- Freeradius-Users - lists.freeradius.org

FreeRadius and MySQL boot problem
by Diniz Da Rocha 26 Nov '06

26 Nov '06

HI, I have currently setup FreeRadius 1.0.4 with ldap authentication and authorization as well as mysql authorization and its all working fine. My only problem is that when I boot the server (Fedora Core 4) and radiusd starts up there is a rlm_sql_mysql error: Wed Feb 15 18:38:51 2006 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Wed Feb 15 18:38:51 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius_client@myip:radius Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on 'myip' (13)' Wed Feb 15 18:38:51 2006 : Error: rlm_sql (sql): Failed to connect DB handle #4 The MySQL server is on another server with ip "myip" I initially thought it was a firewall block but even with no firewall I get this error. But once the server has started and I run "service radiusd restart" from a terminal the connect to the MySQL server works fine and has no problems. I even tried running the service from rc.local but it still fails did anyone have this problem??? is anyone running the MySQL server on another machine???? Is there a fix for this??? thanks diniz

5 8

WPA Guest support
by Josh Shamir 24 Nov '06

24 Nov '06

Hi, I am interested in the fact that also the users who are not registered can visit a few sites. I would to know if the last stable version of freeradius support the "WPA Guest" feature for 802.1x captive portal implemented by Coova chilli. And if so what kinds of modifications I must do in the Freeradius configuration? I am already using Freeradius with WPA (PEAP) and all works fine. Thanks Best Regards,Josh

