2.3.5 Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 70 with timestamp +4 Ready to process requests. -- Alexandr Kovalenko http://uafug.org.ua/

1 2

Vista PEAP troubleshooting
by Hawkins, Jeff (APLY-MN) 13 Sep '09

13 Sep '09

I setup a freeradius server 1.1.7 with mysql on Ubuntu and wanted to use PEAP to avoid any certificate stuff on the clients as they will be guest visiting my company and was hoping for a name/password to connect. Everything worked fine for my testing (XP SP3) until I tried to connect a Vista user. More or less when they are prompt for the name and password and then it goes nowhere and they are not connected. I also tried a Windows & computer with the same PEAP settings and had the same results as Vista. Now I am wondering where to look to find what I have missed. I have been looking over logs from the debugging -X and have done some PEAP tracing on Vista but still find myself guessing on what the cause might be. I was hoping someone could point me on where/what to look for to get the Vista/PEAP working or if I should try something else. I am fairly new to Ubuntu/Freeradius but do enjoy working and learning with it so I apologize in advance if that gets in the way. I used these site for getting it running. http://www.howtoforge.com/setting-up-a-freeradius-based-aaa-server-with- mysql-and-management-with-daloradius then this for some SSL certificates after the Vista problem started thinking/hoping it would help. http://www.linuxjournal.com/article/8095 I appreciate any help you can offer. J Hawk

8 16

Re: FreeRadius is 3 time quicker when running in full debug mode?( -X?option)
by mathieu＠trustive.com 13 Sep '09

13 Sep '09

I all, I'm Vincent's colleague @john dennis: it's not the bug we're hitting, as the issue is visible when launching a "shell command" (via exec program wait) @Ken: It seems the scheduler granularity is 8ms on debian by default, so definitely not the issue here (100ms would be HUGE!): $ cat /proc/sys/kernel/sched_min_granularity_ns 8000000 @Alexander Clouter: it's a dual Intel(R) Pentium(R) D CPU 3.00GHz Do you believe that could cause a 100ms hit? What about rlm_python? would you recommend using it, or will it be as "slow" as the exec program wait in threaded mode? BR Mathieu

4 5

Re: usename + password + MAC address
by Hilton Guaraldi 13 Sep '09

13 Sep '09

Ok, it works, but a new problem emerged.... I have 6 AP´s. One of them send the MAC in the following format: 00-18-E7-41-AD-C2. The others send 0018e741adc2... Here the letters are in lowercase and if changed to uppercase the authentication fails from 5 AP´s. What must I do in radcheck table to work with the 6 AP´s? More details of actual radcheck in MySQL: 1 DEFAULT Fall-Through = Yes 2 guaraldi Calling-Station-Id == 00-18-E7-41-AD-C2 3 guaraldi Cleartext-Password := 123mudar 4 guaraldi Simultaneous-Use := 1 21 DEFAULT Fall-Through = Yes 22 wvcampos Calling-Station-Id == 00-11-95-95-DC-C0 23 wvcampos Cleartext-Password := sprj2009 24 wvcampos Simultaneous-Use := 1 With this config in radcheck table, guaraldi with letters in uppercase and separated by hyphen is fine. Changing MAC to 0018e741adc2 give me authentication reject. XP Clients do 802.1x EAP-PEAP. It works fine. Let me ask, must I enter DEFAULT Fall-Through = Yes to every user in my database or only one entry? The entries above are correct? Best regards, Guaraldi 2009/9/11 Ivan Kalik <tnt(a)kalik.net>: >> Oops!!! >> Putting my head in the right place... :-) >> >> May I insert in the radcheck table for user guaraldi, password >> mudar123, MAC 00-18-E7-41-AD-C2 the following lines??? >> >> 1 DEFAULT Fall-Through = >> yes >> 2 guaraldi Cleartext-Password := >> mudar123 >> 3 guaraldi Calling-Station-Id == >> 00-18-E7-41-AD-C2 >> 4 guaraldi Simultaneous-Use := 1 >> >> And set in the peap section of eap.conf file: copy_request_to_tunnel = >> yes >> Is this correct???????????? > > Yes. You need to copy outer request into the tunnel (sql should alredy be > enabled for password to work). You should probably enable > "use_tunneled_reply" as well, to get reply attributes into the final > reply. > > Ivan Kalik > Kalik Informatika ISP > >

1 0

Re: Pre-release of 2.1.7
by Thor Spruyt 13 Sep '09

13 Sep '09

Just wondering... i have an empty users file, and i use rlm_sql only to fetch the Cleartext-Password in the authorize section, like this: SELECT 1,username,'Cleartext-Password',password,':=' FROM account WHERE username='thor' I then get this message in the debugging output: WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. I don't have "Auth-Type = Local" anywhere, nor with := If I put "DEFAULT Auth-Type := PAP" in the users file, everything still works like I want it and the WARNING messages are gone. However, I'm not sure whether the system is suggesting to always set Auth-Type in the authorize section (could come from SQL query also) or whether I should just ignore those WARNING messages... Regards, Thor.

2 1

Simultaneou-Use := 1
by Rakotomandimby Mihamina 12 Sep '09

12 Sep '09

Hi all, Using Freeradius v2 We use only PGSQL (no "users" file) and a custom schema Just an example: authorize_check_query = "SELECT * FROM f_authorize_check_query2('%{SQL-User-Name}','%{User-Password}' ...." => We play much with FUNCTIONs in PGSQL. Because of legacy application requiring exotic schema, we are obliged to play with it. The problem is I cannot have +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | bartek | Cleartext-Password | := | 1234 | | 3 | bartek | Simultaneous-Use | := | 1 | +----+----------+--------------------+----+-------+ With our schema, but only +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | bartek | Cleartext-Password | := | 1234 | +----+----------+--------------------+----+-------+ Where should i specify a default "Simultaneous-Use := 1" in a file, so that It wouldn't be mandatory to return it from the authorize_check_query? -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 4