- Freeradius-Users - lists.freeradius.org

freeradius- update radacct
by Oguzhan Kayhan 28 Oct '08

28 Oct '08

Hello, I have freeradius virtual configurations. Until today all were working without a problem. But today i created a new one and i have a tiny problem about it. It doesnt update sql queries until the user logs off. SO i can not track the statistics of online users and transferred data etc via mysql. But as i see freeradius gets the following packets below in normal intervals And if it was an error about sql.conf i think it wont write the data when user disconnected too.It just does not update the online users data..and i wonder why..Seems like it does not create user data at the begining so it can not update the data too. ----------------------------------------------------------------- expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('4906e32a00000001', '83f3f3b94fce6dc1', '7798-1', '', '192.168.182.1', '1', 'Wireless-802.11', DATE_SUB('2008-10-28 13:01:21', INTERVAL (3401 + 0) SECOND), '3401', '', '', '0' << 32 | '34293752', '0' << 32 | '1270253', '00-0E-0C-6E-6E-7C', '00-14-22-A1-BB-AB', '', '', '192.168.182.2', '0', '') NAS-IP-Address = 192.168.182.1 -------------------------------------------------- This is the virtual config and sql.conf parameters i am using (which are same of the previous virtual servers actually) ------------------------- server lojnet { authorize { preprocess files update control { Auth-Type := perl } perl_lojnet } authenticate { Auth-Type Perl { perl_lojnet } } preacct { acct_unique files } accounting { detail unix sql_lojnet } session { sql_lojnet } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } ----------------------------------- and the sql part belongs to this virtual server -------------------------------------- sql sql_lojnet { database = "mysql" driver = "rlm_sql_${database}" # Connection info: server = "xxxxxxxxx" login = "xxxxxxxxx" password = "xxxxxxxxxx" # Database table configuration for everything except Oracle radius_db = "lojnet" acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "usergroup" # If set to 'yes' (default) we read the group tables # If set to 'no' the user MUST have Fall-Through = Yes in the radreply table # read_groups = yes # Remove stale session if checkrad does not see a double login deletestalesessions = yes # Print all SQL statements when in debug mode (-x) sqltrace = no sqltracefile = ${logdir}/sqltrace.sql # number of sql connections to make to server num_sql_socks = 5 # number of seconds to dely retrying on a failed database # connection (per_socket) # number of seconds to dely retrying on a failed database # connection (per_socket) connect_failure_retry_delay = 60 #readclients = yes # Table to keep radius client info nas_table = "nas" # Read driver-specific configuration $INCLUDE sql/${database}/dialup.conf }

2 4

rlm_unix cannot find users (2.1.0)
by Martin Pauly 28 Oct '08

28 Oct '08

Hi all, I am trying to upgrade from an ancient 1.0.5 to 2.1.0, and ran into trouble where I least expected it. Underneath is Debian Lenny system run as Linux vserver. I have a large set of users handled by LDAP, and a small group (admins with only a few logins) that I used to handle by setting up a bunch of local unix accounts and doing Auth-Type := System. So my users file looks like pauly Auth-Type := System, Calling-Station-Id =~ "our-special-id-prefix" Reply-Message = "Matched local user entry %{User-Name} in users file", [ more local accounts ...] DEFAULT Auth-Type := Reject, Calling-Station-Id =~ "our-special-id-prefix" Reply-Message = "Illegal username %{User-Name} for this type of request" DEFAULT User-Name = `%{User-Name}`, Reply-Message = "Matched DEFAULT user entry with User-Name %{User-Name}" In sites-available/default, I have 'unix' in both the authorize and authenticate section. The debug output upon a request reads: rad_recv: Access-Request packet from host 192.168.x.y port 1645, id=204, length=77 NAS-IP-Address = 192.168.x.y NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "pauly" Calling-Station-Id = "our-special-id" User-Password = "xxxxxx" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "pauly", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound expand: %{Calling-Station-Id} -> our-special-id [files] users: Matched entry pauly at line 17 expand: Matched local user entry %{User-Name} in users file -> Matched local user entry pauly in users file ++[files] returns ok [ the whole thing is sent to LDAP for authorization now which succeeds, but could perhaps be avoided anyway] ++- entering policy redundant {...} [ldap stuff ...] [ldap2] user pauly authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap2] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> pauly attr_filter: Matched entry DEFAULT at line 11 So to me it looks like rlm_unix can't find me :-( I've read about rlm_passwd, but I don't need any caching or the like. Oh, and user freerad is in group shadow. But as I understand it, this is no longer relevant for my case since rlm_unix uses getpwent which is supposed to handle access to /etc/shadow, right? Thanks for any hint Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 2

