- Freeradius-Users - lists.freeradius.org

rlm_chap: Password check failed
by Marwan Sultan 21 Nov '08

21 Nov '08

Hello All, I'm installing a new FreeBSD server. MySql4.1 php5, Chillispot All working fine. I have installed freeradius-1.1.7_2 when I authinticate throu chillispot it always fails with follow rlm_chap: Setting 'Auth-Type := CHAP'rlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "manager" with CHAP password rlm_chap: Using clear text password "emanager09" for user manager authentication. rlm_chap: Password check failedrad_recv: Access-Request packet from host 127.0.0.1:61467, id=0, length=217Sending Access-Reject of id 0 to 127.0.0.1 port 61467 When password..Ofcourse is correct. Please note i have copied radiusd.conf clients.conf and sql.conf from a diffrent server which is working perfectly. into this new server "identical servers" but its not working anymore.. when I use ntradping for test use..password works fine I have tried to search FAQ i couldnot find it..sorry. Im sure its a small tweak somewhere..PLEASE advise where is excatly as i need this server to be uptonight :( What makes me wonder...the same configuration works on diffrent server and here doesnot ..but its same files.. THANK YOU M. SUltan. _________________________________________________________________ Access your email online and on the go with Windows Live Hotmail. http://windowslive.com/Explore/Hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_access…

1 0

ldap backend and Realm
by Mustapha Bouikhif 21 Nov '08

21 Nov '08

Hi folk, I have Freeradius 2.1.1 and openldap 2.3.27-8 installed in 2 diff servers. My radius server is used to authenticate users from differents relams (lets say 8) against one ldap server. My ldap server has 8 different basedn which holds users from the realms. I want to use unlang to configure radiusd to use a specific ldap module configuration based on the realm of the user connected to the wireless network. Can I use unlang with (switch %{Realm}statement) to do so ? Thanks for any clues and help. -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

6 19

New entry for Interim packet
by Tony Spencer 20 Nov '08

20 Nov '08

Hello Our setup is as follows: Centos 5.2 FreeRADIUS Version 2.0.2 MySQL Version: 4.1.20 We are using FreeRadius for our ADSL users and its working fine. Except when it comes to working out the usage stats for each user at the end of each month. Its easy to do with all sessions that started in the previous month and have a Stop status. But it's difficult when a session rolled over to the next month because the status is Alive. We're trying to find a why to make FreeRadius: Enter a new entry into the Radacct table for a session for an Interim update Mark the previous session with a stop Status and update the OctetsIn and OctetsOut for that session with the current value. Set the new session OctetsIn and OctetsOut at zero until the next update and then it starts from the beginning again. However we can't find a way of making FreeRadius: Run 2 sql statements in the same update. Set the new session counter to zero and not roll over the next updates Octets. We have found the following site: http://www.netexpertise.eu/en/freeradius/daily-accounting.html with a way of doing this within MySQL with procedures, but apparently this only works with MySQL 5. Having installed MySQL 5 on a test server and importing our Radius database we tried running the first procedure but get an error: ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DECLARE COUNTER_LIMIT BIGINT(12)' at line 1 mysql> SET COUNTER_LIMIT = POW(2,32); ERROR 1193 (HY000): Unknown system variable 'COUNTER_LIMIT Has anyone any ideas on how to do what we require or has anyone had any luck with the instructions on the URL? Thanks in advance. Tony

5 9

oracle stored procédure
by Alexandre Chapellon 20 Nov '08

20 Nov '08

I'm still trying to setup freeradius authentication with oracle stored procedure. I have a procedure that return data as i expected it to be returned in an sqlplus client: SQL> SELECT hss_radcheck_func('khoa@mana','bas3_SE') FROM DUAL; HSS_RADCHECK_FUNC('K -------------------- CURSOR STATEMENT : 1 CURSOR STATEMENT : 1 ID USERNAME ATTRIBUTES VALUE OP ---------- -------------------------------- ------------------ -------------------------------- -- 1 khoa@mana Cleartest-Password mudafuka == 2 khoa@mana Simultaneous_Use 1 := Unfortunatly, when freeradius calls the procedure, it gives me an error saying: rlm_sql_oracle: fetch failed in sql_fetch_row: ORA-00932: inconsistent datatypes: expected CHAR got DTYCWD What is weird is that we force the procedure to return data as CHAR (except for ID which is a NUMBER): here is the nd of the procedure... OPEN resultSet FOR SELECT to_number('1') as ID, to_char(name) as username, to_char('Cleartest-Password') as attributes, to_char(password) as value, to_char('==') as operator FROM dual union SELECT to_number('2') as ID, to_char(name) as username, to_char('Simultaneous_Use') as attributes, to_char(loginlimit) as value, to_char(':=') as operator FROM dual return resultSet; I know this is very Oracle related but I am totally stuck now wth this problem, and so trying to find help, where i can... Someone who already setup oracle auth may help.... thx

