- Freeradius-Users - lists.freeradius.org

SQL modul
by Miha Zoubek 02 Dec '10

02 Dec '10

Hello, at the end of this file I am getting massage Failed to load module"sql". Could you please help me what to do ? Thank you! miha[root@localhost sites-available]# /usr/local/sbin/radiusd -XFreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Dec 1 2010 at 14:25:01Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ...including configuration file /usr/local/etc/raddb/radiusd.confincluding configuration file /usr/local/etc/raddb/proxy.confincluding configuration file /usr/local/etc/raddb/clients.confincluding files in directory /usr/local/etc/raddb/modules/including configuration file /usr/local/etc/raddb/modules/checkvalincluding configuration file /usr/local/etc/raddb/modules/krb5including configuration file /usr/local/etc/raddb/modules/sql_logincluding configuration file /usr/local/etc/raddb/modules/linelogincluding configuration file /usr/local/etc/raddb/modules/execincluding configuration file /usr/local/etc/raddb/modules/ldapincluding configuration file /usr/local/etc/raddb/modules/sradutmpincluding configuration file /usr/local/etc/raddb/modules/chapincluding configuration file /usr/local/etc/raddb/modules/radutmpincluding configuration file /usr/local/etc/raddb/modules/inner-eapincluding configuration file /usr/local/etc/raddb/modules/unixincluding configuration file/usr/local/etc/raddb/modules/sqlcounter_expire_on_loginincluding configuration file /usr/local/etc/raddb/modules/dynamic_clientsincluding configuration file /usr/local/etc/raddb/modules/mac2ipincluding configuration file /usr/local/etc/raddb/modules/counterincluding configuration file /usr/local/etc/raddb/modules/smbpasswdincluding configuration file /usr/local/etc/raddb/modules/filesincluding configuration file /usr/local/etc/raddb/modules/realmincluding configuration file /usr/local/etc/raddb/modules/etc_groupincluding configuration file /usr/local/etc/raddb/modules/pamincluding configuration file /usr/local/etc/raddb/modules/acct_uniqueincluding configuration file /usr/local/etc/raddb/modules/detail.example.comincluding configuration file /usr/local/etc/raddb/modules/preprocessincluding configuration file /usr/local/etc/raddb/modules/digestincluding configuration file /usr/local/etc/raddb/modules/mac2vlanincluding configuration file /usr/local/etc/raddb/modules/opendirectoryincluding configuration file /usr/local/etc/raddb/modules/attr_rewriteincluding configuration file /usr/local/etc/raddb/modules/otpincluding configuration file /usr/local/etc/raddb/modules/policyincluding configuration file /usr/local/etc/raddb/modules/ippoolincluding configuration file /usr/local/etc/raddb/modules/logintimeincluding configuration file /usr/local/etc/raddb/modules/wimaxincluding configuration file /usr/local/etc/raddb/modules/expirationincluding configuration file /usr/local/etc/raddb/modules/attr_filterincluding configuration file /usr/local/etc/raddb/modules/smsotpincluding configuration file /usr/local/etc/raddb/modules/ntlm_authincluding configuration file /usr/local/etc/raddb/modules/detailincluding configuration file /usr/local/etc/raddb/modules/mschapincluding configuration file /usr/local/etc/raddb/modules/detail.logincluding configuration file /usr/local/etc/raddb/modules/papincluding configuration file /usr/local/etc/raddb/modules/alwaysincluding configuration file /usr/local/etc/raddb/modules/passwdincluding configuration file /usr/local/etc/raddb/modules/cuiincluding configuration file /usr/local/etc/raddb/modules/exprincluding configuration file /usr/local/etc/raddb/modules/echoincluding configuration file /usr/local/etc/raddb/modules/perlincluding configuration file /usr/local/etc/raddb/eap.confincluding configuration file /usr/local/etc/raddb/sql.confincluding configuration file /usr/local/etc/raddb/policy.confincluding files in directory /usr/local/etc/raddb/sites-enabled/including configuration file/usr/local/etc/raddb/sites-enabled/control-socketincluding configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnelincluding configuration file /usr/local/etc/raddb/sites-enabled/defaultmain {allow_core_dumps = no}including dictionary file /usr/local/etc/raddb/dictionarymain {prefix = "/usr/local"localstatedir = "/usr/local/var"logdir = "/usr/local/var/log/radius"libdir = "/usr/local/lib"radacctdir = "/usr/local/var/log/radius/radacct"hostname_lookups = nomax_request_time = 30cleanup_delay = 5max_requests = 1024pidfile = "/usr/local/var/run/radiusd/radiusd.pid"checkrad = "/usr/local/sbin/checkrad"debug_level = 0proxy_requests = yeslog {stripped_names = noauth = noauth_badpass = noauth_goodpass = no}security {max_attributes = 200reject_delay = 1status_server = yes}}radiusd: #### Loading Realms and Home Servers ####proxy server {retry_delay = 5retry_count = 3default_fallback = nodead_time = 120wake_all_if_all_dead = no}home_server localhost {ipaddr = 127.0.0.1port = 1812type = "auth"secret = "testing123"response_window = 20max_outstanding = 65536require_message_authenticator = yeszombie_period = 40status_check = "status-server"ping_interval = 30check_interval = 30num_answers_to_alive = 3num_pings_to_alive = 3revive_interval = 120status_check_timeout = 4irt = 2mrt = 16mrc = 5mrd = 30}home_server_pool my_auth_failover {type = fail-overhome_server = localhost}realm example.com {auth_pool = my_auth_failover}realm LOCAL {}radiusd: #### Loading Clients ####client localhost {ipaddr = 127.0.0.1require_message_authenticator = nosecret = "testing123"nastype = "cisco"}client xxx.xxx.xxx.xxx {require_message_authenticator = nosecret = "12345"shortname = "intraswitch"}radiusd: #### Instantiating modules ####instantiate {Module: Linked to module rlm_execModule: Instantiating module "exec" from file/usr/local/etc/raddb/modules/execexec {wait = noinput_pairs = "request"shell_escape = yes}Module: Linked to module rlm_exprModule: Instantiating module "expr" from file/usr/local/etc/raddb/modules/exprModule: Linked to module rlm_expirationModule: Instantiating module "expiration" from file/usr/local/etc/raddb/modules/expirationexpiration {reply-message = "Password Has Expired "}Module: Linked to module rlm_logintimeModule: Instantiating module "logintime" from file/usr/local/etc/raddb/modules/logintimelogintime {reply-message = "You are calling outside your allowed timespan "minimum-timeout = 60}}radiusd: #### Loading Virtual Servers ####server inner-tunnel { # from file/usr/local/etc/raddb/sites-enabled/inner-tunnelmodules {Module: Checking authenticate {...} for more modules to loadModule: Linked to module rlm_papModule: Instantiating module "pap" from file/usr/local/etc/raddb/modules/pappap {encryption_scheme = "auto"auto_header = no}Module: Linked to module rlm_chapModule: Instantiating module "chap" from file/usr/local/etc/raddb/modules/chapModule: Linked to module rlm_mschapModule: Instantiating module "mschap" from file/usr/local/etc/raddb/modules/mschapmschap {use_mppe = yesrequire_encryption = norequire_strong = nowith_ntdomain_hack = no}Module: Linked to module rlm_unixModule: Instantiating module "unix" from file/usr/local/etc/raddb/modules/unixunix {radwtmp = "/usr/local/var/log/radius/radwtmp"}Module: Linked to module rlm_eapModule: Instantiating module "eap" from file /usr/local/etc/raddb/eap.confeap {default_eap_type = "md5"timer_expire = 60ignore_unknown_eap_types = nocisco_accounting_username_bug = nomax_sessions = 4096}Module: Linked to sub-module rlm_eap_md5Module: Instantiating eap-md5Module: Linked to sub-module rlm_eap_leapModule: Instantiating eap-leapModule: Linked to sub-module rlm_eap_gtcModule: Instantiating eap-gtcgtc {challenge = "Password: "auth_type = "PAP"}Module: Linked to sub-module rlm_eap_tlsModule: Instantiating eap-tlstls {rsa_key_exchange = nodh_key_exchange = yesrsa_key_length = 512dh_key_length = 512verify_depth = 0CA_path = "/usr/local/etc/raddb/certs"pem_file_type = yesprivate_key_file = "/usr/local/etc/raddb/certs/server.pem"certificate_file = "/usr/local/etc/raddb/certs/server.pem"CA_file = "/usr/local/etc/raddb/certs/ca.pem"private_key_password = "whatever"dh_file = "/usr/local/etc/raddb/certs/dh"random_file = "/usr/local/etc/raddb/certs/random"fragment_size = 1024include_length = yescheck_crl = nocipher_list = "DEFAULT"make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"cache {enable = nolifetime = 24max_entries = 255}verify {}}Module: Linked to sub-module rlm_eap_ttlsModule: Instantiating eap-ttlsttls {default_eap_type = "md5"copy_request_to_tunnel = nouse_tunneled_reply = novirtual_server = "inner-tunnel"include_length = yes}Module: Linked to sub-module rlm_eap_peapModule: Instantiating eap-peappeap {default_eap_type = "mschapv2"copy_request_to_tunnel = nouse_tunneled_reply = noproxy_tunneled_request_as_eap = yesvirtual_server = "inner-tunnel"}Module: Linked to sub-module rlm_eap_mschapv2Module: Instantiating eap-mschapv2mschapv2 {with_ntdomain_hack = no}Module: Checking authorize {...} for more modules to loadModule: Linked to module rlm_realmModule: Instantiating module "suffix" from file/usr/local/etc/raddb/modules/realmrealm suffix {format = "suffix"delimiter = "@"ignore_default = noignore_null = no}Module: Linked to module rlm_filesModule: Instantiating module "files" from file/usr/local/etc/raddb/modules/filesfiles {usersfile = "/usr/local/etc/raddb/users"acctusersfile = "/usr/local/etc/raddb/acct_users"preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"compat = "no"}Module: Checking session {...} for more modules to loadModule: Linked to module rlm_radutmpModule: Instantiating module "radutmp" from file/usr/local/etc/raddb/modules/radutmpradutmp {filename = "/usr/local/var/log/radius/radutmp"username = "%{User-Name}"case_sensitive = yescheck_with_nas = yesperm = 384callerid = yes}Module: Checking post-proxy {...} for more modules to loadModule: Checking post-auth {...} for more modules to loadModule: Linked to module rlm_attr_filterModule: Instantiating module "attr_filter.access_reject" from file/usr/local/etc/raddb/modules/attr_filterattr_filter attr_filter.access_reject {attrsfile = "/usr/local/etc/raddb/attrs.access_reject"key = "%{User-Name}"}} # modules} # serverserver { # from file /usr/local/etc/raddb/radiusd.confmodules {Module: Checking authenticate {...} for more modules to loadModule: Linked to module rlm_digestModule: Instantiating module "digest" from file/usr/local/etc/raddb/modules/digestModule: Checking authorize {...} for more modules to loadModule: Linked to module rlm_preprocessModule: Instantiating module "preprocess" from file/usr/local/etc/raddb/modules/preprocesspreprocess {huntgroups = "/usr/local/etc/raddb/huntgroups"hints = "/usr/local/etc/raddb/hints"with_ascend_hack = noascend_channels_per_line = 23with_ntdomain_hack = nowith_specialix_jetstream_hack = nowith_cisco_vsa_hack = nowith_alvarion_vsa_hack = no}/usr/local/etc/raddb/sites-enabled/default[159]: Failed to load module"sql"./usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorizesection.

