- Freeradius-Users - lists.freeradius.org

RE: Permanent mysql connection in mod_perl
by Nasser Heidari 07 Apr '10

07 Apr '10

> -----Original Message----- > From: freeradius-users-bounces+nasser=rasana.net(a)lists.freeradius.org > [mailto:freeradius-users-bounces+nasser=rasana.net@lists.freeradius.org] > On Behalf Of Apostolos Pantsiopoulos > Sent: Wednesday, April 07, 2010 13:37 > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Permanent mysql connection in mod_perl > > Have a look at the CLONE special function in rlm_perl documentation. > Initiate your db connections in that function. > Unfortunately I'm not familiar with this function, as I have searched , I think that only change that I need is to enclose my db connection part in Perl script into sub CLONE {} . Is that correct? > -- > ------------------------------------------- > Apostolos Pantsiopoulos > Kinetix Tele.com R & D > email: regs(a)kinetix.gr > ------------------------------------------- > > On 7/4/2010 12:01 μμ, Nasser Heidari wrote: > > Hi, > > I'm using mod_perl in my radius configuration and using it I write some > > logs to database. > > Today I noticed that, there are lots of mysql connections in TIME_WAIT > > state. > > > > # netstat -epn --tcp | grep TIME_WAIT | wc -l > > 15015 > > > > netstat -epn --tcp | grep TIME_WAIT | tail -1 > > tcp 0 0 192.168.1.4:49060 192.168.1.6:3306 TIME_WAIT > > > > I'm sure it is because of mod_perl, and I'm looking forward to force > > radius to use permanent mysql connections. > > Has anyone any idea? > > > > Thanks in advance > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Permanent mysql connection in mod_perl
by Nasser Heidari 07 Apr '10

07 Apr '10

Hi, I'm using mod_perl in my radius configuration and using it I write some logs to database. Today I noticed that, there are lots of mysql connections in TIME_WAIT state. # netstat -epn --tcp | grep TIME_WAIT | wc -l 15015 netstat -epn --tcp | grep TIME_WAIT | tail -1 tcp 0 0 192.168.1.4:49060 192.168.1.6:3306 TIME_WAIT I'm sure it is because of mod_perl, and I'm looking forward to force radius to use permanent mysql connections. Has anyone any idea? Thanks in advance

2 1

(no subject)
by Richie Lee 06 Apr '10

06 Apr '10

http://membres.multimania.fr/pmtwiik/ _________________________________________________________________ Hotmail & Messenger. Get them on your phone now. http://go.microsoft.com/?linkid=9724463

1 0

(no subject)
by Richie Lee 06 Apr '10

06 Apr '10

http://uqosobupafiz.moy.su _________________________________________________________________ Videos that have everyone talking! Now also in HD! http://go.microsoft.com/?linkid=9724465

1 0

Multiple EAP-TLS modules with different certificates
by Thibault Le Meur 06 Apr '10

06 Apr '10

Hi, I'm about to change the CA of my radius server certificate. At the same time I've installed a new wifi network and plan to change the SSID as well (authentication is EAP-TTLS or EAP-PEAP). In order to avoid a complete breakout when I change the certificate of my radius server (because a manual operation is required on the supplicant side to select the new CA), I'd like to configure FR so that: * when the WiFi client connects to the SSID1, the server uses the old certificate and key, * and when the client uses the SSID2, the radius server uses the new certificate and key Is this possible ? I've already tried such a configuration by: * defining 2 eap modules let's say "eapOld" and "eapNew" (each with its own key and cert) * making sure that depending on the SSID, the access-point sets a different NAS-Identifier (let's say ID1 and ID2) in the Access-request * in the virtual FR server, I've used unlang to run either eap module: in authorize: if ("%{request:NAS-Identifier}" == ID1) { eapOld { ok = return } if ("%{request:NAS-Identifier}" == ID2) { eapNew { ok = return } in authenticate: Auth-Type eapNew { eapNew } Auth-Type eapOld { eapOld } in eap.conf: the two eap modules only differ from their certificate/key, they redirect to the same inner-tunnel virtual server. The result so far is that with such setup my wireless clients can't connect at all when they check the certificate, but can connect when they don't (no matter what setup is done on the client side). Of course I've installed the 2 certificates on the client to check this. A quick look at FR debug logs confirms, as far as I can read them, that the client is refusing the radius server certificate. Is there a client tool to check which certificate is used by FR ? Have I missed something in the setup ? I've tried to turn on Windows EAP log, but they aren't very easy to read as far as TLS/TTLS/PEAP authentication is concerned ! Environement: FR is 2.1.1, client used Windows XP SP3 and Windows 7. Thanks a lot for your ideas, proposals, ... Best regards, Thibault

2 3

(no subject)
by Richie Lee 06 Apr '10

06 Apr '10

http://penepymibasok.moy.su _________________________________________________________________ Got a phone? Get Hotmail & Messenger for mobile! http://go.microsoft.com/?linkid=9724464

1 0

I have a question about freeradius-client-1.1.6.
by Bryant 05 Apr '10

05 Apr '10

Hi, I download freeradius-client-1.1.6 from your website.Now,I have installed and configured the freeradius server 2.1.8 and freeradius-client-1.1.6 successfully. I use the mysql to store the user and I create a user whose username is test,Auth_Type is Local,Cleartext-Password is test. Then I run the command: #radtest test test lcoalhost 0 testing123 This can authorize successfully. But when I compile freeradius-client-1.1.6/src/radexample.c or run radlogin. #login:test #passoword:test This don't authorize successfully. When I see the server's display ,I find the password is encryped. What should I do? Thanks!

