- Freeradius-Users - lists.freeradius.org

Radiusd.conf & dictionary troubleshooting
by Dan Jones 14 Aug '07

14 Aug '07

Hi all and thanks ahead of time for any responders. The scenario: I have been given the task to install a radius server on a Linux platform. After doing some research, I went with Fedora Core 6 and FreeRadius-1.1.7. It's currently running on my HP Laptop for configuring and testing. As for my strength with Linux, I am a novice but learning quickly just by the amount of work I have done so far with this system. As for the guide I have been following so far for a lot of my work: http://www.jrdcorp.com/index.php?option=com_content&task=view&id=22&Itemid=… I have also reviewed several other sites along the way for cross checking information, file names, locations, and etc. After the installation of Fedora Core 6, I updated the system and installed with yum the: openssl-perl, mysql, and libnet. All work has been done under root privilege. So now, on to the trouble code lines. This is the first part of trouble I had but I think I was able to fix it since I didn't see some of these lines again, this is not my actual trouble part. It will follow below this. After checking all my certificates and checking locations, such as CA.all, certs.sh, CA.certs, I get to the point of starting up the radius server. While in the /etc/init.d directory I do, radiusd -s -X rlm_exec: Wait=yes but no output defined. Did you mean output=none? rlm_eap_tls: Loading the certificate file as a chain rlm_eap_tls: SSL error error 00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radius.conf[10]: eap: Module instantiation failed radius.conf[1939] Unknown module "eap". radius.conf[1886] Failed to parse authentication section The SSL error I gathered after researching is ignorable, no errors actually occurred? Anyways, I did some trouble shooting and it looks like a lot was resolved since I didn't see some of these lines again. Now for the last couple lines that I am having trouble with and can't figure out. The last error problems I have seen by running /radiusd -s -X read_config_files: reading directory Errors reading dictionary: dict_init: /etc/raddb/dictionary[14]: Couldn't open dictionary "/usr/local/share/freeradius/dictionary": No such file or directory Errors reading radius.conf For my first troubleshooting and seeing what might work, I copied the dictionary file, i think from the raddb directory, should have made a note, to the directory that the dictionary file points to. The result of that was the same message except for the "No such file or directory", I got a: To many open files. So I canceled that idea and I am stuck with that line. Now for the radiusd.conf file..... I have no clue at all what could be wrong with this. I have checked the radius.log files and it reports the same printouts I have seen but doesn't go any farther. Can anyone possibly shine a light on the direction to go with this? Thanks a lot

2 1

EAP-TLS certificate based authentication in linux
by Anoop 14 Aug '07

14 Aug '07

Hi I have certificate based EAP_TLS authentication working with windows xp clients.Does the same set up works for linux also.For xp clinets i am using p12 and root.der certificates. Regards Anoop ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com

2 1

strip domain
by Ashraf Al-Basti 14 Aug '07

14 Aug '07

Dear, i had did proxying the users based on the domain and the pstn no. using sql query on the radcheck table, but i need to strip the username before proxying it. please advice