2 1

use existing sql table for user-password
by Oguzhan Kayhan 02 Dec '10

02 Dec '10

Hello, I want to use freeradius for wireless authentication. I got an already installed mysql server, and some tables including usernames and passwords. I want to use this user/passwords with freeradius. How can it be possible? I will create a radius table to keep logs etc, but just to use user/passwd field..can i use another table?

2 3

Mikrotik-Xmit-Limit - Not enforced on first logon but is on subsequent logons...
by Shane Hart 02 Dec '10

02 Dec '10

Hi all, Doing some trials with freeradius 2.x with the intention of moving from 1.1.7 I have an odd problem with mikrotik nas. An account with download limit will not enforce the limit on the first logon but will on subsequent logons. On the first logon, no limit is imposed in mikrotik and the account can use unlimited traffic. If I log off then log on again, the limit is enforced... (I have checked in winbox and the "limit bytes in" column is not populated on first logon). It is taking me a while to get use to v2 of freeradius. Tks Setup details below: User account has attribute Mikrotik-Xmit-Limit := 10471200 in radcheck Do I need to have something in radreply as this is where the shaping is done? In: sql/mysql/counter.conf sqlcounter downloadbytecounter { counter-name = Mikrotik-Xmit-Limit check-name = Mikrotik-Xmit-Limit reply-name = Mikrotik-Xmit-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(acctoutputoctets) FROM radacct WHERE username='%{%k}'" } In sites-available/default authorize { downloadbytecounter

2 1

In what file are enlisted to users?
by Jess Tafo11a 02 Dec '10

02 Dec '10

Hello friends my name´s Jesus I have a problem, I am using freeradius on my virual machine to the ubuntu version 9.10 and want to add clients for my freeradius detect the mac address that I enter. The question is: Is there any easy way to add clients? Yo I have installed: The virtualbox version 3.2.10 Ubuntu version 9.10 Freeradius version 1.2.1910

1 0

Re: dynamically selecting, which attribute to evaluate
by Alan DeKok 01 Dec '10

01 Dec '10

Stefan A. wrote: > :-( but thanks, Alan, > > Unfortunately, I've never have been able to build FR with perl on my x86 > Solaris 10 boxes... but we well keep trying ;-) It should be possible. > > For the meantime, would it be feasable to > > update control { > temp_attribute := "reply:%{control:TicketType}-trigger-reactivation" > } > > and later > > if ("%{control:temp_attribute}" != ""){ > do the rest > } <sigh> I said: >> You can't really do two levels of expansion like that, sorry. >> >>> Why does it not expand the %{control:TicketType} to Ticket245 in this >>> situation? >> You can't really do two levels of expansion like that, sorry. I suggest reading the messages on this list. Alan DeKok.

