- Freeradius-Users - lists.freeradius.org

radius dies after HUP
by Lisa Besko 01 Oct '08

01 Oct '08

I have an issue were Freeradius 1.1.7 dies after doing a kill -HUP on FreeBSD 7.1. I saw that there was an issue with this in version 1.1.6 but I did not see that it had been resolved. Anyone have a fix or a work around? Thanks, LB

2 2

Please Remove
by Tyler Willson 30 Sep '08

30 Sep '08

Thanks! -----Original Message----- From: freeradius-users-bounces+tweetywill=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tweetywill=gmail.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Tuesday, September 30, 2008 2:31 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 41, Issue 141 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: freeradius compiled version (lastest) against active directory authentication (Alan DeKok) 2. Re: freeradius compiled version (lastest) against active directoryauthentication (tnt(a)kalik.net) 3. Missing field in accounting (Arrigo Savio) 4. R: R: Logging level (Arrigo Savio) 5. Re: R: R: Logging level (Alan DeKok) 6. Re: Missing field in accounting (Alan DeKok) 7. Re: problem with ip_pools (Marco C. Coelho) 8. Re: Where do I add the config stuff to route requests based on attributes in a request? (Arran Cudbard-Bell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Sep 2008 17:31:51 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: freeradius compiled version (lastest) against active directory authentication To: luis.azunet(a)yahoo.es, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E24667.7020006(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 luis a wrote: > i all ready read it and he does not work Nonsense. If you follow the instructions, it works. > check it out the output You've edited the configuration files, and broken them. Don't do that. Start off with the default configuration files. THEN follow the instructions. > that warning apered after i added the line to the user config file > DEFAULT Auth-Type = Local, Password == "stealme" The instructions on my web site DON'T say to do that. So you're not following the instructions. > and also when i remplace > DEFAULT Auth-Type = System Can you explain why you're making nearly random changes to the configuration files rather than following the instructions on the web site? Alan DeKok. ------------------------------ Message: 2 Date: Tue, 30 Sep 2008 16:47:30 +0100 From: <tnt(a)kalik.net> Subject: Re: freeradius compiled version (lastest) against active directoryauthentication To: freeradius-users(a)lists.freeradius.org Message-ID: <w7MzM4fw.1222789650.5079860.tnt(a)kalik.net> Content-Type: text/plain; charset=ISO-8859-2 > Have you tried my web site (deployingradius.com) ? It has a >"howto" >for configuring authentication against Active Directory. > >i all ready read it and he does not work > > >check it out the output > >------------------------------------ > > >Listening on authentication address * port 1812 Listening on accounting >address * port 1813 Listening on proxy address * port 1814 Ready to >process requests. >rad_recv: Access-Request packet from host 127.0.0.1 port 49964, id=37, length=72 > User-Name = "luis" > User-Password = "x" > NAS-IP-Address = xx.xx.xx.x > NAS-Port = 0 This is a pap request. ntlm_auth is configured in mschap. Send an mschap request. Or configure ldap "bind as user" if you are going to have pap requests. > > > >------------------- >and also when i remplace >DEFAULT Auth-Type = System > >i get this message . > .. >Found Auth-Type = System >+- entering group authenticate {...} >[unix] invalid password "luis" >++[unix] returns reject >Failed to authenticate the user. That is OK. user "luis" was found but password was wrong. But it looks like (I still can't figure out what is it that you want to do) you don't actually want to authenticate against local users but AD. So what do you want to do: - authenticate against AD? - or against users of the local system? - or both? What type of requests are you going to recieve: - pap? - mschap (PEAP)? - both? Ivan Kalik Kalik Informatika ISP Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Tue, 30 Sep 2008 18:04:42 +0200 From: "Arrigo Savio" <a.savio(a)bascom.it> Subject: Missing field in accounting To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <F978D341FFB841D7837CAA87CFA6F62B(a)bascom.local> Content-Type: text/plain; charset="us-ascii" Hi everybody. I'm trying to complete the setup of freeradius 2.1.1. I have the following problem: When the data flow passes from authentication to accounting, I miss the stripping of the username/realm. I mean: in first authentication step, I have correctly splitted the username (test) from the realm (realm.com) and infact the "INSERT INTO radpostauth" is correctly populated. The next query, that should write into accounting table, doesn't find %{Stripped-User-Name} and %{Realm} values, so that it put empty fields in the table. All other fields are correct. BTW, if I put in dialer.conf accounting query the field %{SQL-User-Name}, I find the field populated with the whole username (test(a)realm.com, in the example below). Can you help me, please? Arrigo [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' . ++[sql] returns ok Login OK: [prova(a)realm.com/realm] (from client C831 Test port 92) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] expand: %t -> Tue Sep 30 17:53:01 2008 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' [sql] expand: %{User-Password} -> realm [sql] expand: INSERT INTO radpostauth (username, realm, pass, reply, authdate) VALUES ( '%{Stripped-User-Name}', '%{Realm}', '%{%{User- ... ++[sql] returns ok +- entering group preacct {...