- Freeradius-Users - lists.freeradius.org

"Acct-Status-Type FAILED" for SQL backend, are SQL actions customizable now?
by Iñaki Baz Castillo 08 Feb '08

08 Feb '08

Hi, as user of OpenSer I do radius accounting using MySQL backend. For non established calls (busy, not found, cancelled...) OpenSer generates: "Acct-Status-Type 15" RFC2866 says: "15 Reserved for Failed" But FreeRadius doesn't support FAILED action using SQL accounting (that would be "accounting_failed_query", but requires source patching). I read a thread [1] about this exactly issue in which Alan DeKok says: "On the good side, we plan on making some changes to the SQL module that make the patch unnecessary, but will still have the functionality you want." So the actions would be customizable via editing sql.conf file, with no need of patching code. This thread is from November 2006, is it already implemented? in that case, which versions do include it? what about Debian packages? Thanks a lot for any response. [1] http://www.openser.org/pipermail/devel/2006-November/004375.html -- Iñaki Baz Castillo ibc(a)in.ilimit.es

2 1

radius stops authenticating users
by Andrew D Kirch 08 Feb '08

08 Feb '08

The top login attempt doesn't work, and the bottom one does. Restarting radius doesn't fix the problem, but rebooting the server it's running on does. This is the 1.1.7 package for Debian Linux, the NAS is a Cisco AS5300. Below is the output from freeradius -X for a working and a failed login session for the same user. Further debug logs avaialable upon request. Thanks in advance for your help. modcall: entering group preacct for request 14 modcall[preacct]: module "preprocess" returns noop for request 14 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 208.64.35.3,NAS-IP-Address = 208.64.35.3,Acct-Session-Id = "000E79BC",User-Name = "skyhawk(a)k-inc.com"' rlm_acct_unique: Acct-Unique-Session-ID = "c27a6dc7ba7ef40a". modcall[preacct]: module "acct_unique" returns ok for request 14 rlm_realm: Looking up realm "k-inc.com" for User-Name = "skyhawk(a)k-inc.com" rlm_realm: No such realm "k-inc.com" modcall[preacct]: module "suffix" returns noop for request 14 modcall[preacct]: module "files" returns noop for request 14 modcall: leaving group preacct (returns ok) for request 14 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 14 radius_xlat: '/var/log/freeradius/radacct/208.64.35.3/detail-20080208' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/208.64.35.3/detail-20080208 modcall[accounting]: module "detail" returns ok for request 14 modcall[accounting]: module "unix" returns ok for request 14 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'skyhawk(a)k-inc.com' modcall[accounting]: module "radutmp" returns ok for request 14 rlm_ippool: Searching for an entry for nas/port: 208.64.35.3/1 rlm_ippool: Deallocated entry for ip/port: 208.64.35.241/1 rlm_ippool: num: 0 modcall[accounting]: module "main_pool" returns ok for request 14 modcall: leaving group accounting (returns ok) for request 14 Sending Accounting-Response of id 47 to 208.64.35.3 port 1646 Finished request 14 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 4 modcall[preacct]: module "preprocess" returns noop for request 4 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 208.64.35.3,NAS-IP-Address = 208.64.35.3,Acct-Session-Id = "000E79BC",User-Name = "skyhawk(a)k-inc.com"' rlm_acct_unique: Acct-Unique-Session-ID = "c27a6dc7ba7ef40a". modcall[preacct]: module "acct_unique" returns ok for request 4 rlm_realm: Looking up realm "k-inc.com" for User-Name = "skyhawk(a)k-inc.com" rlm_realm: No such realm "k-inc.com" modcall[preacct]: module "suffix" returns noop for request 4 modcall[preacct]: module "files" returns noop for request 4 modcall: leaving group preacct (returns ok) for request 4 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 4 radius_xlat: '/var/log/freeradius/radacct/208.64.35.3/detail-20080208' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/208.64.35.3/detail-20080208 modcall[accounting]: module "detail" returns ok for request 4 modcall[accounting]: module "unix" returns ok for request 4 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'skyhawk(a)k-inc.com' modcall[accounting]: module "radutmp" returns ok for request 4 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "main_pool" returns noop for request 4 modcall: leaving group accounting (returns ok) for request 4 Sending Accounting-Response of id 41 to 208.64.35.3 port 1646 Finished request 4

2 1

FreeRadius origin country
by malaya.kishore＠wipro.com 08 Feb '08

08 Feb '08

Hi, Greetings, I wish to post the below question: What is the origin country name of "FreeRadius"? Thank you. Kind Regards, Kishore The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

no start of radiusd after reboot : mysql connection error
by mailinglists 08 Feb '08

