- Freeradius-Users - lists.freeradius.org

Re: a problem about radius and ldap [SOLVED]
by Ramazan Ulker 15 Feb '07

15 Feb '07

Hi Sorry for too many mails. Problem solved by setting identity and password in radius.conf with proper user in ldap. I managed to get User-Password from ldap at the end as shown below. rlm_ldap: Added password ramazan in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userpassword as User-Password, value ramazan & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusClass as Class, value employee & op=11 rlm_ldap: user ramazan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Login OK: [ramazan/<no User-Password attribute>] (from client ldapsrv port 50001 cli 00-12-79-AE-D2-4D) On 1/29/07, Ramazan Ulker <ulkerra(a)gmail.com> wrote: > > > > Hi > > I'm working on 802.1x implementation(cisco 2950, freeradius, ldap), i face a problem. First of all, defining users and passwords in users file in raddb works well with md5 authentication. Then i tried to use ldap, then with radtest i get accept-accept packet. But while authenticating from xp client with md5-challenge, I got > > Auth:rlm_ldap:Attribute "User-Password" is required for authentication > > error. In one of the e-mail you said don't authenticate from ldap, but with radtest function i get success!!! The passwords are kept clear text. I'm looking forward to getting your help. I also send radius debug log. > > Best Regards > > Ramazan > > > > > > Starting - reading configuration files ... > > reread_config: reading radiusd.conf > > Config: including file: /etc/raddb/proxy.conf > > Config: including file: /etc/raddb/clients.conf > > Config: including file: /etc/raddb/snmp.conf > > Config: including file: /etc/raddb/sql.conf > > main: prefix = "/usr" > > main: localstatedir = "/var" > > main: logdir = "/var/log/radius" > > main: libdir = "/usr/lib/freeradius" > > main: radacctdir = "/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = yes > > main: log_file = "/var/log/radius/radius.log" > > main: log_auth = yes > > main: log_auth_badpass = yes > > main: log_auth_goodpass = yes > > main: pidfile = "/var/run/radiusd/radiusd.pid" > > main: user = "radiusd" > > main: group = "radiusd" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/sbin/checkrad" > > main: proxy_requests = yes > > proxy: retry_delay = 5 > > proxy: retry_count = 3 > > proxy: synchronous = no > > proxy: default_fallback = yes > > proxy: dead_time = 120 > > proxy: post_proxy_authorize = yes > > proxy: wake_all_if_all_dead = no > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > > read_config_files: reading dictionary > > read_config_files: reading naslist > > read_config_files: reading clients > > read_config_files: reading realms > > radiusd: entering modules setup > > Module: Library search path is /usr/lib/freeradius > > Module: Loaded expr > > Module: Instantiated expr (expr) > > Module: Loaded PAP > > pap: encryption_scheme = "crypt" > > Module: Instantiated pap (pap) > > Module: Loaded CHAP > > Module: Instantiated chap (chap) > > Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: passwd = "(null)" > > mschap: authtype = "MS-CHAP" > > Module: Instantiated mschap (mschap) > > Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > > Module: Instantiated unix (unix) > > Module: Loaded LDAP > > ldap: server = "192.168.100.18" > > ldap: port = 389 > > ldap: net_timeout = 1 > > ldap: timeout = 4 > > ldap: timelimit = 3 > > ldap: identity = "" > > ldap: start_tls = no > > ldap: password = "" > > ldap: basedn = "dc=dot1x.com" > > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > > ldap: default_profile = "(null)" > > ldap: profile_attribute = "(null)" > > ldap: password_header = "(null)" > > ldap: password_attribute = "userPassword" > > ldap: access_attr = "radiusgroupname" > > ldap: groupname_attribute = "cn" > > ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > ldap: groupmembership_attribute = "radiusGroupName" > > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > > ldap: ldap_debug = 0 > > ldap: ldap_connections_number = 5 > > ldap: compare_check_items = no > > ldap: access_attr_used_for_allow = yes > > conns: (nil) > > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link > > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network > > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone > > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > > rlm_ldap: LDAP userPassword mapped to RADIUS User-Password > > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type > > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id > > conns: 0x8101f58 > > Module: Instantiated ldap (ldap) > > Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > rlm_eap: