- Freeradius-Users - lists.freeradius.org

multiple DB
by baboda 16 Sep '08

16 Sep '08

Hi, I installed freeradius and mysql. Cause I have several database how can I change sql.conf and radiusd.conf to make freeradius to connect to more then one DB?

2 1

Authentication using postfix user password
by Tanya Muluw 16 Sep '08

16 Sep '08

Dear all. I am trying to use Chillispot for captive portal with freeradius v 1.188.2.4.2.16 as the radius server. I am new to both Chillispot and freeradius. Since most users of our organization have mail account in our postfix mail server, I tried to use postfix user password that stored in mysql for authentication. Therefore there will be two types of user, i.e users with postfix user password (encrypted password) and users with cleartext password as normally created using voucher generator. I inserted a user in radcheck with cleartext password, and a user from postfix mysql mailbox table. So my radcheck is : +-----+----------+---------------+----+------------------------------------+ | id | username | attribute | op | value | +-----+----------+---------------+----+------------------------------------+ | 223 | testman | User-Password | := | 123456 | | 225 | testman1 | User-Password | := | $1$bbf49e0f$MAcN54vB4L0wcKuYOCnQv/ | +-----+----------+---------------+----+------------------------------------+ The usergroup table : +----------+-----------+----------+ | username | groupname | priority | +----------+-----------+----------+ | testman | voucher | 1 | | testman1 | postfix | 1 | +----------+-----------+----------+ Test for user with cleartext password was successful. $ sudo radtest testman 123456 localhost 22 easyhotspot Sending Access-Request of id 142 to 127.0.0.1 port 1812 User-Name = "testman" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=142, length=20 Test for user with postfix user password was unsuccessful $ sudo radtest testman1 123456 localhost 22 easyhotspot Sending Access-Request of id 161 to 127.0.0.1 port 1812 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=161, length=20 from debugging : rad_recv: Access-Request packet from host 127.0.0.1:32817, id=161, length=60 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 11 modcall[authorize]: module "preprocess" returns ok for request 11 radius_xlat: 'testman1' rlm_sql (sql): sql_set_user escaped user --> 'testman1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testman1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testman1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 11 modcall: leaving group authorize (returns ok) for request 11 auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 11 for 1 seconds Finished request 11 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 161 to 127.0.0.1 port 32817 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 11 ID 161 with timestamp 48ced6ba Then I put Auth-Type:=PAP in radgroupcheck table +----+-----------+-----------+----+-------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+-------+ | 21 | postfix | Auth-Type | == | PAP | +----+-----------+-----------+----+-------+ However user with postfix user password still fail to authenticate $ sudo radtest testman1 123456 localhost 22 easyhotspot Sending Access-Request of id 157 to 127.0.0.1 port 1812 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=157, length=20 from debugging : rad_recv: Access-Request packet from host 127.0.0.1:32816, id=157, length=60 User-Name = "testman1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 radius_xlat: 'testman1' rlm_sql (sql): sql_set_user escaped user --> 'testman1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testman1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testman1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testman1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 10 modcall: leaving group authorize (returns ok) for request 10 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 10 rlm_pap: login attempt with password 123456 rlm_pap: Using clear text password "$1$bbf49e0f$MAcN54vB4L0wcKuYOCnQv/". rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 10 modcall: leaving group PAP (returns reject) for request 10 auth: Failed to validate the user. Delaying request 10 for 1 seconds Finished request 10 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 157 to 127.0.0.1 port 32816 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 10 ID 157 with timestamp 48ced617 Nothing to do. Sleeping until we see a request. Radiusd.conf was unchanged. Is there any method to use user password of postfix mysql mailbox data to authenticate freeradius user? Thanks in advance, and sorry for my bad English. Best regards TM

2 2

Custom values for Post-Auth-Type
by Matthias Witte 16 Sep '08

16 Sep '08

I am not sure, whether this is the correct way to do this: I would like to use a custom Post-Auth-Type section like post-auth { Post-Auth-Type SQL { sqlmainpool } ... The corresponding line in users is: DEFAULT Service-Type == Framed-User, User-Profile := "framed", Post-Auth-Type := SQL This results in 'Parse error (check) for entry DEFAULT: Unknown value SQL for attribute Post-Auth-Type' unless I add an entry like VALUE Post-Auth-Type SQL 129 to the dictionary. I am using version 2.0.4. Mit freundlichem Gru�, -- Matthias Witte - witte(a)netzquadrat.de Telefon: +49 (0)211-30 20 33-18 Telefax: +49 (0)211-30 20 33-22 [netzquadrat] GmbH - Gladbacher Str. 74 - 40219 D�sseldorf HRB D�sseldorf 36121 - Gesch�ftsf�hrer: Thilo Salmon, Tim Mois Steuernummer: 106/5719/1836, Umsatzsteuer-ID: DE246863050 billiger-telefonieren.de - billiger-surfen.de - stromseite.de - sms.de

2 2

configure FreeRADIUS with Huawei PDSN9660
by Aldo Zavala 16 Sep '08

16 Sep '08

Hello to all... First of all I want to tell that I am happy and very proud that this great software is BSD licenced! This is my first time using it and I didnt found nothing related to my question on the manuals... I have a Huawei PDSN9660 and I want to use the FreeRADIUS as AAA server... how can I start configuring and testing it? is there a manual or a wiki about that??? Thanks in advance community! Aldo

2 1

Radius users state
by Sudarshan Soma 16 Sep '08

16 Sep '08

Hi All, Is there anyway if the radius client can determine, if the user authentication failed due to user locked/user-not-existing. I think the RADIUS doesnt have a field in the response codes to indicate this information. This might be correct in the sense intruder doesnt know the actual reason for authentication failure. I just wanted to clarify that the information such as locked-state/passwdexpired,... cant be obtained through radius client. Thanks and Best Regards,

