- Freeradius-Users - lists.freeradius.org

EAP-TLS can't get connected..etc.
by Kwok Sianbin 16 May '08

16 May '08

Hi Everyone, I am newbie to linux and recently I try to implement wireless connnection with EAP-TLS encryption. I am using Freeradius-1.1.7 installed into Red Hat Enterprise 4. Here I encounter problems that I can't solve it alone hence I need advice guru from this forum. the problem is client just can't get connected and keep request. >/usr/src/sbin/radiusd -XA Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ...... rad_recv: Access-Request packet from host 192.168.0.206:1025, id=15, length=249 User-Name = "mars1.marsindo.com" NAS-IP-Address = 0.0.0.0 Framed-MTU = 1488 Called-Station-Id = "00:30:1a:29:03:66" Calling-Station-Id = "00:1c:f0:10:56:b8" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "127.0.0.1" Connect-Info = "CONNECT 11Mbps 802.11b" State = 0x67f83a14e00c0fa21121d8a0b508daa7 EAP-Message = 0x020200500d800000004616030100410100003d030148231c14867403f94c4d0185bb9c07d8f12ad07bf1980b9c9266979afcf15cc500001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xc493a17418b8010257a94b90bff667f1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "mars1.marsindo.com", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00b1], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 15 to 192.168.0.206 port 1025 EAP-Message = 0x0103040a0dc00000079e160301004a02000046030148231c071178ca610d87b2928af55e7d91fd04ad8097a06a065fa5ec7379be762023997cd4b544591192d007f351bdddb0fe229f9332e060b87c101f2b55e80cb000040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x59eb1d02dc1f6083321bcfbecf7ff5f6 Finished request 5 Going to the next request Waking up in 6 seconds... Testing > radtest MarsindoNet testing123-1 localhost 0 testing123 the result is accept-accept..ok will no problem Here I post the CA.certs execution result as I suppect that the errors might be due to certificate error. When I run ./CA.certs and I got a few errors. ################## create CA use just created 'newreq.pem' private key as filename CA.pl -newca ################## ################## exporting ROOT CA CA.pl -newreq CA.pl -signreq openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.pem openssl pkcs12 -in root.cer -out root.pem ################## Error opening input file demoCA/cacert.pem demoCA/cacert.pem: No such file or directory Error opening input file root.p12 root.p12: No such file or directory Error opening Certificate root.pem 3937:error:02001002:system library:fopen:No such file or directory:bss_file.c:259:fopen('root.pem','r') 3937:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: unable to load certificate ################## creating client certificate name : name-clt client certificate stored as cert-clt.pem CA.pl -newreq CA.pl -signreq ################## Generating a 1024 bit RSA private key .......++++++ ..................................................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) []:State or Province Name (full name) [Kepri]:Locality Name (eg, city) []:Organization Name (eg, company) []:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []: Please enter the following 'extra' attributes to be sent with your certificate request Using configuration from /usr/share/ssl/openssl.cnf Error opening CA private key ./demoCA/private/cakey.pem 3941:error:02001002:system library:fopen:No such file or directory:bss_file.c:259:fopen('./demoCA/private/cakey.pem','r') 3941:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: unable to load CA private key Failed to do sign certificate I'll be appreciated if anyone could help me solve such problem. Thanks in advance. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

3 4

Cisco Mac-Auth-Bypass with Freeradius 2.0.4
by MONTFORD, AUSTIN 16 May '08

16 May '08

Hey, I just got this working on a test server finally using the users file and have a quick question. I was wondering is there a way where I don't have to type the last 3 lines of this everytime in my users file? I was thinking of using some kind of setup with a seperate file for each vlan containing only the first statement (with the mac address as the user/pass). Then $include each vlanfile in the users file with freeradius appending the correct tunnel statements depending on what vlanfile the mac address was in. Anyways I haven't quite wrapped my head around the syntax to do this or am sure this is the best way. If someone has any advice that would be great. 123400000000 Cleartext-Password := "123400000000" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "Students" By the way Freeradius rocks! Thanks, Austin