1 0

EAP abort in the middle of conversation
by Stefan Winter 24 Nov '06

24 Nov '06

Hello, today I stumbled over a very peculiar problem: an EAP exchange goes like this: (eapol_test) -> FR 1.1.3 Access-Request (initial) ---------> (2 proxies) ---------> FR 1.1.3 (eapol_test) <- FR 1.1.3 <--------- (2 proxies) <--------- FR 1.1.3 Access-Challenge (eapol_test) -> FR 1.1.3 Access-Request ---------> (2 proxies) ---------> FR 1.1.3 (eapol_test) <- FR 1.1.3 <--------- (2 proxies) <--------- FR 1.1.3 Access-Reject I.e. there is no networking issue, packet exchange works, but as soon as the second Access-Request comes in, the request is rejected. The -X log of the packet exchange in question gives a hint: rad_recv: Access-Request packet from host 158.64....:1814, id=14, length=184 User-Name = "someuser(a)restena.lu" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x0200001e0174657374757365722e616c6c6f774072657374656e612e6c75 Message-Authenticator = 0xa701151b3e81f0317f3ffa1444b0fd06 RESTENA-Service-Type = "eduroam-lu" Proxy-State = 0x313934 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 54 hints: Matched DEFAULT at 109 modcall[authorize]: module "preprocess" returns ok for request 54 radius_xlat: '/var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail' rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail modcall[authorize]: module "nas_auth_log" returns ok for request 54 rlm_realm: Looking up realm "restena.lu" for User-Name = "someuser(a)restena.lu" rlm_realm: Found realm "restena.lu" rlm_realm: Proxying request from user someuser to realm restena.lu rlm_realm: Adding Realm = "restena.lu" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 54 modcall[authorize]: module "mschap" returns noop for request 54 modcall[authorize]: module "files" returns notfound for request 54 rlm_eap: EAP packet type response id 0 length 30 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 54 radius_xlat: 'testuser.allow(a)restena.lu' rlm_sql (sql-normal-vpn): sql_set_user escaped user --> 'someuser(a)restena.lu' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'someuser(a)restena.lu' ORDER BY id' rlm_sql (sql-normal-vpn): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'someuser(a)restena.lu' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql-normal-vpn): Released sql socket id: 2 rlm_sql (sql-normal-vpn): No matching entry in the database for request from user [someuser(a)restena.lu] modcall[authorize]: module "sql-normal-vpn" returns notfound for request 54 modcall: leaving group authorize (returns updated) for request 54 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 54 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 54 modcall: leaving group authenticate (returns handled) for request 54 Sending Access-Challenge of id 14 to 158.64... port 1814 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb6a7e30b6348a332f14e7da16cc90197 Proxy-State = 0x313934 Finished request 54 Going to the next request Waking up in 1 seconds... rad_recv: Access-Request packet from host 158.64...:1814, id=15, length=160 User-Name = "someuser(a)restena.lu" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x020100060315 Message-Authenticator = 0x4109008e4025ee5df4b62db3e8feaa9d RESTENA-Service-Type = "eduroam-lu" Proxy-State = 0x313935 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 55 hints: Matched DEFAULT at 109 modcall[authorize]: module "preprocess" returns ok for request 55 radius_xlat: '/var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail' rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20061121/eduroam-lu-service/auth-detail modcall[authorize]: module "nas_auth_log" returns ok for request 55 rlm_realm: Looking up realm "restena.lu" for User-Name = "someuser(a)restena.lu" rlm_realm: Found realm "restena.lu" rlm_realm: Proxying request from user someuser to realm restena.lu rlm_realm: Adding Realm = "restena.lu" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 55 modcall[authorize]: module "mschap" returns noop for request 55 modcall[authorize]: module "files" returns notfound for request 55 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 55 radius_xlat: 'someuser(a)restena.lu' rlm_sql (sql-normal-vpn): sql_set_user escaped user --> 'someuser(a)restena.lu' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'someuser(a)restena.lu' ORDER BY id' rlm_sql (sql-normal-vpn): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'someuser(a)restena.lu' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'someuser(a)restena.lu' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql-normal-vpn): Released sql socket id: 1 rlm_sql (sql-normal-vpn): No matching entry in the database for request from user [someuser(a)restena.lu] modcall[authorize]: module "sql-normal-vpn" returns notfound for request 55 modcall: leaving group authorize (returns updated) for request 55 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 55 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 55 modcall: leaving group authenticate (returns invalid) for request 55 auth: Failed to validate the user. Login incorrect: [someuser(a)restena.lu] (from client ... port 0 cli 70-6F-6C-69-73-68) Now, the message "rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request" seems definitive, but it is definitely not a timeout (all happens within a few seconds, and eap.conf timeout is set to 60), and the EAP request really should be known, it's a conversation that started only a few millis ago. I would guess that eapol_test might be broken, but strangely enough it works perfectly when initiating an EAP exchange to another server that ends up at the same home server. So, the only thing that's different is the first-in-line FR 1.1.3 server. I'm perfectly clueless here :-( Why would the EAP conversation be unknown? All FR servers in the chain are 1.1.3, there is one Radiator server in the proxy chain. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 5

Simultaneous login
by Nicolas Viers - Univ. Limoges 24 Nov '06

24 Nov '06

Hello, how to deny simultaneous login with same username on freeradius ? Thanks a lot -- ____________________________________________________________ Nicolas Viers | Service Commun Informatique Mél: nicolas.viers(a)unilim.fr | 123, avenue Albert Thomas | 87060 Limoges cedex Tel: 05-55-45-77-09 | Fax: 05-55-45-75-95 http://www.unilim.fr/sci ____________________________________________________________

2 1

Ippool howto questions..
by Collen Blijenberg 24 Nov '06

24 Nov '06

Hello, just some basic questions about the Ippool. if i'm right, the ippool option, is for handing out IP's to clients ?! (right ??) you could call it DHCP (right??) how can i setup the dns gateway and proxy options in a ippool... Cheers.. Collen..