2 8

rlm_perl + dbi, 2.04 on hardy
by Russell Tester 15 Sep '08

15 Sep '08

Hi All, Would appreciate some help getting rlm_perl working with my perl script, I can successfully run my perl script externally from freeradius, and likewise can run freeradius with a perl script that doesn't involve DBI. I'm using hardy with the perl packaged from intrepid, and a semi-custom build of 2.04 packaged with difsg-5 (from deiban testing). Here's the point it fails on start up, line 11 in scratchlimit.pl is "use DBI;" Not really sure where to head next, I appreciate this may be more of a Perl problem, but as I mentioned the script works just dandy when run by itself. <snip> Mon Sep 15 21:44:26 2008 : Debug: perl { Mon Sep 15 21:44:26 2008 : Debug: module = "/usr/bin/scratchlimit.pl" Mon Sep 15 21:44:26 2008 : Debug: func_authorize = "authorize" Mon Sep 15 21:44:26 2008 : Debug: func_authenticate = "authenticate" Mon Sep 15 21:44:26 2008 : Debug: func_accounting = "accounting" Mon Sep 15 21:44:26 2008 : Debug: func_preacct = "preacct" Mon Sep 15 21:44:26 2008 : Debug: func_checksimul = "checksimul" Mon Sep 15 21:44:26 2008 : Debug: func_detach = "detach" Mon Sep 15 21:44:26 2008 : Debug: func_xlat = "xlat" Mon Sep 15 21:44:26 2008 : Debug: func_pre_proxy = "pre_proxy" Mon Sep 15 21:44:26 2008 : Debug: func_post_proxy = "post_proxy" Mon Sep 15 21:44:26 2008 : Debug: func_post_auth = "post_auth" Mon Sep 15 21:44:26 2008 : Debug: } Can't load '/usr/lib/perl5/auto/DBI/DBI.so' for module DBI: /usr/lib/perl5/auto/DBI/DBI.so: undefined symbol: PL_memory_wrap at /usr/lib/perl/5.10/DynaLoader.pm line 196. at /usr/lib/perl5/DBI.pm line 263 BEGIN failed--compilation aborted at /usr/lib/perl5/DBI.pm line 263. Compilation failed in require at /usr/bin/scratchlimit.pl line 11. BEGIN failed--compilation aborted at /usr/bin/scratchlimit.pl line 11. Mon Sep 15 21:44:26 2008 : Error: rlm_perl: perl_parse failed: /usr/bin/scratchlimit.pl not found or has syntax errors. Mon Sep 15 21:44:26 2008 : Error: /etc/freeradius/radiusd.conf[1577]: Instantiation failed for module "perl" Mon Sep 15 21:44:26 2008 : Error: /etc/freeradius/sites-enabled/default[243]: Failed to find module "perl". Mon Sep 15 21:44:26 2008 : Error: /etc/freeradius/sites-enabled/default[243]: Failed to parse "perl" entry. Mon Sep 15 21:44:26 2008 : Debug: } Mon Sep 15 21:44:26 2008 : Debug: } Mon Sep 15 21:44:26 2008 : Error: Errors initializing modules Cheers Russ.

2 2

Radius don't write on MySQL radacct
by Felipe Neuwald 15 Sep '08

15 Sep '08

Hi all, I have one FreeRADIUS 1.1.7_2 server running on a FreeBSD 6.2-STABLE box, and other FreeBSD 6.3-STABLE box running MySQL 5.0.51a. These RADIUS system, are running at least for one year, and I got no problems, but now, since one month ago, I have no write on radacct table. Here is the result of radiusd -X: http://pastebin.ca/1201080 Does anybody knows what does it could be? Thank you very much, Felipe Neuwald.

3 8

SQL statement in radcheck
by Ljupco Vangelski 15 Sep '08

15 Sep '08

Hello, I'm trying to allow a user to log in from few Calling-Station-Ids, but to load them at run-time (read them from mysql table). For that I'm trying to use sql statement in radcheck, but it doesn't seem to be working. Here is a simplified example (mysql, table radcheck): UserName..........Attribute..............op..........Value (1) test Calling-Station-Id == 001122334455 (is working) (2) test Calling-Station-Id == %{sql:select "001122334455";} (is not working) UserName..........Attribute..............op..........Value (1) test Calling-Station-Id =~ (001122334455|554433221100) (is working) (2) test Calling-Station-Id =~ %{sql:select "(001122334455|554433221100)";} (is not working) I've tried this with freeradius 1.1.6 and 1.1.7, with the Calling-Station-Id Attribute set accordingly by the RadiusClient, but in case (1) the user is granted access, and in case (2) user is not granted access. The sql statement is interpreted successfully by the freeradius when it is in the Reply-Message in RADREPLY, for example: (table: RADREPLY) UserName..........Attribute..............op..........Value (1) test Reply-Message = %{sql:select "(001122334455|554433221100)";} is sending reply to the RadiusClient: Reply-Message = "(001122334455|554433221100)" Can sql statements be used to compare against the Attribute Value in CHECK statements, like in the cases (2) above? Thanks, -- Ljupco

2 4

SQL & flat file database
by Lemaster, Rob 15 Sep '08

15 Sep '08

Is it legal to use both a SQL database and a flat file for users simultaneously, or do you have to choose one or the other? If this is possible, does it require any change in configuration?

3 2

SQL Accounting but only for specific groups
by Marinko Tarlac 14 Sep '08

14 Sep '08

Hi there I want to use sql accounting but only for specific user groups... Is there any chance to do this (maybe Unlang can help?)

1 0