3 2

EAP-TTLS + PAP with external script
by Dario Maccari 15 May '08

15 May '08

I'm trying to use an external php script to authenticate users connecting to an Access Point. Protocol used is EAP-TTLS with PAP as inner authentication protocol. The relevant parts of config file i use is: ********** radiusd.conf ************* modules { pap { auto_header = yes } exec test { wait = yes program = "/usr/local/bin/php -f /etc/raddb/radiusaccess.php" input_pairs = request output_pairs = reply } } authorize { preprocess suffix eap pap } authenticate { Auth-Type PAP { test } eap } ************* END radiusd.conf ********** When i try to connect the TTLS comunication seems to work fine but this is the relevan ouput of radiusd -X at the final steps ************ radiusd -X ***************** Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request User-Name = "testa" User-Password = "testb" FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "testa" User-Password = "testb" FreeRADIUS-Proxied-To = 127.0.0.1 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" Calling-Station-Id = "00-13-49-71-85-68" Called-Station-Id = "00-80-48-47-6B-E1:comune_segrate_milano_oltre" NAS-Identifier = "AP2" NAS-IP-Address = 192.168.11.168 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 rlm_realm: No '@' in User-Name = "testa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 9 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns ok) for request 9 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: leaving group authenticate (returns invalid) for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 ************************ END radiusd -X ****************** As you can see there is the message: "rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9" So the php script for pap authorization is not even executed. Maybe there is something i missed in configuration? Thanx Maccari Dario _________________________________________________________________ Discover the new Windows Vista http://search.msn.com/results.aspx?q=windows+vista&mkt=en-US&form=QBRE

5 11

Re: EAP-TLS can't get connected..etc.
by Kwok Sianbin 15 May '08

15 May '08

Hi Everyone, I installed the Freeradius 2.0.4 as Mr. Alan DeKok had suggested I browse www.freeradius.org and run below command. #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login CVS password: anoncvs nothing happen and return to # #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd then under #/usr/share/doc/radiusd ......run #./configure --with-openssl-includes=/usr/include/openssl --with-openssl-libraries=/usr/lib/libxm --with-prefix=/usr/local/radius # make #make install got some errors btool: install: error: cannot install "rlm_acctlog.la" to a directory not ending in /usr/local/lib/lib gmake[6]: *** [install] Error1 gmake[6]: Leaving dictory '/usr/share/doc/radiusd/src/modules/rlm_acctog' gmake[5]: *** Error 2 gmake[5]: Leaving directory '/usr/share/doc/radiusd/src/modules' gmake[4]: *** Error 2 gmake[4]: Leaving directory '/usr/share/doc/radiusd/src/modules' gmake[3]: *** Error 2 gmake[3]: Leaving directory '/usr/share/doc/radiusd/src' gmake[2]: *** Error 2 gmake[2]: Leaving directory '/usr/share/doc/radiusd/src' gmake[1]: *** Error 2 gmake[1]: Leaving directory '/usr/share/doc/radiusd' make: *** [install] Error 2 I checked the version in /usr/share/doc/radius/VERSION and it shows 2.0.2 (installed before) Have I installed freeradius-2.0.4? where it's located? If I want to uninstall or remove previous version such Freeradius-1.1.7 ..what command I should run or just simply delete the folder in Freeradius? thanks in advance. ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 9, 2008 7:50:34 PM Subject: Re: EAP-TLS can't get connected..etc. Kwok Sianbin wrote: > I am newbie to linux and recently I try to implement wireless > connnection with EAP-TLS encryption. I am using Freeradius-1.1.7 > installed into Red Hat Enterprise 4. You should really use 2.0.4. > Here I encounter problems that I can't solve it alone hence I need > advice guru from this forum. > the problem is client just can't get connected and keep request. > ... > Sending Access-Challenge of id 15 to 192.168.0.206 port 1025 >... > Going to the next request > Waking up in 6 seconds... This is in the FAQ. It's also documented in the "eap.conf" file in 2.0.4. > Here I post the CA.certs execution result as I suppect that the errors > might be due to certificate error. > When I run ./CA.certs and I got a few errors. 2.0.4 also contains new scripts for certificate creation. They're MUCH better than what's in 1.1.7. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

