- Freeradius-Users - lists.freeradius.org

rlm_sql: processing radcheck & radgroupcheck
by Milan Holub 25 May '07

25 May '07

Hi all, I'm wondering about procedure of precessing radcheck&radgroupcheck database tables. On http://wiki.freeradius.org/Rlm_sql we can read: Group processing then begins if any of the following conditions are met: * The user IS NOT found in radcheck * The user IS found in radcheck, but the check items don't match ... Ok, the first point I can imagine that if the user is not found we still can accept the "generic" user and give him some reply attributes based on further group processing. But the 2nd point I do not understand. Few lines below on wiki we can read: > For any fairly complex setup, it is likely that most of the actual > processing will be done in the groups. In these cases, the user entry in > radcheck will be of limited use except for things like setting the > user's password. In fact in my case(I believe in almost all of the cases) we DO check users against their passwords. If this check fails we should reject the user else we give him reply attributes based on group membership and accept the request. Thus my question is: why to continue in group processing when the check items(password,...) in radcheck do not match? This leads to accepting users giving valid username but incorrect password... Here is my patch which enables read_groups option and targets the issue above(rejects user immediately if it's found that the radcheck failed): Index: src/modules/rlm_sql/rlm_sql.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_sql/rlm_sql.c,v retrieving revision 1.165 diff -u -r1.165 rlm_sql.c --- src/modules/rlm_sql/rlm_sql.c 5 Apr 2007 10:52:37 -0000 1.165 +++ src/modules/rlm_sql/rlm_sql.c 12 Apr 2007 09:54:34 -0000 @@ -57,6 +57,8 @@ offsetof(SQL_CONFIG,tracefile), NULL, SQLTRACEFILE}, {"readclients", PW_TYPE_BOOLEAN, offsetof(SQL_CONFIG,do_clients), NULL, "no"}, + {"read_groups", PW_TYPE_BOOLEAN, + offsetof(SQL_CONFIG,read_groups), NULL, "yes"}, {"deletestalesessions", PW_TYPE_BOOLEAN, offsetof(SQL_CONFIG,deletestalesessions), NULL, "yes"}, {"num_sql_socks", PW_TYPE_INTEGER, @@ -638,6 +640,11 @@ /* * Only do this if *some* check pairs were returned */ + DEBUG2("rlm_sql (%s): check items", inst->config->xlat_name); + vp_listdebug(check_tmp); + DEBUG2("rlm_sql (%s): items found in packet", inst->config->xlat_name); + vp_listdebug(request->packet->vps); + if (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) == 0) { found = 1; DEBUG2("rlm_sql (%s): User found in group %s", @@ -960,6 +967,11 @@ dofallthrough = fallthrough(reply_tmp); pairxlatmove(request, &request->reply->vps, &reply_tmp); pairxlatmove(request, &request->config_items, &check_tmp); + } else { + /* + * check items did not match; do not process groups; return REJECT immediately + */ + return RLM_MODULE_REJECT; } } Hope this helps someone. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 3

FYI : My workaround for freeradius not sending back an Access-Reject on a failed external script
by Patric 25 May '07

25 May '07

Hey guys, Thought it might interest some of you as to how I worked around the problem where freeradius does not return an Access-Reject if my php script does not exit successfully (in my case because a user should be rejected). The original code that checks the exit status of the script is this : src/modules/rlm_exec/rlm_exec.c : /* * Dispatch an exec method */ static int exec_dispatch(void *instance, REQUEST *request) { ... if (result != 0) { radlog(L_ERR, "rlm_exec (%s): External script failed", inst->xlat_name); return RLM_MODULE_FAIL; } ... return RLM_MODULE_OK; } So basically if my script does not return 0, it failed, regardless of its exit status. According to the RLM_MODULE_* definitions : enum { RLM_MODULE_REJECT, /* 0 - immediately reject the request */ RLM_MODULE_FAIL, /* 1 - module failed, don't reply */ RLM_MODULE_OK, /* 2 - the module is OK, continue */ RLM_MODULE_HANDLED, /* 3 - the module handled the request, so stop. */ RLM_MODULE_INVALID, /* 4 - the module considers the request invalid. */ RLM_MODULE_USERLOCK, /* 5 - reject the request (user is locked out) */ RLM_MODULE_NOTFOUND, /* 6 - user not found */ RLM_MODULE_NOOP, /* 7 - module succeeded without doing anything */ RLM_MODULE_UPDATED, /* 8 - OK (pairs modified) */ RLM_MODULE_NUMCODES /* 9 - How many return codes there are */ }; So if I wanted to authenticate a user I should *actually* be returning 2. If I wanted to *reject* the user I should be returning 0. But according to the code above if I return 2 the external script failed, and if I return 0, the external script was successful and my user is authenticated successfully. This is how I changed the logic : I *removed* : ... if (result != 0) { radlog(L_ERR, "rlm_exec (%s): External script failed", inst->xlat_name); return RLM_MODULE_FAIL; } ... And replaced it with : ... switch (result) { case 0: // Rejected return RLM_MODULE_REJECT; break; case 1: // Failed return RLM_MODULE_FAIL; break; case 2: // OK break; case 3: // Handled return RLM_MODULE_HANDLED; break; case 4: // Invalid return RLM_MODULE_INVALID; break; case 5: // UserLock return RLM_MODULE_USERLOCK; break; case 6: // Not Found return RLM_MODULE_NOTFOUND; break; case 7: // No Op return RLM_MODULE_NOOP; break; case 8: // Updated return RLM_MODULE_UPDATED; break; case 9: // Num Codes return RLM_MODULE_NUMCODES; break; default: // Fail return RLM_MODULE_FAIL; break; } ... In this way, if the result is 2 (user is OK), the process will drop out of the switch statement, and process the original code for handling a successful authentication. Now in my external script I can do : exit(2); --> User was accepted. OR exit(0); --> User was rejected. I realise that this is a bit of a contradiction for the external script, because for a reject it is exiting successfully, and for a successful authentication it is in fact failing with exit code 2. BUT in this way I can use the codes determined by freeradius in my external script. I do not think that this is the actual bug that Alan refered to, but it was a problem in my case. The original code is actually correct in that the external script *did* fail, but it was ignoring the exit code to determine what action to take. I believe that the actual bug is that freeradius does not return a reply to the authentication request if the status is set to RLM_MODULE_FAIL. From what I could tell the only time that freeradius replies to a request is if the status is RLM_MODULE_OK, or RLM_MODULE_REJECT and possibly RLM_MODULE_USERLOCK. I hope that this is understandable, I have the whole scenario in my head but its a bit difficult to verbalise... Please advise if any of my presumptions or understandings are incorrect, as I am happy to learn! Thanks for all your responses to my questions, Im back on track now! Patrick ---------------------------------------------------------------------- Get a free email address with REAL anti-spam protection. http://www.bluebottle.com

