January 2013 - Freeradius-Users - lists.freeradius.org

Instantiation failed for module "sql" Errors initializing modules
by Elizabeth Fife 09 Jan '13

09 Jan '13

Hi I am using MAC OSX server. I was checking out the inbuilt freeradius. I have not altered files related to this service and simply tried radiusd -X The following error was received FreeRADIUS Version 2.1.3, for host i386-apple-darwin10.0, built on Apr 11 2011 at 17:19:07 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /private/etc/raddb/radiusd.conf including configuration file /private/etc/raddb/proxy.conf including configuration file /private/etc/raddb/clients.conf including files in directory /private/etc/raddb/modules/ including configuration file /private/etc/raddb/modules/acct_unique including configuration file /private/etc/raddb/modules/always including configuration file /private/etc/raddb/modules/attr_filter including configuration file /private/etc/raddb/modules/attr_rewrite including configuration file /private/etc/raddb/modules/chap including configuration file /private/etc/raddb/modules/checkval including configuration file /private/etc/raddb/modules/counter including configuration file /private/etc/raddb/modules/detail including configuration file /private/etc/raddb/modules/detail.example.com including configuration file /private/etc/raddb/modules/detail.log including configuration file /private/etc/raddb/modules/digest including configuration file /private/etc/raddb/modules/echo including configuration file /private/etc/raddb/modules/etc_group including configuration file /private/etc/raddb/modules/exec including configuration file /private/etc/raddb/modules/expiration including configuration file /private/etc/raddb/modules/expr including configuration file /private/etc/raddb/modules/files including configuration file /private/etc/raddb/modules/inner-eap including configuration file /private/etc/raddb/modules/ippool including configuration file /private/etc/raddb/modules/krb5 including configuration file /private/etc/raddb/modules/ldap including configuration file /private/etc/raddb/modules/linelog including configuration file /private/etc/raddb/modules/logintime including configuration file /private/etc/raddb/modules/mac2ip including configuration file /private/etc/raddb/modules/mac2vlan including configuration file /private/etc/raddb/modules/mschap including configuration file /private/etc/raddb/modules/opendirectory including configuration file /private/etc/raddb/modules/pam including configuration file /private/etc/raddb/modules/pap including configuration file /private/etc/raddb/modules/passwd including configuration file /private/etc/raddb/modules/perl including configuration file /private/etc/raddb/modules/policy including configuration file /private/etc/raddb/modules/preprocess including configuration file /private/etc/raddb/modules/radutmp including configuration file /private/etc/raddb/modules/realm including configuration file /private/etc/raddb/modules/smbpasswd including configuration file /private/etc/raddb/modules/sql_log including configuration file /private/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /private/etc/raddb/modules/sradutmp including configuration file /private/etc/raddb/modules/unix including configuration file /private/etc/raddb/modules/wimax including configuration file /private/etc/raddb/eap.conf including configuration file /private/etc/raddb/sql.conf including configuration file /private/etc/raddb/sql/sqlite/dialup.conf including configuration file /private/etc/raddb/sql/mysql/counter.conf including configuration file /private/etc/raddb/policy.conf including files in directory /private/etc/raddb/sites-enabled/ including configuration file /private/etc/raddb/sites-enabled/default including configuration file /private/etc/raddb/sites-enabled/inner-tunnel including dictionary file /private/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/private/var" logdir = "/private/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/private/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/private/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_sqlite" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/private/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql_sqlite: sqlite3_prepare() = 1 rlm_sql (sql): failed after re-connect rlm_sql (sql): database query error, SELECT id,nasname,shortname,type,secret FROM nas: (null) rlm_sql (sql): Released sql socket id: 4 Failed to load clients from SQL. rlm_sql (sql): Closing sqlsocket 4 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 3 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 2 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 1 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 0 rlm_sql_sqlite: sql_destroy_socket noop. /private/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Errors initializing modules Never having used the service before I am surprised. Is there something I should do first to prepare before running radius -X Thanks

3 3

Different BaseDN for User/Group Objects in rlm_ldap
by Rudolph Bott 09 Jan '13

09 Jan '13

Hi List, we are currently using rlm_ldap to check against a LDAP backend, which works fine so far. rlm_ldap is configured to use a BaseDN of "ou=poeple,dc=example,dc=org". We have also specified a group membership filter and are trying to enforce group memberships via the combination of huntgroups-file and Ldap-Group-Settings in the users file. According to debug output, this seems to work (since freeradius is trying to find the groups specified in the users file). However, our groups are stored underneath "ou=groups,dc=example,dc=org" - so rlm_ldap is not able to find them with the basedn shown above. We are also not able to change the basedn to something else, since there is a different user-tree underneath dc=example,dc=org which should not be taken into account by freeradius. Is there is possibility to set a different basedn for group lookups OR another feasable solution (e.g. modify the filter...?). Filter and groupmembership_filter are currently set to: filter = "(uid=%{Stripped-User-Name:-%{mschap:User-Name}})" groupname_attribute = cn groupmembership_filter = "(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{mschap:User-Name}})" Debug output states this: rlm_ldap: performing search in ou=poeple,dc=example,dc=org, with filter (&(cn=GROUP-NAME-FROM-USERS-FILE)(objectClass=posixGroup)(memberUid=LOGIN-USER)) Thanks in advance for your help! -- Mit freundlichen Grüßen / with kind regards Rudolph Bott

