- Freeradius-Users - lists.freeradius.org

SQL Escape Chars
by Arran Cudbard-Bell 13 Feb '08

13 Feb '08

Hi, Am I right in thinking that most alpha numeric characters are escaped before being inserted into SQL databases, and that the resultant string is =<Ascii value as hex> ? For example, the Reply-Message 'HP Networking equipment makes me sad, angry and staby.' would be entered as 'HP Networking equipment makes me sad=2C angry and staby.' Or is it just sensitive SQL chars that are written in this form ? Is this going to change at some point in the future, or can I safely start replacing these with HTML special when displaying FreeRADIUS'd attributes ... -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

1 0

rlm_ippool error problem
by Asaad 13 Feb '08

13 Feb '08

Dear All : rlm_ippool return duplicate ip address in past i used version Version 1.0.5 , so i thought that may be bug in the version so i installed Version 2.0.1 and the problem is still appears but in the last version the problem appears always in specific ips for example x.x.117.63 , x.x .119.162 after lot of debug i doubte in the pool defintions starting not from 1 and the mask!!!! ippool nonsub_pool { range-start = x.x.116.177 range-stop = x.x.119.254 netmask = 255.255.252.0 cache-size = 833 session-db = ${raddbdir}/dbnon.ippool ip-index = ${raddbdir}/dbnon.ipindex override = no } any idea or hint please Thanks _________________________________________________________________ Connect and share in new ways with Windows Live. http://www.windowslive.com/share.html?ocid=TXT_TAGHM_Wave2_sharelife_012008

1 0

radiusd dying
by Frank Winkler 13 Feb '08

13 Feb '08

Hi there ! After 1.1.7 had been running for about a month without any problems, radiusd has now died silently or completely stuck (it has to be "kill -9"ed) a couple of times. In either case, I get no logs about what's wrong. My platform is Solaris 10/x64 with quite current patches. Are there any known issues? TIA fw

2 1

accounting - no huntgroups
by Phil Mayers 13 Feb '08

13 Feb '08

I've never had cause to look at it before, but I discovered today that accouting doesn't support huntgroups; specifically, an attempt to match on Huntgroup-Name in acct_users Is this expected? How does one normally specify Acct-Type based on a huntgroup, if (say) the Class attribute is already being used?

4 6

Re: I can't get 'access-accept' from Linux clients (SOLVED)
by Sergio Belkin 13 Feb '08

13 Feb '08

2008/1/10, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk>: > Hi, > > Hi, > > I can't still figure it out why I can't access from Linux clients. > > I use version 1.1.7 of freeradius. Linux client is a Fedora 8 system. > > what is the linux client config? > > i see the following in your debug > > rlm_eap: Request found, released from the list > rlm_eap: EAP/md5 > rlm_eap: processing type md5 > rlm_eap_md5: User-Password is required for EAP-MD5 authentication > rlm_eap: Handler failed in EAP/md5 > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 84 > modcall: leaving group authenticate (returns invalid) for request 84 > auth: Failed to validate the user. > > > i would also advise that you upgrade to 2.0.0 - not only could this > issue be resolves anyway - its a hell of a lof easier to debug - far > less EAP messages! > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > Well, Finally I get the blessed "Access-Accept" for Linux clients too. How I did that? Well, I upgraded to radius 2.0.1. maybe it could be helpful for many people my settings, well I won't hide as alchemy secret ;) radiusd.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = xxx.qq.yyy.pp port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } $INCLUDE ${confdir}/eap.conf mschap { use_mppe = no require_encryption = yes } ldap { server = "ldap.cadorna.biz" port = 636 identity = "cn=freeradius,ou=applications,dc=cadorna,dc=biz" password = sambombas basedn = "ou=people,dc=palermo,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_debug = 0x0028 tls_cacertfile = /etc/raddb/cacert.pem tls_randfile = /dev/urandom tls_require_cert = "allow" access_attr = "radiusAllowed" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess eap files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } eap.conf: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no md5 { } tls { certificate_file = /etc/pki/tls/certs/pepe.xp-crt.pem private_key_file = /etc/pki/tls/certs/pepe.xp-key.pem CA_file = /etc/pki/tls/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes copy_request_to_tunnel = no use_tunneled_reply = no } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } users: DEFAULT Ldap-UserDN = `uid=%{User-Name},ou=people,dc=cadorna,dc=biz` DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP Enjoy ;) and thanks for your support!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 1