Loaded and initialized the type md5 > > rlm_eap: Loaded and initialized the type leap > > Module: Instantiated eap (eap) > > Module: Loaded preprocess > > preprocess: huntgroups = "/etc/raddb/huntgroups" > > preprocess: hints = "/etc/raddb/hints" > > preprocess: with_ascend_hack = no > > preprocess: ascend_channels_per_line = 23 > > preprocess: with_ntdomain_hack = no > > preprocess: with_specialix_jetstream_hack = no > > preprocess: with_cisco_vsa_hack = no > > Module: Instantiated preprocess (preprocess) > > Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > Module: Instantiated realm (suffix) > > Module: Loaded files > > files: usersfile = "/etc/raddb/users" > > files: acctusersfile = "/etc/raddb/acct_users" > > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > > files: compat = "no" > > Module: Instantiated files (files) > > Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" > > Module: Instantiated acct_unique (acct_unique) > > Module: Loaded detail > > detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > > Module: Instantiated detail (detail) > > Module: Loaded radutmp > > radutmp: filename = "/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > > Module: Instantiated radutmp (radutmp) > > Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp. > > Ready to process requests. > > rad_recv: Access-Request packet from host 192.168.100.17:1812, id=11, length=129 > > NAS-IP-Address = 192.168.100.17 > > NAS-Port = 50001 > > NAS-Port-Type = Ethernet > > User-Name = "ramazan" > > Called-Station-Id = "00-0F-8F-77-DB-81" > > Calling-Station-Id = "00-12-79-AE-D2-4D" > > Service-Type = Framed-User > > Framed-MTU = 1500 > > EAP-Message = 0x0200000c0172616d617a616e > > Message-Authenticator = 0x68c41631d4feb2234d900b37a9845348 > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > rlm_eap: EAP packet type notification id 0 length 12 > > rlm_eap: EAP Start not found > > modcall[authorize]: module "eap" returns updated for request 0 > > rlm_realm: No '@' in User-Name = "ramazan", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > users: Matched DEFAULT at 152 > > rlm_ldap: Entering ldap_groupcmp() > > radius_xlat: 'dc=dot1x.com' > > radius_xlat: '(uid=ramazan)' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: attempting LDAP reconnection > > rlm_ldap: (re)connect to 192.168.100.18:389, authentication 0 > > rlm_ldap: bind as / to 192.168.100.18:389 > > rlm_ldap: waiting for bind result ... > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > ldap_release_conn: Release Id: 0 > > radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in dc=dot1x.com, with filter (&(cn=VPN)(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))) > > rlm_ldap: object not found or got ambiguous search result > > ldap_release_conn: Release Id: 0 > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in uid=ramazan,cn=users,cn=idc,dc=dot1x.com, with filter (objectclass=*) > > rlm_ldap::ldap_groupcmp: User found in group VPN > > ldap_release_conn: Release Id: 0 > > users: Matched DEFAULT at 171 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_ldap: - authorize > > rlm_ldap: performing user authorization for ramazan > > radius_xlat: '(uid=ramazan)' > > radius_xlat: 'dc=dot1x.com' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > rlm_ldap: checking if remote access for ramazan is allowed by radiusgroupname > > rlm_ldap: looking for check items in directory... > > rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 > > rlm_ldap: looking for reply items in directory... > > rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 > > rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 > > rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 > > rlm_ldap: Adding radiusClass as Class, value group-net & op=11 > > rlm_ldap: user ramazan authorized to use remote access > > ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns ok for request 0 > > modcall: group authorize returns updated for request 0 > > rad_check_password: Found Auth-Type ldap > > auth: type "LDAP" > > modcall: entering group Auth-Type for request 0 > > rlm_ldap: - authenticate > > rlm_ldap: Attribute "User-Password" is required for authentication. > > modcall[authenticate]: module "ldap" returns invalid for request 0 > > modcall: group Auth-Type returns invalid for request 0 > > auth: Failed to validate the user. > > Login incorrect: [ramazan/<no User-Password attribute>] (from client radius port 50001 cli 00-12-79-AE-D2-4D) > > Delaying request 0 for 1 seconds > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Sending Access-Reject of id 11 to 192.168.100.17:1812 > > Waking up in 4 seconds... >