} [acct_unique] Hashing 'NAS-Port = 92,Client-IP-Address = 10.0.1.224,NAS-IP-Address = 10.0.1.224,Acct-Session-Id = "000000D8",User-Name = "prova(a)realm.com"' [acct_unique] Acct-Unique-Session-ID = "1bdfdc3b2335277d". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] expand: %t -> Tue Sep 30 17:53:01 2008 ++[detail] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Stripped-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok Arrigo ------------------------------ Message: 4 Date: Tue, 30 Sep 2008 18:07:32 +0200 From: "Arrigo Savio" <a.savio(a)bascom.it> Subject: R: R: Logging level To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <72251FE17275403EAF292FA4A42F8AAC(a)bascom.local> Content-Type: text/plain; charset="iso-8859-1" I read all comments, and tried to give some permission on the files, but I still receive the error pasted... I read in docs that: # If not set, then ANYONE can connect to the control socket, # and have complete control over the server. This is likely # not what you want. I tried to comment out the parameters, but it doesn't work anyway. Arrigo. -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it(a)lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di Alan DeKok Inviato: marted? 30 settembre 2008 8.43 A: FreeRadius users mailing list Oggetto: Re: R: Logging level Arrigo Savio wrote: > radmin> set > ERROR: You do not have write permission. > > Where can I specify this permission? Read the example configuration file in raddb/sites-available/control-socket. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 5 Date: Tue, 30 Sep 2008 18:15:39 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: R: R: Logging level To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E250AB.607(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Arrigo Savio wrote: > I read all comments, and tried to give some permission on the files, > but I still receive the error pasted... > I read in docs that: > # If not set, then ANYONE can connect to the control socket, > # and have complete control over the server. This is likely > # not what you want. > I tried to comment out the parameters, but it doesn't work anyway. Did you see the "access_mode" parameter? Are you sure you're using 2.1.1? Are you sure you're looking at the configuration files that are included in 2.1.1? Alan DeKok. ------------------------------ Message: 6 Date: Tue, 30 Sep 2008 18:18:12 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Missing field in accounting To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E25144.2000209(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Arrigo Savio wrote: > Hi everybody. I'm trying to complete the setup of freeradius 2.1.1. > I have the following problem: > When the data flow passes from authentication to accounting, I miss > the stripping of the username/realm. You need to copy the *same* User-Name re-writing rules from the "authorize" section into the "preacct" section. I mean: in first authentication step, I > have correctly splitted the username (test) from the realm (realm.com) > and infact the "INSERT INTO radpostauth" is correctly populated. > The next query, There is no "next query". There is another packet, which is an *accounting* packet, and not an *authentication* packet. Alan DeKok. ------------------------------ Message: 7 Date: Tue, 30 Sep 2008 12:35:11 -0500 From: "Marco C. Coelho" <maillist1(a)argontech.net> Subject: Re: problem with ip_pools To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48E2634F.7010602(a)argontech.net> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Please See Below: Alan DeKok wrote: > Marco C. Coelho wrote: > >> I ran out of IP space in my original IP_Pool, and since the next >> available addresses were non contiguous, I added a second pool. >> Here's the snippet of my radiusd.conf: >> > > Did you add "main_pool2" to the "post-auth" && accounting sections > where "main_pool" was referenced? > No. After I added it and corrected the operand to := it now issues the new addresses. Thanks! > Did you put "main_pool" and "main_pool" into a fail-over section, as > documented in "man unlang" ? > No, and I must be blind, because I have read the section and cannot find mention of it. > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

