March 2012 - Freeradius-Users - lists.freeradius.org

Question on logging EAP/PEAP authentication rejections
by Josh Hiner 21 Mar '12

21 Mar '12

Hello. Im running freeradius 2.1.6 and logging to /var/log/radius in file/detail format. Currently connection logging is working if the user authenticates correctly. I cant get access rejects to log though. Ive turned on reply detail but that is only showing successful attempts too. I have : use_tunneled_reply = yes and copy_request_to_tunnel = yes in eap.conf (need that to do group checking in the users file) but this does not seem to effect the issue of no rejected logins being logged. Searched this email list as well as online. Sorry to bother. Any info would be great. I appreciate your time. Thanks!!! -Josh

3 11

generate a random value with unlang?
by Stefan Winter 21 Mar '12

21 Mar '12

Hi, in some weird business case, I would like to generate a one-time use token for later consumption in post-auth. So when the user is accepted, trigger an {sql:INSERT randomvalue INTO someplace} The value should be new for every Access-Accept. I wonder how to generate such a random value with unlang. Is there some {%rand} or anything like that? Currently I do it embedded in the INSERT: INSERT ... SHA1(RAND())... INTO someplace but our MySQL admins don't like me doing that. So I'd prefer to do this on FreeRADIUS and send a simple string to the DB. Greetings, Stefan Winter

3 3

EAP-TLS for Hotspots.
by Mrinal K 20 Mar '12

20 Mar '12

This is not exactly a freeradius configuration related query, but considering the deployment related exposure of all of us this seems to be the best place. So here it goes.. We are trying to implement a 802.1x based framework for user authentication for public hotspots. To go about authentication with different hotspots we are using EAP-TLS. The user registers with us then downloads an installer containing the certificates and x-supplicant, then installs them. All the hotspots are configured to authenticate users with our server and the server is a generic freeradius configured for EAP-TLS authentication. For now certificates are issued by the same server which runs freeradius but we plan to have them on different server. The system works perfectly in our test environment(2-3 hotspots with 10 or so users) however I read somewhere that the dissemination of certificates and managing the users in PKI becomes complicated as the number of users increase. So, the question which I want to ask is how has been everyone's experience with EAP-TLS deployment and is there something which we need to plan ahead for. Sincerely, Kumar Mrinal