1 0

strip unwanted characters from reply message
by Cory Robson 15 Feb '07

15 Feb '07

I have failed logins being dumped into a table in myslq and am getting a lot of unwanted characters. IE: Password Has Expired=5Cr=5Cn Is there a way I can tell it to only supply the textual content Thanks Cory

1 0

Multiple SSL CA Files
by Michael Courtney 15 Feb '07

15 Feb '07

Freeradius List, I have Freeradius 1.1.3 running on a Fedora Core 6 box, and it works great in the current setup. My question has to do with a configuration change that I'm having trouble implementing. Right now, I have an in-house CA Cert that was generated for our servers that sit behind a firewall. The Radius server connects to our LDAP box via a hole in the firewall over an SSL connection that was generated with our internal CA Cert. I would like to have two SSL certs on the Radius box: one, for the internal connections to our servers, and two, an SSL cert that one can verify as a trusted Root Authority for the TTLS connections. This is causing an issue right now on the server. I have the following LDAP fields in radiusd.conf: tls_cacertfile = /etc/lfncerts/cacert.pem tls_certfile = /etc/lfncerts/ldap2_public_cert.pem tls_keyfile = /etc/lfncerts/ldap2_private_key.pem I have the following fields in the eap.conf: private_key_file = /etc/lfnnewcerts/radius.lawrencefreenet.org.key certificate_file = /etc/lfnnewcerts/radius.lawrencefreenet.org.crt CA_file = /etc/lfnnewcerts/rapidssl_01.cer Here's the output in the logs: Feb 14 12:47:26 radius kernel: audit(1171478846.538:8): avc: denied { read } for pid=10837 comm="radiusd" name="radius.lawrencefreenet.org.crt" dev=dm-0 ino=1310741 scontext=root:system_r:radiusd_t:s0 tcontext=root:object_r:user_home_t:s0 tclass=file As you can see, the CA_files are different, since they are signed by different certificate authorities. I have tried this configuration and 777'ed each of the files to no avail. Is the configuration I'm trying to implement possible? Any help that you can offer would be greatly appreciated! Thanks for your time! -Mike

2 1

Freeradius dies if it cant resolve clients...
by "Jóhann B. Guðmundsson" 15 Feb '07

15 Feb '07

I had the unfortunate experience for my radius daemon to die when it couldn't resolve one client in clients.conf Is there any particular reason for radius not to spew out error message to the logs and declare the client "dead" or "unresolvable " and continue to function or is this just bad programming.... Best regards Johann B. -- Jóhann B. Guðmundsson. RHCE,CCSA Unix Kerfistjóri. Kerfistjórn. Reiknistofnun Háskóla Íslands. Tæknigarði, Dunhaga 5. Rafpóstur: johannbg(a)hi.is 107 Reykjavík. Sími: 525-4267 Ísland. Bréfasími: 552-8801 Johann B. Gudmundsson. RHCE,CCSA Unix System Engineer. IT Management. Reiknistofnun University of Iceland. Taeknigardi, Dunhaga 5. Email: johannbg(a)hi.is IS-107 Reykjavik. Phone: +354-525-4267 Iceland. Fax: +354-552-8801

4 5

pap/peap confusion
by Matt Ashfield 14 Feb '07

14 Feb '07

I'm pouring through the alphabet soup of all of this and have a few questions that keep popping up. During a pap conversation, the radius server ends up with the username/password passed to it from the client. It then encrypts the password to match the encryption of the stored password in ldap (or other directory) and tries a bind. Correct? During a PEAP conversation, the radius server also would end-up with a username/password received from the client (either via clear-text or via the mschap conversation). Why can it not then encrypt the password just like PAP did? Does it do the comparison to LDAP stored passwords via MSCHAP as well? Thanks for any info. Matt mda(a)unb.ca