How to activate the accounting sub section in perl script
by johnson elangbam 15 May '08

15 May '08

hi, I am doing my AAA in perl script for radius 2.0.3, can anybody please tell how do I activate my accounting subsection in my perl program, I didn't find any execution of my queries in the accounting sub section in my perl script. With Regards, Johnson Elangbam

3 2

Listen port problem
by Hoggins! 15 May '08

15 May '08

Hello, I have a strange problem since I updated my freeradius from 1.x to 2.x, from a simple rpm update. It binds to random ports ! Here is the dump of radiusd -X : ------------------------------------ FreeRADIUS Version 2.0.2, for host i386-redhat-linux-gnu, built on Mar 18 2008 at 13:16:44 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb//radiusd.conf including configuration file /etc/raddb//clients.conf including configuration file /etc/raddb//snmp.conf including configuration file /etc/raddb//eap.conf including configuration file /etc/raddb//sql.conf including configuration file /etc/raddb//sql/mysql/dialup.conf including configuration file /etc/raddb//sql/mysql/counter.conf including configuration file /etc/raddb//policy.conf including files in directory /etc/raddb//sites-enabled/ including configuration file /etc/raddb//sites-enabled/default including dictionary file /etc/raddb//dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "radiusbouffard" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "radiusbouffard" shortname = "wifigates" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb//certs/server.pem" certificate_file = "/etc/raddb//certs/server.pem" CA_file = "/etc/raddb//certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb//certs/dh" random_file = "/etc/raddb//certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb//certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb//huntgroups" hints = "/etc/raddb//hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb//users" acctusersfile = "/etc/raddb//acct_users" preproxy_usersfile = "/etc/raddb//preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb//attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb//attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 45632 Listening on accounting address * port 36936 Ready to process requests. ------------------------------------ I don't really understand why it does that. I checked if there wasn't any other program that would have listened on 1812 before radius. Do you have an idea ? Thanks in advance, Hoggins!

2 2

EAP TLS Authentication with eToken
by Riccardo Veraldi 15 May '08

15 May '08

Hello, anyone has used eToken Aladdin 64k with EAP-TLS authentication using wpa_supplicant ? thank you Rick

1 0

No authenticate method
by Jean Frontin 15 May '08

15 May '08

Hello, I run FreeRadius 1.1.7 under Fedora core 8. Here is the radiusd.conf extract and below a session log. In the log I put a start at the beginning of lines which I don't understand. I want that the FreeRadius looks for user password in the ldap. Thanks you for your help ---- radiusd.conf extracts modules { ... ldap ldap1 { ... } ldap ldap2 { ... } ... } authorize { ... Autz-Type ldap1 { ldap1 } Autz-Type ldap2 { ldap2 } ... } authenticate { ... Auth-Type ldap1 { ldap1 } Auth-Type ldap2 { ldap2 } ... } ... ----------- log extracts Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded Counter counter: filename = "/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 3001 rlm_counter: Current Time: 1210772270 [2008-05-14 15:37:50], Next reset 1210802400 [2008-05-15 00:00:00] Module: Instantiated counter (daily) Module: Loaded LDAP ldap: server = "ldap1.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7a380 Module: Instantiated ldap (ldap1) ldap: server = "ldap2.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7aad0 Module: Instantiated ldap (ldap2) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 11.12.13.14:1896, id=3, length=47 User-Name = "xxxxxx" User-Password = "yyyyyy" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/141.115.16.72/auth-detail-20080514' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/141.115.16.72/auth-detail-20080514 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 * auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user * auth: Failed to validate the user. * Login incorrect: [xxxxxx/yyyyyy] (from client zzzzz port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 141.115.16.72 port 1896 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 482aeb39 Nothing to do. Sleeping until we see a request.