1 1

Re: Radius is running away with the CPU
by Scott Lambert 14 Aug '07

14 Aug '07

I am attempting to build a setup which authenticates users from 3 realms in one MySQL database. Some of my users, actually a large proportion of them, are currently not using their realm to authenticate. I am about to merge the dial pools so I won't be able to use huntgroups or hints to figure out which realm they are coming from. I am trying to use the new unlang option to avoid writing an rlm_perl type script. FreeRADIUS-snapshot-20070813 I don't know if any of this is "legal". I'm using one sql module. I just call it once for each realm after changing the %{User-Name} to append that realm. It just looked like it might work so I tried it. The debug output makes it look like I am very close. I haven't been able to figure out exactly what is wrong with it, yet. The failure happens in rlm_pap when the user does not specify a realm. I don't see the cause of the failure in the debug output. I'm probably not interpreting the output correctly. Here are the diffs to the default config coming from the snapshot. -------------------------------------------------------------------- --- radiusd.conf-orig Mon Aug 13 20:42:25 2007 +++ radiusd.conf Mon Aug 13 21:15:41 2007 @@ -210,7 +210,7 @@ # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" - port = 0 + port = 1645 # Type of packets to listen for. # Allowed values are: @@ -252,7 +252,7 @@ listen { ipaddr = * # ipv6addr = :: - port = 0 + port = 1646 type = acct # interface = eth0 # clients = per_socket_clients @@ -1051,7 +1051,7 @@ # # If you're not running a Cisco or Quintum NAS, you don't # need this hack. - with_cisco_vsa_hack = no + with_cisco_vsa_hack = yes } # Livingston-style 'users' file @@ -1214,33 +1214,33 @@ # # See rlm_sql_log(5) manpage. # -# sql_log { -# path = ${radacctdir}/sql-relay -# acct_table = "radacct" -# postauth_table = "radpostauth" -# -# Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ -# NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ -# AcctSessionTime, AcctTerminateCause) VALUES \ -# ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ -# '%{Framed-IP-Address}', '%S', '0', '0', '');" -# Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ -# NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ -# AcctSessionTime, AcctTerminateCause) VALUES \ -# ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ -# '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ -# '%{Acct-Terminate-Cause}');" -# Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ -# NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ -# AcctSessionTime, AcctTerminateCause) VALUES \ -# ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ -# '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" -# -# Post-Auth = "INSERT INTO ${postauth_table} \ -# (user, pass, reply, date) VALUES \ -# ('%{User-Name}', '%{User-Password:-Chap-Password}', \ -# '%{reply:Packet-Type}', '%S');" -# } + sql_log { + path = ${radacctdir}/sql-relay + acct_table = "radacct" + postauth_table = "radpostauth" + + Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ + NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ + AcctSessionTime, AcctTerminateCause) VALUES \ + ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ + '%{Framed-IP-Address}', '%S', '0', '0', '');" + Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ + NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ + AcctSessionTime, AcctTerminateCause) VALUES \ + ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ + '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ + '%{Acct-Terminate-Cause}');" + Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ + NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ + AcctSessionTime, AcctTerminateCause) VALUES \ + ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ + '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" + + Post-Auth = "INSERT INTO ${postauth_table} \ + (user, pass, reply, date) VALUES \ + ('%{User-Name}', '%{User-Password:-Chap-Password}', \ + '%{reply:Packet-Type}', '%S');" + } # # Create a unique accounting session Id. Many NASes re-use --- default-orig Mon Aug 13 21:00:10 2007 +++ default Tue Aug 14 03:30:23 2007 @@ -122,7 +122,56 @@ # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf -# sql + if ( "%{User-Name}" =~ /@/) { + sql + } + else { + update request { + Stripped-User-Name := "%{User-Name}" + User-Name := "%{User-Name}(a)example1.net" + } + sql { + fail = 1 + notfound = 2 + noop = return + ok = return + updated = return + reject = return + userlock = return + invalid = return + handled = return + } + update request { + User-Name := "%{Stripped-User-Name}(a)example2.com" + } + sql { + fail = 1 + notfound = 2 + noop = return + ok = return + updated = return + reject = return + userlock = return + invalid = return + handled = return + } + update request { + User-Name := "%{Stripped-User-Name}(a)example3.net" + } + sql { + fail = 1 + notfound = 2 + noop = return + ok = return + updated = return + reject = return + userlock = return + invalid = return + handled = return + } + } + + # # If you are using /etc/smbpasswd, and are also doing @@ -312,7 +361,7 @@ # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf -# sql + sql # # Instead of sending the query to the SQL server, @@ -339,11 +388,11 @@ # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { - radutmp +# radutmp # # See "Simultaneous Use Checking Queries" in sql.conf -# sql + sql } @@ -364,7 +413,7 @@ # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf -# sql + sql # # Instead of sending the query to the SQL server, -------------------------------------------------------------------- Here are the authentication tests. lambert@sysmon ~ 22:30:33 Mon Aug 13 $ radtest lambert(a)example3.net password1 radtest.example1.net 2 blahblah 2 Sending Access-Request of id 82 to radtest.example1.net port 1645 User-Name = "lambert(a)example3.net" User-Password = "password1" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Framed-Protocol = PPP rad_recv: Access-Accept packet from host radtest.example1.net:1645, id=82, length=32 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP lambert@sysmon ~ 22:33:43 Mon Aug 13 $ radtest lambert password1 radtest.example1.net 2 blahblah 2 Sending Access-Request of id 99 to radtest.example1.net port 1645 User-Name = "lambert" User-Password = "password1" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Framed-Protocol = PPP rad_recv: Access-Reject packet from host radtest.example1.net:1645, id=99, length=20 -------------------------------------------------------------------- And here is the output from "/usr/local/sbin/radiusd -X": Script started on Tue Aug 14 03:33:25 2007 root(a)radtest.example1.net /usr/local/etc/raddb 03:33:25 Tue Aug 14 # /usr/local/sbin/radiusd -X FreeRADIUS Version 2.0.0-pre2, for host i386-unknown-freebsd6.2, built on Aug 13 2007 at 19:41:31 Copyright (C) 2000-2007 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Config: including file: /usr/local/etc/raddb/radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf Config: including file: /usr/local/etc/raddb/sql/mysql/dialup.conf Config: including file: /usr/local/etc/raddb/sql/mysql/counter.conf Config: including files in directory: /usr/local/etc/raddb/sites-enabled/ Config: including file: /usr/local/etc/raddb/sites-enabled/default Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no snmp = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no log_stripped_names = no log_file = "/usr/local/var/log/radius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" } proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } home_server localhost { ipaddr = 127.0.0.1 IP address [127.0.0.1] port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } listen { type = "auth" ipaddr = * port = 1645 client 127.0.0.1 { secret = "testing123" shortname = "localhost" nastype = "other" } } listen { type = "acct" ipaddr = * port = 1646 } radiusd: entering modules setup radiusd: Library search path is /usr/local/lib instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } rlm_exec: wait=yes but no output defined. Did you mean output=none? Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } eap: Linked to sub-module rlm_eap_md5 eap: Instantiating eap-md5 eap: Linked to sub-module rlm_eap_leap eap: Instantiating eap-leap eap: Linked to sub-module rlm_eap_gtc eap: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } eap: Linked to sub-module rlm_eap_tls eap: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } rlm_eap_tls: Loading the certificate file as a chain eap: Linked to sub-module rlm_eap_ttls eap: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } eap: Linked to sub-module rlm_eap_peap eap: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } eap: Linked to sub-module rlm_eap_mschapv2 eap: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "kic7ops83" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = 0 AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = 0" postauth_query = "INSERT INTO radpostauth (user, pass, reply, date) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=sysmon.example1.net,shortname=sysmon,secret=blahblah rlm_sql (sql): Adding client xx.xy.yz.w (sysmon) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } Initializing the thread pool... Listening on authentication address * port 1645 Listening on accounting address * port 1646 Listening on proxy address * port 1647 Ready to process requests. Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host xx.xy.yz.w port 1131, id=82, length=75 User-Name = "lambert(a)example3.net" User-Password = "password1" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Framed-Protocol = PPP +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: Looking up realm "example3.net" for User-Name = "lambert(a)example3.net" rlm_realm: No such realm "example3.net" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 172 ++[files] returns ok ++? if ("%{User-Name}" =~ /@/) expand: %{User-Name} -> lambert(a)example3.net ? Evaluating ("%{User-Name}" =~ /@/) -> TRUE ++? if ("%{User-Name}" =~ /@/) -> TRUE ++- entering if ("%{User-Name}" =~ /@/) expand: %{User-Name} -> lambert(a)example3.net rlm_sql (sql): sql_set_user escaped user --> 'lambert(a)example3.net' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lambert(a)example3.net' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lambert(a)example3.net' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lambert(a)example3.net' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dialup' ORDER BY id rlm_sql (sql): User found in group dialup expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dialup' ORDER BY id rlm_sql (sql): Released sql socket id: 3 +++[sql] returns ok ++- if ("%{User-Name}" =~ /@/) returns ok ++ ... skipping else for request 0: Preceding "if" was taken ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password password1 rlm_pap: Using clear text password. rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> lambert(a)example3.net rlm_sql (sql): sql_set_user escaped user --> 'lambert(a)example3.net' expand: %{User-Password} -> password1 expand: INSERT INTO radpostauth (user, pass, reply, date) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'lambert(a)example3.net', 'password1', 'Access-Accept', '2007-08-14 03:33:43') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'lambert(a)example3.net', 'password1', 'Access-Accept', '2007-08-14 03:33:43') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok Sending Access-Accept of id 82 to xx.xy.yz.w port 1131 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 state 5 Going to the next request Waking up in 4 seconds... Cleaning up request 0 ID 82 with timestamp +15 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host xx.xy.yz.w port 3307, id=99, length=65 User-Name = "lambert" User-Password = "password1" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Framed-Protocol = PPP +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated rlm_realm: No '@' in User-Name = "lambert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 172 ++[files] returns ok ++? if ("%{User-Name}" =~ /@/) expand: %{User-Name} -> lambert ? Evaluating ("%{User-Name}" =~ /@/) -> FALSE ++? if ("%{User-Name}" =~ /@/) -> FALSE ++- entering else expand: %{User-Name} -> lambert expand: %{User-Name}(a)example1.net -> lambert(a)example1.net +++[request] returns ok expand: %{User-Name} -> lambert(a)example1.net rlm_sql (sql): sql_set_user escaped user --> 'lambert(a)example1.net' rlm_sql (sql): Reserving sql socket id: 1 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lambert(a)example1.net' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lambert(a)example1.net' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): User lambert(a)example1.net not found +++[sql] returns notfound expand: %{Stripped-User-Name}(a)example2.com -> lambert(a)example2.com +++[request] returns notfound expand: %{User-Name} -> lambert(a)example2.com rlm_sql (sql): sql_set_user escaped user --> 'lambert(a)example2.com' rlm_sql (sql): Reserving sql socket id: 0 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lambert(a)example2.com' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lambert(a)example2.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 rlm_sql (sql): User lambert(a)example2.com not found +++[sql] returns notfound expand: %{Stripped-User-Name}(a)example3.net -> lambert(a)example3.net +++[request] returns notfound expand: %{User-Name} -> lambert(a)example3.net rlm_sql (sql): sql_set_user escaped user --> 'lambert(a)example3.net' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lambert(a)example3.net' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lambert(a)example3.net' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lambert(a)example3.net' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dialup' ORDER BY id rlm_sql (sql): User found in group dialup expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dialup' ORDER BY id rlm_sql (sql): Released sql socket id: 4 +++[sql] returns ok ++- else returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password password1 rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> lambert(a)example3.net attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Sending delayed reject for request 1 Sending Access-Reject of id 99 to xx.xy.yz.w port 3307 Waking up in 4 seconds... Cleaning up request 1 ID 99 with timestamp +27 Nothing to do. Sleeping until we see a request. root(a)radtest.example1.net /usr/local/etc/raddb 03:38:22 Tue Aug 14 # exit exit Script done on Tue Aug 14 03:38:25 2007 -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

