- Freeradius-Users - lists.freeradius.org

Re: Freeradius + CHAP
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

What do you want to put in them? This is enough to get authenticated. Good day to all! I'm testing my setup right now and this is that it tells me when I try to authenticate this user. rlm_sql: Failed to create the pair: Failed to find IP address for rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail Invalid user: [s/fj4\032] (from client localhost port 2 cli 00-1C-A4-6F-21-10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> s attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Any ideas? Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

freeradius 2.0.3 peap, mschapv2, sql
by Martin.Gabauer＠spselh.sk 07 Apr '08

07 Apr '08

Hi all, I have following problem, I compiling and installing freeradius 2.0.3 from tgz. I configuring him for authorizing from windows clients (Winxp), whith using mysql to save login and password. The problem is that if password in sql is saved as user-password authorization works fine, but if I save password in MD5 or DES authorization don't work. SQL entry: mysql> select * from radcheck; +----+----------+--------------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------------------------------+ | 5 | test | User-Password | == | test1 | | 7 | gabo2 | MD5-Password | == | $1$7MAOFK8L$5s0zdXoefcE10UfSAjf831 | +----+----------+--------------------+----+------------------------------------+ radius -X output: FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Mar 26 2008 at 12:53:26 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.168.6/32 { require_message_authenticator = no secret = "mysecret" shortname = "Test" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "MyKey" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiususer" password = "SQlpassword" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiususer@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.168.1 port = 1812 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address 192.168.168.1 port 1812 Listening on accounting address * port 1813 Listening on proxy address 192.168.168.1 port 1814 Ready to process requests. ############# END of radiusd -X ####################################### Thanks for help, and sorry for my bad english. Martin Gabauer -- .--. |o_o | Ing. Martin Gabauer |:_/ | network & system administrator // \ \ Zdruzena stredna skola elektrotechnicka (| | ) v Lipt. Hradku /'\_ _/`\ Europe / Slovakia \___)=(___/ homepage : http://www.zsselh.sk/mgabauer icq : #289207549

2 1

Re: RPM Build Errors
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

I'm used the first one but still same error begets me. ----- Original Message ---- From: Jos Vos <jos(a)xos.nl> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, April 7, 2008 15:20:02 Subject: Re: RPM Build Errors On Mon, Apr 07, 2008 at 12:07:38AM -0700, SANDY KALUGDAN wrote: > I'm pretty sure about that. > what should I use? > echo '%_topdir %(echo $HOME)/rpmbuild' >> .rpmmacros > or > echo '%_topdir%(echo $HOME)/rpmbuild' >> .rpmmacros > > to populate the .rpmmacros The first one. -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: RPM Build Errors
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

that is the spec file i'm working on... ----- Original Message ---- From: Austin G. Smith <Austin(a)digitalson.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, April 7, 2008 15:05:06 Subject: RE: RPM Build Errors Grab that .spec file that was posted earlier. It will work like a charm! ;) Austin G. Smith, A+, MCP Digital Son, I.T. Services www.digitalson.com 678.213.0550 x:101 Office 678.213.0535 Fax Need reliable hosting? www.digitalsonhosting.com -----Original Message----- From: freeradius-users-bounces+austin=digitalson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+austin=digitalson.com@lists.freeradius. org] On Behalf Of SANDY KALUGDAN Sent: Monday, April 07, 2008 1:41 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: RPM Build Errors Here is the error I got $ cd ~/rpmbuild/SOURCES $ ls -al total 3432 drwxr-xr-x 2 root root 4096 Apr 6 16:41 . drwxr-xr-x 7 root root 4096 Mar 17 12:17 .. -rw-r--r-- 1 root root 3488944 Apr 6 16:41 freeradius-server-2.0.3.tar.gz my .rpmmacros contains %_topdir %(echo $HOME)/rpmbuild [root@host SPECS]# rpmbuild -bb freeradius.spec error: File % (echo $HOME) /rpmbuild/SOURCES/freeradius-server-2.0.3.tar.gz: No such file or directory What am I missing? Send instant messages to your online friends http://uk.messenger.yahoo.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: RPM Build Errors
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

