- Freeradius-Users - lists.freeradius.org

Whats the best CA to use?
by jasoneswan 18 Sep '08

18 Sep '08

Are there any CA out there that will automatically be trusted by almost any client we throw at it? our problem is that when logging in each client has to specifically say "I trust this CA" when doing PEAP -- View this message in context: http://www.nabble.com/Whats-the-best-CA-to-use--tp19543005p19543005.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

LDAP Group membership check not working after upgrade to Windows Server 2003
by kesm0724 18 Sep '08

18 Sep '08

Hello All, I had FreeRADIUS Version 2.0.5 working fine until I upgraded our domain this past weekend to Server 2003. When I try to authenticate to our configured devices this morning I see the following generic error in the debug: rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fails The odd part about it is that I still have our previous 2000 domain controllers in place but it appears LDAP group checking is not working. I have only dcpromo'd the new 2003 controllers and have not made them global catalogs. Would anyone have any idea why my group checking would no longer be working? With LDAP debug turned on....not much more informative: rlm_ldap: performing user authorization for voila\webtest expand: (sAMAccountName=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountName=webtest) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to control.voila.com:389, authentication 0 rlm_ldap: bind as cn=testuser,cn=users,dc=voila,dc=com/mypass to control.voila.com:389 rlm_ldap: waiting for bind result ... request done: ld 0x98c6708 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=webtest) request done: ld 0x98c6708 msgid 4 request done: ld 0x98c6708 msgid 2 rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [voila\\webtest/<via Auth-Type = mschap>] (from client Test port 1176 cli xxxxxxxxx) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> voila\webtest Complete Debug: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host xxxxxxxxxxx port 1059, id=117, length=191 User-Name = "voila\\testuser" NAS-Port = 1175 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "xxxxxxxxxxx" Calling-Station-Id = "xxxxxxxxxx" Tunnel-Client-Endpoint:0 = "xxxxxxxxxxxxx" MS-CHAP-Challenge = 0x949d0f260c0a83423f766c1ba4786e6f MS-CHAP2-Response = 0x00008c51e82b0b401baffa11bbe4804841af0000000000000000b90e47cdede219ef0896903add05ea5ada973c6c8d58d431 NAS-IP-Address = xxxxxxxxxx NAS-Port-Type = Virtual +- entering group authorize ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/xxxxxxxxx/auth-detail-20080915 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/xxxxxxxxxx/auth-detail-20080915 expand: %t -> Mon Sep 15 11:52:00 2008 ++[auth_log] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "voila\testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '"' in User-Name = "voila\testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com expand: (sAMAccountName=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to control.voila.com:389, authentication 0 rlm_ldap: bind as cn=project,cn=users,dc=voila,dc=com/mypass to control.voila.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=testuser) rlm_ldap: ldap_search() failed: Operations error rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for voila\testuser expand: (sAMAccountName=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to control.voila.com:389, authentication 0 rlm_ldap: bind as cn=project,cn=users,dc=voila,dc=com/mypass to control.voila.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=testuser) rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [voila\\testuser/<via Auth-Type = mschap>] (from client Test port 1175 cli xxxxxxxxxxxxx) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> voila\testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 117 to xxxxxxxxxxxx port 1059 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +18 Ready to process requests. ___________ Freeradius - 2.0.5 [root@ras modules]# rpm -qa | grep openldap openldap-devel-2.3.27-8.el5_2.4 openldap-2.3.27-8.el5_2.4 [root@ras modules]# rpm -qa | grep samba samba-common-3.0.28-1.el5_2.1 samba-3.0.28-1.el5_2.1 samba-client-3.0.28-1.el5_2.1 ______________________________________________ LDAP.CONF ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "control.voila.com" identity = "cn=testuser,cn=users,dc=voila,dc=com" password = mypass basedn = "dc=voila,dc=com" # CHANGED filter object search to look for 'SamAccountName' # filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" filter = "(sAMAccountName=%{mschap:User-Name:-%{User-Name}})" # filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the cerificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" # require_cert = "demand" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "User-Password" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html # https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.S… # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = User-Password # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no # # Group membership checking. Disabled by default. # groupname_attribute = cn #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_filter = "(|(&(objectClass=group)(member=%{check:LDAP-UserDn}))(&(objectClass=GroupOfNames)(member=%{check:LDAP-UserDn})))" groupmembership_attribute = memberOf # compare_check_items = yes do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) ldap_debug = 0x0028 ______________________________________________________ Samba / Windbind responses: [root@ras modules]# wbinfo -t checking the trust secret via RPC calls succeeded [root@ras modules]# wbinfo -a testuser%mypass plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user testuser%mypass with plaintext password challenge/response password authentication succeeded wbinfo -u and wbinfo -g enumerate all users/groups. -- View this message in context: http://www.nabble.com/LDAP-Group-membership-check-not-working-after-upgrade… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