2 1

(no subject)
by Richie Lee 04 Apr '10

04 Apr '10

http://olepidinuqa.ucoz.es _________________________________________________________________ Live connected. Get Hotmail & Messenger on your phone. http://go.microsoft.com/?linkid=9724462

1 0

(no subject)
by Richie Lee 04 Apr '10

04 Apr '10

www.Newviagrashop.neipdnalu.com _________________________________________________________________ Hotmail & Messenger are available on your phone. Try now. http://go.microsoft.com/?linkid=9724461

1 0

Kerberos (krb5) Module Overrides Other Authentication Types . . .
by Mowgli Assor 03 Apr '10

03 Apr '10

I've had the rlm_krb5 module running for a while now, with the line in the users file : ----- DEFAULT Auth-Type = Kerberos ----- I found that was the only way to get the rlm_krb5 module to actually fire, otherwise the krb5 module would never try to authenticate anyone. I'm now trying to add authentication from an SQL database. So, I have an appropriate tested setup for SQL, and the following in the radreply table : mysql> select * from radreply; +----+----------+--------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------+----+------------+ | 1 | mowglidb | Service-Type | := | Login-User | | 2 | mowglidb | Fall-Through | = | No | | 3 | mowglidb | Auth-Type | := | Accept | | 4 | mowglidb | Hint | := | SQL | +----+----------+--------------+----+------------+ 4 rows in set (0.00 sec) I've verified that both authentication types work properly, but what happens is that the Kerberos result is the only one ever used, despite the fact that the SQL result appears valid. So when you lookup an ID in the SQL table which is valid, the Kerberos lookup executes, doesn't find the ID, and sends a REJECT. Here's partial radiusd -X output showing the results of a query . . . ----- Ready to process requests. rad_recv: Access-Request packet from host 128.146.XXX.XXX port 1166, id=12, length=48 User-Name = "mowglidb" User-Password = "1234abcd" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/128.146.XXX.XXX/auth-detail-20100401 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/128.146.XXX.XXX/auth-detail-20100401 [auth_log] expand: %t -> Thu Apr 1 00:38:53 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [IPASS] No '/' in User-Name = "mowglidb", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [suffix] No '@' in User-Name = "mowglidb", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok [sql] expand: %{User-Name} -> mowglidb [sql] sql_set_user escaped user --> 'mowglidb' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radcheck WHERE username = 'mowglidb' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mowglidb' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radreply WHERE username = 'mowglidb' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mowglidb' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mowglidb' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'mowglidb' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: [mowglidb] krb5_g_i_t_w_p failed: Client not found in Kerberos database ++[krb5] returns reject Failed to authenticate the user. Login incorrect: [mowglidb] (from client test port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mowglidb attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 12 to 128.146.XXX.XXX port 1166 Finished request 1. Going to the next request ----- I've tried varying what is in the users file, but so far my only results are either the SQL result is squashed by the Kerberos result, or the Kerberos section never attempts a lookup. In reading the attributes description, it implies that if I put the "Auth-Type = Kerberos" in the check section for the DEFAULT entry, it should only add this if there is no Auth-Type, but I'm not clear on when the items from the radreply table are added to the reply. Explicitly setting the Auth-Type in the SQL reply doesn't appear to affect anything - the Kerberos DEFAULT entry seems to simply override it. I've tried swapping the order of the sql & files attributes in the authenticate section, but that didn't work either : ----- ++[sql] returns ok [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: [mowglidb] krb5_g_i_t_w_p failed: Client not found in Kerberos database ++[krb5] returns reject Failed to authenticate the user. Login incorrect: [mowglidb] (from client test port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} ----- And modifying the users file so that the entry reads : ----- DEFAULT Auth-Type = Kerberos ----- resulted in the krb5 module failing to fire at all, even though the files result did match the DEFAULT rule : ----- ++[chap] returns noop ++[mschap] returns noop [IPASS] No '/' in User-Name = "assor.3", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [suffix] No '@' in User-Name = "assor.3", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok [sql] expand: %{User-Name} -> assor.3 [sql] sql_set_user escaped user --> 'assor.3' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radcheck WHERE username = 'assor.3' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'assor.3' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'assor.3' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'assor.3' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User assor.3 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user ----- The users file really only has the single DEFAULT rule in it, but let me know if seeing any of the other configuration files would help. Otherwise, I'd appreciate any help on getting the krb5 module to work with other authentication types. One other thing, it might be useful to add an "extended debugging" flag to the -X option, which shows you the reply table entries after each module, to allow tracking what sets what values. I haven't seen that mentioned in any documentation, but in my case that would at least allow me to answer the question of what reply entries get set where when. Thanks, <Mowgli> -- The Ohio State University Network Security Group | Mowgli Assor ---------------------------------------------------+-------------------------- E-mail : security(a)osu.edu | Network Security Engineer Web : http://www.infosec.ohio-state.edu | Office : (Use E-mail)

3 5