I'm pretty sure about that. what should I use? echo '%_topdir %(echo $HOME)/rpmbuild' >> .rpmmacros or echo '%_topdir%(echo $HOME)/rpmbuild' >> .rpmmacros to populate the .rpmmacros ----- Original Message ---- From: Jos Vos <jos(a)xos.nl> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, April 7, 2008 10:59:22 Subject: Re: RPM Build Errors On Sun, Apr 06, 2008 at 10:40:51PM -0700, SANDY KALUGDAN wrote: > my .rpmmacros contains > %_topdir %(echo $HOME)/rpmbuild For me this works (rpm 4.4.2), I just tried. > [root@host SPECS]# rpmbuild -bb freeradius.spec > error: File % (echo $HOME) /rpmbuild/SOURCES/freeradius-server-2.0.3.tar.gz: No such file or directory Are you sure the extra spaces that are shown here are not in .rpmmacros? -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Another Issue--
by Austin G. Smith 07 Apr '08

07 Apr '08

I am having an issue authenticating against mysql backended radius now. I have been toyin with this for around 4 hours, and cannot seem to make it work. In my previous email about rpm build, something about quirks was mentioned on this arch... it has me weary... Here is the output from radiusd -X ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a0f3a2b7b0d23f0e1d4dc591995af63 Finished request 13. Going to the next request Waking up in 9.9 seconds. User-Name = "digitalson" NAS-IP-Address = 192.168.246.5 NAS-Port = 0 Called-Station-Id = "00-1D-7E-97-F6-7A:Northpoint Premium" Calling-Station-Id = "00-1D-E0-8C-07-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202007919800000006f160301006a01000066030147f95b9753cefb5adae0b4ba1f59 d49dc0614fbb9ff218341ee80ef4354aaa7d000018002f00350005000ac009c00ac013c0 140032003800130004010000250000000f000d00000a6469676974616c736f6e000a0008 0006001700180019000b00020100 State = 0x7a0f3a2b7b0d23f0e1d4dc591995af63 Message-Authenticator = 0x4a75ae062299e625fed959b6fa4bd464 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "digitalson", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 121 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 111 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 006a], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x0103040019c0000008bb160301004a02000046030147f9543a68321a7a62ce34c26376 3d3359f2099e1fd9ca05349a30804f08280420aea048386039e1a5cc9a13b4f0429a3914 fb0ae478c40bb9fcfc9adeadc74431002f00160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b300906 0355040613024652310f300d060355040813065261646975733112301006035504071309 536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e 06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603 5504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e17 0d3038303430363134333131365a170d3039303430363134333131365a307c310b300906 0355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665 722043657274696669636174653120301e06092a864886f70d010901161161646d696e40 6578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f0030 82010a0282010100ca117750f8f17a2992b0480a1399839df3eec850117b33a6f511045c 2093 EAP-Message = 0xea2001890a23edf356bcdb56313eaac53f5a9783a01cfe4b39a11e8f6e82dd36326b42 dc2605862d578bdf14bfc46dd83a66b0620a9852fe5f01e360e86cf158556d3843c9a370 dd7ed1a0b6da543766b806b94cd419f6a20569b120002f010c4fb65d552527040a6fce79 b5552714e8492a40f0661c88003c8e513c605fe44a8bbe2fd809e6325cde81310109c86d e406aa83fbb92d28cbf54efb47b1359dcc15fee7770389f0cf81203a81936d23f4eb4ae5 cec9913065dbb8a6364efbf4057cfdb1249317865866f0a56f62bb563b1a1cb1f57a0d40 2de7770548787e6812d4810203010001a317301530130603551d25040c300a06082b0601 0505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101001d7a32050162b36928e88d5f 705cbee9f73970a986be65705210a399078f05012c239a18ea7b9605f35855cc26b91a91 9a5e578afd47847b5dd04e74e26bcbbcedc7632ef09e7a90825d5513681e0539f03aa6dd 74f932a1d27b80670734e9be3760f93673631b8b1bd663fde8356f2573ed87af640f9a50 401dcfdbb317115248e70b429ced6810b5e6fdf7bb4f373d445324acb9e50ea013624430 4df7dd6c12b4b7f2a340b8953b5f2320f099123c98f760b7d8c1e4120c2e9f45152074fa 1757ea0fe2aef2917cd3c120ca448ff70a4e074a67a59893ea2fdddfa7c793d65519720a f126 EAP-Message = 0xc21109cfb9e3422ba776a96b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a0f3a2b780c23f0e1d4dc591995af63 Finished request 14. Going to the next request Waking up in 9.9 seconds. User-Name = "digitalson" NAS-IP-Address = 192.168.246.5 NAS-Port = 0 Called-Station-Id = "00-1D-7E-97-F6-7A:Northpoint Premium" Calling-Station-Id = "00-1D-E0-8C-07-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x7a0f3a2b780c23f0e1d4dc591995af63 Message-Authenticator = 0x1ce44b64106d26fcd359de6619859946 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "digitalson", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x010403fc1940970a7f6f1c3963e9ee36c9d44b1e0004ab308204a73082038fa0030201 02020900945a69e3e183b155300d06092a864886f70d0101050500308193310b30090603 55040613024652310f300d06035504081306526164697573311230100603550407130953 6f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06 092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c6520436572746966696361746520417574686f72697479301e17 0d3038303430363134333131355a170d3038303530363134333131355a308193310b3009 0603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309 536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e 06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603 550403131d4578616d706c6520436572746966696361746520417574686f726974793082 0122300d06092a864886f70d01010105000382010f003082010a0282010100c5e93d4905 1e396fb916d49d7953268bf0a4ca316b9039587d2a4be095d95a410a7fb23f8a54e80997 12211740ae4a215077f8f0e393429649fede567817eecc110fa93800f2d5b3c26a017b5f 2ab0 EAP-Message = 0xbce70664aa453ab85af07f0f2ea63c5421a39c856c06b1a6261b8e93fe1ef88ff615a5 6c17d96bc6c4499872300813316678cfc6223eecb54844fe7e578e6dffdad24db022c315 c5da9eedde0d35c003d33c195e381b0388d68b07549bf349e186fc4dff38f634549dedb8 dfcf06771f296d2ea99f2a2d5f08f0359887dd51885b5eec69d78e6cb95f0cdfba41447a ca7dc777067ecea80dd8f5c5c246e207c3a9afbf1350857b449b3b8cc8d6570bfe290203 010001a381fb3081f8301d0603551d0e041604149404f079c9d6448388d1d83af2cb1493 98094d863081c80603551d230481c03081bd80149404f079c9d6448388d1d83af2cb1493 9809 EAP-Message = 0x4d86a18199a48196308193310b3009060355040613024652310f300d06035504081306 5261646975733112301006035504071309536f6d65776865726531153013060355040a13 0c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e40 6578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966 696361746520417574686f72697479820900945a69e3e183b155300c0603551d13040530 030101ff300d06092a864886f70d010105050003820101003b94781a23220539481af383 f93b481cf03c645b2ed6ea40331ba8bbe72299c64b416153fc059c8d8beeaf2487ab0cd4 5089 EAP-Message = 0xc4e35d2df42af41f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a0f3a2b790b23f0e1d4dc591995af63 Finished request 15. Going to the next request Waking up in 9.9 seconds. User-Name = "digitalson" NAS-IP-Address = 192.168.246.5 NAS-Port = 0 Called-Station-Id = "00-1D-7E-97-F6-7A:Northpoint Premium" Calling-Station-Id = "00-1D-E0-8C-07-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0x7a0f3a2b790b23f0e1d4dc591995af63 Message-Authenticator = 0xdcb63ac17c637f3a2986c92aff1f3af0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "digitalson", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x010500d519001afd8b58bd12e3cb9fedaf77df710a1b666378f924516cb6351265906d d9dcf5cc8b6c9f6c4e98e7bdc03e464e0086f76c69294284fe27e0429cdc608ad2290544 97961089f1a6b59a255a4e289556f77922ebeae185caac925ae7b515ddd487009ab7d9bc 8a424e3a39cf78ce3dcad4e9a04043bac9cf89387f2947b064e201189139fce33b0e1d14 6d691c4c9d60c3285e6e45a531e9c7e8cf9a012a0d1459d2d7113aa6c7f9392cb1bb738c 086f6657446aa1f9014b1cdc490d0cdda99d70ad4d2135a1ad16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a0f3a2b7e0a23f0e1d4dc591995af63 Finished request 16. Going to the next request Waking up in 9.9 seconds. User-Name = "digitalson" NAS-IP-Address = 192.168.246.5 NAS-Port = 0 Called-Station-Id = "00-1D-7E-97-F6-7A:Northpoint Premium" Calling-Station-Id = "00-1D-E0-8C-07-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0x7a0f3a2b7e0a23f0e1d4dc591995af63 Message-Authenticator = 0xc2f762f0550b5bc3d0385797a35f7bda +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "digitalson", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a0f3a2b7f0923f0e1d4dc591995af63 Finished request 17. Going to the next request Waking up in 9.9 seconds. Cleaning up request 12 ID 18 with timestamp +618 Cleaning up request 13 ID 19 with timestamp +618 Cleaning up request 14 ID 20 with timestamp +618 Cleaning up request 15 ID 21 with timestamp +618 Cleaning up request 16 ID 22 with timestamp +618 Cleaning up request 17 ID 23 with timestamp +618 Ready to process requests. Austin G. Smith, A+, MCP Digital Son, I.T. Services www.digitalson.com 678.213.0550 x:101 Office 678.213.0535 Fax Need reliable hosting? www.digitalsonhosting.com

