- Freeradius-Users - lists.freeradius.org

FR with MySQL - Stored Procedures
by Gunther 15 May '07

15 May '07

Despite that several people reported that their FreeRadius 1.x installation is working fine with MySQL Stored Procedures, I run into quite some problems. Here my environment: - CentOS 4.4 on Xen Server 3.1 - FreeRadius 1.1.6 - MySQL 5.0.37 Community Edition with INNODB Tables I used a very simple stored procedure to track down the problem: --------------- DELIMITER // DROP PROCEDURE IF EXISTS CheckIt // CREATE PROCEDURE CheckIt () BEGIN SELECT 12345; END// --------------- This routine will always return the value 12345. Anyhow, when I called this procedure from FreeRadius I always go an error: "PROCEDURE myDB.CheckIt can't return a result set in the given context" ----- Sun May 6 07:23:10 2007 : Debug: rlm_sql_mysql: query: CALL CheckIt() Sun May 6 07:23:10 2007 : Debug: rlm_sql_mysql: MYSQL check_error: 1312 received Sun May 6 07:23:10 2007 : Error: rlm_sql (sql): database query error, CALL CheckIt(): PROCEDURE myDB.CheckIt can't return a result set in the given context ----- I then tried to call the same function via a PHP script (w/o FreeRadius involved) and run into the same problem. Then I found the information that it is required for MySQL Stored Procedures to function the client_flag 'CLIENT_MULTI_STATEMENTS' (refer to mysql.h) has to be added to the mysql_real_connect call. After adding it to the call within PHP all worked fine. Then I added the flag to freeradius-1.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql/sql_mysql.c : ----- if (!(mysql_sock->sock = mysql_real_connect(&(mysql_sock->conn), config->sql_server, config->sql_login, config->sql_password, config->sql_db, atoi(config->sql_port), NULL, CLIENT_FOUND_ROWS|CLIENT_MULTI_STATEMENTS))) { ----- ./configure; make; make install Note: CLIENT_MULTI_STATEMENTS automatically also sets CLIENT_MULTI_RESULTS within MySQL Started FreeRadius and procedure calls were accepted and results were correct. ----- Sun May 6 21:29:08 2007 : Debug: rlm_sql_mysql: query: CALL CheckIt() Sun May 6 21:29:08 2007 : Debug: rlm_sql (sql): - sql_xlat finished Sun May 6 21:29:08 2007 : Debug: rlm_sql (sql): Released sql socket id: 0 Sun May 6 21:29:08 2007 : Debug: radius_xlat: '12345' ----- A user can now login and things seem to work fine. But then consecutive MySQL queries started showing new error results: ----- Sun May 6 21:41:42 2007 : Debug: rlm_sql_mysql: MYSQL check_error: 2014 received Sun May 6 21:41:42 2007 : Error: rlm_sql (sql): database query error, <SELECT ... my sql query> : Commands out of sync; you can't run this command now ----- MySQL seems to track the state of each call and when the order of this state is incorrect, MySQL responds with 'CR_COMMANDS_OUT_OF_SYNC' = 'Commands out of sync; you can't run this command now'. >From what I found on the net ... "When the result of a statement isn't freed MySQL gives an error when trying to process a new query" Could it be that there is somewhere a 'mysql_free_result' missing? This is what the MySQL documentation is saying: -------------------- B.1.2.13. Commands out of sync If you get Commands out of sync; you can't run this command now in your client code, you are calling client functions in the wrong order. This can happen, for example, if you are using mysql_use_result() and try to execute a new query before you have called mysql_free_result(). It can also happen if you try to execute two queries that return data without calling mysql_use_result() or mysql_store_result() in between. -------------------- 2.4.16. Upgrading MySQL If, after an upgrade, you experience problems with recompiled client programs, such as Commands out of sync or unexpected core dumps, you probably have used old header or library files when compiling your programs. In this case, you should check the date for your mysql.h file and libmysqlclient.a library to verify that they are from the new MySQL distribution. If not, recompile your programs with the new headers and libraries. -------------------- ... Did that ... When I leave some time between a login/logout/login it works ... Looks like the MySQL status information times out after a short while. Any hints on getting this up and running without changing O/S ? Thanks!

6 27

FreeRADIUS authfile equivalent
by Steve Forman 14 May '07

14 May '07

Greetings, I'm attempting to migrate a RADIUS service from Interlink RADIUS to FreeRADIUS and am running into a bit of a problem I was hoping you could help out with. Basically, I have several different domains which would all be separated by an @ sign plus the name of the domain. What I'd like to do is use separate local "users" files for each of these domains. In Interlink RADIUS, I simply use the "authfile" as the "glue" to make this work. e.g. domain1.com FILE users.domain1.com domain2.com FILE users.domain2.com domain3.com FILE users.domain3.com Each "users.domain.com" file would then contain the username and password for every user in that domain such that if joesmith(a)domain1.com logs in, he will be authenticated with the "joesmith" password contained in "users.domain1.com". However, there is no authfile in FreeRADIUS so the question is: How do I accomplish this same task with FreeRADIUS? Any information would be greatly appreciated. Thanks in advance.