let radius distinguish more cases
by alois blasbichler 28 Oct '08

28 Oct '08

hello list I have a question to understanding better radius. For this i make a simple example-scenario : I want to use my radius for 2 things : 1. wireless-access for laptops with machine authentication over a wireless switch with ip 1.1.1.1 2. authentication for the login to my switches for some admin-users My machines (case 1) are in a samba-domain and saved in a openldap-DB in the tree : basedn = "ou=samba-machines,dc=sb-brixen,dc=it" My users (case 2), where i select my admins with a ldap-filter are also in an openldap-dB in the tree: basedn = "ou=users,dc=sb-brixen,dc=it" How and where i distinguish this 2 cases? In the standard configuration, what i have understood radius let try the clients a lot of possibilities and i have read its better to not restrict the auth-methods. A possibility to solve my question is to make 2 files under /modules like ldap1 and ldap2 for my separate cases - but now my problem : Where i say that my wireless switch gos to ldap1 (with mschap) and my switches (for example all the network 1.1.20.x) gos to ldap2 (with ldap-authentication) : in users, or maybe in raddb/sites-available/default In clients.conf i have defined my switches and my network. For the users-file i have seen som examples like : DEFAULT Huntgroup-Name = "vpn-pix",Auth-Type := ldap But where i define "Huntgroup-Name = "vpn-pix"" is this the normal name in the client.conf ? Thank you for a response luis

2 1

Insert billiplan code in radacct table during authenticaiton
by Bishal 27 Oct '08

27 Oct '08

Hi all, I am using freeradius for AAA of my cable users. Now what I want to do is, insert billiplan code 001 into radacct table during authentication so that I can view online users according to billingplan code. There will be Billingplan field in radcheck table and when users tries to login the script will check the radcheck table and update that billingplan code into radacct table. Is it possible with rlm_perl module? Thank you Bishal

4 8

EAP-MSK & WiMAX-MSK validity?
by Stefano Colagreco 27 Oct '08

27 Oct '08

Hi All, i use: - WiMAX-MSK = EAP-MSK and all it works correctly, and I suppose It's validity is only for the authentication session, it is right? - WiMAX-AAA-Session-Id: is set as a pseudo-random value. It's correct? It's value is related to the duration of the session? Thanks all in advance! Stefano

1 0

Help with sqlippool
by Madwifi 27 Oct '08

27 Oct '08

I need some help trying to configure sqlippool. I've followed the instruction from http://wiki.freeradius.org/Rlm_sqlippool and few other places. I did compile FR from source with the following configuration options: Options 1: ./configure --prefix=/usr/local/freeradius-server-2.1.1 --with-openssl --with-threads --with-vmps --with-modules=rlm_sqlippool Options 2: ./configure --prefix=/usr/local/freeradius-server-2.1.1 --with-openssl --with-threads --with-vmps --with-rlm_sqlippool Options 3: ./configure --prefix=/usr/local/freeradius-server-2.1.1 --with-openssl --with-threads --with-vmps --enable-rlm_sqlippool Each time my start access point running hostapd, FR crashes with the following message. Sun Oct 26 22:10:49 2008 : Info: ++[sradutmp] returns ok Sun Oct 26 22:10:49 2008 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Sun Oct 26 22:10:49 2008 : Info: [sqlippool] expand: %{User-Name} -> Sun Oct 26 22:10:49 2008 : Info: [sqlippool] sql_set_user escaped user --> '' Sun Oct 26 22:10:49 2008 : Info: [sqlippool] expand: START TRANSACTION -> START TRANSACTION radiusd: symbol lookup error: /usr/local/freeradius-server-2.1.1/lib/rlm_sqlippool-2.1.1.so: undefined symbol: rlm_sql_query Below are my configuration OS: Ubuntu (Kernel 2.6.24-21) FR: 2.1.1 radiusd.conf exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf $INCLUDE sqlippool.conf } instantiate { exec expr daily expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ sites-enabled/default authorize { preprocess chap mschap suffix eap { ok = return } unix #files sql daily expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix #files } accounting { detail daily unix radutmp sradutmp sqlippool sql sql_log attr_filter.accounting_response } session { radutmp } post-auth { sqlippool reply_log sql sql_log exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } ippool.conf allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ expiry_time IS NULL \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < NOW() \ ORDER BY (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ LIMIT 1 \ FOR UPDATE" pool-check = "SELECT id FROM ${ippool_table} \ WHERE pool_name='%{control:Pool-Name}' LIMIT 1" allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE framedipaddress = '%I'" start-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}'" stop-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time IS NULL \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" alive-update = "UPDATE ${ippool_table} \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" on-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time IS NULL \ WHERE nasipaddress = '%{Nas-IP-Address}'" off-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', \ expiry_time IS NULL \ WHERE nasipaddress = '%{Nas-IP-Address}'" sqlippool.conf sqlippool { sql-instance-name = "sql" ippool_table = "radippool" lease-duration = 3600 pool-key = "%{NAS-Port}" #pool-key = "%{Calling-Station-Id}" $INCLUDE sql/mysql/ippool.conf sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address}\ (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined \ (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } radippool table mysql> select * from radippool; +----+-----------+-----------------+--------------+---------------------------+------------------+-------------+----------+----------+-----------------+-------------+----------+----------+ | id | pool_name | framedipaddress | nasipaddress | calledstationid | callingstationid | expiry_time | username | pool_key | +----+-----------+-----------------+--------------+---------------------------+------------------+-------------+----------+----------+-----------------+-------------+----------+----------+ | 2 | main_pool | 10.5.5.29 | 192.168.2.31 | 06-07-6F-4A-C1-60:Tlink-g | | NULL | testuser | | | 3 | main_pool | 10.5.5.30 | 192.168.2.31 | 06-07-6F-4A-C1-60:Tlink-g | | NULL | testuser2 | | +----+-----------+-----------------+--------------+---------------------------+------------------+-------------+----------+----------+-----------------+-------------+----------+----------+ 2 rows in set (0.00 sec)

