- Freeradius-Users - lists.freeradius.org

LDAP and group support
by alexb＠arctel.ru 20 Dec '10

20 Dec '10

Hello all, I've followed these hints: http://lists.freeradius.org/mailman/htdig/freeradius-users/2010-July/msg005… everything works fine. As I see, group information (group attrubutes) stored in 'users' file. My question is: is there any way to store group information (attributes) in LDAP tree (not in 'users' file)? Any hints? Thanks -- Alexander Belov

2 1

Alvarion BS Service Provision
by Wilson, Stuart 20 Dec '10

20 Dec '10

I cannot get our Alvarion BS to assign service profiles to a MS. I have read the forums and tried to use that information to help, but I cannot get a service profile to be assigned. Our setup is as follows: FreeRADIUS AAA with MySQL database. The radgroupreply is: 8 | MLB_MS | Filter-ID | = | "n=sp1:v=<VLAN_200>:h=OFF:a=<ON,VLAN_200>:c=ON" The radusergroup is: MLB_LAB_MS2(a)WiMax.com | MLB_MS | 1 | a sample from radiusd -x Access-Request: Access-Request packet from host 192.168.254.253 port 49154, id=109, length=258 User-Name = "{am=1}6ced97d91a6fcef3419e70f9c7ff34c1(a)WiMax.com" NAS-IP-Address = 192.168.254.253 NAS-Port-Type = 27 NAS-Port = 3 Calling-Station-Id = "\000\020\347A\\d" NAS-Identifier = "002002002000065002" WiMAX-GMT-Timezone-offset = 18000 Framed-MTU = 1490 Service-Type = Framed-User WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-BS-Id = 0x303032303032303032303030303635303032 EAP-Message = 0x02010035017b616d3d317d366365643937643931613666636566333431396537306639 63376666333463314057694d61782e636f6d Message-Authenticator = 0x4277326335201e6d8fa3f8a26a9311d7 Access-Accept: Sending Access-Accept of id 108 to 192.168.254.253 port 49154 Filter-Id = "n=sp1:v=<VLAN_200>:h=OFF:a=<ON,VLAN_200>:c=OFF" WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = 0x TTLS Reply: [ttls] Got tunneled reply code 2 Filter-Id = "n=sp1:v=<VLAN_200>:h=OFF:a=<ON,VLAN_200>:c=ON" MS-CHAP2-Success = 0x98533d4133464334443937354642413645433943313532394132364331384437343743 4542313443453330 MS-MPPE-Recv-Key = 0x095bfcafbd7e6970eb5762a77b159f59 MS-MPPE-Send-Key = 0x4d060be03b8d2c8939627ade2f95c539 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 The most helpful information would be a guide on how to configure FreeRADIUS and the associated MySQL server to apply a service profile to a MS. Thanks for the help. Stuart Wilson Email: swilso19(a)harris.com

2 1

Huntgroups question.
by Ramon Escriba 20 Dec '10

20 Dec '10

Hi, I have a "freeradius-server-2.1.1-1.27". My question it's about hungroups. The huntgroup file has: XXX NAS-IP-Address==X.Y.Z.W, NAS-Port>=1033, NAS-Port<=1038 #XXX NAS-IP-Address == X.Y.Z.W In users: DEFAULT Huntgroup-Name == XXX, ZZZ-Ldap-Group == mac, Auth-Type == ZZZ ( ZZZ it's an ldap backend) ####------------------------------------------------# Extreme-Netlogin-Vlan = "ZZZ", Termination-Action = 1, Fall-Through = no ##################################################################### If I set in "XXX NAS-IP-Address == X.Y.Z.W" in huntgroups, and I comment "XXX NAS-IP-Address==X.Y.Z.W, NAS-Port>=1033, NAS-Port<=1038" then it does "mac" loggin without problems, but when I want to fix the port range, just skips the authentication, and finally rejects. Any clue? Thanks. ---------------------------------------------------------------- Ramon Escribà. (escriba%at$cells!dot#es) System Managers CELLS. Telf: +34.93.592.43.84 -Si creus que l'educació és cara, prova la ignorància. -El mercado es un buen esclavo,pero un amo terrible. -Give Earth a chance, or she'll get rid of us. ------------------------------------------------------------------ CELLS - ALBA Synchrotron Carretera BP 1413, de Cerdanyola del Vallès a Sant Cugat del Vallès, Km. 3,3 08290 Cerdanyola del Vallès, Barcelona ,Spain Tel: +34 93.592.4300 Fax: +34 93.592.4301 http://www.cells.es v.1.52 -----------------------------------------------------------------

1 0

Radkill
by john decot 20 Dec '10

20 Dec '10

Hi, I have problem with some user not being terminate even logout. After googling I came know about radkill. Can anyone post some howto about radkill. Thank you, Rgds, John.

