- Freeradius-Users - lists.freeradius.org

Re: Problem with freeradius 1.1.3 and MySQL reserving sql socket
by Raúl Rodríguez 25 Jan '07

25 Jan '07

Sorry, I'm stupid... i have commented sql query about authentication

1 0

Re: The EAP Saga begins.
by Evan Vittitow 25 Jan '07

25 Jan '07

rad_recv: Access-Request packet from host 192.168.0.250:1175, id=66, length=149 User-Name = "kurama" Cisco-AVPair = "ssid=Pukey" NAS-IP-Address = 192.168.0.250 Called-Station-Id = "004096285ceb" Calling-Station-Id = "00095b679ccf" NAS-Identifier = "AP340-285ceb" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Login-User EAP-Message = 0x024e000b016b7572616d61 Message-Authenticator = 0xa9ef47a3079c2a10a405828572e5931a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 28 modcall[authorize]: module "preprocess" returns ok for request 28 rlm_ldap: - authorize rlm_ldap: performing user authorization for kurama radius_xlat: '(uid=kurama)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=pukey, with filter (uid=kurama) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value supersecret & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value Enterasys:version=1:policy=Enterprise User & op=11 rlm_ldap: user kurama authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 28 modcall[authorize]: module "chap" returns noop for request 28 modcall[authorize]: module "mschap" returns noop for request 28 rlm_realm: No '@' in User-Name = "kurama", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "kurama" rlm_realm: Proxying request from user kurama to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 28 rlm_eap: EAP packet type response id 78 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 28 modcall[authorize]: module "files" returns notfound for request 28 modcall: leaving group authorize (returns updated) for request 28 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 28 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 28 modcall: leaving group authenticate (returns handled) for request 28 Sending Access-Challenge of id 66 to 192.168.0.250 port 1175 Filter-Id = "Enterasys:version=1:policy=Enterprise User" EAP-Message = 0x014f00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6da2542209613e6e277dfd56deb50f0c Finished request 28 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 28 ID 66 with timestamp 45b79890 Nothing to do. Sleeping until we see a request. This uid does exist and has the NT and LM password attributes.

2 1

Problem with freeradius 1.1.3 and MySQL reserving sql socket
by Raúl Rodríguez 25 Jan '07

25 Jan '07

Hi all! I'm trying to set-up a freeradius 1.1.3 using MySQL 5.0.22 as Database Backend... although i have a very annoying problem that i don't know how to solve. When i launch the service with -X option to see debug, it seems that everything goes well, although when i try to submit some request to the server (Auth, access...) it fails with an sql query error without doing any query (i can confirm this beacuse i was sniffing mysql traffic in the server). The problem seems to come when the server try to reserve one sql socket... but there is no error, inmediately it response with an sql query error... here is the log: rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.100:9695, id=38, length=43 User-Name = "101" User-Password = "1234" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '@' in User-Name = "101", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '' -------------- ERROR ------------------------------------- rlm_sql (sql): Reserving sql socket id: 24 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 24 ---------------------------------------------------------- modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 ... Thank you in advance. Raúl.

3 2

Proxying based on SSID
by Lai Fu Keung 25 Jan '07

25 Jan '07

Hi, Sorry if the questions have been asked. I have done a lot of searches, but could not find the answer. Normally, I proxy a PEAP request whenever the realm is unknown to us (i.e. using the DEFAULT realm without stripping user name). However, for some SSIDs, I want requests to be handled locally with ldap, independent of what the realm is (and with the user name stripped). What I did is to find those SSIDs in "Called-Station-ID" and set proxy-to-realm to a local realm. But the problem (I guess) is that when freeradius processes the realm file, the user name is not stripped. When later on processed by the local realm, the request fails because the user name still contains the domain. Any suggestions to solve it is appreciated. Thanks in advance. Best Regards, Lai Users ===== DEFAULT NAS-Port-Type == "Wireless-802.11", Called-Station-Id =~ "MY-SSID$", St rip-User-Name := Yes, Autz-Type := usePlainTextPwd, Proxy-to-realm := "hku.hk" DEFAULT NAS-Port-Type == "Wireless-802.11", Autz-Type := usePlainTextPwd Radiusd -X ========= rad_recv: Access-Request packet from host 17.18.28.26:20002, id=136, length=152 NAS-Port-Id = "2098/1" Calling-Station-Id = "00-18-DE-83-3E-1B" Called-Station-Id = "00-16-E0-FD-47-40:VIP-peap" Service-Type = Framed-User EAP-Message = 0x02010012017063637732406173642e636f6d User-Name = "pcw2(a)asd.com" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 17.18.28.26 Message-Authenticator = 0x46e6da4a3ad7d253157a9f21a110807b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "asd.com" for User-Name = "pcw2(a)asd.com" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user pcw2 to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 244 modcall[authorize]: module "files" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 Found Autz-Type usePlainTextPwd Processing the authorize section of radiusd.conf modcall: entering group usePlainTextPwd for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for pcw2(a)asd.com radius_xlat: '(&(uid=pcw2(a)asd.com)))' radius_xlat: 'ou=ldap,o=hku,c=hk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.hku.hk:389, authentication 0 rlm_ldap: starting TLS rlm_ldap: bind as cn=net,o=hku,c=hk/M134aNaa to ldap1.hku.hk:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=ldap,o=hku,c=hk, with filter (&(uid=pcw2(a)asd.com)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "withNTPwd" returns notfound for request 0 modcall: leaving group redundant (returns notfound) for request 0 modcall: leaving group usePlainTextPwd (returns notfound) for request 0 WARNING: You set Proxy-To-Realm = hku.hk, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 WARNING: Cancelling proxy to Realm hku.hk, as the realm is local. Sending Access-Challenge of id 136 to 17.18.28.26 port 20002 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd7f032f1c3ed7e8e39bf1872727e771 Finished request 0 Going to the next request