4 7

Re: Instantiation failed for module "sql" Errors initializing modules
by Alan Buxey 09 Jan '13

09 Jan '13

Hi, Are you running as root? alan

1 0

Re: Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Alan Buxey 09 Jan '13

09 Jan '13

The certs resulting from a make install and initial run of 'radiusd -X' are valid and will work. alan

1 0

EAP-SIM authentication with Huawei
by akinpelu emmanuel 09 Jan '13

09 Jan '13

Dear All, Please has there been anyone that has successfully implemented EAP-SIM with Huawei HLR? I would appreciate head-start on how possible this is. Thank you

2 1

rml_sqlcounter dailycounter do not reset
by Prabhpal S. Mavi 09 Jan '13

09 Jan '13

Dear List Members, i have come across the problem that "dailycounter" that is (rlm_sqlcounter) do not reset. Users are rejected by the following message. "Your maximum daily usage time has been reached" i am trying to figure out the cause but unable to. Counter & Query in use: sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" sqlmod-inst = "sql" key = "User-Name" reset = "daily" cache-size = 5000 query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" logs: rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user prabhpal, check_item=3600, counter=2147056619 ++[dailycounter] returns reject Thanks

1 0

Memory leak in FR 2.1.10 and 2.2.0 ?
by Philippe MARASSE 08 Jan '13

08 Jan '13

Hello, I'm experiencing an infinitely growth of memory footprint of freeradius process in our production environment (of course, in our test env. everything goes right). Clients : - ~60 Alcatel omnistack OS6200 switches doing MAC Authentication (via EAP-MD5), - a few WiFi AP doing either EAP-TLS or EAP-PEAP. - Average load : 5 auth/minute On my first environment production I used : - Server : CentOS 5.6 32 bits on VM, 2 CPUs, 512 Mb RAM - freeradius2 2.1.10-1 i686 packages - MySQL on a different CentOS 5.6 server used for NAS, postauth, checks, etc. process get killed by kernel in less than 48 hours. As it was not the latest freeradius release, I recently moved to : - Server : Debian 4 32 bits on VM, 2 CPUs, 256 Mb RAM - freeradius 2.2.0 downloaded directly, and packaged on the debian server using this wiki page : http://wiki.freeradius.org/building/Build#Building-Debian-packages process get killed by kernel in less than 36 hours. As I cannot reproduce this on my test environment by using eapol_test, I suspect alcatel frames to trigger a kind of memory leak in freeradius. I collected different things : - pcap of eap-md5 exchange between freeradius and a switch - valgrind log on my production server - pidstat showing memory usage of freeradius process For now, i'm running out of new ideas to fix this issue... Rgds. -- Philippe MARASSE Service Informatique - Centre Hospitalier Henri Laborit BP 587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