2 1

Custom properties check
by Sascha Kiefer 14 May '08

14 May '08

Hi, I'm freeradius combined with mysql. Is it possible to check custom property values of existens. Like "let the user logon iff xyz == 1" I guess it is just a matter of writing the sql. But which queries do i have to customize? Regards, Sascha

2 1

Re: freeradius-2.0.3 not talking to mysql-5.1
by NPY 14 May '08

14 May '08

Hi Chris, Thanks for the hint. It helped to resolve the problem. -Marcus ----- Original Message ----- From: "Chris" <cjl(a)viptalk.net> To: "NPY" <npy(a)pdog-vpn.com> Sent: Thursday, May 15, 2008 12:57 AM Subject: Re: freeradius-2.0.3 not talking to mysql-5.1 > Uncommenting it in instantiate is okay (probably unnecessary), but if you > want it to authorize using sql, you have to uncomment it in authorize > { }. If you want to authenticate using sql, you have to uncomment it in > authenticate { }. Want to do sql accounting? uncomment in accounting > { }. > > See raddb/sites-enabled/default > > On May 14, 2008, at 9:42 AM, NPY wrote: > >> OK, I added a line 'sql' to 'instantiate' section of radiusd.conf and >> radiusd is finally loading rlm_sql_mysql. >> Only the authentication is still not going through ..... sigh >> >> Anything else I have missed? Do I need to modify 'users' file etc? >> >> Below is the new 'radiusd -X' output for 'radtest joy happy localhost >> 1812 testing123' >> --------------------------------------------- >> >> FreeRADIUS Version 2.0.3, for host amd64-portbld-freebsd7.0, built on >> May 13 2008 at 14:48:48 >> Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. >> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >> PARTICULAR PURPOSE. >> You may redistribute copies of FreeRADIUS under the terms of the >> GNU General Public License. >> Starting - reading configuration files ... >> including configuration file /usr/local/etc/raddb/radiusd.conf >> including configuration file /usr/local/etc/raddb/proxy.conf >> including configuration file /usr/local/etc/raddb/clients.conf >> including configuration file /usr/local/etc/raddb/snmp.conf >> including configuration file /usr/local/etc/raddb/eap.conf >> including configuration file /usr/local/etc/raddb/sql.conf >> including configuration file /usr/local/etc/raddb/sql/mysql/ dialup.conf >> including configuration file /usr/local/etc/raddb/sql/mysql/ counter.conf >> including configuration file /usr/local/etc/raddb/policy.conf >> including files in directory /usr/local/etc/raddb/sites-enabled/ >> including configuration file /usr/local/etc/raddb/sites-enabled/ default >> including configuration file /usr/local/etc/raddb/sites-enabled/ >> inner-tunnel >> including dictionary file /usr/local/etc/raddb/dictionary >> main { >> prefix = "/usr/local" >> localstatedir = "/var" >> logdir = "/var/log" >> libdir = "/usr/local/lib" >> radacctdir = "/var/log/radacct" >> hostname_lookups = no >> max_request_time = 30 >> cleanup_delay = 5 >> max_requests = 1024 >> allow_core_dumps = no >> pidfile = "/var/run/radiusd/radiusd.pid" >> user = "freeradius" >> group = "freeradius" >> checkrad = "/usr/local/sbin/checkrad" >> debug_level = 0 >> proxy_requests = yes >> security { >> max_attributes = 200 >> reject_delay = 1 >> status_server = yes >> } >> } >> client localhost { >> ipaddr = 127.0.0.1 >> require_message_authenticator = no >> secret = "testing123" >> nastype = "other" >> } >> radiusd: #### Loading Realms and Home Servers #### >> proxy server { >> retry_delay = 5 >> retry_count = 3 >> default_fallback = no >> dead_time = 120 >> wake_all_if_all_dead = no >> } >> home_server localhost { >> ipaddr = 127.0.0.1 >> port = 1812 >> type = "auth" >> secret = "testing123" >> response_window = 20 >> max_outstanding = 65536 >> zombie_period = 40 >> status_check = "status-server" >> ping_check = "none" >> ping_interval = 30 >> check_interval = 30 >> num_answers_to_alive = 3 >> num_pings_to_alive = 3 >> revive_interval = 120 >> status_check_timeout = 