3 3

Freeradius + mysql Auth-Type error...
by Todd Bateman 19 Dec '10

19 Dec '10

I have been trying to get freeradius + mysql to play nice together for the past few days and no mater what HOW TO or Tutorial I follow the end result is the same when I run radtest from the command line I get "Access-Reject". In the HOW TO/Tutorials I have followed I was told to make my /etc/raddb/sites-available/default like the following: authorize { sql } authenticate { } preacct { acct_unique } accounting { sql } session { sql } post-auth { } pre-proxy { } post-proxy { } and add the information to clients.conf and sql.conf, and it seems to be working for I get database requests when I run radiusd -X and run radtest. My mysql tables look like the following: mysql> select * from radcheck; +----+----------+--------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------+----+----------------------------------+ | 1 | testuser | MD5-Password | := | 179ad45c6ce2cb97cf1029e212046e81 | +----+----------+--------------+----+----------------------------------+ 1 row in set (0.00 sec) I have also tried this with Attribute set to Cleartext-Password and op set to == with the same result. mysql> select * from radgroupcheck; +----+-------------+-----------+----+---------+ | id | groupname | attribute | op | value | +----+-------------+-----------+----+---------+ | 1 | normalusers | Auth-Type | := | MS-CHAP | +----+-------------+-----------+----+---------+ 1 row in set (0.00 sec) mysql> select * from radgroupreply; +----+-------------+--------------------+----+---------------------+ | id | groupname | attribute | op | value | +----+-------------+--------------------+----+---------------------+ | 1 | normalusers | Framed-Compression | = | Van-Jacobson-TCP-IP | +----+-------------+--------------------+----+---------------------+ 1 row in set (0.00 sec) mysql> select * from radpostauth; +----+----------+--------------+---------------+---------------------+ | id | username | pass | reply | authdate | +----+----------+--------------+---------------+---------------------+ | 1 | testuser | testuserpass | Access-Reject | 2010-12-16 23:45:22 | | 2 | testuser | testuserpass | Access-Reject | 2010-12-16 23:52:18 | | 3 | testuser | testuserpass | Access-Reject | 2010-12-17 00:24:07 | | 4 | root | changed | Access-Accept | 2010-12-17 01:28:43 | | 5 | user1 | password1 | Access-Reject | 2010-12-17 01:29:01 | | 6 | root | changed | Access-Accept | 2010-12-17 01:38:59 | | 7 | todd | changed | Access-Accept | 2010-12-17 01:41:16 | | 8 | user1 | password1 | Access-Reject | 2010-12-17 02:06:47 | | 9 | user1 | password1 | Access-Reject | 2010-12-17 02:18:37 | | 10 | testuser | testpass | Access-Reject | 2010-12-17 05:05:05 | | 11 | testuser | testpass | Access-Reject | 2010-12-17 05:10:04 | | 12 | testuser | testpass | Access-Reject | 2010-12-17 05:24:06 | | 13 | testuser | testpass | Access-Reject | 2010-12-17 05:35:10 | | 14 | testuser | testpass | Access-Reject | 2010-12-17 06:09:40 | | 15 | testuser | testpass | Access-Reject | 2010-12-17 06:28:45 | | 16 | testuser | testpass | Access-Reject | 2010-12-17 06:43:24 | +----+----------+--------------+---------------+---------------------+ 16 rows in set (0.00 sec) The Access-Accepts that I got here is when I switched it to use the /etc/passwd file. mysql> select * from radreply; +----+----------+-------------------+----+-----------+ | id | username | attribute | op | value | +----+----------+-------------------+----+-----------+ | 1 | testuser | Framed-IP-Address | = | 127.0.0.1 | +----+----------+-------------------+----+-----------+ 1 row in set (0.00 sec) mysql> select * from radusergroup; +----------+-------------+----------+ | username | groupname | priority | +----------+-------------+----------+ | testuser | normalusers | 1 | +----------+-------------+----------+ 1 row in set (0.00 sec) When I start freeradius in debug mode (radiusd -X) I get the following: root@krazy:/etc/raddb# radiusd -X FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Dec 12 2010 at 00:37:40 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/local/lib/" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "neffadmin" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{Stripped-User-Name}" default_user_profile = "DEFAULT" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. And when I run radtest testuser testpass localhost 1812 testing123 in another window I get the following output in the radiusd -X window: rad_recv: Access-Request packet from host 127.0.0.1 port 58413, id=90, length=60 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '' ORDER BY priority [sql] Checking profile DEFAULT [sql] sql_set_user escaped user --> 'DEFAULT' [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'DEFAULT' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'DEFAULT' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User not found ++[sql] returns notfound ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' [sql] expand: %{User-Password} -> testpass [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testpass', 'Access-Reject', '2010-12-17 07:21:15') [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testpass', 'Access-Reject', '2010-12-17 07:21:15') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'testpass', 'Access-Reject', '2010-12-17 07:21:15') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 90 to 127.0.0.1 port 58413 Waking up in 4.9 seconds. Cleaning up request 0 ID 90 with timestamp +152 Ready to process requests. And in the window where I ran radtest I get a Access-Reject radtest testuser testpass localhost 1812 testing123 Sending Access-Request of id 90 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=90, length=20 I not sure how to fix this I been searching for days with no luck.