4 3

Group reply parameter
by tzieleniewski 14 Feb '07

14 Feb '07

Hi!! I'd like to ask You If it is possible to set up radius in such way that whenever there will be an Access Request send from the NAS for a user which in a member of the particular group in database the reply will be attached with the reply parameter of thed value equal to the User-Name parameter. So generally there will be for instance the Cleartext-password attribute in the radchek table for that user and a reply parameter in the radgroupreply table, will it work? Is it possible to specify the parameter as it is done in the users file %{User-Name} will it be translated to the correct value? Thanks in advance Cheers -tomasz

1 0

FreeRadius + OpenLDAP + VLAN assignation
by Romain Mercier 14 Feb '07

14 Feb '07

Hi, I want to assign users to a certain VLAN depending on an attribute stocked in LDAP. At the time, I use files module to do that and it works in a first test but don't take care about the attribute. How can I use the attribute I create? In the ldap.attrmap file I add this line: checkItem Ldap-Group auaStatut In the users file I add these lines: DEFAULT Ldap-Group == "xxxx" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 1, Fall-Through = 0 Does anybody have an idea? Romain Mercier

2 2

counter and limiter in freeradius
by brad brock 14 Feb '07

14 Feb '07

Hi, I want to use counter module in free radius. Where can I find the reference to use it? What is the difference between counter and sqlcounter? Is there a kind of bandwidth limiter in freeradius? For example, I want to limit each client connection transfer rate about 300 Kbps. How can I do it? Thank you.

1 0

rlm_postgresql , accounting and Framed-IP-Address
by Francisco Gimeno 14 Feb '07

14 Feb '07

Hello I'm having some problems when accounting with postgreSQL. I'm using FreeRadius 1.1.3 with sqlippool and postgresql. Authentication is done via PAM to a LDAP server. Some authorization is done with LDAP (pool assignment, profiles...). I would like to use accounting and simultaneous use check with postgreSQL. It seems that everything is working well.. But for some reason I don't get the assigned IP in my accounting tables whenever the user is logged. I just get it whenever the user is disconnected. I would like to have that info in real-time for debugging purposes. This is my postgresql.sql related config: ---- sql_user_name = "%{Stripped-User-Name:-%{User-Name}}" accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, \ ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', \ NULLIF('%{reply:Framed-IP-Address}', '')::inet, '%{Acct-Delay-Time:-0}')" ---- The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at all... SQL module is executed after sqlippool, so, that variable should be available. The logs: --- rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' rlm_sql_postgresql: query: BEGIN rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = radius_xlat: 'UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = '10.15.208.103' AND pool_name = 'Pool-VODA-IPdina'' rlm_sql_postgresql: query: UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = ' 10.15.208.103' AND pool_name = 'Pool-VODA-IPdina' rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 2 radius_xlat: 'COMMIT' rlm_sql_postgresql: query: COMMIT rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sqlippool" returns ok for request 6 radius_xlat: 'vodafone.dinamica@junta' rlm_sql (sql): sql_set_user escaped user --> 'vodafone.dinamica@junta' radius_xlat: 'INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', 'vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', ' vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0') rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 1 rlm_sql (sql): Released sql socket id: 1 modcall[accounting]: module "sql" returns ok for request 6 --- The assigned IP is 10.247.254.3 (or 10.247.254.5)... The relevant part in radiusd.conf ---- accounting { sqlippool sql } ------------- By the way.. The username is not stripped, and @junta appears in the logs after the xlat call :/ what am I doing wrong? Thanks

2 3

mschap and unix
by Jean Frontin 14 Feb '07

14 Feb '07

Hello, I'm usinq freeradius + mysql. I should want that users use mschap protocol and I should want that freeradius uses unix shadow to authenticate them. tests return in "radius.log" : "no user password configured" Any ideas please Regards Jean Frontin

2 1