2 2

trivial problem?
by Yans van Horn 24 Nov '06

24 Nov '06

Hello, I'm fairly new to freeradius so to some my problem may seem trivial, but ... I'm trying to get EAP-TLS to work, and when using "file" setup everything works as it's suppose to - only selected users can authorize after meeteing check criteria. When i switch to SQL (postgresql) it seems that no matter what i insert to radcheck and radreply tables *any user (if he has valid cert) can authorize without any problems* :-( Can anybody shed some light on this issue ? My configuration: ### USERS ### "ajax" Auth-Type := EAP, Calling-Station-Id == "some-valid-mac" # "ajax" Auth-Type := EAP, Calling-Station-Id == "some-invalid-mac" DEFAULT Auth-Type := Reject Reply-Message = "ACCESS DENIED" ### SQL ### radius=> select * from radcheck; id | username | attribute | op | value -----+----------+--------------------+----+--------------- 410 | ajax | Auth-Type | := | EAP 411 | ajax | Calling-Station-ID | == | some-INVALID-mac 412 | DEFAULT | Auth-Type | := | Reject (3 rows) radius=> select * from radreply; id | username | attribute | op | value ----+----------+---------------+----+--------------- 3 | DEFAULT | Reply-Message | = | ACCESS DENIED (1 row) All other tables are _empty_ ### postgresql.conf ### Is a default postgresql.conf from freeradius (with database connection settings set) ### radiusd.conf ### authorize { preprocess suffix eap sql # files } authenticate { eap } -- best regards, Marcin 'Yans' Bazarnik

2 9

Compiling 1.1.3
by Matthew Green 23 Nov '06

23 Nov '06

Hello, I am trying to compile 1.1.3 on Mac OS X so FreeRADIUS will work with PostgreSQL 8.3 as it does not have libpq.3.dylib but libpq.4.1.dylib but I get the following error: Making all in rlm_perl... /Users/mat/Desktop/freeradius-1.1.3/libtool --mode=link gcc -release 1.1.3 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/freeRADIUS/lib rlm_perl.lo rlm_perl.c /Users/mat/Desktop/freeradius-1.1.3/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a is not portable! rm -fr .libs/rlm_perl-1.1.3.so .libs/rlm_perl.a .libs/rlm_perl.so gcc ${wl}-flat_namespace ${wl}-undefined ${wl}suppress -o .libs/rlm_perl-1.1.3.so -bundle .libs/rlm_perl.o /Users/mat/Desktop/freeradius-1.1.3/src/lib/.libs/libradius.dylib -L/usr/local/lib /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread (cd .libs && rm -f rlm_perl.so && ln -s rlm_perl-1.1.3.so rlm_perl.so) ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a rlm_perl.o /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (7) cpusubtype (3) is not an object file (bad magic number) ar: internal ranlib command failed make[6]: *** [rlm_perl.la] Error 1 make[5]: *** [common] Error 2 make[4]: *** [all] Error 2 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 Any ideas why? Thanks in advance Mat

2 6

Using different authentication methods according to realm
by Romain Guilleret 23 Nov '06

23 Nov '06

Hi, We are are currently moving our RADIUS server from Radiator to Freeradius. With Radiator, you can select the authentication method used, according to realm. In our case, each realm is authenticated using MySQL, but with a different database according to the realm. HOw can I do the same thing with Freeradius ?

2 1

FreeRadius working as proxy Radius for RSA ACE Server
by Luis 23 Nov '06

23 Nov '06

Hi there, Is there anyone with experience with FreeRadius working as proxy for the RSA ACE Server? Regards. -- Luis infotech(a)tryoutlinux.com

2 1

Getting the domain/realm
by Pshem Kowalczyk 23 Nov '06

23 Nov '06

Hi, I would like to proxy on a realm/domain basis. Users log in with standard username(a)domain.com logins, so this should be relatively straightforward, the problem is that most of the providers that we serve uses a lot of domains (and we have a few providers as well). Which makes the proxy.conf file really long and ugly (as in most cases there are 2-3 servers we proxy to for every domain) and many information simply overlaps. Is there a way to extract the realm and put it into a different attribute and then proxy on it's basis? so for example user(a)domain.com is logging in, i set My-Domain := domain.com and then in users file DEFAULT My-Domain == 'domain.com', Proxy-To-Realm := domains-realm is there a way of doing this? regards pshemko

2 1