2 4

send radius.log to mysql
by cktan 18 Dec '10

18 Dec '10

Dear all, I'm looking for possibility to inject the log from radius.log into mysql DB for some monitoring purpose. Any better suggestion? I tried with Syslog-NG and it just won't send radius.log to my syslog server but only system log... Regards CK -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 3

Reals Based Upon Port
by Brian Carpio 17 Dec '10

17 Dec '10

Hi, Currently I am using freeradius2-2.1.8-2 to load balance radius traffic between two hosts, I have a single realm DEFAULT setup which proxies the radius traffic between the two servers and that works great, however now I have an unusual need to proxy auth/acct radius traffic to non standard ports and I'm unsure how (or even it's even possible) to setup a new realm which is based on destination port for instance. Default Server 1 - Auth/Acct - Port 1812,1813 Default Server 2 - Auth/Acct - Port 1812,1813 Pool Default - Default Server 1 - Default Server 2 Realm Default - Pool Default - NOTE: Traffic coming into freeradius on the standard 1812/1813 ports will be sent to this default realm (which I have working perfectly now) ---- Up to this point I have it all working ---- Alt Server 1 - Auth/Acct - Port 1815/1816 Alt Server 2 - Auth/Acct - Port 1815/1816 Pool Alt - Alt Server 1 - Alt Server 2 Realm Alt - Pool Alt - NOTE: Traffic coming into freeradius on 1815/1816 will be sent to this Alt realm... I am just wondering if this is possible. Or if I would need to setup another instance of freeradius with its own configuration to do this alternative ports setup. Thanks a lot! Brian Carpio Senior Systems Engineer Office: +1.303.962.7242 Mobile: +1.720.319.8617 Email: bcarpio(a)broadhop.com

2 9

No authenticate method (Auth-Type) configuration found for the request:
by discgolfer72 17 Dec '10

