- Freeradius-Users - lists.freeradius.org

Logging into MySQL doesnt work, how enable MAC address control on MySQL
by Andrej Simko 12 Dec '06

12 Dec '06

Hello everybody I have a problem in setting up my freeradius to log all querries into database. The radacct is still empty. I read some messages from this mailing group and I found that the NAS server is not sending anything about Start time or Stop time. My naslist looks like: # NAS Name Short Name Type #---------------- ---------- ---- localhost local other and in clients.conf I have nastype = other So maybe I donnot know how to setup NAS on my server or maybe I donnot understand what does the NAS means. I am sure that we do not have any cisco or something like that so I want to authenticate only on the machine where freeradius is running. And second question. Does anybody know how to setup MAC address control from MySQL database. My idea is that when user wants to login it will need his username, password and MAC address to authenticate succesfully. Thank you for any ideas! AnDY

3 4

Problem with unprintable characters in the password
by Rafał Kamiński 12 Dec '06

12 Dec '06

Hello, I don't touch my Radius server since 2 weeks, and know when I try do some radtest, it show me Acces-Reject and in log: Mon Dec 11 14:51:47 2006 : Debug: Processing the authorize section of radiusd.conf Mon Dec 11 14:51:47 2006 : Debug: modcall: entering group authorize for request 2 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: - authorize Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: performing user authorization for rka Mon Dec 11 14:51:47 2006 : Debug: radius_xlat: '(uid=rka)' Mon Dec 11 14:51:47 2006 : Debug: radius_xlat: 'ou=users,dc=firm' Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: performing search in ou=users,dc=firm, with filter (uid=rka) Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: looking for check items in directory... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: looking for reply items in directory... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Setting Auth-Type = ldap Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: user rka authorized to use remote access Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall[authorize]: module "ldap" returns ok for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall: leaving group authorize (returns ok) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rad_check_password: Found Auth- Type ldap Mon Dec 11 14:51:47 2006 : Debug: auth: type "LDAP" Mon Dec 11 14:51:47 2006 : Debug: Processing the authenticate section of radiusd.conf Mon Dec 11 14:51:47 2006 : Debug: modcall: entering group LDAP for request 2 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authenticate]: calling ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: - authenticate Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: login attempt by "rka" with password "?Pđ ,??č?ń/9?Â??" Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: user DN: uid=rka,ou=Users,dc=firm Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: (re)connect to ldap:636, authentication 1 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS mode to 1 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ca.pem Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS Cert File to / etc/freeradius/cert/radius.crt Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS Key File to / etc/freeradius/cert/radius.key Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: bind as uid=rka,ou=Users,dc=firm/?Pđ ,??č?ń/9?Â?? to ldap:636 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Bind failed with invalid credentials Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Mon Dec 11 14:51:47 2006 : Debug: modsingle[authenticate]: returned from ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall[authenticate]: module "ldap" returns reject for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall: leaving group LDAP (returns reject) for request 2 Mon Dec 11 14:51:47 2006 : Debug: auth: Failed to validate the user. Mon Dec 11 14:51:47 2006 : Debug: WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Mon Dec 11 14:51:47 2006 : Debug: Delaying request 2 for 1 seconds Mon Dec 11 14:51:47 2006 : Debug: Finished request 2 Mon Dec 11 14:51:47 2006 : Debug: Going to the next request Mon Dec 11 14:51:47 2006 : Debug: --- Walking the entire request list --- Mon Dec 11 14:51:47 2006 : Debug: Waking up in 1 seconds... Mon Dec 11 14:51:48 2006 : Debug: --- Walking the entire request list --- Mon Dec 11 14:51:48 2006 : Debug: Waking up in 1 seconds... Mon Dec 11 14:51:49 2006 : Debug: --- Walking the entire request list --- Last when i run that servers all was oki :( And know :( not :( Why ? I'm sure that my secret is good. Can you help me? BR Kamyk