1 0

Bug 233 and 234 - only match one huntgroup per nas
by Walt Reynolds 25 May '07

25 May '07

I have looked at both of these bugs and am not sure I understand the programming, but I do understand that there seemed to be simple solutions to allowing a NAS to be in more than one huntgroup. One had a patch attached and the other mentions a section that needed to be re-added from a previous version. Neither bug has had any activity since 2005. Is this still something that has not been fixed, or are the fixes in the newer versions that I do not see (nothing in changelog either). If the answer is that it is still not fixed, what is the possibility of getting this resolved? Thanks. -- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

Authenticating many devices using one attribute
by Brian Johnson 25 May '07

25 May '07

Hello -- We're hoping to begin using radius to authenticate logins to our Cisco routers and Cisco switches. Currently, we're going to start with a group of core routers, but would like to make all of our switches authenticate to radius. Being the networking group for the University, our switches are located on many different networks all over campus, and we have ~900. We currently use our radius server to authenticate other services such as modems and the VPN. I'm looking for a radius configuration that's as compact as possible; obviously, when dealing with 900+ devices, using individual ips isn't ideal. Thank you for your help. Brian -- Brian Johnson "And I will be even more undignified than this, and will be humble in my own sight." (2 Samuel 6:22)

2 1

2.0.0-pre1 compile problem on ubuntu
by Norbert Wegener 25 May '07

25 May '07

on an ubuntu 6.06 configure does not show an error with 2.0.0-pre1. Compiling fails: ..... make[6]: Betrete Verzeichnis '/home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/modules/rlm_perl'^M /home/norbert/Desktop/freeradius-server-2.0.0-pre1/libtool --mode=link gcc -release 2.0.0-pre1 \^M -module -export-dynamic -o rlm_perl.la \^M -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/lib/libradius.la \^M `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lpthread^M ^M *** Warning: Linking the shared library rlm_perl.la against the^M *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable!^M gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-2.0.0-pre1.so -o .libs/rlm_perl-2.0.0-pre1.so^M /usr/bin/ld: cannot find -lperl^M .... On the other hand, dpkg shows: dpkg -l|grep libperl ii libperl5.8 5.8.8-7build1 Norbert Wegener

4 3

DB handles dying slowly
by Milan Holub 25 May '07

25 May '07

2 5

missing entry for evaluate.c in Makefile.in
by Milan Holub 25 May '07

25 May '07

Hi Alan, I just compiled cvs head and it fails because of not updated makefile. here is a patch: Index: src/main/Makefile.in =================================================================== RCS file: /source/radiusd/src/main/Makefile.in,v retrieving revision 1.66 diff -u -r1.66 Makefile.in --- src/main/Makefile.in 16 Apr 2007 10:54:19 -0000 1.66 +++ src/main/Makefile.in 25 May 2007 11:59:34 -0000 @@ -8,7 +8,7 @@ listen.c log.c mainconfig.c modules.c modcall.c \ radiusd.c radius_snmp.c \ session.c smux.c threads.c util.c valuepair.c version.c \ - xlat.c event.c realms.c + xlat.c event.c realms.c evaluate.c SERVER_OBJS += $(SERVER_SRCS:.c=.lo) @@ -137,6 +137,9 @@ xlat.lo: xlat.c $(LIBTOOL) --mode=compile $(CC) $(CFLAGS) -c xlat.c +evaluate.lo: evaluate.c + $(LIBTOOL) --mode=compile $(CC) $(CFLAGS) -c evaluate.c + # # Helper programs # Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 1