17 Dec '10

Installed FreeRadius 2.1.8 to authenticate to an LDAP back end (eDirectory) Set it up per the document link below: http://www.novell.com/communities/node/11321/freeradius-218-edirectory-inte… Now I'm getting a No authenticate method error. Output of radiusd -X below: Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.0.12 port 3915, id=9, length=48 User-Name = "radadmin" User-Password = "thepassword" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "radadmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> radadmin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 9 to 10.1.0.12 port 3915 Waking up in 4.9 seconds. Cleaning up request 0 ID 9 with timestamp +3 Ready to process requests. In the Novell Cool Solution link, they say to un-comment "ldap" in the authorize section of /etc/raddb/sites-enabled/inner-tunnel but I had a question on this. Attached is my inner-tunnel config. My question is do I also need to un-comment the following in the authenticate section or am I missing something else entirely? #Auth-Type LDAP { # ldap #} # -*- text -*- ###################################################################### # # This is a virtual server that handles *only* inner tunnel # requests for EAP-TTLS and PEAP types. # # $Id$ # ###################################################################### server inner-tunnel { # # Un-comment the next section to perform test on the inner tunnel # without needing an outer tunnel session. The tests will not be # exactly the same as when TTLS or PEAP are used, but they will # be close enough for many tests. # #listen { # ipaddr = 127.0.0.1 # port = 18120 # type = auth #} # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module, above. # unix # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # # Note that proxying the inner tunnel authentication means # that the user MAY use one identity in the outer session # (e.g. "anonymous", and a different one here # (e.g. "user(a)example.com"). The inner session will then be # proxied elsewhere for authentication. If you are not # careful, this means that the user can cause you to forward # the authentication to another RADIUS server, and have the # accounting logs *not* sent to the other server. This makes # it difficult to bill people for their network activity. # suffix # ntdomain # # The "suffix" module takes care of stripping the domain # (e.g. "@example.com") from the User-Name attribute, and the # next few lines ensure that the request is not proxied. # # If you want the inner tunnel request to be proxied, delete # the next few lines. # update control { Proxy-To-Realm := LOCAL } # # This module takes care of EAP-MSCHAPv2 authentication. # # It also sets the EAP-Type attribute in the request # attribute list to the EAP type from the packet. # # The example below uses module failover to avoid querying all # of the following modules if the EAP module returns "ok". # Therefore, your LDAP and/or SQL servers will not be queried # for the many packets that go back and forth to set up TTLS # or PEAP. The load on those servers will therefore be reduced. # eap { ok = return } # # Read the 'users' file files # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf # sql # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap # # Enforce daily limits on time spent logged in. # daily # # Use the checkval module # checkval expiration logintime # # If no other module has claimed responsibility for # authentication, then try to use PAP. This allows the # other modules listed above to add a "known good" password # to the request, and to do nothing else. The PAP module # will then see that password, and use it to do PAP # authentication. # # This module should be listed last, so that the other modules # get a chance to set Auth-Type for themselves. # pap } # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user, or forcibly accept him. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. #Auth-Type LDAP { # ldap #} # # Allow EAP authentication. eap } ###################################################################### # # There are no accounting requests inside of EAP-TTLS or PEAP # tunnels. # ###################################################################### # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp # # See "Simultaneous Use Checking Queries" in sql.conf # sql } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # Note that we do NOT assign IP addresses here. # If you try to assign IP addresses for EAP authentication types, # it WILL NOT WORK. You MUST use DHCP. # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf # sql # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject } # # The example policy below updates the outer tunnel reply # (usually Access-Accept) with the User-Name from the inner # tunnel User-Name. Since this section is processed in the # context of the inner tunnel, "request" here means "inner # tunnel request", and "outer.reply" means "outer tunnel # reply attributes". # # This example is most useful when the outer session contains # a User-Name of "anonymous@....", or a MAC address. If it # is enabled, the NAS SHOULD use the inner tunnel User-Name # in subsequent accounting packets. This makes it easier to # track user sessions, as they will all be based on the real # name, and not on "anonymous". # # The problem with doing this is that it ALSO exposes the # real user name to any intermediate proxies. People use # "anonymous" identifiers outside of the tunnel for a very # good reason: it gives them more privacy. Setting the reply # to contain the real user name removes ALL privacy from # their session. # # If you want privacy to remain, see the # Chargeable-User-Identity attribute from RFC 4372. In order # to use that attribute, you will have to allocate a # per-session identifier for the user, and store it in a # long-term database (e.g. SQL). You should also use that # attribute INSTEAD of the configuration below. # #update outer.reply { # User-Name = "%{request:User-Name}" #} } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { # attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. # post_proxy_log # attr_rewrite # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter.post-proxy # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap # # If the server tries to proxy a request and fails, then the # request is processed through the modules in this section. # # The main use of this section is to permit robust proxying # of accounting packets. The server can be configured to # proxy accounting packets as part of normal processing. # Then, if the home server goes down, accounting packets can # be logged to a local "detail" file, for processing with # radrelay. When the home server comes back up, radrelay # will read the detail file, and send the packets to the # home server. # # With this configuration, the server always responds to # Accounting-Requests from the NAS, but only writes # accounting packets to disk if the home server is down. # # Post-Proxy-Type Fail { # detail # } } } # inner-tunnel server block -- View this message in context: http://freeradius.1045715.n5.nabble.com/No-authenticate-method-Auth-Type-co… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Unable to Authenticate users
by john decot 17 Dec '10

17 Dec '10

Hi, I am planing to use freeradius for authentication for lan users. The following are the radcheck parameters: mysql> select * from radcheck; +----+----------+--------------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------------------------------+ | 17 | test1 | User-Password | := | $1$q79.qtrm$gD6D4znw2uBGIU0K3mt/1/ | | 9 | test | Cleartext-Password | := | password1234 | +----+----------+--------------------+----+------------------------------------+ 2 rows in set (0.00 sec) 　 The user test can authenticate as it is clear text password but when i try to authenticate user test1 I got error like Found Auth-Type = CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! and failed. I would like to implement password with encrypted as user test1. So, could you please help me how to resolve this issue. Thanking you, Regards, John

2 2

Possible memory leak in rlm_sql?
by Brian Candler 17 Dec '10

17 Dec '10

I noticed something in rlm_sql.c function rlm_sql_process_groups(). group_list is allocated at the top of the function, but sql_grouplist_free(&group_list) is only called at the end. All the various error exits don't call it. ISTM that's going to leak memory in event of errors, but perhaps I have overlooked something which prevents that. Regards, Brian.

2 1