2 1

Temporary Accounts
by Thibault Le Meur 12 Dec '06

12 Dec '06

Hi, I'm using FR 1.1.3. I'd like to use the 'files' or 'mysql' backends to store temporary radius accounts used for guest accesses. I'd like to be able to enforce: * a Day-Of-Week and Time-Of-Day policy ===> using the Login-Time attribute seems appropriate * an 'account available Not-Before / Not-After' policy ===> What is the recommended setup for this last part of the policy ? - Using the 'Expiration' attribute for the 'Not-After' part is ok, but what about the Not-Before part ? - Do I have to use the Current-Login attribute to check the Not-Before part ? If yes what is the format of this attribute ? Any pointer to a faq or a sample setup file would be appreciated ;-) Regards, Thibault

2 8

Which Variable name for sql result
by Stavros Patiniotis 12 Dec '06

12 Dec '06

Hi When radgroupcheck does its query, what variable name does it store its results in? The default sql (ie authorize_group_check_query) should be returning the GroupName, but I cannot seem to access it. Also, in doc/rlm_sql point 3c refers to the 'read_groups' directive. I'm assuing a couple of things here. (a) That this is set in sql.conf (b) By default its set to yes. Thanks. Cheers, Stavros Patiniotis EscapeNet ~ 08 8292 5200

1 0

Re: Counter
by Sean 12 Dec '06

12 Dec '06

> Read /etc/raddb/dictionary Alan, that directory doesn't exist on either of my systems. One system is running 1.0.4 and the other is running 1.1.3. I've tried searching the dictionaries for Max-All-Session, because that attribute works as does Expiration. The dictionaries that I'm searching are in /local/share/freeradius. Thanks for giving me your time with this. Do you think that there is a basic flaw in my setup? Should I delete everything and start from scratch? Are Max-Daily-Session and Max-Monthly-Session valid attributes that I can use in the same way that I use Expiration and Max-All-Session? I doubt that it is a FreeRadius problem, and more likely that I'm mistaken in how I think it works. Regards, Sean

2 1

Re: SQL Counter (Enrique Acosta)
by Sean 12 Dec '06

12 Dec '06

> 1. Fwd: SQL Counter (Enrique Acosta) Thanks Enrique. I upgraded to 1.1.3 but the error is still there. Alan gave me a hint that the attribute is not in the dictionary, so I've spent all evening searching the dictionary files looking for SQL attributes with no luck. My searches of the list archives suggest that Max-Daily-Session and Max-Monthly-Session are valid attributes. I think that the code I added to radiusd.conf is okay. I've listed it below. $INCLUDE ${confdir}/sql.conf sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } So where am I going wrong? If it was a problem in my SQL queries I wouldn't expect the following reply that comes from radius. rlm_sql (sql): Reserving sql socket id: 0 rlm_sql: Failed to create the pair: Unknown attribute "Max-Daily-Session" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns fail for request 39 modcall: group authorize returns fail for request 39 Did you ever get it to work? The guy I'm doing this for is putting me under a lot of pressure to get it finished. Regards, Sean Bracken

2 1

Use MS RAS as RADIUS client, FreeRADIUS got no User-Password
by Cui Jeffrey 11 Dec '06