4 >> } >> home_server_pool my_auth_failover { >> type = fail-over >> home_server = localhost >> } >> realm example.com { >> auth_pool = my_auth_failover >> } >> realm LOCAL { >> } >> radiusd: #### Instantiating modules #### >> instantiate { >> Module: Linked to module rlm_exec >> Module: Instantiating exec >> exec { >> wait = yes >> input_pairs = "request" >> shell_escape = yes >> } >> Module: Linked to module rlm_expr >> Module: Instantiating expr >> Module: Linked to module rlm_expiration >> Module: Instantiating expiration >> expiration { >> reply-message = "Password Has Expired " >> } >> Module: Linked to module rlm_logintime >> Module: Instantiating logintime >> logintime { >> reply-message = "You are calling outside your allowed timespan " >> minimum-timeout = 60 >> } >> Module: Linked to module rlm_sql >> Module: Instantiating sql >> sql { >> driver = "rlm_sql_mysql" >> server = "localhost" >> port = "" >> login = "radius" >> password = "pie=3.14" >> radius_db = "radius" >> read_groups = yes >> sqltrace = no >> sqltracefile = "/var/log/sqltrace.sql" >> readclients = no >> deletestalesessions = yes >> num_sql_socks = 5 >> sql_user_name = "%{User-Name}" >> default_user_profile = "" >> nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" >> authorize_check_query = "SELECT id, username, attribute, value, op FROM >> radcheck WHERE username = '%{SQL-User- Name}' ORDER >> BY id" >> authorize_reply_query = "SELECT id, username, attribute, value, op FROM >> radreply WHERE username = '%{SQL-User- Name}' ORDER >> BY id" >> authorize_group_check_query = "SELECT id, groupname, attribute, Value, >> op FROM radgroupcheck WHERE groupname = '% >> {Sql-Group}' ORDER BY id" >> authorize_group_reply_query = "SELECT id, groupname, attribute, value, >> op FROM radgroupreply WHERE groupname = '% >> {Sql-Group}' ORDER BY id" >> accounting_onoff_query = " UPDATE radacct SET >> acctstoptime = '%S', acctsessiontime = >> unix_timestamp('%S') - unix_timestamp(acctstarttime), >> acctterminatecause = '%{Acct-Terminate-Cause}', >> acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE >> acctsessiontime = 0 AND acctstoptime = NULL >> AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime >> <= '%S'" >> accounting_update_query = " UPDATE radacct SET >> framedipaddress = '%{Framed-IP-Address}', acctsessiontime >> = '%{Acct-Session-Time}', acctinputoctets = >> '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{% {Acct-Input-Octets}:-0}', >> acctoutputoctets = '%{% {Acct-Output-Gigawords}:-0}' << 32 | >> '%{%{Acct-Output- Octets}:-0}' WHERE acctsessionid = >> '%{Acct-Session- Id}' AND username = '%{SQL-User-Name}' >> AND nasipaddress = '%{NAS-IP-Address}'" >> accounting_update_query_alt = " INSERT INTO radacct >> (acctsessionid, acctuniqueid, username, realm, >> nasipaddress, nasportid, nasporttype, >> acctstarttime, acctsessiontime, acctauthentic, >> connectinfo_start, acctinputoctets, acctoutputoctets, >> calledstationid, callingstationid, servicetype, >> framedprotocol, framedipaddress, acctstartdelay, >> xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '% >> {Acct-Unique-Session-Id}', '%{SQL-User-Name}', '% {Realm}', >> '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS- Port-Type}', >> DATE_SUB('%S', INTERVAL (%{%{Acct-Session- Time}:-0} + >> %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session- Time}', >> '%{Acct-Authentic}', '', '%{%{Acct-Input- Gigawords}:-0}' << 32 | >> '%{%{Acct-Input-Octets}:-0}', '% >> {%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output- >> Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '% >> {Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', >> '0', '%{X-Ascend-Session-Svr-Key}')" >> accounting_start_query = " INSERT INTO radacct (acctsessionid, >> acctuniqueid, username, realm, nasipaddress, >> nasportid, nasporttype, acctstarttime, acctstoptime, >> acctsessiontime, acctauthentic, connectinfo_start, >> connectinfo_stop, acctinputoctets, acctoutputoctets, >> calledstationid, callingstationid, acctterminatecause, >> servicetype, framedprotocol, framedipaddress, >> acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES >> ('% {Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL- >> User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS- >> Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '% >> {Connect-Info}', '', '0', '0', '%{Called-Station-Id}', >> '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed- Protocol}', >> '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', >> '%{X-Ascend-Session-Svr-Key}')" >> accounting_start_query_alt = " UPDATE radacct SET >> acctstarttime = '%S', acctstartdelay = '%{%{Acct- >> Delay-Time}:-0}', connectinfo_start = '%{Connect- Info}' >> WHERE acctsessionid = '%{Acct-Session-Id}' AND username = >> '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" >> accounting_stop_query = " UPDATE radacct SET acctstoptime >> = '%S', acctsessiontime = '%{Acct- Session-Time}', >> acctinputoctets = '%{%{Acct-Input- Gigawords}:-0}' << 32 | >> '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = >> '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{% {Acct-Output-Octets}:-0}', >> acctterminatecause = '%{Acct- Terminate-Cause}', >> acctstopdelay = '%{%{Acct-Delay- Time}:-0}', >> connectinfo_stop = '%{Connect- Info}' WHERE acctsessionid = >> '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' >> AND nasipaddress = '%{NAS-IP-Address}'" >> accounting_stop_query_alt = " INSERT INTO radacct >> (acctsessionid, acctuniqueid, username, realm, >> nasipaddress, nasportid, nasporttype, acctstarttime, >> acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, >> connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, >> callingstationid, acctterminatecause, servicetype, framedprotocol, >> framedipaddress, acctstartdelay, acctstopdelay) >> VALUES ('%{Acct-Session-Id}', '% {Acct-Unique-Session-Id}', >> '%{SQL-User-Name}', '% {Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', >> '%{NAS-Port- Type}', DATE_SUB('%S', >> INTERVAL (%{% {Acct-Session-Time}:-0} + >> %{%{Acct-Delay-Time}:-0}) SECOND), '%S', >> '%{Acct-Session-Time}', '%{Acct- Authentic}', '', '%{Connect-Info}', >> '%{%{Acct-Input- Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', >> '% {%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output- >> Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '% >> {Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed- >> Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct- >> Delay-Time}:-0}')" >> group_membership_query = "SELECT groupname FROM radusergroup >> WHERE username = '%{SQL-User-Name}' ORDER BY priority" >> connect_failure_retry_delay = 60 >> simul_count_query = "" >> simul_verify_query = "SELECT radacctid, acctsessionid, username, >> nasipaddress, nasportid, framedipaddress, callingstationid, >> framedprotocol FROM radacct WHERE >> username = '%{SQL-User-Name}' AND >> acctstoptime = NULL" >> postauth_query = "INSERT INTO radpostauth (username, pass, reply, >> authdate) VALUES ( >> '%{User-Name}', '%{%{User-Password}:-% {Chap-Password}}', >> '%{reply:Packet-Type}', '%S')" >> safe-characters = >> "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- _: /" >> } >> rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and >> linked >> rlm_sql (sql): Attempting to connect to radius@localhost:/radius >> rlm_sql (sql): starting 0 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 >> rlm_sql_mysql: Starting connect to MySQL server for #0 >> rlm_sql (sql): Connected new DB handle, #0 >> rlm_sql (sql): starting 1 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 >> rlm_sql_mysql: Starting connect to MySQL server for #1 >> rlm_sql (sql): Connected new DB handle, #1 >> rlm_sql (sql): starting 2 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 >> rlm_sql_mysql: Starting connect to MySQL server for #2 >> rlm_sql (sql): Connected new DB