3 3

Re: RPM Build Errors
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

Here is the error I got $ cd ~/rpmbuild/SOURCES $ ls -al total 3432 drwxr-xr-x 2 root root 4096 Apr 6 16:41 . drwxr-xr-x 7 root root 4096 Mar 17 12:17 .. -rw-r--r-- 1 root root 3488944 Apr 6 16:41 freeradius-server-2.0.3.tar.gz my .rpmmacros contains %_topdir %(echo $HOME)/rpmbuild [root@host SPECS]# rpmbuild -bb freeradius.spec error: File % (echo $HOME) /rpmbuild/SOURCES/freeradius-server-2.0.3.tar.gz: No such file or directory What am I missing? Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: freeradius 2.0.3 peap, mschapv2, sql
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

try to send the radiusd -X output after you've done some authentication. ----- Original Message ---- From: "Martin.Gabauer(a)spselh.sk" <Martin.Gabauer(a)spselh.sk> To: freeradius-users(a)lists.freeradius.org Sent: Monday, April 7, 2008 13:12:19 Subject: freeradius 2.0.3 peap, mschapv2, sql Hi all, I have following problem, I compiling and installing freeradius 2.0.3 from tgz. I configuring him for authorizing from windows clients (Winxp), whith using mysql to save login and password. The problem is that if password in sql is saved as user-password authorization works fine, but if I save password in MD5 or DES authorization don't work. SQL entry: mysql> select * from radcheck; +----+----------+--------------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------------------------------+ | 5 | test | User-Password | == | test1 | | 7 | gabo2 | MD5-Password | == | $1$7MAOFK8L$5s0zdXoefcE10UfSAjf831 | +----+----------+--------------------+----+------------------------------------+ radius -X output: FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Mar 26 2008 at 12:53:26 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.168.6/32 { require_message_authenticator = no secret = "mysecret" shortname = "Test" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "MyKey" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiususer" password = "SQlpassword" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawo! rds}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Fr! amed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gi! gawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiususer@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.168.1 port = 1812 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address 192.168.168.1 port 1812 Listening on accounting address * port 1813 Listening on proxy address 192.168.168.1 port 1814 Ready to process requests. ############# END of radiusd -X ####################################### Thanks for help, and sorry for my bad english. Martin Gabauer -- .--. |o_o | Ing. Martin Gabauer |:_/ | network & system administrator // \ \ Zdruzena stredna skola elektrotechnicka (| | ) v Lipt. Hradku /'\_ _/`\ Europe / Slovakia \___)=(___/ homepage : http://www.zsselh.sk/mgabauer icq : #289207549 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Windows AD Integration
by Lemaster, Rob 07 Apr '08

07 Apr '08

Can FreeRADIUS be integrated into Windows Active Directory for user credentials and privelige based on Active Directory group? What is the best way to integrate FreeRADIUS into Windows Active Directory? Thanks! FreeRADIUS: It's what's for dinner.

2 1

RADIUS Packet Debugging
by Lemaster, Rob 07 Apr '08

07 Apr '08

Does FreeRADIUS have a functionality that allows the administrator to debug RADIUS requests and responses? Something that will show the request and response with attributes, etc.. Thanks! FreeRADIUS: The other white meat.

2 1