- Freeradius-Users - lists.freeradius.org

Stripping Realms from SQL Accounting Queries
by Tim Gustafson 23 Nov '09

23 Nov '09

Hi, I'm using FreeRADIUS with LDAP for authentication and mySQL for logging. The LDAP queries seem to be stripping the realm name properly, whereas the mySQL queries are not. I'm running FreeRADIUS 2.1.6 on FreeBSD: FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd7.2, built on Nov 10 2009 at 08:34:04 Here's what I've got in my modules/ldap: ----- modules/ldap ----- ldap { server = "foo" basedn = "dc=foo" identity = "uid=foo" password = "foo" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = yes } access_attr = "uid" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = sambaNTPassword edir_account_policy_check = no groupname_attribute = "cn" groupmembership_attribute = "memberUid" groupmembership_filter = "(memberUid=%{Stripped-User-Name:-%{User-Name}})" } ----- modules/ldap ----- Here's what I've got in my sql/mysql/wpa.conf file: ----- sql/mysql/wpa.conf ----- accounting_start_query = "insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('%{Acct-Session-Id}', '%{Stripped-User-Name:-%{User-Name}}', '%{NAS-IP-Address}', '%{Calling-Station-Id}', '%S')" accounting_stop_query = "update RadiusLog set EndTime = '%S', BytesIn = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', BytesOut = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' where SessionID = '%{Acct-Session-Id}' and UserName = '%{Stripped-User-Name:-%{User-Name}}' and StartTime >= date_sub(now(), interval 30 day)" accounting_update_query = "update RadiusLog set BytesIn = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', BytesOut = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' where SessionID = '%{Acct-Session-Id}' and UserName = '%{Stripped-User-Name:-%{User-Name}}' and StartTime >= date_sub(now(), interval 30 day)" ----- sql/mysql/wpa.conf ----- And here are some sample queries from the SQL trace file: ----- /var/log/radacct/radius.sql ----- insert into RadiusLog (SessionID, UserName, WapIpAddress, UserMacAddress, StartTime) value ('0004F815', 'tjg@foo', '192.168.32.8', '0024.2b58.2f46', '2009-11-23 10:52:58'); update RadiusLog set EndTime = '2009-11-23 10:53:46', BytesIn = '0' << 32 | '2487', BytesOut = '0' << 32 | '1356' where SessionID = '0004F815' and UserName = 'tjg@foo' and StartTime >= date_sub(now(), interval 30 day); ----- /var/log/radacct/radius.sql ----- I tried adding a realm definition in proxy.conf, like this: ----- proxy.conf ----- realm foo { type = radius authhost = LOCAL accthost = LOCAL strip } ----- proxy.conf ----- But that didn't help at all. I know I must be missing something obvious. Most of the Google hits on this talk about creating realms and stuff, but that hasn't helped me. Can anyone share some wisdom here? Thanks! Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 2

ntlm_auth and AD authentication
by freeradius＠corwyn.net 23 Nov '09

23 Nov '09

freeradius2-2.1.7-2.el5 freeradius2-utils-2.1.7-2.el5 freeradius2-libs-2.1.7-2.el5 CentOS 5.2 I'm trying to get freeradius to authenticate with an AD server, using the instructions at http://deployingradius.com/documents/configuration/active_directory.html The initial confirmation of communication with AD is working. The instructions then say to try: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password to confirm, and it looks like it's working. However, the instructions also indicate you should also see the NT_KEY output, which is needed in order for FreeRADIUS to perform MS-CHAP authentication. However, whether I use ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password or ntlm_auth --domain=MYDOMAIN --username=user --password=password the output/response looks the same: NT_STATUS_OK: Success (0x0) which leads me to believe that the nt-key isn't being provided? What is the nt-key supposed to look like? If it's not showing up correctly, any ideas why? thanks Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

6 9

help: radiusd process quit automatically
by pangjiacai 23 Nov '09

23 Nov '09

radiusd process would quit automatically while doing authorization and accounting presure test about 150 times per second,can anyone tell me what the problem is？