1 0

dailycounter is not working with redundant sql
by Oleg Sorocean 19 Mar '12

19 Mar '12

Dear all, I have the radius configuration with 2 radius servers and mysql, I configured radius for sql redundancy like below: radiusd.conf instantiate { ..... redundant redundant_sql { sql1 sql2 } .... } in default in each section authorization, accounting.... I am using redundant_sql instead of sql everything is working ok beside the daily counter which is not working as expected if primary sql server is down I configured daily counter like this sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst=redundant_sql key = User-Name reset = daily .... } Which seems to be wrong, could you suggest please which would be the correct way to configure this. Also please see below the log for the user for which daily counter has expired, but with on main sql server down, it is accepted in anyway. Thank you in advance Oleg Radius log --------------------------------------------------------------------------------------------------------------------------------- [root@radiusdb2 ~]# radiusd -X FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. ....... ........ ...... Module: Loading virtual module redundant_sql Module: Linked to module rlm_sql Module: Instantiating module "sql1" from file /etc/raddb/sql.conf sql sql1 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "XXXXXXXXXX" password = "XXXXXXXXX" radius_db = "XXXX" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND acctsessionid != '%{Acct-Session-Id}'" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S','%{reply:Reply-Message}','%{NAS-IP-Address}')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql Creating new attribute sql1-SQL-Group rlm_sql: Registering sql_groupcmp for sql1-SQL-Group rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql1): Attempting to connect to radius@localhost:/radius rlm_sql (sql1): starting 0 rlm_sql (sql1): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)' rlm_sql (sql1): Failed to connect DB handle #0 rlm_sql (sql1): starting 1 rlm_sql (sql1): starting 2 rlm_sql (sql1): starting 3 rlm_sql (sql1): starting 4 rlm_sql (sql1): Failed to connect to any SQL server. Module: Instantiating module "sql2" from file /etc/raddb/sql.conf sql sql2 { driver = "rlm_sql_mysql" server = "radius-db3" port = "3306" login = "XXXXX" password = "XXXXXXXXXXXXXXXXXXXXXXXX" radius_db = "XXXXX" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND acctsessionid != '%{Acct-Session-Id}'" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S','%{reply:Reply-Message}','%{NAS-IP-Address}')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql Creating new attribute sql2-SQL-Group rlm_sql: Registering sql_groupcmp for sql2-SQL-Group rlm_sql (sql2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql2): Attempting to connect to radius@radius-db3:3306/radius rlm_sql (sql2): starting 0 rlm_sql (sql2): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql2): Connected new DB handle, #0 rlm_sql (sql2): starting 1 rlm_sql (sql2): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql2): Connected new DB handle, #1 rlm_sql (sql2): starting 2 rlm_sql (sql2): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql2): Connected new DB handle, #2 rlm_sql (sql2): starting 3 rlm_sql (sql2): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql2): Connected new DB handle, #3 rlm_sql (sql2): starting 4 rlm_sql (sql2): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql2): Connected new DB handle, #4 Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Loading virtual module redundant_sql Module: Linked to module rlm_sqlcounter Module: Instantiating module "dailycounter" from file /etc/raddb/sql/mysql/counter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "redundant_sql" query = "SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{%k}' AND acctstarttime BETWEEN FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Daily-Session-Time is number 11275 rlm_sqlcounter: Check attribute Max-Daily-Session is number 11276 rlm_sqlcounter: Current Time: 1331850151 [2012-03-15 23:22:31], Next reset 1331852400 [2012-03-16 00:00:00] rlm_sqlcounter: Current Time: 1331850151 [2012-03-15 23:22:31], Prev reset 1331766000 [2012-03-15 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Loading virtual module redundant_sql Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Loading virtual module redundant_sql Module: Checking post-auth {...} for more modules to load Module: Loading virtual module redundant_sql } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. rad_recv: Access-Request packet from host x.y.z.k port 45064, id=111, length=142 User-Name = "test11(a)test.com" User-Password = "xxxxxx" NAS-IP-Address = x.y.z.k NAS-Port = 2 Service-Type = Outbound-User Calling-Station-Id = "x1.x2.x3.x4" NAS-Identifier = "OpenVpn-tcp" Acct-Session-Id = "7815B44B60809E4755317B1613AE0024" NAS-Port-Type = Virtual # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "test.com" for User-Name = "test11(a)test.com" [suffix] No such realm "test.com" ++[suffix] returns noop ++[files] returns noop ++- entering group redundant_sql {...} [sql1] expand: %{User-Name} -> test11(a)test.com [sql1] sql_set_user escaped user --> 'test11(a)test.com' rlm_sql (sql1): Ignoring unconnected handle 4.. rlm_sql (sql1): Ignoring unconnected handle 3.. rlm_sql (sql1): Ignoring unconnected handle 2.. rlm_sql (sql1): Ignoring unconnected handle 1.. rlm_sql (sql1): Ignoring unconnected handle 0.. rlm_sql (sql1): There are no DB handles to use! skipped 5, tried to connect 0 +++[sql1] returns fail [sql2] expand: %{User-Name} -> test11(a)test.com [sql2] sql_set_user escaped user --> 'test11(a)test.com' rlm_sql (sql2): Reserving sql socket id: 4 [sql2] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test11(a)test.com' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test11(a)test.com' ORDER BY id [sql2] User found in radcheck table [sql2] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test11(a)test.com' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test11(a)test.com' ORDER BY id [sql2] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test11(a)test.com' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'test11(a)test.com' ORDER BY priority [sql2] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'freeuser' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'freeuser' ORDER BY id [sql2] User found in group freeuser [sql2] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'freeuser' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'freeuser' ORDER BY id rlm_sql (sql2): Released sql socket id: 4 +++[sql2] returns ok ++- group redundant_sql returns ok [expiration] Checking Expiration time: 'Dec 29 2012 20:36:50' ++[expiration] returns ok ++[logintime] returns noop ++[pap] returns updated rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('1331766000') AND FROM_UNIXTIME('1331852400')' [dailycounter] expand: SELECT SUM(acctsessiontime) FROM radacct WHERE username = '%{User-Name}' AND acctstarttime BETWEEN FROM_UNIXTIME('1331766000') AND FROM_UNIXTIME('1331852400') -> SELECT SUM(acctsessiontime) FROM radacct WHERE username = 'test11(a)test.com' AND acctstarttime BETWEEN FROM_UNIXTIME('1331766000') AND FROM_UNIXTIME('1331852400') sqlcounter_expand: '%{redundant_sql:SELECT SUM(acctsessiontime) FROM radacct WHERE username = 'test11(a)test.com' AND acctstarttime BETWEEN FROM_UNIXTIME('1331766000') AND FROM_UNIXTIME('1331852400')}' [dailycounter] WARNING: Unknown module "redundant_sql" in string expansion "%" rlm_sqlcounter: No integer found in string "" ++[dailycounter] returns noop Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "xxxxx" [pap] Using clear text password "xxxxx" [pap] User authenticated successfully ++[pap] returns ok # Executing section session from file /etc/raddb/sites-enabled/default +- entering group session {...