4 7

EAP-SIM configuration on FreeRadius
by Muhammad Usman 08 Jan '13

08 Jan '13

Dear All, I am trying to configure freeradius for EAP-SIM authentication, for that i compiled FreeRadius with "./configure --with-modules="rlm_sim" --with-modules="rlm_sim_files"". Freeradius is installed successfully as i have tested it using radtest, as suggested on Freeradius wikis. i have installed freeradius version 2.2.0 Now in order to test EAP-SIM, i have added the below block in eap.conf file after mschapv2 block, sim { } I am trying to successfully run /src/tests/eapsim-03 example, i have copied the the below in users file, 1244070100000001(a)eapsim.foo Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0x101112131415161718191a1b1c1d1e1f, EAP-Sim-SRES1 = 0xd1d2d3d4, EAP-Sim-Rand2 = 0x202122232425262728292a2b2c2d2e2f, EAP-Sim-SRES2 = 0xe1e2e3e4, EAP-Sim-Rand3 = 0x303132333435363738393a3b3c3d3e3f, EAP-Sim-SRES3 = 0xf1f2f3f4, EAP-Sim-KC1 = 0xa0a1a2a3a4a5a6a7, EAP-Sim-KC2 = 0xb0b1b2b3b4b5b6b7, EAP-Sim-KC3 = 0xc0c1c2c3c4c5c6c7, 1232420100000015 Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0x30000000000000000000000000000000, EAP-Sim-SRES1 = 0x30112233, EAP-Sim-KC1 = 0x445566778899AABB, EAP-Sim-Rand2 = 0x31000000000000000000000000000000, EAP-Sim-SRES2 = 0x31112233, EAP-Sim-KC2 = 0x445566778899AABB, EAP-Sim-Rand3 = 0x32000000000000000000000000000000, EAP-Sim-SRES3 = 0x32112233, EAP-Sim-KC3 = 0x445566778899AABB, eapsim Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC3 = 0x30415263748596a7 but when i try to run client.sh, it gets the following logs, Sending Access-Request packet to host 127.0.0.1 port 1812, id=64, length=0 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 EAP-Code = Response EAP-Type-Identity = 0x65617073696d Message-Authenticator = 0x30 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 EAP-Message = 0x023f000b0165617073696d Received Access-Challenge packet from host 127.0.0.1 port 1812, id=64, length=78 EAP-Message = 0x01f30014120a00000f0200020001000011010100 Message-Authenticator = 0x81ffe249ace5353152e1476e8f7f890b State = 0x9a9ec8169a6dda46839134a50c8e1d5d EAP-Id = 243 EAP-Code = Request EAP-Type-SIM = 0x0a00000f0200020001000011010100 Sending Access-Request packet to host 127.0.0.1 port 1812, id=65, length=71 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 EAP-Code = Response Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 EAP-Sim-State = 1 EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d EAP-Id = 243 EAP-Message = 0x02f3002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d Received Access-Challenge packet from host 127.0.0.1 port 1812, id=65, length=138 EAP-Message = 0x01f40050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b050000cd1494bcf2173b38d26c31c3872b60f9 Message-Authenticator = 0x11986571b4665594edefbf3d811efbae State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Id = 244 EAP-Code = Request EAP-Type-SIM = 0x0b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b050000cd1494bcf2173b38d26c31c3872b60f9 Input was: identity: (len=6)65617073696d nonce_mt: c9615ec963ada36f11bd4e81093a7271 rand0: 00000000000000000000000000000000 rand1: 00000000000000000000000000000000 rand2: 00000000000000000000000000000000 sres0: 1234abcd sres1: 234abcd1 sres2: 34abcd12 Kc0: 0011223344556677 Kc1: 1021324354657687 Kc2: 30415263748596a7 versionlist[2]: 0001 select 00 01 Output mk: 8502e062_35537770_2c0a7c2c_9cfc9fc4_dc4d21d6 K_aut: b89dafa5_99422bee_db010d3a_6dcded9c K_encr: d8a6df78_25d9ad9d_2535083c_33a5c1c6 msk: f5feb9c1_9dbea4dd_cd94b140_17892e4b_f96327cc 84b16260_f0e6447b_b201018f_102b2217_bb6717c8 351115b9_a8248f46_aa33c120_f6e5979f_b27f1c98 69da98ed emsk: 8c1c04ef_4b345a29_50980817_563fc216_844d8e0d c2e4bc15_886523be_2e149835_ef850c3e_076722dc e27926e8_d01d1929_3da147a1_62833433_391b8a9a 20711dd2 calculated MAC (c412722f_ab82c18d_f5404f45_da872e93_cd950d07 did not match Sending Access-Request packet to host 127.0.0.1 port 1812, id=66, length=122 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 EAP-Code = Response Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 EAP-Sim-State = 0 EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d EAP-Id = 244 State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Message = 0x02f4002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 Received Access-Challenge packet from host 127.0.0.1 port 1812, id=66, length=138 EAP-Message = 0x01f50050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b0500006a93d1ff0e02e0b507f2940ce8e59251 Message-Authenticator = 0x6c9b33feb4d0851ed9d2c72e94640cc2 State = 0x9a9ec816986bda46839134a50c8e1d5d EAP-Id = 245 EAP-Code = Request EAP-Type-SIM = 0x0b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b0500006a93d1ff0e02e0b507f2940ce8e59251 radeapclient: sim in state init message challenge is illegal. Reply dropped. --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- This is the eapsim-in.txt file used in client.sh script User-Name = "eapsim" NAS-IP-Address = marajade.sandelman.ottawa.on.ca EAP-Code = Response EAP-Type-Identity = "eapsim" Message-Authenticator = 0 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-Sres1 = 0x1234abcd EAP-Sim-Sres2 = 0x234abcd1 EAP-Sim-Sres3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- while on radius debugging console, it says rad_recv: Access-Request packet from host 127.0.0.1 port 29859, id=64, length=71 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xcdbcb987fbfe7846c70edb63de2af9bb NAS-Port = 0 EAP-Message = 0x023f000b0165617073696d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eapsim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop can not open /usr/local/etc/raddb/simtriplets.dat: No such file or directory ++[sim_files] returns notfound [eap] EAP packet type response id 63 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry eapsim at line 24 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 243 ++[eap] returns handled Sending Access-Challenge of id 64 to 127.0.0.1 port 29859 EAP-Message = 0x01f30014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 29859, id=65, length=122 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xa62ac94a97d1f99105aef11ea7f7f802 NAS-Port = 0 EAP-Message = 0x02f3002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eapsim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop can not open /usr/local/etc/raddb/simtriplets.dat: No such file or directory ++[sim_files] returns notfound [eap] EAP packet type response id 243 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry eapsim at line 24 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xa62ac94a97d1f99105aef11ea7f7f802 NAS-Port = 0 EAP-Message = 0x02f3002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 State = 0x9a9ec8169a6dda46839134a50c8e1d5d EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d0000 [eap] Underlying EAP-Type set EAP ID to 244 ++[eap] returns handled Sending Access-Challenge of id 65 to 127.0.0.1 port 29859 EAP-Message = 0x01f40050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b050000cd1494bcf2173b38d26c31c3872b60f9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9ec8169b6ada46839134a50c8e1d5d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 29859, id=66, length=122 User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0x0066414e52eb81de434cb323e73182dc NAS-Port = 0 State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Message = 0x02f4002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eapsim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop can not open /usr/local/etc/raddb/simtriplets.dat: No such file or directory ++[sim_files] returns notfound [eap] EAP packet type response id 244 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry eapsim at line 24 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "eapsim" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0x0066414e52eb81de434cb323e73182dc NAS-Port = 0 State = 0x9a9ec8169b6ada46839134a50c8e1d5d EAP-Message = 0x02f4002c120a00001001000107050000c9615ec963ada36f11bd4e81093a72710e03000665617073696d0000 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000c9615ec963ada36f11bd4e81093a7271 EAP-Sim-IDENTITY = 0x000665617073696d0000 [eap] Underlying EAP-Type set EAP ID to 245 ++[eap] returns handled Sending Access-Challenge of id 66 to 127.0.0.1 port 29859 EAP-Message = 0x01f50050120b0000010d0000abcd1234abcd1234abcd1234abcd1234bcd1234abcd1234abcd1234abcd1234acd1234abcd1234abcd1234abcd1234ab0b0500006a93d1ff0e02e0b507f2940ce8e59251 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9a9ec816986bda46839134a50c8e1d5d Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 64 with timestamp +9 Cleaning up request 1 ID 65 with timestamp +9 Cleaning up request 2 ID 66 with timestamp +9 Ready to process requests. Can anybody help me to identify where i am going wrong, and what are the missing steps here. Thanks in Advance.