1 0

Where do I add the config stuff to route requests based on attributes in a request?
by Peter Eriksson 30 Sep '08

30 Sep '08

Setup: WLAN Access Points providing multiple SSIDs for access to different VLANs. They talk to RADIUS server that should forward the requests to different other RADIUS servers based on which WLAN the clients are connecting to. SSID 'eduroam' should forward requests to the EDUROAM RADIUS server. SSID 'IFM' should forward requests to our internal RADIUS server. I'd see that in the incoming RADIUS request from the access points there is a Called-Station-Id that I'd like to use for this purpose. Now the question is - what do I write and in which config files to use this? The attribute typically looks like this: Called-Station-Id = "00-17-9A-D3-9A-BA:IFM" or Called-Station-Id = "00-17-9A-D1-67-CE:eduroam" (Access Points ethernet address, colon, and then the SSID). - Peter

4 3

Missing field in accounting
by Arrigo Savio 30 Sep '08

30 Sep '08

Hi everybody. I'm trying to complete the setup of freeradius 2.1.1. I have the following problem: When the data flow passes from authentication to accounting, I miss the stripping of the username/realm. I mean: in first authentication step, I have correctly splitted the username (test) from the realm (realm.com) and infact the "INSERT INTO radpostauth" is correctly populated. The next query, that should write into accounting table, doesn't find %{Stripped-User-Name} and %{Realm} values, so that it put empty fields in the table. All other fields are correct. BTW, if I put in dialer.conf accounting query the field %{SQL-User-Name}, I find the field populated with the whole username (test(a)realm.com, in the example below). Can you help me, please? Arrigo [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' . ++[sql] returns ok Login OK: [prova(a)realm.com/realm] (from client C831 Test port 92) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] expand: %t -> Tue Sep 30 17:53:01 2008 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' [sql] expand: %{User-Password} -> realm [sql] expand: INSERT INTO radpostauth (username, realm, pass, reply, authdate) VALUES ( '%{Stripped-User-Name}', '%{Realm}', '%{%{User- ... ++[sql] returns ok +- entering group preacct {...} [acct_unique] Hashing 'NAS-Port = 92,Client-IP-Address = 10.0.1.224,NAS-IP-Address = 10.0.1.224,Acct-Session-Id = "000000D8",User-Name = "prova(a)realm.com"' [acct_unique] Acct-Unique-Session-ID = "1bdfdc3b2335277d". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] expand: %t -> Tue Sep 30 17:53:01 2008 ++[detail] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Stripped-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok Arrigo

2 1

EAP-TTLS-PAP using LDAP for authorization and PAM for authentication
by Erik Karlsson 30 Sep '08