} ++- entering group redundant_sql {...} [sql1] expand: %{User-Name} -> test11(a)test.com [sql1] sql_set_user escaped user --> 'test11(a)test.com' [sql1] expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND acctsessionid != '%{Acct-Session-Id}' -> SELECT COUNT(*) FROM radacct WHERE username = 'test11(a)test.com' AND acctstoptime IS NULL AND acctsessionid != '7815B44B60809E4755317B1613AE0024' rlm_sql (sql1): Ignoring unconnected handle 4.. rlm_sql (sql1): Ignoring unconnected handle 3.. rlm_sql (sql1): Ignoring unconnected handle 2.. rlm_sql (sql1): Ignoring unconnected handle 1.. rlm_sql (sql1): Ignoring unconnected handle 0.. +++[sql1] returns fail [sql2] expand: %{User-Name} -> test11(a)test.com [sql2] sql_set_user escaped user --> 'test11(a)test.com' [sql2] expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL AND acctsessionid != '%{Acct-Session-Id}' -> SELECT COUNT(*) FROM radacct WHERE username = 'test11(a)test.com' AND acctstoptime IS NULL AND acctsessionid != '7815B44B60809E4755317B1613AE0024' rlm_sql (sql2): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT COUNT(*) FROM radacct WHERE username = 'test11(a)test.com' AND acctstoptime IS NULL AND acctsessionid != '7815B44B60809E4755317B1613AE0024' rlm_sql (sql2): Released sql socket id: 3 +++[sql2] returns ok ++- group redundant_sql returns ok Login OK: [test11(a)test.com/xxxxx] (from client nas1.uk port 2 cli x1.x2.x3.x4) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++- entering group redundant_sql {...} [sql1] expand: %{User-Name} -> test11(a)test.com [sql1] sql_set_user escaped user --> 'test11(a)test.com' [sql1] expand: %{User-Password} -> xxxxxxx [sql1] expand: INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S','%{reply:Reply-Message}','%{NAS-IP-Address}') -> INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( 'test11(a)test.com', 'Test123=241', 'Access-Accept', '2012-03-15 23:23:19','','x.y.z.k') [sql1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql1) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( 'test11(a)test.com', 'Test123=241', 'Access-Accept', '2012-03-15 23:23:19','','x.y.z.k') rlm_sql (sql1): Ignoring unconnected handle 4.. rlm_sql (sql1): Ignoring unconnected handle 3.. rlm_sql (sql1): Ignoring unconnected handle 2.. rlm_sql (sql1): Ignoring unconnected handle 1.. rlm_sql (sql1): Ignoring unconnected handle 0.. +++[sql1] returns fail [sql2] expand: %{User-Name} -> test11(a)test.com [sql2] sql_set_user escaped user --> 'test11(a)test.com' [sql2] expand: %{User-Password} -> Test123=241 [sql2] expand: INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S','%{reply:Reply-Message}','%{NAS-IP-Address}') -> INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( 'test11(a)test.com', 'Test123=241', 'Access-Accept', '2012-03-15 23:23:19','','x.y.z.k') [sql2] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql2) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( 'test11(a)test.com', 'Test123=241', 'Access-Accept', '2012-03-15 23:23:19','','x.y.z.k') rlm_sql (sql2): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate,reply_message,nas_ip) VALUES ( 'test11(a)test.com', 'Test123=241', 'Access-Accept', '2012-03-15 23:23:19','','x.y.z.k') rlm_sql (sql2): Released sql socket id: 2 +++[sql2] returns ok ++- group redundant_sql returns ok ++[exec] returns noop Sending Access-Accept of id 111 to x.y.z.k port 45064 Session-Timeout := 1800 Acct-Interim-Interval := 600 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host x.y.z.k port 53711, id=240, length=142 User-Name = "test11(a)test.com" NAS-IP-Address = x.y.z.k NAS-Port = 2 Service-Type = Outbound-User Framed-Protocol = PPP Framed-IP-Address = 10.100.0.6 Calling-Station-Id = "x1.x2.x3.x4" NAS-Identifier = "OpenVpn-tcp" Acct-Status-Type = Start Acct-Session-Id = "7815B44B60809E4755317B1613AE0024" NAS-Port-Type = Virtual # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address = x.y.z.k,NAS-IP-Address = x.y.z.k,Acct-Session-Id = "7815B44B60809E4755317B1613AE0024",User-Name = "test11(a)test.com"' [acct_unique] Acct-Unique-Session-ID = "cf0adf9ddd6a5d82". ++[acct_unique] returns ok [suffix] Looking up realm "test.com" for User-Name = "test11(a)test.com" [suffix] No such realm "test.com" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} ++[unix] returns ok ++- entering group redundant_sql {...} [sql1] expand: %{User-Name} -> test11(a)test.com [sql1] sql_set_user escaped user --> 'test11(a)test.com' [sql1] expand: %{Acct-Delay-Time} -> [sql1] ... expanding second conditional [sql1] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', [sql1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql1): Ignoring unconnected handle 4.. rlm_sql (sql1): Ignoring unconnected handle 3.. rlm_sql (sql1): Ignoring unconnected handle 2.. rlm_sql (sql1): Ignoring unconnected handle 1.. rlm_sql (sql1): Ignoring unconnected handle 0.. +++[sql1] returns fail [sql2] expand: %{User-Name} -> test11(a)test.com [sql2] sql_set_user escaped user --> 'test11(a)test.com' [sql2] expand: %{Acct-Delay-Time} -> [sql2] ... expanding second conditional [sql2] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', [sql2] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql2): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('7815B44B60809E4755317B1613AE0024', 'cf0adf9ddd6a5d82', 'test11(a)test.com', '', 'x.y.z.k', '2', 'Virtual', '2012-03-15 23:23:19', NULL, '0', '', '', '', '0', '0', '', 'x1.x2.x3.x4', '', 'Outbound-User', 'PPP', '10.100.0.6', '0', '0', '') rlm_sql (sql2): Released sql socket id: 1 +++[sql2] returns ok ++- group redundant_sql returns ok [attr_filter.accounting_response] expand: %{User-Name} -> test11(a)test.com attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 240 to x.y.z.k port 53711 Finished request 1. Cleaning up request 1 ID 240 with timestamp +48 Going to the next request Waking up in 4.7 seconds. Cleaning up request 0 ID 111 with timestamp +48 Ready to process requests.