2 1

Update of "No NAS-PORT seen"
by Peter Carlstedt 23 Nov '09

23 Nov '09

Hello again! I have an update of the problem. I also got an error which I´ve had before, then Ivan Kalik I think told me that i need to enable copy_request_to_tunnel = yes. Well I have that enabled so I can authenticate by peap. But now I get the same error when I try to authenticate the user which has been created in the MySQL database. The error I get is: (only mentioning the mschapv2 & mschap response from the output) "[mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for test-user with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Also as a side note, the user in the database has a Cleartext-Password := test-pass. I read on the wiki that I should use ":=" and not "==" to do the check of the password. Also I have not set a AUTH-TYPE, i let the server figure it out on its own. Best regards/ Peter > > Message: 5 > Date: Mon, 23 Nov 2009 14:03:41 +0000 > From: Peter Carlstedt <pc_007(a)hotmail.com> > Subject: "No NAS-PORT seen" > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <SNT120-W743F9B44DFAEDBDCB59F0B49E0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello everyone! > > After some work now I have succesfully got MySQL to work towards the Freeradius server or at least I think it does. > > But hurm.. I?ve added a user by adding a user in radcheck, ive written "insert into radcheck (id, username, attribute, op, value) VALUES (null, 'test-user', 'Cleartext-Password', ':=', 'test-pass'); > > and then I?ve written "select * from radcheck;" which shows the new user. > > > > Well all of that works but from that point and forward it doesnt, I cant get my new user to authenticate towards the radius server and I get from attr_filter that the request matched entry DEFAULT at line 11, which sends a reject message if I have understood it correctly. Also I?ve commented out that the radius server should use the users file to do checks against when someone tries to authenticate, well that dont seem to work because when i try to authenticate towards the radius server with a user in the users file I succeed while i do not succeed when i try to authenticate by using the user that i created in the mysql database. > > > > > > Have I missed something? > > > > But something i also noticed is that when i authenticate as the user who is in the users file and have commented out that it should use the users file it gets a message from rlm_radutmp saying "No NAS-Port seen. Cannot do anything." > > > > Have I done something terrible wrong? > > > > Ive installed and made my own build of Freeradius 2.1.7 after i installed mysql client and all those libraries and mysql server. also I installed OpenSSL 0.9.8l before installation of the Freeradius server. > > > > Since the log is so big from radiusd -X is there any possibility to save it into a file? And how do i do that? > > > > Best regards/ Peter Carlstedt > > > > _________________________________________________________________ > Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail?. > http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so… >

2 1

Re: "No NAS-PORT seen"
by Peter Carlstedt 23 Nov '09

23 Nov '09

> ------------------------------ > > Message: 2 > Date: Mon, 23 Nov 2009 15:25:32 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: "No NAS-PORT seen" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4B0A9B5C.6000102(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Peter Carlstedt wrote: > > Well all of that works but from that point and forward it doesnt, I cant > > get my new user to authenticate towards the radius server and I get from > > attr_filter that the request matched entry DEFAULT at line 11, which > > sends a reject message if I have understood it correctly. Also I?ve > > commented out that the radius server should use the users file to do > > checks against when someone tries to authenticate, well that dont seem > > to work because when i try to authenticate towards the radius server > > with a user in the users file I succeed while i do not succeed when i > > try to authenticate by using the user that i created in the mysql database. > > > > Have I missed something? > > It shouldn't be that hard. If you change the configuration, re-start > the server. I re-start the server all the time when I change the configuration...so that is not the case. I´ve checked if it works with radtest and it does. So in my mind it feels like i´ve missed something in the peap configuration? > > And READ the debug output. There's a lot of text in it, but it > describes which modules its using, and what it's doing. The ONLY answer > to configuration problems is in the debug output. > > > But something i also noticed is that when i authenticate as the user who > > is in the users file and have commented out that it should use the users > > file it gets a message from rlm_radutmp saying "No NAS-Port seen. Cannot > > do anything." > > That only comes from accounting traffic, not from authentication > traffic. Please do NOT confuse the two. > > > Ive installed and made my own build of Freeradius 2.1.7 after i > > installed mysql client and all those libraries and mysql server. also I > > installed OpenSSL 0.9.8l before installation of the Freeradius server. > > > > Since the log is so big from radiusd -X is there any possibility to save > > it into a file? And how do i do that? > > $ script radius.log > $ radiusd -X .... > (run) > $ exit > > And then look at the file "radius.log" > > Alan DeKok. Ok thanks! I´ll do that. Peter Carlstedt > > > ------------------------------ > > > Message: 4 > Date: Mon, 23 Nov 2009 14:53:42 +0000 > From: Peter Carlstedt <pc_007(a)hotmail.com> > Subject: Update of "No NAS-PORT seen" > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <SNT120-W79B8526AA982DAA24E059B49E0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello again! > > I have an update of the problem. > > > > I also got an error which I?ve had before, then Ivan Kalik I think told me that i need to enable copy_request_to_tunnel = yes. Well I have that enabled so I can authenticate by peap. But now I get the same error when I try to authenticate the user which has been created in the MySQL database. The error I get is: (only mentioning the mschapv2 & mschap response from the output) > > > > "[mschapv2] +- entering group MS-CHAP {...} > > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > > [mschap] Told to do MS-CHAPv2 for test-user with NT-Password > > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > > [mschap] FAILED: MS-CHAP2-Response is incorrect > > ++[mschap] returns reject > > > > Also as a side note, the user in the database has a Cleartext-Password := test-pass. > > I read on the wiki that I should use ":=" and not "==" to do the check of the password. > > Also I have not set a AUTH-TYPE, i let the server figure it out on its own. > > > > Best regards/ Peter > > _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

