- Freeradius-Users - lists.freeradius.org

freeradius with active directory integration
by Karthik R 16 Nov '06

16 Nov '06

In my setup am trying to authenticate wifi users using PEAP with TLS against the active directory using freeradius. i m using linksys wap54g AP. i may be going somewhat out of this forum related to, but as am using freeradius i thought of posting it here. I was able to successfully configure the freeradius v1.1.1 on a RHEL 4 box and integrated with windows 2003 active directory. I was able to pull the users and groups from active directory using getent group and getent passwd command and ntlm_auth also work great. I configured the windows XP supplicant as mentioned in this link: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO The issue is when i try to connect the wireless client, i dont see any traffic hitting the freeradius server unless i enable "Authentication as computer when computer info is available" in client. Does anyone faced this issue or pour some light ?

1 0

logging to normal radius.log and syslog
by Michael Messner 16 Nov '06

16 Nov '06

hey @all, for testing we write the complete debugging messages to syslog into a special file but with this method the loggin to the normal radius.log file won't work anymore! We start radiusd with daemontools and with these parameters: loggeropt="logger -p local6.info -t radiusd -s" ARGS="-Afxyz" NICELEVEL="-10" exec nice -n $NICELEVEL $RADIUSD $ARGS | $loggeropt this works quite good but there are nomore messages in the radius.log - file. the radiusd.conf: 15:09:45 Xradius ~ [root]grep radius.log /etc/raddb/radiusd.conf log_file = ${logdir}/radius.log the detail logs are working! any ideas what can I do? thanks mIke

3 5

Mysql and usage of radgroupcheck
by Anne-Mie Vandermeeren 16 Nov '06

16 Nov '06

I have set up Freeradius working fine with a users-file. I did some tests to change to Mysql and all was ok, until I want to add some conditions for users in more than one group. This looks like a simple setup for Mysql, but it's not working as I thought it would: mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | user1 | Group1 | 1 | | user1 | Group2 | 2 | +----------+-----------+----------+ 2 rows in set (0.00 sec) mysql> select * from radcheck; +----+----------+---------------+----+------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+------------+ | 1 | user1 | User-Password | == | paswoordje | +----+----------+---------------+----+------------+ 1 row in set (0.00 sec) mysql> select * from radreply; Empty set (0.00 sec) mysql> select * from radgroupcheck; +----+-----------+----------------+----+--------------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+--------------+ | 1 | Group1 | NAS-IP-Address | == | 172.16.224.1 | | 2 | Group2 | NAS-IP-Address | == | 172.16.224.2 | +----+-----------+----------------+----+--------------+ 2 rows in set (0.01 sec) mysql> select * from radgroupreply; +----+-----------+-----------+----+----------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+----------+ | 1 | Group1 | Class | := | groepje1 | | 2 | Group2 | Class | := | groepje2 | +----+-----------+-----------+----+----------+ 2 rows in set (0.00 sec) I use ntradping to check the setup. When I use NAS-IP-Address = 172.16.224.1 I get the correct class (groepje1), but when I use the NAS-IP-Address = 172.16.224.2 I get a reject and not as I was expecting the class-attribute groepje2. I can't figure out why this is the case. The debug output is not helping me, either. Anyone a suggestion on solving this? ---- DEBUG output for NAS-IP-Address = 172.16.224.1-------------- rad_recv: Access-Request packet from host 157.193.39.138:3674, id=65, length=51 User-Name = "user1" User-Password = "paswoordje" NAS-IP-Address = 172.16.224.1 Tue Nov 14 16:37:17 2006 : Debug: Processing the authorize section of radiusd.conf Tue Nov 14 16:37:17 2006 : Debug: modcall: entering group authorize for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 37 Tue Nov 14 16:37:17 2006 : Debug: rlm_realm: No '@' in User-Name = "user1", looking up realm NULL Tue Nov 14 16:37:17 2006 : Debug: rlm_realm: No such realm "NULL" Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 37 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 37 Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'user1' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'user1' Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:37:17 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Nov 14 16:37:17 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id Tue Nov 14 16:37:17 2006 : Debug: rlm_sql (sql): Released sql socket id: 2 Tue Nov 14 16:37:17 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 37 Tue Nov 14 16:37:17 2006 : Debug: modcall: leaving group authorize (returns ok) for request 37 Tue Nov 14 16:37:17 2006 : Debug: auth: type Local Tue Nov 14 16:37:17 2006 : Debug: auth: user supplied User-Password matches local User-Password Tue Nov 14 16:37:17 2006 : Auth: Login OK: [user1] (from client ntradping port 0) Sending Access-Accept of id 65 to 157.193.39.138 port 3674 Class := 0x67726f65706a6531 ---- DEBUG output for NAS-IP-Address = 172.16.224.2-------------- rad_recv: Access-Request packet from host 157.193.39.138:3675, id=66, length=51 User-Name = "user1" User-Password = "paswoordje" NAS-IP-Address = 172.16.224.2 Tue Nov 14 16:45:11 2006 : Debug: Processing the authorize section of radiusd.conf Tue Nov 14 16:45:11 2006 : Debug: modcall: entering group authorize for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 38 Tue Nov 14 16:45:11 2006 : Debug: rlm_realm: No '@' in User-Name = "user1", looking up realm NULL Tue Nov 14 16:45:11 2006 : Debug: rlm_realm: No such realm "NULL" Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 38 Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 38 Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'user1' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'user1' Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'user1' ORDER BY id Tue Nov 14 16:45:11 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Nov 14 16:45:11 2006 : Debug: rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id Tue Nov 14 16:45:11 2006 : Debug: rlm_sql (sql): Released sql socket id: 1 Tue Nov 14 16:45:11 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [user1] Tue Nov 14 16:45:11 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall[authorize]: module "sql" returns notfound for request 38 Tue Nov 14 16:45:11 2006 : Debug: modcall: leaving group authorize (returns ok) for request 38 Tue Nov 14 16:45:11 2006 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Nov 14 16:45:11 2006 : Debug: auth: Failed to validate the user. Tue Nov 14 16:45:11 2006 : Auth: Login incorrect: [user1] (from client ntradping port 0) Tue Nov 14 16:45:11 2006 : Debug: Delaying request 38 for 1 seconds Tue Nov 14 16:45:11 2006 : Debug: Finished request 38 Tue Nov 14 16:45:11 2006 : Debug: Going to the next request Tue Nov 14 16:45:11 2006 : Debug: --- Walking the entire request list --- Tue Nov 14 16:45:11 2006 : Debug: Waking up in 1 seconds... Tue Nov 14 16:45:12 2006 : Debug: --- Walking the entire request list --- Tue Nov 14 16:45:12 2006 : Debug: Waking up in 1 seconds... Tue Nov 14 16:45:13 2006 : Debug: --- Walking the entire request list --- Sending Access-Reject of id 66 to 157.193.39.138 port 3675 Anne-Mie