radiusd dead but pid file exists
by Charlie B 17 Sep '08

17 Sep '08

Sep 15 01:07:58 rad1 kernel: radiusd[26743] general protection ip:44216fc sp:b57fe040 error:0 in libcrypto.so.0.9.8g[4398000+137000] Sep 17 08:18:21 rad1 kernel: radiusd[536] general protection ip:44216fc sp:b75f5040 error:0 in libcrypto.so.0.9.8g[4398000+137000] Help, any idea what is going on with this error? Everything other than radius is running fine however radius is dead and unresponsive. fedora 9 2.6.25.10-86.fc9.i686 samba-common-3.2.1-0.18.fc9.i386 samba-3.2.1-0.18.fc9.i386 samba-winbind-3.2.1-0.18.fc9.i386 samba-client-3.2.1-0.18.fc9.i386 freeradius-perl-2.0.5-2.fc9.i386 freeradius-krb5-2.0.5-2.fc9.i386 freeradius-ldap-2.0.5-2.fc9.i386 freeradius-2.0.5-2.fc9.i386 freeradius-utils-2.0.5-2.fc9.i386 freeradius-libs-2.0.5-2.fc9.i386

3 3

User-Name Authorization Problem in ldap module
by Syed Anwarul Hasan 17 Sep '08

17 Sep '08

Dear Alan,Ivan and all, I am having the Problem in rlm_ldap module in FreeRadius. I am doing a MD5 based Authentication with a Windows XP Supplicant and a Alcatel Switch acting as Authenticator and FreeRadius2.0.5 build as Front end and OpenLDAP 2.3.32 as backend. When a Request is received the *FreeRadius rlm_ldap module is not able to Authorize the User-Name in Authorize section.* But when I tried with* radtest it was able to Authorize and bind the identity with server. and authorized password. I am unable to find the problem. Please comment in this regard. SYED Debugged output with RADIUS Access Request received from Authenticator:* rad_recv: Access-Request packet from host 192.168.1.2 port 1026, id=23, length=118 User-Name = "hasan" NAS-IP-Address = 192.168.1.2 State = 0xd2721542d2731113194d83152fbd73d0 NAS-Port = 1003 Calling-Station-Id = "000fb0ba868d" EAP-Message = 0x0201001b0410aa93c55c3f5fb6f41369d77838fad2a2686173616e Message-Authenticator = 0x6525206bdea6b09c81a5a3252e515782 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "hasan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 27 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize *rlm_ldap: Attribute "User-Name" is required for authorization.* *++[ldap] returns noop* ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 23 to 192.168.1.2 port 1026 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1. Going to the next request Debugged o/p with radtest: radtest hasan password 192.168.1.131 10 testing123 *rlm_ldap: - authorize rlm_ldap: performing user authorization for password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=hasan) expand: dc=thales,dc=com -> dc=thales,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=thales,dc=com/thales to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=thales,dc=com, with filter (uid=hasan) rlm_ldap: checking if remote access for password is allowed by uid rlm_ldap: Added User-Password = password in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user password authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0* ++[ldap] returns ok expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 27 to 192.168.1.131 port 1068

1 0

User-Name Authorization Problem in ldap module
by Syed Anwarul Hasan 17 Sep '08

17 Sep '08

Dear Alan,Ivan and all, I am having the Problem in rlm_ldap module in FreeRadius. I am doing a MD5 based Authentication with a Windows XP Supplicant and a Alcatel Switch acting as Authenticator and FreeRadius2.0.5 build as Front end and OpenLDAP 2.3.32 as backend. When a Request is received the *FreeRadius rlm_ldap module is not able to Authorize the User-Name in Authorize section.* But when I tried with* radtest it was able to Authorize and bind the identity with server. and authorized password. I am unable to find the problem. Please comment in this regard. SYED Debugged output with RADIUS Access Request received from Authenticator:* rad_recv: Access-Request packet from host 192.168.1.2 port 1026, id=23, length=118 User-Name = "hasan" NAS-IP-Address = 192.168.1.2 State = 0xd2721542d2731113194d83152fbd73d0 NAS-Port = 1003 Calling-Station-Id = "000fb0ba868d" EAP-Message = 0x0201001b0410aa93c55c3f5fb6f41369d77838fad2a2686173616e Message-Authenticator = 0x6525206bdea6b09c81a5a3252e515782 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "hasan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 27 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize *rlm_ldap: Attribute "User-Name" is required for authorization.* *++[ldap] returns noop* ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 23 to 192.168.1.2 port 1026 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1. Going to the next request Debugged o/p with radtest: radtest hasan password 192.168.1.131 10 testing123 *rlm_ldap: - authorize rlm_ldap: performing user authorization for password WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=hasan) expand: dc=thales,dc=com -> dc=thales,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=thales,dc=com/thales to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=thales,dc=com, with filter (uid=hasan) rlm_ldap: checking if remote access for password is allowed by uid rlm_ldap: Added User-Password = password in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user password authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0* ++[ldap] returns ok expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 27 to 192.168.1.131 port 1068

