- Freeradius-Users - lists.freeradius.org

romel invites you to join Zorpia
by romel 30 Nov '06

30 Nov '06

Hi freeradius-users! Your friend romel from , just invited you to his online photo albums and journals at Zorpia.com. About romel : Know Me Know Fun No Me No Fun So what is Zorpia? It is an online community that allows you to upload unlimited amount of photos, write journals and make friends. We also have a variety of skins in store for you so that you can customize your homepage freely. Join now for free! Please click the following link to join Zorpia: http://signup.zorpia.com/signup?invitation_key=7d3391e3c6586a56fcd14ad5a68f… This message was delivered with the romel's initiation. If you wish to discontinue receiving invitations from us, please click the following link: http://signup.zorpia.com/email/optout/freeradius-users@lists.freeradius.org

1 0

Redundant LDAP servers
by Peter Param 30 Nov '06

30 Nov '06

hi all, is it possible to have multiple ldap servers for lookup for redundancy purposes in a similar way below? ldap { server = ldap1.myorg.com, ldap2.myorg.com, ldap3.myorg.com login = "cn=admin,o=myorg,c=au" password = mypass } cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

EAP-AKA support?
by Ramm-Ericson, Johannes 29 Nov '06

29 Nov '06

Hi, searching through the mail archive and the Freeradius bugzilla on Freeradius support for EAP-AKA authentication I found this : http://bugs.freeradius.org/show_bug.cgi?id=386 (Yes, I know that this Wiki page http://wiki.freeradius.org/EAP does not include EAP-AKA in the list of supported methods) Does anyone have any input on the status of this code? Is it stable, does it need further testing? Thanks and Regards, Johannes

2 1

radiusd.conf: Why extra "Auth-Type" in authenticate section?
by Martin Gadbois 29 Nov '06

29 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, - From a typical radiusd.conf: authenticate { Auth-Type PAP { pap } ... snip ... eap } Why the "Auth-Type PAP { }" construct? I tried RTFM and RTFC, but I have not seen an actual description of why that is there. From the "authenticate" radiusd.conf documentation: # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. So why specify "Auth-Type PAP { pap }" at all if the system will select authentication 'pap' when Auth-Type == PAP? Thanks, - -- ============== +----------------------------------------------+ Martin Gadbois | "Windows might take you from 0 to 60 faster, | S/W Developer | but to go to 100 you need Unix." | Colubris Networks Inc. +----------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFbIvs9Y3/iTTCEDkRAqf0AJ9Phxbej5KtfSVULJwtCnmMV1GbjACeJbGO aDtM2jrSJ+rO5zgGLbrJu5U= =q6pD -----END PGP SIGNATURE-----

2 3

eap peap
by Daniel Romero 29 Nov '06

29 Nov '06

Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert- srv.pem" tls: certificate_file = "(null)" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "radiusUDP" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100E:system library:fopen:Bad address rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[399] Unknown module "eap". radiusd.conf[382] Failed to parse authenticate section. any ideas??? certificates created with certs.sh radius:/home/dromero/radius/freeradius-1.1.3/scripts# sh certs.sh Generating DH parameters, 512 bit long safe prime, generator 2 This is going to take a long time ............+....+........................+..................+...............+............................+...............+.......+.+.....................++*++*++*++*++*++* See the 'certs' directory for the certificates. The 'certs' directory should be copied to .../etc/raddb/ All passwords have been set to 'whatever'

2 1

LDAP authentication... Help Me...
by Maurizio Pederneschi 29 Nov '06

29 Nov '06

Hi, I'm a newbie for Freeradius. I've implemented this type of structure: APPLICATION --> PAM --> FREERADIUS --> SQL I want substitute SQL with a LDAP backend; I don't need any type of accounting; I just want that application check userid and password on my LDAP server. How can I accomplish that? MySql seem to work but frequently I get this type of error in radiusd.log: Nov 29 18:04:11 public20 safesquid: pam_radius_auth: RADIUS server 212.80.192.120 failed to respond Nov 29 18:04:11 public20 safesquid: pam_radius_auth: All RADIUS servers failed to respond. Nov 29 18:04:11 public20 safesquid: pam_radius_auth: RADIUS server 212.80.192.120 failed to respond Nov 29 18:04:11 public20 safesquid: pam_radius_auth: All RADIUS servers failed to respond. Nov 29 18:04:15 public20 safesquid: pam_radius_auth: RADIUS server 212.80.192.120 failed to respond Nov 29 18:04:15 public20 safesquid: pam_radius_auth: All RADIUS servers failed to respond. And I don't know why this error appear. Can anybody help me? Thank's, Maury76