handle, #2 >> rlm_sql (sql): starting 3 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 >> rlm_sql_mysql: Starting connect to MySQL server for #3 >> rlm_sql (sql): Connected new DB handle, #3 >> rlm_sql (sql): starting 4 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 >> rlm_sql_mysql: Starting connect to MySQL server for #4 >> rlm_sql (sql): Connected new DB handle, #4 >> } >> radiusd: #### Loading Virtual Servers #### >> server inner-tunnel { >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Linked to module rlm_pap >> Module: Instantiating pap >> pap { >> encryption_scheme = "auto" >> auto_header = no >> } >> Module: Linked to module rlm_chap >> Module: Instantiating chap >> Module: Linked to module rlm_mschap >> Module: Instantiating mschap >> mschap { >> use_mppe = yes >> require_encryption = no >> require_strong = no >> with_ntdomain_hack = no >> } >> Module: Linked to module rlm_unix >> Module: Instantiating unix >> unix { >> radwtmp = "/var/log/radwtmp" >> } >> Module: Linked to module rlm_eap >> Module: Instantiating eap >> eap { >> default_eap_type = "md5" >> timer_expire = 60 >> ignore_unknown_eap_types = no >> cisco_accounting_username_bug = no >> } >> Module: Linked to sub-module rlm_eap_md5 >> Module: Instantiating eap-md5 >> Module: Linked to sub-module rlm_eap_leap >> Module: Instantiating eap-leap >> Module: Linked to sub-module rlm_eap_gtc >> Module: Instantiating eap-gtc >> gtc { >> challenge = "Password: " >> auth_type = "PAP" >> } >> Module: Linked to sub-module rlm_eap_tls >> Module: Instantiating eap-tls >> tls { >> rsa_key_exchange = no >> dh_key_exchange = yes >> rsa_key_length = 512 >> dh_key_length = 512 >> verify_depth = 0 >> pem_file_type = yes >> private_key_file = "/usr/local/etc/raddb/certs/server.pem" >> certificate_file = "/usr/local/etc/raddb/certs/server.pem" >> CA_file = "/usr/local/etc/raddb/certs/ca.pem" >> private_key_password = "whatever" >> dh_file = "/usr/local/etc/raddb/certs/dh" >> random_file = "/usr/local/etc/raddb/certs/random" >> fragment_size = 1024 >> include_length = yes >> check_crl = no >> cipher_list = "DEFAULT" >> make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" >> } >> Module: Linked to sub-module rlm_eap_ttls >> Module: Instantiating eap-ttls >> ttls { >> default_eap_type = "md5" >> copy_request_to_tunnel = no >> use_tunneled_reply = no >> virtual_server = "inner-tunnel" >> } >> Module: Linked to sub-module rlm_eap_peap >> Module: Instantiating eap-peap >> peap { >> default_eap_type = "mschapv2" >> copy_request_to_tunnel = no >> use_tunneled_reply = no >> proxy_tunneled_request_as_eap = yes >> virtual_server = "inner-tunnel" >> } >> Module: Linked to sub-module rlm_eap_mschapv2 >> Module: Instantiating eap-mschapv2 >> mschapv2 { >> with_ntdomain_hack = no >> } >> Module: Checking authorize {...} for more modules to load >> Module: Linked to module rlm_realm >> Module: Instantiating suffix >> realm suffix { >> format = "suffix" >> delimiter = "@" >> ignore_default = no >> ignore_null = no >> } >> Module: Linked to module rlm_files >> Module: Instantiating files >> files { >> usersfile = "/usr/local/etc/raddb/users" >> acctusersfile = "/usr/local/etc/raddb/acct_users" >> preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" >> compat = "no" >> } >> Module: Checking session {...} for more modules to load >> Module: Linked to module rlm_radutmp >> Module: Instantiating radutmp >> radutmp { >> filename = "/var/log/radutmp" >> username = "%{User-Name}" >> case_sensitive = yes >> check_with_nas = yes >> perm = 384 >> callerid = yes >> } >> Module: Checking post-proxy {...} for more modules to load >> Module: Checking post-auth {...} for more modules to load >> Module: Linked to module rlm_attr_filter >> Module: Instantiating attr_filter.access_reject >> attr_filter attr_filter.access_reject { >> attrsfile = "/usr/local/etc/raddb/attrs.access_reject" >> key = "%{User-Name}" >> } >> } >> } >> server { >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Checking authorize {...