2 1

/etc/shadow
by Norman Zhang 20 Nov '08

20 Nov '08

My current radius installation permits radius daemon read-only access to /etc/shadow. But this introduces security risks. -rw-r--r-- 1 root root 6514 Nov 18 16:52 /etc/shadow I have been told to consider MySQL back-end. Is there a way to pull the existing local users/passwords in MySQL? Or I have recreate every user plus password in MySQL? Norman

2 3

How possible is this???
by Martin MacLeod-Brown 20 Nov '08

20 Nov '08

After playing around with Freeradius and LDAP integration we have decided to try and simplify things to avoid the 'big bang approach' as we are not confident enough to go the whole way. My current thinking for our wired network is to add the MAC-addresses of all our desktop machines (2500 PC/laptops) into LDAP with the MAC-address being both the user name and password. We would then try FreeRadius and MAC-Authentication - how feasible is this and are there any gotcha's? I am going to start googling the best way to this, although most of the links seem to relate to wireless rather than wired setups. Can someone help by typing a simple list of the steps I need to follow so I can google and hopefully work out how to do this? Im thinking Import the Mac addresses into LDAP List the IP of all our edge switches in clients.conf Configure the shared secret Configure radiusd.conf to talk to the LDAP server - partially done Set up switches to query the radius server Are there any good how-to's on radius and mac-auth? We are looking to keep things as simple as possible so we can get used to using radius, before thinking about deploying 802.1x and I am desperate to avoid having to use IAS Many thanks Martin Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Direct line +44 (0)20 7000 7772 | Email mmacleod(a)london.edu www.london.edu ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

Setting VLAN based on Certificate Issuer
by Edgar Fuß 20 Nov '08

20 Nov '08

I thought this was a FAQ but apparently it isn't. I have an 1.1.7 FreeRADIUS server up and running with EAP/TLS. Now, I would like to put clients into different VLANs based on who signed their certificate. Is there a way to set the Tunnel-Private-Group-Id attribute based on the certificate issuer? Is the Rlm_eap module able to export any information on the certificate chain? Switching to 2.1.1 wouldn't be a problem for me I suppose. Thanks for any help.

2 1

Problems in TLS
by Martin Silvero 20 Nov '08

20 Nov '08

Good day. After testing several options, I got this error: Does anyone have any suggestions? thank you very much. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=1, length=136 User-Name = "user" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xd3be97c3a6d121a5d734f193b7bf3870 EAP-Message = 0x020100090163657274 NAS-Port-Type = Wireless-802.11 NAS-Port = 257 NAS-IP-Address = 10.8.31.40 NAS-Identifier = "ap-p" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.0.31.40 port 1645 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6fe46b926fe66623314da1f26c728696 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 1 with timestamp +152067 Ready to process requests.

2 1

Problem in setting up radius database in sql
by Saeed Akhtar 20 Nov '08

20 Nov '08

Hi all, I want to setup radius database in mysql.... I browse through wiki and found an artical "SQL How to" http://wiki.freeradius.org/SQL_HOWTO .... I went through step by step and when in the last i tried to run radiusd ... I ended up with following error: Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "123" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[14]: Instantiation failed for module "sql" /usr/local/etc/raddb/radiusd.conf[1847]: Failed to find module "sql". /usr/local/etc/raddb/radiusd.conf[1776]: Errors parsing authorize section. } } Errors initializing modules If somebody could help me i'll be very thankful. Regards, Saeed Akhtar

2 2

Re: Fail to disable the Simultanous-use, somebody help me.
by Alexandre Chapellon 20 Nov '08

20 Nov '08

I don't your problem have anything to deal with simultaneous-use checking... Indeed, when enabled Sim-Use would REJECT NEW users trying to connect to if the login used has reached the limit.... What you say is that new user (same login) disconnect existing session... This sounds more like something with netscreen for me...eg could be ip allocation pb if managed by netscreen or something like this... May be providing debug of query processing would be more usefull than just the startup.

3 2