1 0

RE: Unable to authenticate freeradius using PostgreSQL
by Ross McOwat 29 Nov '06

29 Nov '06

All sorted! I copied a fresh-install postgresql.conf file from another server, and bingo, all is working fine. Must have made a mistake while editing this file - note to self, make copies of the file BEFORE editing it! Thanks for everyones help. Ross -----Original Message----- From: freeradius-users-bounces+ross.mcowat=first-utility.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+ross.mcowat=first-utility.com@lists.fre eradius.org] On Behalf Of Ross McOwat Sent: 29 November 2006 10:53 To: FreeRadius users mailing list Subject: RE: Unable to authenticate freeradius using PostgreSQL OK, I've made progress. I now appear to be connecting to my Postgres database, as I'm receiving syntax errors in the database log file when trying a freeRadius authentication. The debug radius output is as follows (I now have queries against the radius_xlat line): rad_recv: Access-Request packet from host 10.150.19.134:1115, id=5, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = ' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql_getvpdata: database query error rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.150.19.134:1115, id=5, length=49 Discarding duplicate request from client ROSSpc:1115 - ID: 5 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 5 with timestamp 456d62ae Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.150.19.134:1115, id=5, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = ' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql_getvpdata: database query error rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 1 modcall: group authorize returns fail for request 1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 5 with timestamp 456d62b5 Nothing to do. Sleeping until we see a request. The following is what is logged in my /var/log/pgsql trace when trying the above query: LOG: statement: SELECT id, UserName, Attribute, Value, Op # authorize_check_query = ERROR: syntax error at end of input at character 69 (repeated 4 times) So I suspect now that my user data is incorrect. The output from my database files is as follows: radius=# select * from radcheck; id | username | attribute | value | op ----+-----------+-----------+-----------+---- 1 | ROSStest3 | Password | bdwnlc274 | == 2 | ROSStest4 | Password | nntlpa401 | == (2 rows) radius=# select * from radreply; id | username | attribute | value | op ----+-----------+-------------------+---------------+---- 1 | ROSStest3 | Framed-IP-Address | 10.150.19.134 | := 2 | ROSStest4 | Framed-IP-Address | 10.150.19.134 | := (2 rows) I have changed the 'value' and 'op' columns around, as the authentication sql query within postgresql.conf appears to try and retrieve 'value' before 'op'. Using the supplied database schema, the op column appears BEFORE value. Not sure if this is significant or not? Or possibly the actual data format I've entered is incorrect? I suspect (hope) it's something as simple as that. -----Original Message----- From: freeradius-users-bounces+ross.mcowat=first-utility.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+ross.mcowat=first-utility.com@lists.fre eradius.org] On Behalf Of Alan DeKok Sent: 28 November 2006 16:53 To: FreeRadius users mailing list Subject: Re: Unable to authenticate freeradius using PostgreSQL "Ross McOwat" <ross.mcowat(a)first-utility.com> wrote: > rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' > radius_xlat: '' > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql (sql): SQL query error; rejecting user It looks like you haven't configured the SQL queries needed by the server. The "radius_xlat" line SHOULD be printing out the query it's going to use. The default postgresql.conf has queries that work for Postgres. Are you using those, or have you edited the file? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Unable to authenticate freeradius using PostgreSQL
by Ross McOwat 29 Nov '06