2 1

Freeside Modifications for FreeRADIUS
by Matthew Neumark 14 May '07

14 May '07

Hello, I was wondering if anyone has any modifications that they are willing to share that they have done for freeradius. Such as added attributes and such when provisioning radius accounts. A good example is like Filter-ID for freeradius. I would like to be able to assign users to a specific filter. Another good example would be assigning different dns servers to different clients. I already know how to add it to radreply to give the specific users the information I want I was just wondering if anyone else has anything like this already done. Matt

2 1

Inserting Authentication Packet Attribute at Post-Auth Packet
by Erico Augusto 14 May '07

14 May '07

Hi, is it possible to insert an authentication attribute(from auth packet) to post-auth packet? - I'd like to insert the Authentication Packet : Calling-Station-Id:<User-MAC> at post-auth packet ... Thanks, Erico. __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0

External script problem
by Sándor Szabó 14 May '07

14 May '07

Hi! I have the following problem. I use FreeRadius v1.1.6 on an Ubuntu Edgy Linux I'd like to use authentication and accounting with an external PHP script. I think the radius server is configured well. The radius server send the request to the script, I can read it through the $_ENV variable, but there is the problem. In the request I have more than one 'Digest-Attributes' fields and in the $_ENV variable I see only the last one, because in the array the 'DIGEST_ATTRIBUTES' key's values overwrite each other. How can solve this? Thanks. Regards, Sandor

2 1

Re: LDAP/RACF authentication error
by Marc Giuliani 14 May '07

14 May '07

Can anyone help me on this? > >Hello, > >I am try to set up authentication for Oracle 10g (on Solaris) --> Radius (on Solaris)--> LDAP (on Z/os) --> Racf (on z/os)... > >i was able to get past my last error however now I am getting a "no authentication method found" type of error. Can anyone assist me? > >I have checked that the secret password matches on the LDAP server, radius server and Oracle... > > > > >rad_recv: Access-Request packet from host 10.71.175.19:37544, id=178, length=47 > User-Name = "NBCTST1" > User-Password = "/\265P\251R\344>%P\2022\0144\0165p" > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 >radius_xlat: '/opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070511' >rlm_detail: /opt/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/local/var/log/radius/radacct/10.71.175.19/auth-detail-20070511 > modcall[authorize]: module "auth_log" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "NBCTST1", skipping NULL due to config. > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 1 > modcall[authorize]: module "files" returns notfound for request 1 >rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for request 1 >modcall: leaving group authorize (returns ok) for request 1 >auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user >auth: Failed to validate the user. >Login incorrect: [NBCTST1//\265P\251R\344>%P\2022\0144\0165p] (from client test1 port 0) > WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! >Delaying request 1 for 1 seconds > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Freeradius-Users Digest, Vol 25, Issue 56
by t.drollinger＠i-motion.de 14 May '07

14 May '07

Ich bin am 14. Mai nicht im Haus und kann Ihre Nachricht erst am Dienstag den 15. Mai bearbeiten. In dringenden Fällen wenden Sie sich bitte an Herrn René Böhm (E-Mail: r.boehm(a)i-motion.de) Mit freundlichen Grüßen Tobias Drollinger

1 0

PEAP authentication + LDAP attribute recovery
by Manuel Sánchez Cuenca 14 May '07

14 May '07

Hi all, It is possible to configure freeradius to authenticate users using PEAP and then, for authenticated users, return some RADIUS attributes recovered from a LDAP server, such as Session-Timeout or Framed-IP-Address?. And in that case, how can I configure it? Thanks in adavance -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

2 1

PAM modules
by Ouahiba MACHANI 14 May '07

14 May '07

Hi, Did there anyone who developped a PAM module that operate with radius server? my question is : 1- How does that work ?does it only allow configuration of predefined methodes or could we also programme new PAM module for new/customized authentication methode such as OTP (One Time Password) authentication? 2- could we programme PAM that redirect multiplle authentication requests to different servers and make an "AND" of the received reponses ? 3- how does it work with radius? thanks in advance. Ouahiba.

2 1

free radius 1.1.6 -eap-tls authentication
by anoop_c＠sifycorp.com 14 May '07

14 May '07

Dear all I am using the same AP,same widows client and same root certificate for testing navis as well as free raduis .Root certificate is also installed. Is ther any clue in the debug message? anoop_c(a)sifycorp.com wrote: > Dear all > Thank you for the responses > I am using openssl tool for certificate generation.I have inclided the file xpextensions while generating certificates.The same certificates worked well with Navis radius server and windows xp as client.So this may not be the problem here Is it the SAME windows client, with the SAME root certificate, with the SAME access point, going to FreeRADIUS using the SAME certificate? If it really works for Navis using the same certificate, my guess is that your tests for FreeRADIUS are using a different Windows machine, without the root certificate installed. Alan DeKok.

2 1