1 0

[bug 571 PATCH] make rlm_sqlipool escape properly
by Phil Mayers 17 Sep '08

17 Sep '08

This is an updated patch to the one in bug 571 --- src/modules/rlm_sql/rlm_sql.c | 3 +-- src/modules/rlm_sql/rlm_sql.h | 1 + src/modules/rlm_sqlippool/rlm_sqlippool.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c index 1987d81..de9cd53 100644 --- a/src/modules/rlm_sql/rlm_sql.c +++ b/src/modules/rlm_sql/rlm_sql.c @@ -123,7 +123,6 @@ static int fallthrough(VALUE_PAIR *vp) * Yucky prototype. */ static int generate_sql_clients(SQL_INST *inst); -static size_t sql_escape_func(char *out, size_t outlen, const char *in); /* * sql xlat function. Right now only SELECTs are supported. Only @@ -355,7 +354,7 @@ static int generate_sql_clients(SQL_INST *inst) /* * Translate the SQL queries. */ -static size_t sql_escape_func(char *out, size_t outlen, const char *in) +size_t sql_escape_func(char *out, size_t outlen, const char *in) { size_t len = 0; diff --git a/src/modules/rlm_sql/rlm_sql.h b/src/modules/rlm_sql/rlm_sql.h index 54cc6ee..40cd526 100644 --- a/src/modules/rlm_sql/rlm_sql.h +++ b/src/modules/rlm_sql/rlm_sql.h @@ -89,4 +89,5 @@ int rlm_sql_select_query(SQLSOCK *sqlsocket, SQL_INST *inst, char *query); int rlm_sql_query(SQLSOCK *sqlsocket, SQL_INST *inst, char *query); int rlm_sql_fetch_row(SQLSOCK *sqlsocket, SQL_INST *inst); int sql_set_user(SQL_INST *inst, REQUEST *request, char *sqlusername, const char *username); +size_t sql_escape_func(char *out, size_t outlen, const char *in); #endif diff --git a/src/modules/rlm_sqlippool/rlm_sqlippool.c b/src/modules/rlm_sqlippool/rlm_sqlippool.c index b9df57b..ab0e5b6 100644 --- a/src/modules/rlm_sqlippool/rlm_sqlippool.c +++ b/src/modules/rlm_sqlippool/rlm_sqlippool.c @@ -318,7 +318,7 @@ static int sqlippool_command(const char * fmt, SQLSOCK * sqlsocket, return RLM_MODULE_FAIL; } - if (!radius_xlat(query, sizeof(query), expansion, request, NULL)) { + if (!radius_xlat(query, sizeof(query), expansion, request, sql_escape_func)) { radlog(L_ERR, "sqlippool_command: xlat failed on: '%s'", query); return 0; } @@ -364,7 +364,7 @@ static int sqlippool_query1(char * out, int outlen, const char * fmt, return RLM_MODULE_FAIL; } - if (!radius_xlat(query, sizeof(query), expansion, request, NULL)) { + if (!radius_xlat(query, sizeof(query), expansion, request, sql_escape_func)) { radlog(L_ERR, "sqlippool_command: xlat failed."); out[0] = '\0'; return 0; -- 1.5.4.3

2 1

sqlcounter problem after upgrading to 2.1.0
by J M Toms 17 Sep '08

17 Sep '08

Hi All, I've been using freeradius 1.1.5 for sometime. I use mysql for storing users and I have enabled sqlcounter module for restricitng monthly access time. Each user is member of a group and group's Max-Monthly-Session is set in radgroupcheck table. I have a script which is invoked from cron every month which calculates remaining time of users and does a insert/update/delete on radcheck so that there will be a record in radcheck if the user has any time left from the prevois month. Attribute is Max-Monthly-Session and value = (remaining + group's Max-Monthly-Session). This way I have implemented a session time carry over system. Recently I have upgraded freeradius to version 2.1.0. Everything is working well as expected other than sqlcounter. In new version it is ignoring the Max-Monthly-Session from radcheck table. I have installed radius in a new server but the same result. The radius debug output and sql table are available at http://pastebin.ca/1204050 Is there any config item for sqlcounter to process radcheck table? Thanks, JT