help.. MD5 with PAP
by cengiz co�kun 13 Feb '08

13 Feb '08

Hi, I have configured freeradius 2.0.0 EAP-ttls and configured a mysql db to store the users. It was working fine until i recently decided to convert the database-stored passwords to md5 encryption. Since then, i am getting the below output, despite all my efforts. I tried all the things i could find on the internet with no result. Can anybody help? ( I am a beginner for freeradius server, so it may be very simple though) . Kind regards, I have authenticate { Auth-Type PAP { pap } Auth-Type md5 { pap } in the authenticate section, and pap { encryption_scheme = md5 authtype = md5 auto_header = yes } in the modules/radiusd.conf file. I have the following in my mysql - radcheck definition. +----+----------------------+----------------+----+----------------------------------+----------------------+ | id | username | attribute | op | value | operator | +----+----------------------+----------------+----+----------------------------------+----------------------+ | 90 | t1 | Crypt-Password | := | 83f1535f99ab0bf4e9d02dfd85d3e3f7 | cengiz | and the following in radgroupcheck table. +----+-----------+--------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------+ | 1 | dynamic | Auth-Type | := | MD5 | | 2 | dynamic | Service-Type | == | Framed-User | +----+-----------+--------------+----+-------------+ radiusd -X radtest t1 t1 10.1.1.170 0 testing123 rad_recv: Access-Request packet from host 10.1.1.170 port 32878, id=131, length=54 User-Name = "t1" User-Password = "t1" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.1.1.170/auth-detail-20080213 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.1.1.170/auth-detail-20080213 expand: %t -> Wed Feb 13 13:36:39 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "t1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{User-Name} -> t1 rlm_sql (sql): sql_set_user escaped user --> 't1' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 't1' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 't1' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 't1' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "t1" rlm_pap: No password configured for the user. Cannot do authentication ++[pap] returns fail auth: Failed to validate the user. Login incorrect: [t1/t1] (from client testUserShortName port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> t1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 131 to 10.1.1.170 port 32878 Waking up in 4.9 seconds. Cleaning up request 0 ID 131 with timestamp +2 Ready to process requests. ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

2 1

RE: I can't get 'access-accept' from Linux clients
by Ivan Kalik 13 Feb '08

13 Feb '08

... >rlm_ldap: Added password {SSHA}F8XliBuxscoShNf0k7RxlC7niB7ISswp in check items ... >rlm_eap_md5: User-Password is required for EAP-MD5 authentication ... You can't use encrypted passwords with EAP-MD5. http://deployingradius.com/documents/protocols/compatibility.html Ivan Kalik Kalik Informatika ISP

5 10

Could not link driver rlm_sql_mysql
by johnson elangbam 13 Feb '08

13 Feb '08

Hi Alan, Thanks for helping me in configuring my freeradius with mysql. I've uncommented the "sql" in the file /usr/local/etc/raddb/sites-enabled/default . And now I've seen message trying to commucinate with mysql. But still there is a problem of not getting the mysql driver. I am using MySql 4.1.2. Please suggest to work out. Here is the piece of output emphasizing the errors. rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[123]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[33]: Errors parsing authorize section. With Regards, Elangbam Johnson

2 1

MLPPP - Maybe off topic
by Tony Spencer 13 Feb '08

13 Feb '08

Hi Apologises if this isn’t really a Freeradius question, although maybe someone on the list has encountered the issue we have and may have a solution. We are trying to bond 2 DSL lines for a customer who has 2 phone lines and 2 DSL circuits in his office. For some reason it is not working as we would expect. My understanding is that both DSL circuits have to connect using the same username/password and we have to add: Cisco-Avpair = "preauth:ppp-multilink=1" To the users Radius profile. Although both DSL routers connect it gives some very strange routing issues. And things that web pages can’t be viewed. We are terminating DSL on a Cisco 7304 over L2TP. We know the Cisco does MLPPP and we can see it does bond some connections for some reason, no idea why, but we see them. Am I doing some wrong? Thanks in advance. Tony No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.19.21/1265 - Release Date: 07/02/2008 11:17

3 3

checkval - Calling-Station-Id
by Rob Wroblewski 13 Feb '08

13 Feb '08

Hi I use freeradius 1.1.7 (PLD Linux distribution). In default configuration freeradius work OK but I have problem checking Calling-Station-Id - for check mac adres client validation. My user file contains: "Waldi" User-Password == "12345", It's working. It also works when I add ip verification: "Waldi" User-Password == "12345", Client-IP-Address == "192.168.1.10" But after adding mac verification always got Access-Reject "Waldi" User-Password == "12345", Client-IP-Address == "192.168.1.10", Calling-Station-Id == "xxxxxxxxxxxx" xxxxxxxxxxxx - client mac adress. For test I use NTRadPing Test Utility 1.5. In radiusd.conf: checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string notfound-reject = yes } What is wrong or what did I forgot about?

1 0