2 1

FW: altas de direcciones mac
by Leonardo Fajardo López 01 Dec '10

01 Dec '10

From: cosita_bodoque(a)hotmail.com To: freeradius-users(a)lists.freeradius.org Subject: altas de direcciones mac Date: Tue, 30 Nov 2010 20:19:42 +0000 Hello I am Leonardo Fajardo Lopez, I am working with an operating system Ubuntu 9.10 and with freeradius-server-02.01.1910 and say high to a customer in the file clients.conf Client localhost { ipaddr = 127.0.0.1 secret = testing123 } and a user in the users file steve Cleartext-Passwords="testing" sirvice=Type=Framed-User, Framed-Protocot=PPP Framed Compression=van-Jscobsen=TCP-IP I want to know is where you should enlist the mac direcion?

1 1

Re: TLS authentication works, but does not check usernames against 'users'file.
by Nolan King 01 Dec '10

01 Dec '10

It is easier for me to put explicit denies in the users file when authenticating with TLS. By default anyone with a valid cert gets in. See also certificate revocation list >>> Andrew Bovill <abovill(a)gmail.com> 11/30/10 7:56 AM >>> Hi, I'm trying to get WPA Enterprise EAP/TLS working with my wireless router. It appears that the TLS portion of the authentication works (valid certificates give me a working connection) but it does NOT appear to actually be checking the username/password combination that is also sent along the line. I have followed the WPA_HOWTO as best I could (my clients are OS X and Android and Gentoo, not Windows XP) but I can't figure out how to 'fail' an auth attempt with an invalid user/pass combination. Here is the debug output: Thanks for any advice. I didn't want to start reconfiguring with a shotgun :) <snip>

1 0

Re: dynamically selecting, which attribute to evaluate
by Alan DeKok 01 Dec '10

01 Dec '10

Stefan A. wrote: > and then to evaluate TicetType specific Attributes... > > if ("reply:%{control:TicketType}-trigger-reactivation" != ""){ You can't really do two levels of expansion like that, sorry. > Why does it not expand the %{control:TicketType} to Ticket245 in this > situation? You can't really do two levels of expansion like that, sorry. > How may I dynamically select Attributes to check for? Perl. Alan DeKok.

2 1

Freeradius and Voip
by miha- 01 Dec '10

01 Dec '10

Hello, I am first time setting freeradius. I am setting it for voip accounting. I need a little help form you guys :) I read that I need to enable sql in radiusd.conf. I have also run a script for creating a tables. I changed sql.conf to voip-postpaid.conf ( I changed login, pass, and server in conf file). Is this the right scipt for crating tables : http://wiki.freeradius.org/MySQL_DDL_script http://wiki.freeradius.org/MySQL_DDL_script I am getting this error beacuse I do not know where must I put users and etc. sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "(null)" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Acct-Multi-Session-Id = "1291187632294" Cisco-Attr-130 = 0x683332332d63616c6c696e672d656e74657270726973652d69643d656e74504258 Calling-Station-Id = "81609000" NAS-Identifier = "intraswitch" NAS-IP-Address = 212.13.228.58 3GPP2-Prepaid-acct-Capability = 0x010600000002 3GPP2-Session-Termination-Capability = 1 h323-conf-id = "h323-conf-id=1291187632294" Vendor-Specific = 0x00000009 Event-Timestamp = "Dec 1 2010 08:13:52 CET" User-Name = "081609000" User-Password = "1234" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '@' in User-Name = "081609000", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 081609000 at line 92 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '081609000' rlm_sql (sql): sql_set_user escaped user --> '081609000' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '081609000' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql: Failed to create the pair: Unknown attribute "1234" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 212.13.228.58:47469, id=2, length=206 Discarding duplicate request from client intraswitch:47469 - ID: 2 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 2 with timestamp 4cf5f5ac Nothing to do. Sleeping until we see a request. Thank you for your help!!! I will remember this :) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-and-Voip-tp3287359p32873… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Certificate-based client side authentication towards a website with freeradius
by Martin Schneider 01 Dec '10

01 Dec '10

Hello all, we're trying to setup a freeradius / apache installation that allows us to authenticate and authorize users with *certificates* towards a website. Is there a good tutorial out there somewhere? We did only finde partial information that seems to be quite old unfortunately. Or could somebody who is deep into this matter please give some advice or ideas how we can solve our task? Best regards M

5 10