February 2016 - Freeradius-Users - lists.freeradius.org

Example process flow?
by Alan Batie 04 Feb '16

04 Feb '16

I was wondering if there was an example of typical radius process flow and interactions with the config file and modules anywhere? That is: Connection setup: Access-Request processed through in this way (generating either Access-Accept or Access-Reject when this or that happens) Accounting records Accounting-Start Interim-Update Accounting-Stop etc It is just not clear to me what happens when... Thanks...

4 5

Freeradius MYSQL Multiuser Access-Accept
by Adem Darguner 04 Feb '16

04 Feb '16

Hi Everyone, I want to accept multiple password on the same user on MYSQL. Do you have any solutions? Please tell me a solutions.Please. Thank you Regards. mysql> select * from radcheck; +--------+-----------+-----------+----+----------+------------+ | id | username | attribute | op | value | unixtime | +--------+-----------+-----------+----+----------+------------+ | 1 | mahmut | Password | := | 53159248 | 1454429830 | | 2 | erdem | Password | := | 712388 | 1454429830 | | 3 | test_1 | Password | := | 679374 | 1454429830 | | 4 | test_1 | Password | := | 955897 | 1454429830 | | 5 | test_1 | Password | := | 740793 | 1454429830 | | 6 | test_1 | Password | := | 571155 | 1454429830 | | 7 | test_1 | Password | := | 924218 | 1454429830 | | 8 | test_1 | Password | := | 496653 | 1454429830 | | 9 | test_1 | Password | := | 886088 | 1454429830 | | 10 | test_1 | Password | := | 195173 | 1454429830 | | 11 | test_1 | Password | := | 410097 | 1454429830 | | 12 | test_1 | Password | := | 778656 | 1454429830 | -- Adem DARGÜNER Network Engineer

4 3

TLS Version 1.2 Protocol
by Danielle Fratto 04 Feb '16

04 Feb '16

We have a FreeRadius version 2.1 implemented which we have inherited to support. The person who installed this on our servers has separated from the company and we have limited knowledge with the configuration and setup. The version release information that we found online does not reference the version we are running currently : V2.1.1-7.18.1. Can you confirm if TLSV1.2 Protocol is supported for our version of FreeRadius? Thank you for any help you can offer.

4 3

dhcp_sqlippool: IP address could not be allocated
by Elton Machado 04 Feb '16

04 Feb '16

Hi Guys, No matter what I do I always get this error: Executing select query: SELECT id FROM radippool WHERE pool_name='my_pool' LIMIT 1 (17) dhcp_sqlippool: ERROR: SQL query did not return any results if I do the same query on my database server it always retrieve a line. so I got no ip for my clients. Does anyone can help me? Regards, Elton *_____________________________________* Elton Machado System Administrator phone: +32 (0) 16 36 02 19 mobile: +32 (0) 476 56 08 32 email: elton.machado(a)tenforce.com Havenkant 38, 3000 Leuven www.tenforce.com *_____________________________________*

2 1

request for a simple set of instructions for EAP-SIM
by Michael Martinez 04 Feb '16

04 Feb '16

I've looked around online, but a lot of documentation is outdated and other docs don't do a good job, so would someone provide a simple set of instructions for getting EAP-SIM to work, including: which flags (if any) freeradius-3.0.11 should be compiled with; what config files need to be edited, why and how; what need to be done on the wireless device, if anything; and how to test and basic gotchas that might be encountered. Would be greatly appreciated and would eliminate a lot of the confusion that arises when trying to find this information in scattered places online. Thanks! Michael Martinez http://www.michael--martinez.com/computers/ -- ---

4 11

[freeRADIUS 2.2.9 : fail building the rlm_sql_oracle module : make: *** No rule to make target `../../../../../Make.inc'. Stop
by Vincent MARCEL 03 Feb '16

03 Feb '16

Hi, I need to build the rlm_sql_oracle module for my freeRADIUS server v2.2.6. I have downloaded freeradius v2.2.9 tarball here : http://freeradius.org/download.html and followed instructions here : http://wiki.freeradius.org/modules/Rlm_sql_oracle Below is the result : [radiusrec@radiusa1r1 rlm_sql_oracle]$ autoconf [radiusrec@radiusa1r1 rlm_sql_oracle]$ ./configure --with-oracle-include-dir --with-oracle-lib-dir=/OPT/oracle/product/11.2.0.4.8/lib checking for oci.h... checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed yes yes configure: creating ./config.status config.status: creating Makefile [radiusrec@radiusa1r1 rlm_sql_oracle]$ make Makefile:1: ../../../../../Make.inc: No such file or directory make: *** No rule to make target `../../../../../Make.inc'. Stop. After searching by myself, I can't find any way to go further. Please someone may help me to build rlm_sql_oracle-<fr_version>.so ? Best regards, Vincent MARCEL.