} for more modules to load >> Module: Linked to module rlm_preprocess >> Module: Instantiating preprocess >> preprocess { >> huntgroups = "/usr/local/etc/raddb/huntgroups" >> hints = "/usr/local/etc/raddb/hints" >> with_ascend_hack = no >> ascend_channels_per_line = 23 >> with_ntdomain_hack = no >> with_specialix_jetstream_hack = no >> with_cisco_vsa_hack = no >> with_alvarion_vsa_hack = no >> } >> Module: Checking preacct {...} for more modules to load >> Module: Linked to module rlm_acct_unique >> Module: Instantiating acct_unique >> acct_unique { >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- Address, >> NAS-Port" >> } >> Module: Checking accounting {...} for more modules to load >> Module: Linked to module rlm_detail >> Module: Instantiating detail >> detail { >> detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" >> header = "%t" >> detailperm = 384 >> dirperm = 493 >> locking = no >> log_packet_header = no >> } >> Module: Instantiating attr_filter.accounting_response >> attr_filter attr_filter.accounting_response { >> attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" >> key = "%{User-Name}" >> } >> Module: Checking session {...} for more modules to load >> Module: Checking post-proxy {...} for more modules to load >> Module: Checking post-auth {...} for more modules to load >> } >> } >> radiusd: #### Opening IP addresses and Ports #### >> listen { >> type = "auth" >> ipaddr = * >> port = 0 >> } >> listen { >> type = "acct" >> ipaddr = * >> port = 0 >> } >> Listening on authentication address * port 1812 >> Listening on accounting address * port 1813 >> Listening on proxy address * port 1814 >> Ready to process requests. >> User-Name = "joy" >> User-Password = "happy" >> NAS-IP-Address = 123.242.231.112 >> NAS-Port = 1812 >> +- entering group authorize >> ++[preprocess] returns ok >> ++[chap] returns noop >> ++[mschap] returns noop >> rlm_realm: No '@' in User-Name = "joy", looking up realm NULL >> rlm_realm: No such realm "NULL" >> ++[suffix] returns noop >> rlm_eap: No EAP-Message, not doing EAP >> ++[eap] returns noop >> ++[unix] returns notfound >> ++[files] returns noop >> ++[expiration] returns noop >> ++[logintime] returns noop >> rlm_pap: WARNING! No "known good" password found for the user. >> Authentication may fail because of this. >> ++[pap] returns noop >> auth: No authenticate method (Auth-Type) configuration found for the >> request: Rejecting the user >> auth: Failed to validate the user. >> Login incorrect: [joy/happy] (from client localhost port 1812) >> Found Post-Auth-Type Reject >> +- entering group REJECT >> expand: %{User-Name} -> joy >> attr_filter: Matched entry DEFAULT at line 11 >> ++[attr_filter.access_reject] returns updated >> Delaying reject of request 0 for 1 seconds >> Going to the next request >> Waking up in 0.9 seconds. >> Sending delayed reject for request 0 >> Waking up in 4.9 seconds. >> >> >> ----- Original Message ----- From: "Alan DeKok" >> <aland(a)deployingradius.com >> > >> To: "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org >> > >> Sent: Wednesday, May 14, 2008 11:51 PM >> Subject: Re: freeradius-2.0.3 not talking to mysql-5.1 >> >> >>> NPY wrote: >>>> I notice when running 'radiusd -X' that no module rlm_sql_mysql was >>>> loaded. Is that a problem? >>>> How do I resolve it? >>> >>> Ensure that the MySQL client libraries and headers are installed, and >>> then re-build the server. >>> >>> Also, un-comment the references to SQL in the configuration files. It >>> appears you haven't done that, so I have no idea why you would expect >>> it >>> to use SQL. >>> >>> If you do un-comment the reference to SQL in the config files, the >>> server will look for the MySQL libraries. If they've been built, the >>> server will use them. If not, it will complain. >>> >>> Alan DeKok. >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > >

1 0