30 Sep '08

Hello! I am trying to set up a simple Wlan-authentication using EAP-TTLS to avoid client certificates and PAM to use the server system authentication scheme. PAM doesn't know about users, and the users are situated in a LDAP database, which I think makes it logical to use rlm_ldap for authorization. I.e. I just want to check that users exist in LDAP and then move on to checking the password against PAM. The problem is that PAM is never used. This seems to be an artifact of the fact that rlm_ldap is supposed to fetch a "known good" password, but I don't have passwords in the LDAP database. rlm_ldap is indeed successful in authorizing, but there is no Auth-Type set to handle the authentication. If I for example force Auth-Type to PAM in the users file (not good, I know), TTLS-negotiation is never run. If I add Auth-Type LDAP { pam } to the authenticate section and let rlm_ldap set Auth-Type, it works with radtest, but fails using TTLS: pam_pass: function pam_acct_mgmt FAILED for <USERNAME>. Reason: Authentication service cannot retrieve authentication info My configuration is: FreeRADIUS 2.0.5 sites-enabled/default: authorize { preprocess auth_log eap { ok = return } files ldap pap } authenticate { Auth-Type PAP { pap } pam eap } Regards, Erik Karlsson.

4 11

Proxying EAP-TTLS requests via 2.1.0 to 1.1.7
by Peter Eriksson 30 Sep '08

30 Sep '08

Sorry about this long first mail, but I figured I'd try to include as much information as possible. right away.. I'm trying to set up a rather complicated RADIUS structure that I hope will be able to support a number of different needs. Anyway, some bit of background information. Things I need to support: EDUROAM for my roaming users at other sites around Europe. EDUROAM for roaming users at my site via WLAN access points (SSID "EDUROAM"). Normal 802.1x for our local users via WLAN (another SSID) Normal 802.1x-enabled ethernet ports on switches. Modem pool access (Ascend MAX4000 - olde faithful still going strong :-) for out users and two neighboring departments (separate user databases) VPN gateway access (Nortel Contivity and OpenVPN) for out users and one other neighboring department. + More stuff (web services)... "Access" Hardware/Software: D-Link DWL-3200AP and DWL-8200AP WLAN access points HP ProCurve ethernet switches Ascend MAX4000 modem pool Nortel Contivity IPSEC VPN gateway OpenVPN server Anyway, I have set up our access points to successfully do EAP-TTLS authentication via RADIUS to a FreeRadius 1.1.7 server since this spring. (The VPN and modem pool is handled by another very old RADIUS server for the moment but I'm planning on moving those to the new FreeRadius structure when things are working smoothly). But now in our quest for implementing EDUROAM I starting looking at using FreeRadius 2.1 and do some intelligent proxying based on various criterias which gets complicated pretty quickly... :-) 1) Users connecting to the WLAN SSID "EDUROAM" should be handled as EDUROAM authentication requests and routed thru those RADIUS servers, and if successful should end up on our "EDUROAM" VLAN. 2) Users connecting to our "PERSONAL" WLAN SSID should be handled as local users only and if successfully authenticated should end up on our "TWILIGHT ZONE" VLAN. It seems I should be able to distinguish at the RADIUS server side between #1 and #2 via the "Called-Station-Id" attribute since the D-Link AP's we are using sets that to something like: Called-Station-Id = "00-17-9A-D3-9A-BA:EDUROAM" (where the last part is the WLAN SSID). 