1 0

"No NAS-PORT seen"
by Peter Carlstedt 23 Nov '09

23 Nov '09

Hello everyone! After some work now I have succesfully got MySQL to work towards the Freeradius server or at least I think it does. But hurm.. I´ve added a user by adding a user in radcheck, ive written "insert into radcheck (id, username, attribute, op, value) VALUES (null, 'test-user', 'Cleartext-Password', ':=', 'test-pass'); and then I´ve written "select * from radcheck;" which shows the new user. Well all of that works but from that point and forward it doesnt, I cant get my new user to authenticate towards the radius server and I get from attr_filter that the request matched entry DEFAULT at line 11, which sends a reject message if I have understood it correctly. Also I´ve commented out that the radius server should use the users file to do checks against when someone tries to authenticate, well that dont seem to work because when i try to authenticate towards the radius server with a user in the users file I succeed while i do not succeed when i try to authenticate by using the user that i created in the mysql database. Have I missed something? But something i also noticed is that when i authenticate as the user who is in the users file and have commented out that it should use the users file it gets a message from rlm_radutmp saying "No NAS-Port seen. Cannot do anything." Have I done something terrible wrong? Ive installed and made my own build of Freeradius 2.1.7 after i installed mysql client and all those libraries and mysql server. also I installed OpenSSL 0.9.8l before installation of the Freeradius server. Since the log is so big from radiusd -X is there any possibility to save it into a file? And how do i do that? Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

authorize_check_query - authorize_reply_query - synchronous or asynchronous?
by freeradius＠duxtel.com 23 Nov '09

23 Nov '09

Hi Folks! I have a working freeRadius with Postgresql database behind it, and looking at developing some additional functionality for a public access wireless service requested by one of our customers. The deal is that they want to allow limited access (by time/download etc) to first-time visitors for free, and then direct them to a purchase page once they have used up that limit. What I'm thinking is to point the authorize_check_query to a pgSQL function that looks for the MAC address in a special table, and if it doesn't exist, to create a new user linked to the client MAC (Our Access Points all support MAC-Auth when the wireless client connects to the network). I'm expecting that if I can create a new user in the authorize_check_query and have it return auth-success, then the authorize_reply_query will return the relevant data from what is created by the former.... I hope that makes some kind of sense! :-} So my basic question is: Does "authorize_check_query" complete fully before starting the call to "authorize_reply_query"? If they happen at the same time, then I expect that 'authorize_reply_query' may execute before I get a chance to create the relevant records for the 'guest' user... I know I can just go ahead and find out my answer by 'empirical method', but I figure that just because it seems to work every time, there is no definite guarantee that it will work *every* time unless I can be certain that these functions execute in sequence :-} Any comments are gratefully received! :-) Thanks, regards, Mike Everest.

3 7

question about scalability
by Divya Shah 23 Nov '09

23 Nov '09

How many radius accounting requests per second can free radius support? I am using openser-1.1.1-1.1 . I have tested up to around 400. But need it to support more than 600 requests per sec. Please let me know the max rate it can support or if it has any dependency on the hardware. Thanks, Regards, Divya Shah QA | GlobalLogic India. B-34/1, Sector-59, Noida Office Phone: +91.120.406.2000 - 3145 www.globallogic.com <http://www.globallogic.com>

2 1

max accounting requests per second
by Divya Shah 23 Nov '09

23 Nov '09

How many radius accounting requests per second can free radius support? I am using freeradius-1.0.4-4.2 I have tested up to around 400. But need it to support more than 600 requests per sec. Please let me know the max rate it can support or if it has any dependency on the hardware. Thanks, Regards, Divya Shah QA | GlobalLogic India. B-34/1, Sector-59, Noida Office Phone: +91.120.406.2000 - 3145 www.globallogic.com <http://www.globallogic.com>

2 1

Re: Authentication
by kachin Agarwal 23 Nov '09

23 Nov '09

Hi, What is the approx authentication rate u get on a good standard hardware using freeradius-server 2.1.7...? Thanx & Regards, Kachin --- On Fri, 20/11/09, kachin Agarwal <kach_gr8(a)yahoo.co.in> wrote: From: kachin Agarwal <kach_gr8(a)yahoo.co.in> Subject: Authentication To: freeradius-users(a)lists.freeradius.org Date: Friday, 20 November, 2009, 4:32 PM Hi, I m currently using freeradius-server 2.1.7. when i try to authenticate it takes abt 400 millisec to authenticate. i use peap-mschapv2 for authentication. So in 1 sec the number of devices i can authenticate is jus 4 to 5. so wat to do? should i modify anything in the freeradius code to increase the authentication rate. Thanx & Regards, kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

1 0