Freeradius pauses before responding when not running in debug mode
by Patric 25 May '07

25 May '07

Hi all, As per the subject, I have found the following interesting behaviour with freeradius 1.1.6 When running the server in normal mode or in debug level 1 mode : radiusd -y or radiusd -y -x (lowercase x) When sending an access request, the server pauses for a few seconds somewhere in the exec part of the authorize section. When running the server in more verbose debug mode : Radiusd -y -X (uppercase X) This pause does not occur. I am using exec to run external authentication, and would have thought it was my script causing the pause, but it does not appear when running with -X Anybody else experience something like this? Thanks Patrick ---------------------------------------------------------------------- Find out how you can get spam free email. http://www.bluebottle.com

1 0

mysql database limit
by satish patel 25 May '07

25 May '07

Dear ALL I have single machine with model name : Intel(R) Pentium(R) D CPU 2.80GHz + RAM 512 - configuration i am plaing to use freeradius-1.0.0 with mysql with 500 users so what about the performance issue so it will working fine in this configuration or not ???? What is the limit of radacct table in mysql is there any limit of data how much it will go up to data in mysql or any performance issuse with more data ??? $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Download prohibited? No problem! CHAT from any browser, without download.

2 1

RE: freeradius and ntlm_auth howto
by King, Michael 25 May '07

25 May '07

Some things I've noticed from your attached files Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes I've never enabled these before, I'm unaware what affect they will have tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" Did you generate your OWN certs... They one's that ship with the server ARE NOT vailid. You have to generate your own. rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 That doesn't look right BUT YOUR FINAL ANSWER: xec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=b9ee04ca891c7b7d --nt-response=79b960c773fa101929d3bf8e738168e8b6d8ae8cd61f64f0 Exec-Program output: Account locked out (0xc0000234) Exec-Program-Wait: plaintext: Account locked out (0xc0000234) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Your account in the domain is not correct. Looks like it's been disabled or something. Fix that first before you change anymore config files. ________________________________ From: Stieven.Struyf(a)komatsu.eu [mailto:Stieven.Struyf@komatsu.eu] Sent: Monday, November 06, 2006 3:16 AM To: King, Michael Subject: Fw: freeradius and ntlm_auth howto Michael, I sent my reply already to the list, but due to the size(larger than 100k) it had to be reviewed by the admin and after a week it was rejected. Below you can find the mail. Thanks for helping me. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 ----- Forwarded by Stieven Struyf/KEISA/BE/KOMEUR on 11/06/2006 09:13 AM ----- Stieven Struyf/KEISA/BE/KOMEUR 11/02/2006 08:55 AM To FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Subject RE: freeradius and ntlm_auth howtoLink <Notes://BENT63KE/C1257011005324FB/DABA975B9FB113EB852564B5001283EA/625A 148B6EA233CDC125721400531414> I added the debuglog as attachment(as it is a little large to paste here). This is the mschap config: mschap { authtype = MS-CHAP use_mppe = yes require_strong = yes with_ntdomain_hack = yes require_encryption = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu(a)lists.freeradius.org wrote on 10/27/2006 04:36:00 PM: > Let's see if we can get this solved... > > > -----Original Message----- > > Here's the full log: > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.104.254.73:1645, > > This is NOT the full log. The full log would have started with the line > /path/to/radiusd -X > > Some important stuff is printed out there, it helps us help you. > > > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > Did you enable Ntdomain Hack in the MSCHAP module? (See below) > > > Including your radius.conf file would help. > > > > > HOWEVER, first you may want to check your mschap module definition: > > > > > > modules { > > > mschap { > > > ntlm_auth = "/usr/bin/ntlm_auth \ > > > --request-nt-key \ > > > --username=%{mschap:User-Name:-None} \ > > > --domain=%{mschap:NT-Domain:-None} \ > > > --challenge=%{mschap:Challenge:-00} \ > > > --nt-response=%{mschap:NT-Response:-00}" > > > > > > ...all on one line of course. Note the use of the > > "mschap:User-Name" > > > and "mschap:NT-Domain" values. > > Mine radiusd.conf file's mschap section looks like this: > NOTE that I do NOT have the :-00 and the :-None statements, and I DO > have with_ntdomain_hack=yes > > > # Microsoft CHAP authentication > # > # This module supports MS-CHAP and MS-CHAPv2 authentication. > # It also enforces the SMB-Account-Ctrl attribute. > # > mschap { > with_ntdomain_hack = yes > ntlm_auth = "/usr/bin/ntlm_auth \ > --request-nt-key \ > --username=%{mschap:User-Name} \ > --challenge=%{mschap:Challenge} \ > --nt-response=%{mschap:NT-Response} > } > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9