2 1

segfault calling rc_auth()
by dev 03 Feb '16

03 Feb '16

I have an ldap password plugin which calls rc_auth() to authenticate the user/pass combination with a freeradius server. I've used a plugin template from openLDAP and the code from radexample.c (1.1.6 on ubuntu 14.04) for the radius bits. I'm getting segfaults in libc sometimes in kernel.log and not sure what's causing the problem: traps: slapd[5181] general protection ip:7fa35a699c7f sp:7fa353664f90 error:0 in libc-2.19.so[7fa35a602000+1bb000] I have the code on pastebin to help clarify: line 126 (http://pastebin.com/NNzeetz5) Does this seem like an issue in the 1.1.6 freeradiusclient library somehow, or am I doing something boneheaded? Not sure at this point where to start looking for the problem. dmesg only shows the segfault entry and /var/log/freeradius/radius.log says "ldap_search() failed: LDAP connection lost.". The output in debug mode for the ldap server simply terminates as the segfault takes out slapd. Thanks for any help!

3 6

Check LDAP password with SHA512
by Will W. 03 Feb '16

03 Feb '16

Hello All, Trying to get freeradius 3.0.10 setup with LDAP using SHA512 and I am trying to get my head around the new layout. Has anyone had luck getting this working? Thanks Will

7 49

Freeradius Multiple MYSQL User
by Adem Darguner 03 Feb '16

03 Feb '16

Hi Everyone, We have Freeradius and MYSQL databases. I want to make OTP server with Freeradius. I create Mutliuser in the MYSQL radcheck is below. I create different passwords for the same user. I send requests FreeRADIUS with MYSQL but cannot Access-Accept. How can I run for a single user, but multiple password.? For Example: Mutli user "test_1" mysql> select * from radcheck; +--------+-----------+-----------+----+----------+------------+ | id | username | attribute | op | value | unixtime | +--------+-----------+-----------+----+----------+------------+ | 1 | mahmut | Password | := | 53159248 | 1454429830 | | 2 | erdem | Password | := | 712388 | 1454429830 | | 3 | test_1 | Password | := | 679374 | 1454429830 | | 4 | test_1 | Password | := | 955897 | 1454429830 | | 5 | test_1 | Password | := | 740793 | 1454429830 | | 6 | test_1 | Password | := | 571155 | 1454429830 | | 7 | test_1 | Password | := | 924218 | 1454429830 | | 8 | test_1 | Password | := | 496653 | 1454429830 | | 9 | test_1 | Password | := | 886088 | 1454429830 | | 10 | test_1 | Password | := | 195173 | 1454429830 | | 11 | test_1 | Password | := | 410097 | 1454429830 | | 12 | test_1 | Password | := | 778656 | 1454429830 | Thank you Regards. -- Adem DARGÜNER Network Engineer

3 2

Issue with authorisation on Dlink switch
by Viacheslav Gubin 02 Feb '16

02 Feb '16

Got stuck with a strange behaviour : Listening on auth address 10.10.9.5 port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 36922 Listening on proxy address :: port 52073 Ready to process requests (0) Received Access-Request Id 188 from 10.10.9.10:1044 to 10.10.9.5:1812 length 86 (0) User-Name = "admin" (0) User-Password = "c\375'\364D\212\021\257.?\327\017\336\177W\212" (0) NAS-IP-Address = 10.10.9.10 (0) NAS-Identifier = "Test" (0) NAS-Port-Type = Virtual (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "admin", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 181 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [admin/c?'? D???.?????W?] (from client switch port 0) (0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> admin (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 188 from 10.10.9.5:1812 to 10.10.9.10:1044 length 20 Waking up in 3.9 seconds. Waking up in 8.9 seconds. (0) Cleaning up request packet ID 188 with timestamp +48 Ready to process requests (1) Received Access-Request Id 205 from 10.10.9.10:1045 to 10.10.9.5:1812 length 86 (1) User-Name = "admin" (1) User-Password = "\365yo\274\206Oz\203\024/\350\256p\317\312\353" (1) NAS-IP-Address = 10.10.9.10 (1) NAS-Identifier = "test" (1) NAS-Port-Type = Virtual (1) Service-Type = Framed-User (1) Framed-Protocol = PPP (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "admin", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry DEFAULT at line 181 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [admin/?yo?? Oz??/??p???] (from client switch port 0) (1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> admin (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 205 from 10.10.9.5:1812 to 10.10.9.10:1045 length 20 Waking up in 3.9 seconds. Waking up in 8.9 seconds. (1) Cleaning up request packet ID 205 with timestamp +114 Ready to process requests. Just a few lines make me confused: (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available Here is some lines from config users: user Cleartext-Password := "1234" Dlink-User-Level = 3 1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! the secret is 100% correct on both sides..... is is really simple 123..... Got very confused.. I have tried to play around the whole day but could not sort the issue out :(

3 2