- Freeradius-Users - lists.freeradius.org

oracle stored procédure
by Alexandre Chapellon 20 Nov '08

20 Nov '08

I'm still trying to setup freeradius authentication with oracle stored procedure. I have a procedure that return data as i expected it to be returned in an sqlplus client: SQL> SELECT hss_radcheck_func('khoa@mana','bas3_SE') FROM DUAL; HSS_RADCHECK_FUNC('K -------------------- CURSOR STATEMENT : 1 CURSOR STATEMENT : 1 ID USERNAME ATTRIBUTES VALUE OP ---------- -------------------------------- ------------------ -------------------------------- -- 1 khoa@mana Cleartest-Password mudafuka == 2 khoa@mana Simultaneous_Use 1 := Unfortunatly, when freeradius calls the procedure, it gives me an error saying: rlm_sql_oracle: fetch failed in sql_fetch_row: ORA-00932: inconsistent datatypes: expected CHAR got DTYCWD What is weird is that we force the procedure to return data as CHAR (except for ID which is a NUMBER): here is the nd of the procedure... OPEN resultSet FOR SELECT to_number('1') as ID, to_char(name) as username, to_char('Cleartest-Password') as attributes, to_char(password) as value, to_char('==') as operator FROM dual union SELECT to_number('2') as ID, to_char(name) as username, to_char('Simultaneous_Use') as attributes, to_char(loginlimit) as value, to_char(':=') as operator FROM dual return resultSet; I know this is very Oracle related but I am totally stuck now wth this problem, and so trying to find help, where i can... Someone who already setup oracle auth may help.... thx

2 1

/etc/shadow
by Norman Zhang 20 Nov '08

20 Nov '08

My current radius installation permits radius daemon read-only access to /etc/shadow. But this introduces security risks. -rw-r--r-- 1 root root 6514 Nov 18 16:52 /etc/shadow I have been told to consider MySQL back-end. Is there a way to pull the existing local users/passwords in MySQL? Or I have recreate every user plus password in MySQL? Norman

2 3

How possible is this???
by Martin MacLeod-Brown 20 Nov '08

20 Nov '08

After playing around with Freeradius and LDAP integration we have decided to try and simplify things to avoid the 'big bang approach' as we are not confident enough to go the whole way. My current thinking for our wired network is to add the MAC-addresses of all our desktop machines (2500 PC/laptops) into LDAP with the MAC-address being both the user name and password. We would then try FreeRadius and MAC-Authentication - how feasible is this and are there any gotcha's? I am going to start googling the best way to this, although most of the links seem to relate to wireless rather than wired setups. Can someone help by typing a simple list of the steps I need to follow so I can google and hopefully work out how to do this? Im thinking Import the Mac addresses into LDAP List the IP of all our edge switches in clients.conf Configure the shared secret Configure radiusd.conf to talk to the LDAP server - partially done Set up switches to query the radius server Are there any good how-to's on radius and mac-auth? We are looking to keep things as simple as possible so we can get used to using radius, before thinking about deploying 802.1x and I am desperate to avoid having to use IAS Many thanks Martin Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Direct line +44 (0)20 7000 7772 | Email mmacleod(a)london.edu www.london.edu ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

Setting VLAN based on Certificate Issuer
by Edgar Fuß 20 Nov '08

20 Nov '08

I thought this was a FAQ but apparently it isn't. I have an 1.1.7 FreeRADIUS server up and running with EAP/TLS. Now, I would like to put clients into different VLANs based on who signed their certificate. Is there a way to set the Tunnel-Private-Group-Id attribute based on the certificate issuer? Is the Rlm_eap module able to export any information on the certificate chain? Switching to 2.1.1 wouldn't be a problem for me I suppose. Thanks for any help.

2 1

Problems in TLS
by Martin Silvero 20 Nov '08

20 Nov '08

Good day. After testing several options, I got this error: Does anyone have any suggestions? thank you very much. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=1, length=136 User-Name = "user" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xd3be97c3a6d121a5d734f193b7bf3870 EAP-Message = 0x020100090163657274 NAS-Port-Type = Wireless-802.11 NAS-Port = 257 NAS-IP-Address = 10.8.31.40 NAS-Identifier = "ap-p" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.0.31.40 port 1645 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6fe46b926fe66623314da1f26c728696 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 1 with timestamp +152067 Ready to process requests.

2 1

Problem in setting up radius database in sql
by Saeed Akhtar 20 Nov '08

20 Nov '08

Hi all, I want to setup radius database in mysql.... I browse through wiki and found an artical "SQL How to" http://wiki.freeradius.org/SQL_HOWTO .... I went through step by step and when in the last i tried to run radiusd ... I ended up with following error: Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "123" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[14]: Instantiation failed for module "sql" /usr/local/etc/raddb/radiusd.conf[1847]: Failed to find module "sql". /usr/local/etc/raddb/radiusd.conf[1776]: Errors parsing authorize section. } } Errors initializing modules If somebody could help me i'll be very thankful. Regards, Saeed Akhtar

2 2

Re: Fail to disable the Simultanous-use, somebody help me.
by Alexandre Chapellon 20 Nov '08

20 Nov '08

I don't your problem have anything to deal with simultaneous-use checking... Indeed, when enabled Sim-Use would REJECT NEW users trying to connect to if the login used has reached the limit.... What you say is that new user (same login) disconnect existing session... This sounds more like something with netscreen for me...eg could be ip allocation pb if managed by netscreen or something like this... May be providing debug of query processing would be more usefull than just the startup.

3 2

PEAP-EAP-MD5 failure with freeradius-2.1.1
by Prasad Parab 20 Nov '08

20 Nov '08

Dear All, Kndly help with the following setup: SETUP; wifi client (Windows-XPservice pack 2) <-----------------> AP <-----------------------> freeradius-2.1.1 on red hat fedora-9 auth type:PEAP-EAP-MD5 wpa-enterprise (external Radius Server) user: client password :test123 I trying to use WPA-Enterprise using PEAP,EAP-MD5 as authentication type and freeradius-2.1.1 as external radius server. It fails to authenticate. Attached are the log files and wireshark captures from the freeradius-2.1.1. Regards Prasad

3 8

Fwd: Re:Re: Fail to disable the Simultanous-use, somebody help me.
by Alexandre Chapellon 20 Nov '08

20 Nov '08

It seems like your NAS sends accounting Stop for the previous session (nas-port is different) after receiving the response of of the accounting Start (for the new session)... this would show your NAS ask the radius to notice a disconnection hit has decided... I don't know how netscreen works, but neither Access-Accept nor Accouting request have any Framed-IP-Address or anything ppp related... looks strange to me. This can mean that whereas established the vpn connection doesn't work (you can easily test this) or netscreen is managing ip allocation by its ow, and so you should take a look at its config to see if it's able to offer different IP addresses for one login at the same time (If it tries to give every body the same address, no doubt it won't work unless it disconnects the previous session)... Or you can ask freeradius to handle ip allocation, depending on your config

1 0

free RADIUS client + CHAP + PAM
by Vinay 20 Nov '08

20 Nov '08

Hi there There are a lot of places on the net which talk about how PAM cannot work with CHAP on the RADIUS server. Will an implementation of freeRADIUS client with CHAP and PAM(pam_radius_auth) module work? Please point me to the appropriate link. Thanks -Vinay

1 0