1 1

Re: Configuration issue - unknown client
by Dan O'Reilly 13 Aug '07

13 Aug '07

I had it that way and it didn't work either. At 04:27 PM 8/13/2007, Nicholas Hall wrote: >On 8/13/07, Dan O'Reilly <<mailto:dano@process.com>dano(a)process.com> wrote: >Same issue. Here's my /etc/raddb/clients.conf: > >client <http://192.168.0.11>192.168.0.11 >secret foobar > > >Shouldn't that be: > >client <http://192.168.0.11>192.168.0.11 { > secret = foobar >} > >-- >Nicholas Hall ><mailto:ngharo@gmail.com>ngharo(a)gmail.com >262.208.6271 >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html ------ +-------------------------------+----------------------------------------+ | Dan O'Reilly | "There are 10 types of people in this | | Principal Engineer | world: those who understand binary | | Process Software | and those who don't." | | http://www.process.com | | +-------------------------------+----------------------------------------+

2 1

Re: Configuration issue - unknown client
by Dan O'Reilly 13 Aug '07

13 Aug '07

Same issue. Here's my /etc/raddb/clients.conf: client 192.168.0.11 secret foobar At 04:15 PM 8/13/2007, Nicholas Hall wrote: >On 8/13/07, Dan O'Reilly <<mailto:dano@process.com>dano(a)process.com> wrote: >This is my first stab at Freeradius. I have the server installed on >Sabayon Linux, and the radtest script runs fine. I've done basically no >configuration to it, because I'm not sure what to configure. > >I'm writing a client on another system (it's VMS if that's germane). I >format & send a request packet to the server system, and get (running >radiusd -X): > >rad_recv: Access-Request packet from host ><http://192.168.0.11:1812>192.168.0.11:1812, id=67, length=47 >Ignoring request from unknown client ><http://192.168.0.11:1812>192.168.0.11:1812 > > >You need to add new clients to clients.conf. FreeRADIUS will only talk to >clients in this file. > >-- >Nicholas Hall ><mailto:ngharo@gmail.com>ngharo(a)gmail.com >262.208.6271 >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html ------ +-------------------------------+----------------------------------------+ | Dan O'Reilly | "There are 10 types of people in this | | Principal Engineer | world: those who understand binary | | Process Software | and those who don't." | | http://www.process.com | | +-------------------------------+----------------------------------------+