2 3

Issues with squid_radius_auth
by Ovi C 19 Mar '12

19 Mar '12

Hi. I'm using squid proxy server with freeradius authentication with postgresql backend running on Debian Squeeze and I get the following error from freeradius. ./squid_radius_auth -f /etc/squid3/squid_radius_auth.conf andrei tester Warning: Received invalid reply digest from server Warning: Received invalid reply digest from serverERR I'll post the files configuration and output from freeradius debug: cat /etc/squid3/squid_radius_auth.conf # squid_rad_auth configuration file # MvS: 28-10-1998 server 192.168.107.2 secret testing -------------------------------------------------------------------------------------------------------------------------------- freeradius -X stripped output: freeradius -X including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 User-Name = "andrei" User-Password = "WIdk\214\356\376G/\215X\367n\246h\224" NAS-Port = 111 NAS-Port-Type = Async NAS-IP-Address = 192.168.107.2 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.107.2/auth-detail-20100129 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.107.2/auth-detail-20100129 [auth_log] expand: %t -> Fri Jan 29 18:34:05 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "andrei", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> andrei [sql] sql_set_user escaped user --> 'andrei' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'andrei' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'andrei' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='andrei' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "WIdk?��G/?X�n�h?" [pap] Using clear text password "tester" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> andrei attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 1.9 seconds. rad_recv: Access-Request packet from host 192.168.107.2 port 48244, id=1, length=64 Sending duplicate reply to client localhost port 48244 - ID: 1 Sending Access-Reject of id 1 to 192.168.107.2 port 48244 Waking up in 0.9 seconds. Cleaning up request 0 ID 1 with timestamp +3 Ready to process requests. ---------------------------------------------------------------------------------------------------------------------------------- cat /etc/freeradius/clients.conf client localhost { ipaddr = 192.168.107.2 netmask = 32 secret = testing require_message_authenticator = no shortname = localhost nastype = other -------------------------------------------------------------------------------------------------------------------------- Somehow the client is not sending the cleartext password from database and this causes the error. The shared secret is correct as I use the same configuration for a PPPOE server and everything works as it should. Any hints ?