1 0

How long do dynamic clients stay cached?
by jasoneswan 26 Oct '08

26 Oct '08

How long do dynamic clients stay cached? And is this time configurable? -- View this message in context: http://www.nabble.com/How-long-do-dynamic-clients-stay-cached--tp20171312p2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

voip accounting
by Noel Rwamatsika 25 Oct '08

25 Oct '08

Hi there, I have setup a SuSE 11 server with freeradius and mysql. The freeradius and mysql are rpm packages from the SuSE 11 dvd. How can I setup voip accounting on this server? Which files should I configure in mysql and freeradius and how should i do it? regards, Noel

2 1

Tr : error when using radtest
by ELOM ETSE 24 Oct '08

24 Oct '08

Please i need your help for this error message i get when i want to use radtest utility. #radtest jerry cool 127.0.0.1:1812 0 testing123 Here are results i get: Sending Access-Request of id 197 to 192.168.1.30 port 1812 User-Name = "jery" User-Password = "cool" NAS-IP-Address = 127.0.1.1 NAS-Port = 43459 Sending Access-Request of id 197 to 192.168.1.30 port 1812 User-Name = "jery" User-Password = "cool" NAS-IP-Address = 127.0.1.1 NAS-Port = 43459 Sending Access-Request of id 197 to 192.168.1.30 port 1812 User-Name = "jery" User-Password = "cool" NAS-IP-Address = 127.0.1.1 NAS-Port = 43459 Sending Access-Request of id 197 to 192.168.1.30 port 1812 User-Name = "jery" User-Password = "cool" NAS-IP-Address = 127.0.1.1 NAS-Port = 43459 radclient: no response from server for ID 197 socket 3 Here is the result of the command radiusd -X: Starting - reading configuration files ... client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "EsCuJePaII" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "****" password = "*****" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.1.30 port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } Listening on authentication address 192.168.1.30 port 1812 Listening on accounting address * port 1813 Listening on proxy address 192.168.1.30 port 1814 Ready to process requests. I can get this message with radtest: Ignoring request to authentication address 192.168.1.30 port 1812 from unknown client 192.168.1.30 port 59982 Ready to process requests. Please help me ________________________________ ETSE Elom, Etudiant en fin de formation en informatique au CIC/UL-TOGO ________________________________

1 0

SMD5 format, for hash and salt?
by Julie Starr 24 Oct '08

24 Oct '08

I'm using FreeRADIUS v 2.1.1 on CentOS 5.2. I have everything working well, where I'm reading the user file for Cleartext and MD5 hashes. Here are two examples from my user file: bob Cleartext-Password := "testing123" carol MD5-Password := "f30aa7a662c728b7407c54ae6bfd27d1" (where carol's password is just hello123) However, it appears the data I have access to is actually stored as salted MD5 hashes. An example of an SMD5 hash that doesn't work in my user file: abe SMD5-Password := "37d0aa2d0d2b1f282eb2b393c9413998:rqZAS049NrEgN9bD" (where the above is :=salted MD5 hash:salt) I see the rlm_pap man page lists SMD5-Password as an attribute, but I'm at a loss as to the correct format for the MD5 hash and its associated salt. I've tried not just the colon above, but a semicolon, dash, period, a space, or tacked the salt to the beginning or to the end. I tried looking through the src, but couldn't figure it out. The output from radiusd -X and radtest for user abe is: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 55280, id=91, length=55 User-Name = "abe" User-Password = "hellojulie" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "abe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry abe at line 3 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "hellojulie" [pap] Using SMD5 encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> abe attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 91 to 127.0.0.1 port 55280 Waking up in 4.9 seconds. And if anyone is curious, I was told this is how these particular SMD5 entries I was given were generated: function mosMakePassword($length=8) { $salt = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; $makepass = ''; mt_srand(10000000*(double)microtime()); for ($i = 0; $i < $length; $i++) $makepass .= $salt[mt_rand(0,61)]; return $makepass; } list($hash, $salt) = explode(':', $row->password); $cryptpass = md5($passwd.$salt); if ($hash != $cryptpass) { if ( $bypost ) { mosErrorAlert(_LOGIN_INCORRECT); } else { $this->logout(); mosRedirect('index.php'); } exit(); } If anyone has any ideas or point out what I've completely misunderstood, please let me know. thanks, Julie

1 0