2 1

radius client in on Server, Freeradius on another Server
by ram 13 Aug '07

13 Aug '07

Hi I have radius client installed in my server and freeradius and mysql installed in other server how can i connect them ? what configs i need to change ram

2 2

Configuration issue - unknown client
by Dan O'Reilly 13 Aug '07

13 Aug '07

This is my first stab at Freeradius. I have the server installed on Sabayon Linux, and the radtest script runs fine. I've done basically no configuration to it, because I'm not sure what to configure. I'm writing a client on another system (it's VMS if that's germane). I format & send a request packet to the server system, and get (running radiusd -X): rad_recv: Access-Request packet from host 192.168.0.11:1812, id=67, length=47 Ignoring request from unknown client 192.168.0.11:1812 I'm sure I don't have the server configured properly. So, what am I missing? Thanks! ------ +-------------------------------+----------------------------------------+ | Dan O'Reilly | "There are 10 types of people in this | | Principal Engineer | world: those who understand binary | | Process Software | and those who don't." | | http://www.process.com | | +-------------------------------+----------------------------------------+

2 1

Re: Error running FreeRadius 1.1.7
by George Beitis 13 Aug '07

13 Aug '07

Hi Alan, i removed all the dictionary files as you recommended and any other freeradius related file on the system, i even made a package using the freeradius build guide and installed and uninstalled it. The problems i have remain the same. This is what i get for my output. The only dictionaries on my system are under usr/share/freeradius regards George /usr/sbin/freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess /etc/freeradius/hints[37]: Parse error (check) for entry DEFAULT: Unknown value Yes for attribute Strip-User-Name rlm_preprocess: Error reading /etc/freeradius/hints radiusd.conf[1021]: preprocess: Module instantiation failed. radiusd.conf[1802] Unknown module "preprocess". radiusd.conf[1792] Failed to parse authorize section. > > > Alan DeKok wrote: > >> George Beitis wrote: >> >> >>> Thanks for the reply Alan, i was running version 1.1.1 before. I >>> deleted the raddb directory, what else should i delete before making a >>> clean install? >>> >>> >> That should have worked. >> >> Read the debug output to see which dictionary files it's loading. >> Make sure you've installed the ones from 1.1.7, and that the server is >> using them. >> >> Alan DeKok. >> >> >> >> > > >

2 2

Problem on WPA-EAP with Linux
by Alexandros Gougousoudis 13 Aug '07

13 Aug '07

Hi, I'am having trouble to authenticate my linux workstations with wpa_supplicant to Freeradius (1.1). The Windows Stations are working fine, but linux is making trouble. The AP is a Linksys WLAN Accesspoint, as said WPA Radius works, because all Windows Notebooks can login. I'am doing a WPA over EAP. And my Error is: Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request After switching on my debug I see this: rlm_eap: NAK asked for bad type 0 rlm_eap: Failed in EAP select Which is most certanly the reason why the auth fails. But I'am far away from knowing the solution. Can you help please? Below the complete Log of the conversation: rad_recv: Access-Request packet from host 10.48.244.28:3073, id=1, length=131 User-Name = "scit-acer" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "0016cfab64e4" NAS-Identifier = "0016b64f44cc" NAS-Port = 43 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000e01736369742d61636572 Message-Authenticator = 0x8b86db463306f78257b8e03600912a5b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry scit-acer at line 14 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 1 to 10.48.244.28 port 3073 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb2f2a1559ef1683126762202eeec3974 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.244.28:3073, id=1, length=141 User-Name = "scit-acer" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "0016cfab64e4" NAS-Identifier = "0016b64f44cc" NAS-Port = 43 Framed-MTU = 1400 State = 0xb2f2a1559ef1683126762202eeec3974 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060300 Message-Authenticator = 0x9a1a879ecba47ab01f2f3410625ceabc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry scit-acer at line 14 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for bad type 0 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect: [scit-acer] (from client khb-buehring port 43 cli 0016cfab64e4) Delaying request 1 for 1 seconds Finished request 1 TIA Alex

3 3