3) Users connecting to the 802.1x enabled physical ethernet ports should if authenticating as USER(a)ifm.liu.se be handled like #2 above, else be handled like #1 above, and if completely unsuccessful should be conencted to a third special VLAN. (This should be doable via the a RADIUS attribute telling the switch which VLAN to switch a successfully authenticated user's port to). 4) Modem pool users should accept request from three different realms USER(a)ifm.liu.se USER(a)dept2.liu.se USER(a)dept3.liu.se Route those to the correct RADIUS server responsible for authenticating those users, and in the response set the Ascend-special attributes to 'give' the user the right IP# from the departments special IP pools 5) VPN pool users should do something similar to #4 but using the Nortel-specific attributes. (We do #4 and #5 already today with the stoneage RADIUS server, sans the RADIUS-proxying stuff I want to do). Anyway - what I'm curious about is if there are others 'out there' that have done similar stuff before? Any cookbooks for setting up a FreeRadius 2 server in an EDUROAM environment? Anyone with experience talking to D-Link DWL-3200AP or 8200AP with EAP-TTLs and FreeRadius 2? I ran into a problem directly - for some unknown reason when I redirect my APs to talk to a proxying-only FreeRadius 2.1.0 server that forwards requests to our old FreeRadius 1.1.7 server the access points doesn't seem to correctly understand or mishandles (sort of - it looks like things are going OK, but the Window and MacOS X clients just goes into a loop with reretrying the authentication sequence and never finishing) the 'Access-Accept' sent to them after having successfully authenticated the user... And I'm at a loss as to why. I tried running the radiusd servers with -X to see what the difference in the responses are and I can't really see any big differences: FreeRadius 1.1.7 directly to the Access Point: First request: rad_recv: Access-Request packet from host 192.168.160.158:1115, id=0, length=181 Message-Authenticator = 0x377dba909d00b36f5edacd2d732b8cc6 Service-Type = Framed-User User-Name = "testson" Framed-MTU = 1488 Called-Station-Id = "00-17-9A-D3-9A-BA:EDUROAM" Calling-Station-Id = "00-30-65-18-72-61" NAS-Identifier = "ap13434" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000c0174657374736f6e NAS-IP-Address = 192.168.160.158 NAS-Port = 2 NAS-Port-Id = "STA port # 2" Last response: Sending Access-Accept of id 6 to 192.168.160.158 port 1096 MS-MPPE-Recv-Key = 0xd95114ac0ba4ea2f18815d9d713bcc09730dce74705a24e87c1b3ff1e59bb391 MS-MPPE-Send-Key = 0x59bdb8c81b2d31916a50dbd43079f019616468618cd956c2bb8db99b29436b22 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testson" Finished request 6 FreeRadius 2.1.0 directly to the Access Point (with a response received via Proxying to the same 1.1.7 server): First request: rad_recv: Access-Request packet from host 192.168.160.158 port 1036, id=0, length=181 Message-Authenticator = 0x54e5c5b797c55e4cf49655edfa140e05 Service-Type = Framed-User User-Name = "testson\000" Framed-MTU = 1488 Called-Station-Id = "00-17-9A-D3-9A-BA:EDUROAM" Calling-Station-Id = "00-30-65-18-72-61" NAS-Identifier = "ap13434" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000c0174657374736f6e NAS-IP-Address = 192.168.160.158 NAS-Port = 2 NAS-Port-Id = "STA port # 2" Last response: Sending Access-Accept of id 6 to 192.168.160.158 port 1036 Vendor-Specific = 0x0000013711348565439b6986f71bfa7425319eac8dd791f24936bc66a8cdd928a91c9c4343958ef040212 4dd4f552726302e356b878e6474 Vendor-Specific = 0x0000013710348b855687f3a4ef1194289232229fe0be952c98689fb606c1e9d6ceae6a388baee98eeb292 be2d41ae58efa7f67737dec758c EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testson" Finished request 6. (I assume that 'Vendor-Specific' stuff is the MS-MPPE-Recv-Key stuff that the 1.1.7 talks about). Any suggestions? - Peter