4 8

Using MySQL with FreeRADIUS.
by Twanny Azzopardi 17 Sep '08

17 Sep '08

Hello list, Can anyone help me with this. From what I gather, radcheck and radreply tables are sufficient to get an Access-Accept packet? Is there a way for radiusd to *not* check the radgroupcheck? Below is the output of radtest, my radcheck and radreply tables, and the output of radiusd -X. All help will be greatly appreciated. Best regards, Twanny. [root@webby ~]# /usr/bin/radtest barney betty localhost 1812 testing123 Sending Access-Request of id 136 to 127.0.0.1 port 1812 User-Name = "barney" User-Password = "betty" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=136, length=20 [root@webby ~]# --- mysql> select * from radcheck; +----+------------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+------------+-----------+----+--------+ | 1 | fredf | password | == | wilma | | 2 | barney | password | == | betty | | 3 | dialrouter | password | == | dialup | +----+------------+-----------+----+--------+ 3 rows in set (0.00 sec) mysql> select * from radreply; +----+------------+-------------------+----+-------------------------+ | id | UserName | Attribute | op | Value | +----+------------+-------------------+----+-------------------------+ | 1 | barney | Framed-IP-Address | := | 1.2.3.4 | | 2 | dialrouter | Framed-IP-Address | := | 2.3.4.1 | | 3 | dialrouter | Framed-IP-Netmask | := | 255.255.255.255 | | 4 | dialrouter | Framed-Routing | := | Broadcast-Listen | | 5 | dialrouter | Framed-Route | := | 2.3.4.0 255.255.255.248 | | 6 | dialrouter | Idle-Timeout | := | 900 | +----+------------+-------------------+----+-------------------------+ 6 rows in set (0.00 sec) --- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "shadow" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "xxxx" sql: password = "xxxx" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = yes sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeside@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32774, id=136, length=58 User-Name = "barney" User-Password = "betty" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "barney", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'barney' rlm_sql (sql): sql_set_user escaped user --> 'barney' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = 'barney' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = 'barney' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = 'barney' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = 'barney' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'barney' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 136 to 127.0.0.1 port 32774 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 136 with timestamp 48d0d716 Nothing to do. Sleeping until we see a request. --- Best regards, Twanny Azzopardi. +356 79713618. _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 2

log incorrect login to mysql
by sub 17 Sep '08

17 Sep '08

Hi boys, I'd like to log to my mysql server every authentication request that reach my freeradius server. Actually I log the Access-Accept requests to radpostauth table but I'd like to have, into a table, the Access-Reject requests. Until now I've not found anything useful.... Thanks a lot! sub

4 6

NAS list with MySQL
by fibie roosadhy 17 Sep '08

17 Sep '08

dear all, i use command 'radiusd -X' to debug.i found this : rlm_sql (hotspot): - generate_sql_clients rlm_sql (hotspot): Query: SELECT * FROM nas_10 rlm_sql (hotspot): Reserving sql socket id: 7 rlm_sql_mysql: query: SELECT * FROM nas_10 rlm_sql (hotspot): Read entry nasname=10.11.12.0/24,shortname=gsd-lt7,*secret=gsd** lantai 7* rlm_sql (hotspot): Adding client 10.11.12.0/24 (gsd-lt7) to clients list rlm_sql (hotspot): Read entry nasname=10.11.21.0/24,shortname=gsd-lt14,*secret=**untuk** training* rlm_sql (hotspot): Adding client 10.11.21.0/24 (gsd-lt14) to clients list rlm_sql (hotspot): Released sql socket id: 7 fact,in my nas_10 table are : mysql> select * from nas_10 \G; *************************** 1. row *************************** id: 1 nasip: 10.11.12.0/24 shortname: gsd-lt7 secret: telkom community: mabes description: gsd lantai 7 tgl_pasang: 2008-09-11 *************************** 2. row *************************** id: 2 nasip: 10.11.21.0/24 shortname: gsd-lt14 secret: telkom community: lt14 description: untuk training tgl_pasang: 2008-09-11 2 rows in set (0.00 sec) can you help me please, thanks. fibie roosadhy indonesia

2 4