3 2

AP->FR->LDAP authentication
by Julie 19 Mar '12

19 Mar '12

I'm new to FreeRadius and trying to setup the server to authenticate using LDAP. I'm having some problem and hope to get some help from the list. I'm trying to setup AP->FR->LDAP. Both FreeRadius and LDAP are new installation on CentOS. I tried to follow the installation for FR and test each steps. test accounts are created in both user file and LDAP database. radtest are successful with both accounts. The problem is when I try to authenticate through AP. The debug log shows Failed to authenticate the user. here is the log file. # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "julietest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for julietest [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> julietest [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=julietest) [ldap] expand: ou=xxx,dc=xxxx,dc=xxx,dc=xxx -> ou=xxx,dc=xxx,dc=xxx,dc=xxx [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=xxx,dc=xxx,dc=xxx,dc=xxx, with filter (uid=julietest) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}$1$svVH/H.V$S02th.oBG7iQV0UtFBcVx1" [ldap] looking for reply items in directory... [ldap] user julietest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: julietest [mschap] Told to do MS-CHAPv2 for julietest with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\202E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} Thank you very much for your time and help. Best, Julie -- View this message in context: http://freeradius.1045715.n5.nabble.com/AP-FR-LDAP-authentication-tp5572785… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 9

Alvarion WiMax VSA's
by David Peterson 19 Mar '12

19 Mar '12

Alan, Am I correct in my understanding that only version 3 will support the new Alvarion WiMax VSAs. If I am, would John Dennis be willing to supply any roadmap for 3.0 support in Redhat? David

2 1

Accounting-Request with invalid signature
by Shurbann Martes 19 Mar '12

19 Mar '12

Hello gents, I've been trying to solve this problem for a couple of days now. I'm asking for your expert advise since I'm not getting anywhere near a solution: The problem is when FreeRADIUS receives a Accounting-Request it drops the packet without response due to a problem with the signature: rad_recv: Accounting-Request packet from host x.x.x.x port 64514, id=1, length=287 Received Accounting-Request packet from x.x.x.x with invalid signature! (Shared secret is incorrect.) Dropping packet without response. The Access-Request are ok: rad_recv: Access-Request packet from host x.x.x.x port 64986, id=236, length=102 User-Name = "test" User-Password = "\2517Rq\2308Uv\"\204\220\341\377\244(\363" NAS-IP-Address = x.x.x.x NAS-Identifier = "NPR_GGSN_01" Called-Station-Id = "wap1.btcbahamas.com" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 61 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 236 to x.x.x.x port 64986 The shared secret key has special characters in it such as $-sign and /-sign. The client is a Juniper NAS. These are the questions I have: - Any issues with FreeRADIUS Accounting-Request in combination with a secret key containing special characters? - Why is the access-request having no issues with these special characters? - Anyone bumped into a similar problems in combination with a juniper NAS - Is there a way to figure out the secret-key the client is using? Thank you. Regards, Shurbann Martes

2 4

Help - ASN-GW throwing error - Validation of attributes failed
by Rathod Subhashchandra 19 Mar '12

19 Mar '12

Dear All, I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details. 1. TATA ELXSI - WIMAX MS 2. TATA ELXSI - WIMAX BS 3. ARICENT ASN-GW version 4.2 4. Free Radius AAA server version 2.1.3 Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed" Wireshark logs @ ASN-GW I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word. What are the mandatory fields in Access-Accept and their valid values? Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS? I am guessing this should be 8. I don't have control over ASN-GW parameters modification. Please let me know what fields are invalid in above ACCESS-ACCEPT. Thanks ! Rathod.

6 10

Re:Inserting NT-Passwords in MySQL database
by pamela pomary 18 Mar '12

18 Mar '12

Thank you Alan and Alan, it worked. :) # radtest -t mschap viola password localhost 0 key Sending Access-Request of id 67 to 127.0.0.1 port 1812 User-Name = "viola" NAS-IP-Address = x.x.x.x NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0xb8aa006ef4040d71 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000037cfefe932713bd369dc9bbaa3e35b25d2316e83ae73db95 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=67, length=84 MS-CHAP-MPPE-Keys = 0x0000000000000000493adff9cf9839a289e3c19d21c8a4310000000000000000 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000006

1 0