29 Nov '06

Thanks Kevin - you were right, the issue was with the SQL query in postgresql.conf. I replaced my existing file with a default file on another server, and everything worked fine. Many thanks for your help! Ross -----Original Message----- From: freeradius-users-bounces+ross.mcowat=first-utility.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+ross.mcowat=first-utility.com@lists.fre eradius.org] On Behalf Of Kevin Bonner Sent: 29 November 2006 16:16 To: FreeRadius users mailing list Subject: Re: Unable to authenticate freeradius using PostgreSQL On Wednesday 29 November 2006 05:52, Ross McOwat wrote: > radius_xlat: 'SELECT id, UserName, Attribute, Value, Op > #?authorize_check_query = ' > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op > #?authorize_check_query = > rlm_sql_postgresql: Status: PGRES_FATAL_ERROR radius_xlat now shows the query, but "SELECT id, UserName, Attribute, Value, Op" is not a valid SQL query. The "authorize_check_query" being listed in the radius_xlat line means that you haven't properly quoted the SQL query in the config file. Look at the default postgresql.conf to see what you're missing... paying close attention to quotation marks. > I have changed the 'value' and 'op' columns around, as the > authentication sql query within postgresql.conf appears to try and > retrieve 'value' before 'op'. Using the supplied database schema, the > op column appears BEFORE value. Not sure if this is significant or not? > Or possibly the actual data format I've entered is incorrect? I suspect > (hope) it's something as simple as that. It doesn't matter how the table columns are arranged, as long as your query asks for them in the correct order. Kevin Bonner

1 0

RE: Unable to authenticate freeradius using PostgreSQL
by Ross McOwat 29 Nov '06

29 Nov '06

OK, I've made progress. I now appear to be connecting to my Postgres database, as I'm receiving syntax errors in the database log file when trying a freeRadius authentication. The debug radius output is as follows (I now have queries against the radius_xlat line): rad_recv: Access-Request packet from host 10.150.19.134:1115, id=5, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = ' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql_getvpdata: database query error rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.150.19.134:1115, id=5, length=49 Discarding duplicate request from client ROSSpc:1115 - ID: 5 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 5 with timestamp 456d62ae Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.150.19.134:1115, id=5, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = ' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op #?authorize_check_query = rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql_getvpdata: database query error rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 1 modcall: group authorize returns fail for request 1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 5 with timestamp 456d62b5 Nothing to do. Sleeping until we see a request. The following is what is logged in my /var/log/pgsql trace when trying the above query: LOG: statement: SELECT id, UserName, Attribute, Value, Op # authorize_check_query = ERROR: syntax error at end of input at character 69 (repeated 4 times) So I suspect now that my user data is incorrect. The output from my database files is as follows: radius=# select * from radcheck; id | username | attribute | value | op ----+-----------+-----------+-----------+---- 1 | ROSStest3 | Password | bdwnlc274 | == 2 | ROSStest4 | Password | nntlpa401 | == (2 rows) radius=# select * from radreply; id | username | attribute | value | op ----+-----------+-------------------+---------------+---- 1 | ROSStest3 | Framed-IP-Address | 10.150.19.134 | := 2 | ROSStest4 | Framed-IP-Address | 10.150.19.134 | := (2 rows) I have changed the 'value' and 'op' columns around, as the authentication sql query within postgresql.conf appears to try and retrieve 'value' before 'op'. Using the supplied database schema, the op column appears BEFORE value. Not sure if this is significant or not? Or possibly the actual data format I've entered is incorrect? I suspect (hope) it's something as simple as that. -----Original Message----- From: freeradius-users-bounces+ross.mcowat=first-utility.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+ross.mcowat=first-utility.com@lists.fre eradius.org] On Behalf Of Alan DeKok Sent: 28 November 2006 16:53 To: FreeRadius users mailing list Subject: Re: Unable to authenticate freeradius using PostgreSQL "Ross McOwat" <ross.mcowat(a)first-utility.com> wrote: > rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' > radius_xlat: '' > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql (sql): SQL query error; rejecting user It looks like you haven't configured the SQL queries needed by the server. The "radius_xlat" line SHOULD be printing out the query it's going to use. The default postgresql.conf has queries that work for Postgres. Are you using those, or have you edited the file? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Different accounting based on avpair
by Nuno Pais Fernandes 29 Nov '06

29 Nov '06

Hi, I've been searching the ML for something related to this without any success. I don't know if freeradius does what i need and correct me if i'm wrong. I want to freeradius insert/update different sql tables using a avpair from my custom dictionary. What i would like is somthing like this: "if avpair Wireless = yes use accounting module sql1 else use accounting module sql2" accounting { acct_unique sql1 if (Wireless = yes) sql2 if (Wireless != yes) } Could it be done with users file? Thanks, -- Nuno Miguel Pais Fernandes <npf(a)eurotux.com> Cisco Certified Network Associate Oracle Certified Professional Eurotux Informática, S.A. [http://eurotux.com] Rua Rosalvo de Almeida, 5. 4710-429 BRAGA PORTUGAL Tel: (+351) 253 257395 - Fax: (+351) 253 257396

2 3