3 6

RE: help
by John Wan 25 Jan '07

25 Jan '07

Hi Alan, Thanks for your help again. Does the NAS documentation mean the documentation of my wireless access point? Thanks Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, 22 January 2007 5:57 PM To: FreeRadius users mailing list Subject: Re: help John Wan wrote: > > I have followed all the instructions from http://deployingradius.com. > I do not know why I have had the CHAP authentication. See the NAS documentation. > I would like to use MS-CHAP authentication instead of CHAP, and do you > have any tipps for me for this kind of setup (MS-CHAP)? See the NAS documentation. The choice of CHAP or MS-CHAP is not under control of the RADIUS server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

Accounting in MySQL
by DESEtech - German P. Santillan 25 Jan '07

25 Jan '07

I actually have my Users DB in MySQL Server and my FreeRADIUS use the "radcheck" and "radreply" tables to read (SELECT) records, in my radiusd.conf I have... authorize { sql } accounting { sql } But I don´t hace records in radacct Table. What is the problem? Thanks in advance and sorry for my English Germán P. Santillán Administrador de Redes Jefe del Dpto. Técnico DESETech Argentina S.A. San Martín 133 - CP: B8000FIC Bahía Blanca - Argentina Tel/Fax: +54 (291) 456-5642 gsantillan(a)desetech.com.ar http://www.desetech.com.ar

3 5

Setting a realm in the User-Name based on Client-IP-Address
by Jason E. Murray 24 Jan '07

24 Jan '07

I have quite a few people on campus who authenticate to various systems without using a realm in their username. With our current radius server there is a option in the clients file where you specify a Default-Realm per client. When an authentication request comes in from this client the @realm is automatically tacked onto the User-Name attribute then proxying is done based username@realm combination. I need to replicate this behavior in FreeRadius. In the users file I have: DEFAULT Client-IP-Address == 127.0.0.1, User-Name !~ ".*@.*", Proxy-To-Realm := "rts" Fall-Through = Yes In the preproxy_users file I have: DEFAULT Client-IP-Address == 127.0.0.1, User-Name !~ ".*@.*" User-Name := "%{User-Name}@rts" Both of these lines check to see if the @realm is missing and the Client-IP-Address is 127.0.0.1 the proxy and rewrite accordingly. My question is there a better way to do this, this seems a bit kludgy. Using FreeRadius 1.1.4 Thanks in advance, -- Jason E. Murray - jemurray(a)zweck.net

2 1

SSL locking code
by King, Michael 24 Jan '07

24 Jan '07

Back on October 18th, we had a conversation about threading issues. In the message it was said: > The issues is "bad record mac", not "failed in system call". The >second error message is a result of the first. > > I suspect threading issues. Try running the server in non-threaded >mode. If that works, then the SSL locking code should be back-ported >from the CVS head (src/main/threads.c) > > Alan DeKok. I was wondering if anything had come of this? Vista is on the way, and I can't stay at version 1.0.4 indefinatly. (I know there have been some major fixes since then) Michael King

2 7

RADIUS will no longer start!
by Michelle Gates 24 Jan '07

24 Jan '07

All, Our RADIUS server has been up and running fine for 127 days now. Suddenly today it no longer runs. I tried to put it into debug mode and got the following output: ---- [root@RAD01 ~]# /opt/freeradius/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/trs_proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/trs_clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/sqlcounter.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "trustive" main: group = "trustive" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients /opt/freeradius/etc/raddb/radiusd.conf[751]: Missing client name ----- Can anyone shed any light on this? Unfortunately for me, one of our developers was working on our production server but *claims* not to have changed anything of any consequence... I'm really unsure of where this is coming from! Has anyone seen this error before or could anyone at least point me in the right direction? Best regards, -michelle.

7 7

Setting check pairs in script when using exec
by Patric 24 Jan '07

24 Jan '07

Hi guys, This is my previous mail phrased differently, as after further investigation I found what Im supposed to be asking. Up till now have been using sql to authenticate, and am trying to change to my own script and mysql db. In radiusd.conf I have : modules { exec exec-radauth { wait = yes program = "/path/to/script.php -- %{User-Name} %{Password}" input_pairs = request output_pairs = reply } authorize { exec-radauth } This all works perfectly when I include "files" in the authorize section and place the following in the users file : DEFAULT Auth-Type = Accept But if I exclude "files" from the authorize section I get : auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. So now I know that I need to set the Auth-Type check pair in my external authentication script, but am not sure how to accomplish this. Can anyone point me in the right direction with this problem? radiusd: FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu, built on Sep 20 2006 at 14:13:13 Thanks in advance Patric ---------------------------------------------------------------------- Looking For the Right College? Let us help find the best online criminal justice program for you! http://tags.bluebottle.com/fc/MhtYWUjFdpo7ZzqpDkaZhGRgrChcJrdZy3oBy/

1 0