08 Feb '08

Hello, I use freeradius-1.1.3-1.2.el5 and freeradius-mysql-1.1.3-1.2.el5. the mysql database (mysql-server-5.0.22-2.1.0.1) is hosted on a remote host (both centos5). When I use /etc/init.d/radiusd as root it starts up correctly. But when the service is launched at boot time, I get this error-log : Wed Feb 6 16:17:46 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Feb 6 16:17:46 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Attempting to connect to radius@192.168.1.1:/radius Wed Feb 6 16:17:46 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@192.168.1.1:radius Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '192.168.1.1' (113)' Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Feb 6 16:17:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): generate_sql_clients() returned error Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[14]: sql: Module instantiation failed. Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1844] Unknown module "sql". Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1773] Failed to parse authorize section. I set a tcpdump on the mysql-server host, and during the boot of my freeradius server, I see no traffic comming from freeradius host. There is no reject in the firewall. I've tried to put the radius rc.d script in S99 to start it as late as possible, but nothing changes. I also noticed that it doesen't seem to retry to connect to the database later. Or is it after a long time ? Is this a bug ? Where is the retry time configured (I cant try to set up to 5 seconds) ? Thanks for answers Laetitia.

4 11

How to change the key on ippool
by Luis Galan 08 Feb '08

08 Feb '08

Hi! I have a problem with my dialup users with a dynamic pool of ip addresses. My RAS provider don't send me the right Port-id nor Cisco-NAS-Port (always send me a 0 value for all users). I use ippool module to assign dynamic ip addresses. Then I have to change the key on my pool configuration. By default is: key = "%{NAS-IP-Address} %{NAS-Port}" I have changed to that: key = "%{NAS-IP-Address} %{Acct-Session-Id}" Question: Is it the right choice? or Should I use key = "%{NAS-IP-Address} %{Acct-Unique-Session-Id}"? Do I have to change something else? After that, (I am not sure if this is working well), rlm_ippool_tool doesn't show me how the pool are (how many ip addresses are assigned). Could I do something about it to show me the ip addresses assigned? Thanks.

2 1

Check for LDAP source in users?
by Kolbjørn Barmen 08 Feb '08

08 Feb '08

I have an LDAP server with sets of users. The only thing that seperate the different groups of users is the DN itself, group1 of users are located under ou=group1,o=bla,c=no, group2 of users are locate under ou=group2,o=bla,c=no and so forth. I want to send different attributes for the different groups. There are no groupMemberShip or groupName attributes available that I can trust, I just want to check if the DN contains the string "ou=group1,o=bla,c=no" or "ou=group2,o=bla,c=no" etc. I have tried setting up two LDAP entries (ldap1 and ldap2), each with the above DNs as basedn, but is there a way to create DEFAULT-entrie in the users file that will check which the user mathes? Suggestions? Thanks alot. -- Kolbjørn Barmen UNINETT Driftsenter

1 0

PEAP MSCHAP Problem
by Grooz, Marc (regio iT) 08 Feb '08

08 Feb '08

Hello, we have a strange problem with the PEAP MSCHAP authentication truh WLAN. We use freeradius 1.1.7 on debian etch. 1. If we auth a ActiveDirectory User with automatic sending of username and password to our wlan everthing is OK. No lan-cabel is connected. In my case the Username is DOMAIN\\GroozMarc. 2. If we auth the same user with a lan-cabel connected. the auth fails. In this case the Username is DOMAIN\\groozmarc 3. If we auth the user without automatic sending of username and password and enter DOMAIN\\groozmarc and have lan connected everthing fine. Her is an output from case 2: rad_recv: Access-Request packet from host x , id=11, length=303 User-Name = "DOMAIN\\groozmarc" Calling-Station-Id = "x" Called-Station-Id = "x" NAS-Port = 2 NAS-IP-Address = x NAS-Identifier = "x" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "27" EAP-Message = 0x020a006a1900170301005fca5e86c4de36db061ffe1fc7f358599fa78cd53e221d2899 73525b8ed1328424653bad8e457757c9ae67d167a60b6 0585b1c37d22ed1377e9ed39b37901e7cf213d6a306ef154326ca0f6c2aad68111681c24 4b1523668e9effcfd97e1a216 State = 0xc1c18b62ee37419ada28a725693523d4 Message-Authenticator = 0x8dd2ca9d8fc2a09f7dcaef11b100f2c6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 PEAP: Setting User-Name to DOMAIN\groozmarc PEAP: Adding old state with 6a 6f PEAP: Sending tunneled request EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\groozmarc" State = 0x6a6f2590246560c8fdcd054d188cbb3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 83 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 39 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for groozmarc with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=DOMAIN' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=groozmarc' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: e9 radius_xlat: '--challenge=d5ab398544877442' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=b828c2bcb15e3c9ddaba50c2e6933328d1849c510dc92510' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 39 modcall: leaving group MS-CHAP (returns reject) for request 39 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 39 modcall: leaving group authenticate (returns reject) for request 39 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [DOMAIN\\groozmarc/<no User-Password attribute>] (from client localhost p ort 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x80148570 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 39 modcall: leaving group authenticate (returns handled) for request 39 hope you can help. thanks! Kind regards Marc Grooz