2 4

Re: rlm_sqlcounter always return 0 Resolved !!!!!
by Mike Russell 08 Jan '13

08 Jan '13

On Tue, Jan 8, 2013 at 12:05 AM, Alan DeKok <aland(a)deployingradius.com> wrote: > > Alan DeKok Wrote: > > The sqlcounter module should be pretty simple. Configure accounting data > to go into SQL, and ensure that the server is receiving accounting packets. > Then, configure the sqlcounter module. > > My rlm_sqlnoresetcounter module: > > sqlcounter noresetcounter { > counter-name = Max-All-Session-Time > check-name = Max-All-Session > sqlmod-inst = sql > key = User-Name > reset = never > query = "SELECT IFNULL(SUM(AcctSessionTime),0) > FROM radacct WHERE UserName='${key}'" > > Alan DeKok Wrote: You edited the default configuration, and broke it. Don't do that. The default uses %{${key}}, not ${key}. They're different. Russell Wrote: Yes, Alan D. That's Brilliant, You hit the nail in the head strate, your advice fixed the problem. Configuration is now working!!! Counter is retuning the values back and prepaid users are in control now. I was struggling about a week now. Billion of thanks man. World is grateful for the work you are doing. Secondly, You are right, i broke the server by changing the veritable in query. I was advised to change make changes and i did it wrong **my mistake**. Kindly advice me for this warnings as well. Can i safely ignore them? They caused me to change the default query When i start the server is debug mode and users authenticate. i get this two lines. Are they safe to ignore? WARNING: Please replace '%k' with '${key}' WARNING: Please replace '%S' with '${sqlmod-inst}' Thanks Alan you saved my life.

2 1

Re: Kerberos - Radius does not get password
by Alan Buxey 08 Jan '13

08 Jan '13

Hmm, having run FR with AD authentication using winbindd and samba for many many years I am interested in what problems with those daemons you were having ... why need the frequent restarts etc. eduroam certainly wouldn't have had the high take-up we've seen in eg Europe if all sites had to reengineer their backend authentication and couldn't use PEAP/MSCHAPv2 alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 5