11 Dec '06

Hello everyone, I am newbie to FreeRADIUS. Using Windows RAS (VPN server) as RADIUS client, but from output, I can see that there is no User-Password field in request from RAS at all, I am using rlm_jradius inside freeradius to forward username/password to my own authentication program. Only found one post about this issue, someone suggested to put mschap in conf file, but I am sure it's there already. Do I need to change anything on RAS side? I am using freeradius 1.1.2. Anybody can help me out? Thank you in advance Jeffrey rad_recv: Access-Request packet from host 192.168.2.151:1382, id=8, length=289 Acct-Session-Id = "108" NAS-IP-Address = 192.168.2.151 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 129 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.11.14.105" Tunnel-Client-Endpoint:0 = "10.11.14.105" Microsoft-Attr-35 = 0x4d5352415356352e3030 Microsoft-Attr-34 = 0x4d535241532d312d4a454646324b User-Name = "dvmh00000055(a)DVVPN.COM" MS-CHAP-Challenge = 0xe6e76c750472fb5879986d8b8e75df6e MS-CHAP2-Response = 0x0000f21eb6c0b591297af094964bb6e9417c0000000000000000f990636a5a5237f4c3456225c9c475b07004e32cb758fdf2 Message-Authenticator = 0x25fa1bd20b0a0f3fa273ae4fc66eb8d5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: Looking up realm "DVVPN.COM" for User-Name = "dvmh00000055(a)DVVPN.COM" rlm_realm: No such realm "DVVPN.COM" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 0 rlm_jradius: packing attribute Acct-Session-Id (type: 44; len: 3) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute NAS-Port (type: 5; len: 4) rlm_jradius: packing attribute MS-RAS-Vendor (type: 20381705; len: 4) rlm_jradius: packing attribute MS-RAS-Version (type: 20381714; len: 10) rlm_jradius: packing attribute NAS-Port-Type (type: 61; len: 4) rlm_jradius: packing attribute Tunnel-Type (type: 64; len: 4) rlm_jradius: packing attribute Tunnel-Medium-Type (type: 65; len: 4) rlm_jradius: packing attribute Calling-Station-Id (type: 31; len: 12) rlm_jradius: packing attribute Tunnel-Client-Endpoint (type: 66; len: 12) rlm_jradius: packing attribute Microsoft-Attr-35 (type: 20381731; len: 10) rlm_jradius: packing attribute Microsoft-Attr-34 (type: 20381730; len: 14) rlm_jradius: packing attribute User-Name (type: 1; len: 22) rlm_jradius: packing attribute MS-CHAP-Challenge (type: 20381707; len: 16) rlm_jradius: packing attribute MS-CHAP2-Response (type: 20381721; len: 50) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing attribute Client-IP-Address (type: 1052; len: 4) rlm_jradius: packing packet with code: 1 (attr length: 429) rlm_jradius: packing attribute Framed-IP-Address (type: 8; len: 4) rlm_jradius: packing attribute Framed-MTU (type: 12; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute Framed-Compression (type: 13; len: 4) rlm_jradius: packing packet with code: 0 (attr length: 80) rlm_jradius: packing attribute Auth-Type (type: 1000; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: sending 586 bytes to jradius server rlm_jradius: return code 8; receiving 2 packets rlm_jradius: reading packet: code=1 len=429 rlm_jradius: reading attribute: type=44; len=3 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=5; len=4 rlm_jradius: reading attribute: type=20381705; len=4 rlm_jradius: reading attribute: type=20381714; len=10 rlm_jradius: reading attribute: type=61; len=4 rlm_jradius: reading attribute: type=64; len=4 rlm_jradius: reading attribute: type=65; len=4 rlm_jradius: reading attribute: type=31; len=12 rlm_jradius: reading attribute: type=66; len=12 rlm_jradius: reading attribute: type=20381731; len=10 rlm_jradius: received attribute we do not recognize (type: 20381731) rlm_jradius: reading attribute: type=20381730; len=14 rlm_jradius: received attribute we do not recognize (type: 20381730) rlm_jradius: reading attribute: type=1; len=22 rlm_jradius: reading attribute: type=20381707; len=16 rlm_jradius: reading attribute: type=20381721; len=50 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading packet: code=0 len=80 rlm_jradius: reading attribute: type=8; len=4 rlm_jradius: reading attribute: type=12; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=13; len=4 rlm_jradius: reading request: config_item: len=48 rlm_jradius: reading attribute: type=1000; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 modcall[authorize]: module "jradius" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for dvmh00000055(a)DVVPN.COM with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [dvmh00000055(a)DVVPN.COM/<no User-Password attribute>] (from client jeff2003 port 129 cli 10.11.14.105) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 0 rlm_jradius: packing attribute Acct-Session-Id (type: 44; len: 3) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute NAS-Port (type: 5; len: 4) rlm_jradius: packing attribute MS-RAS-Vendor (type: 20381705; len: 4) rlm_jradius: packing attribute MS-RAS-Version (type: 20381714; len: 10) rlm_jradius: packing attribute NAS-Port-Type (type: 61; len: 4) rlm_jradius: packing attribute Tunnel-Type (type: 64; len: 4) rlm_jradius: packing attribute Tunnel-Medium-Type (type: 65; len: 4) rlm_jradius: packing attribute Calling-Station-Id (type: 31; len: 12) rlm_jradius: packing attribute Tunnel-Client-Endpoint (type: 66; len: 12) rlm_jradius: packing attribute User-Name (type: 1; len: 22) rlm_jradius: packing attribute MS-CHAP-Challenge (type: 20381707; len: 16) rlm_jradius: packing attribute MS-CHAP2-Response (type: 20381721; len: 50) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing attribute Client-IP-Address (type: 1052; len: 4) rlm_jradius: packing packet with code: 1 (attr length: 381) rlm_jradius: packing attribute Framed-IP-Address (type: 8; len: 4) rlm_jradius: packing attribute Framed-MTU (type: 12; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute Framed-Compression (type: 13; len: 4) rlm_jradius: packing attribute MS-CHAP-Error (type: 20381698; len: 10) rlm_jradius: packing packet with code: 3 (attr length: 102) rlm_jradius: packing attribute Auth-Type (type: 1000; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute Post-Auth-Type (type: 1014; len: 4) rlm_jradius: sending 576 bytes to jradius server rlm_jradius: return code 7; receiving 2 packets rlm_jradius: reading packet: code=1 len=381 rlm_jradius: reading attribute: type=44; len=3 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=5; len=4 rlm_jradius: reading attribute: type=20381705; len=4 rlm_jradius: reading attribute: type=20381714; len=10 rlm_jradius: reading attribute: type=61; len=4 rlm_jradius: reading attribute: type=64; len=4 rlm_jradius: reading attribute: type=65; len=4 rlm_jradius: reading attribute: type=31; len=12 rlm_jradius: reading attribute: type=66; len=12 rlm_jradius: reading attribute: type=1; len=22 rlm_jradius: reading attribute: type=20381707; len=16 rlm_jradius: reading attribute: type=20381721; len=50 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading packet: code=3 len=102 rlm_jradius: reading attribute: type=8; len=4 rlm_jradius: reading attribute: type=12; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=13; len=4 rlm_jradius: reading attribute: type=20381698; len=10 rlm_jradius: reading request: config_item: len=64 rlm_jradius: reading attribute: type=1000; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=1014; len=4 modcall[post-auth]: module "jradius" returns noop for request 0 modcall: leaving group REJECT (returns noop) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 8 to 192.168.2.151 port 1382 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 8 with timestamp 457dbde0 Nothing to do. Sleeping until we see a request _________________________________________________________________ 享用世界上最大的电子邮件系统― MSN Hotmail。 http://www.hotmail.com

1 0

Assertion failed in listen.c, line 621
by Guilherme Franco 11 Dec '06

11 Dec '06

Hello, Freeradius-snapshot-20061203 crashes, when running just "radiusd" with proxy ("radiusd -X" doesn't crash): It logs the following "Error: Assertion failed in listen.c, line 621", which is "rad_assert(request->proxy_listener == listener);" Thanks.

2 9

Re: Counter
by Sean 11 Dec '06

11 Dec '06

> > I can't understand why Max-Daily-Session is an unknown attribute > when > > it's declared in the radiusd.conf and radius loads with no errors. > > Because attributes are defined in the dictionaries. > > Arguably, the sqlcounter module should look up that attribute, and > either complain if it doesn't exist, or else create it. That doesn't > happen right now. > Okay, thanks Alan. Should I edit a dictionary file and if so which one? Regards, Sean

2 1

HELP WITH FREERADIUS AND DHCP3
by Tomas Eduardo Lotina Ramos 11 Dec '06

11 Dec '06

2 1