1 0

radsqlrelay - and default config
by A.L.M.Buxey＠lboro.ac.uk 08 Feb '08

08 Feb '08

hi, I've been looking at the current state of the default (commented out ready for use) radsqlrelay commands in radiusd.conf . for a quick reminder they look like this: # sql_log { # path = "${radacctdir}/sql-relay" # acct_table = "radacct" # postauth_table = "radpostauth" # sql_user_name = "%{%{User-Name}:-DEFAULT}" # # Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '%S', '0', '0', '');" # Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ # '%{Acct-Terminate-Cause}');" # Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" # # Post-Auth = "INSERT INTO ${postauth_table} \ # (username, pass, reply, authdate) VALUES \ # ('%{User-Name}', '%{User-Password:-Chap-Password}', \ # '%{reply:Packet-Type}', '%S');" # } now - whilst radsqlrelay is recommended for those whose accounting DB systems cannot keep up with the real flow of packets - and we recommend it - its not productive to have imho a broken default config. the issues which i can see from this are the following 1) with a default postgres install, those '0' dates are not going to work with the supplied schema for PGSQL - in fact it takes a bit of breaking postgres for such values to work. the simple change is to have a null entry. 2) likewise for MySQL - '0000-00-00 00:00:00' is iirc the correct way of doing it 3) BOTH mysql and postgres (i havent done any looking into oracle) will have issues with the radacct entries - for each of them has another index in the radacct table which cannot be null and must be unique - mysql acctuniqueid varchar(32) NOT NULL default '' KEY acctuniqueid (acctuniqueid) postgres AcctUniqueId VARCHAR(32) NOT NULL such a value is not being provided in the field. which means when the user finally runs radsqlrelay they will be faced with issues. as far as i can see, radpostauth will work fine. so what I'd propose is we get a few folk who are successfully using this function, get their radiusd.conf entries, and have 2 sections for uncommenting - one for postgres and one for mysql. alan

2 2

Newslists
by Keith Dovale - HostworX.co.za 08 Feb '08

08 Feb '08

My Honest opinion of this news list / user group is that it is not helpful at all, it seems if you are not in the click, no one helps, does anyone moderate this or not ? I have posted twice now and no one replies. Regards Keith From: Keith Dovale - HostworX.co.za [mailto:keith@HostworX.co.za] Sent: Thursday, February 07, 2008 9:08 PM To: ' Subject: attr rewrite issue Hi Guys, some help please . I am trying to do a attr rewrite to change an Attribute value then do a check based on the attribute that is changed, if the check fails do another attrib rewrite to the next value and do another check, until either the check fails or passes. There is basically only 4 checks in the group statement in the authorise section which do Attrib rewrite Do check (If it fails do) Attrib rewrite Do check (If it fails do) Attrib check Do rewrite (If it fails do) Attrib check Do rewrite Reject Pass When it runs it checks the reply packet for an attribute Configuration-Token which is defined in the radgroupreply for the users but it seems it cannot find it and gives an error. As below rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 radius_xlat: 'UNSHAPED_NORMAL' rlm_attr_rewrite: No match found for attribute Configuration-Token with value 'SHAPED_NORMAL' radius_xlat: 'UNSHAPED_NORMAL' radius_xlat: 'SHAPED_NORMAL' rlm_attr_rewrite: Changed value for attribute Configuration-Token from 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' rlm_attr_rewrite: Could not find value pair for attribute Configuration-Token modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns ok for request 2 can anyone help

3 5

Unlang in auth-type sections
by Arran Cudbard-Bell 08 Feb '08

08 Feb '08

Hi, EAP type module in autz sets Auth-Type to be EAP, allowing : Auth-Type { eap ... unlang } But it appears the eap module releases the tunneled reply into the current reply list, then everything skips to post-auth. # # Allow EAP authentication. Auth-Type EAP { eap # Parse User-Name sent back from EAP-Tunnel if(ok && "%{reply:User-Name}"){ update request { User-Name := "%{reply:User-Name}" } $INCLUDE ${unlangdir}/uidrewrite.conf } } auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler ++[eap] returns ok Login OK: [anonymous/<via Auth-Type = EAP>] (from client hp-e-its-dev8021x-sw1 port 1 cli 001b63a3a8dd) +- entering group post-auth ++[reply] returns noop Is this intentional ? This is to do with logging with User-Names returned from the inner tunnel. It almost seems like this is something that belongs in the EAP module with an option to copy the User-Name from the tunnelled request to the outer request at the point the tunnelled reply is released. But i'm not sure, still trying to reason out the best way to deal with inner/outer identities. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1