2 8

RLM-EAP-MD5 compilation problem
by Andre Dieball 30 Sep '08

30 Sep '08

Hi there I¹m trying to build a rpm for my CentOS 5.2 system. Everything worked fine the first time, but I need to do it again, as I need to include some special rlm-eap-md5 src files in order to make my freeradius to work with Kobil SecOvid (something similar to RSA SecureID). When I start to comile the rpm, it stops with the following: ---cut--- Making all in rlm_eap_md5... gmake[9]: Entering directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes/rlm_eap_md5' /usr/bin/libtool --mode=compile gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/libltdl -I../.. -I../../libeap -c rlm_eap_md5.c mkdir .libs gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/libltdl -I../.. -I../../libeap -c rlm_eap_md5.c -fPIC -DPIC -o .libs/rlm_eap_md5.o `-mcpu=' is deprecated. Use `-mtune=' or '-march=' instead. rlm_eap_md5.c:24:22: error: autoconf.h: No such file or directory rlm_eap_md5.c:31:24: error: rad_assert.h: No such file or directory rlm_eap_md5.c: In function 'md5_initiate': rlm_eap_md5.c:73: warning: implicit declaration of function 'lrad_rand' gmake[9]: *** [rlm_eap_md5.lo] Error 1 gmake[9]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes/rlm_eap_md5' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.22909 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.22909 (%build) ---cut--- As I'm a total newbie of both systems, I'd like to ask some questions: 1. can anyone see what the real problem is? Are the src files (the replacements) using something which is not available in freeradius 2.x anymore? They say they have tested with 1.x. (I'm currently trying to get information on their support of 2.x) Thanks a lot in advance Andre

3 6

Reject from SQL when user is in users file
by Karl Auer 29 Sep '08

29 Sep '08

Anyway, this is the first of three *actual* questions. I have just set up freeradius 2.1.1. I have an entry in the users file, and when I use radtest, I get the expected correct answers back from the radius server. Then I added "sql" to the default authorize, accounting and post-auth sections in site-enabled/default. The database exists, but not the tables. The server makes connections to the database just fine, but obviously all queries fail :-) Now I get Accept-Reject for the same user. The users file is the same. No changes have been made to the configuration except adding the SQL stuff. If *just* the "sql" lines in the authorize section and the post-auth section are commented out, it goes back to working. My question is: Is this to be expected? Does a failure in SQL somehow override the entry in the users file? Or is this an indication that I've screwed something else up? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 4

Accounting table in MS-CHAP session
by Arrigo Savio 29 Sep '08

29 Sep '08

Hi. I'm trying to configuring accounting in MS-Chap session. I can see in logs (attached) that accounting is written in /var/log/radius/radacct directory, but not in radacct table, as PAP, CHAP and other types of authentication. Can you explain me where I have to setup it? Arrigo Here are the logs: +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [sql] expand: %{User-Name} -> wifi [sql] sql_set_user escaped user --> 'wifi' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wifi' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wifi' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'wifi' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "wifi", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for wifi with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok Login OK: [wifi/<via Auth-Type = mschap>] (from client WLController port 1535 cli 00-16-EA-87-5D-46) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.0.4.223/reply-detail-20080929 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.4.223/reply-detail-20080929 [reply_log] expand: %t -> Mon Sep 29 17:54:34 2008 ++[reply_log] returns ok [sql] expand: %{User-Name} -> wifi [sql] sql_set_user escaped user --> 'wifi' [sql] expand: %{User-Password} -> [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wifi', '', 'Access-Accept', '2008-09-29 17:54:34') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wifi', '', 'Access-Accept', '2008-09-29 17:54:34') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok Finished request 18.

2 1

2.1.1 - radiusd.sock - permission denied
by John Horne 29 Sep '08

29 Sep '08

Hi, I have installed FR2.1.1 onto a test server, built using the Fedora rawhide RPM source. No problems building and installing FR, but when I start FR it seems to immediately stop. The radius.log file just shows: Fri Sep 26 17:20:58 2008 : Error: Failed to stat /var/run/radiusd/radiusd.sock: Permission denied The ls command shows: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 Sep 26 16:53 /var/run/radiusd/radiusd.sock I have tried disabling selinux, and iptables, but they made no difference. Changing the permissions to 666 on the socket made no difference. Running 'radiusd -C' shows nothing, and 'radiusd -X' starts up okay. If I then use a different terminal I can run 'radmin' with no problem (which I gather uses the socket). The problem is, I can't see what permissions may be wrong. Anyone any ideas on this? John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 587001

3 5