2 3

Tsunami MP.11 5054-R base station and Tsunami MP.11 5054-R
by Cameron Cowie 16 Nov '06

16 Nov '06

Hi all Is there anyone out there that works or has worked with the Tsunami base station / subscriber unit combo. I can get the base station to authenticate against my free radius server and it works beautifully, but when I get the subscriber unit to try to authenticate through the b/s it skips it and looks for the next available b/s that is not running radius authentication. Now is this a limitation of the hardware or am I missing a clue on the radius server? Trouble shooting I have done so far. Boot the radius server with raidusd -XX turn on the basestation have it authenticate. turn on the subscriber unit and nothing. Thanks all: Cameron

1 0

Re: build rpm packages on centOS
by Michael Messner 16 Nov '06

16 Nov '06

Patric sagte: > Michael Messner wrote: >> >> jep from source it compiles, >> >> 16:05:16 Xradius ~/rpmbuild/SPECS [root]rpmbuild -ba freeradius.spec >> >> ca mIke > > Sorry man, in that case Im not sure what the problem is... > You might get more help from the guys on GLUG Tech if you post there - > www.glug.org.za > > Let me know if you resolve it, Id be interested to know what the problem > was! I've found out that the problem is in the line with %pre freeradius.spec: ... cd .. echo "test1" %pre echo "test2" /usr/sbin/useradd -c "radiusd user" -r -s /bin/false -u 95 -d / radiusd 2>/dev/null || : ... before the test2 it breaks! ideas? ca mIke

1 1

Re: Freeradius-Users Digest, Vol 19, Issue 38
by Marilene Lima 16 Nov '06

16 Nov '06

Hi, Thanks a lot for the response. But I have two problems. The first is my english: I am Brazilian and I might not write in english very well... ; ) The second and more important problem is this: I configured my freeradius server, I can authenticate with my users ldap... but I configured my mysql server too, but I can't to authenticate with the mysql users... the access is denied... even when the user and password is correct... ho I think that the server isn't looking for my users in mysql database. Someone knows how I can to test if the freeradius is looking for my users in my mysql database too? Thanks a lot, Marilene

2 1

problem with freeeradius, mysql setup
by Alexandru Matei 16 Nov '06

16 Nov '06

Hi all, I have some problems setting up Freeradius 1.1.3, with mysql 3.23.54 on Redhat9. Here's the log for radiusd (relevant part): Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=216, length=57 User-Name = "test1" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 500 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [test1] modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 216 to 127.0.0.1 port 32769 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 216 with timestamp 4559bead Nothing to do. Sleeping until we see a request. On the mysql front all seems good: mysql -u dialup_admin -ppassword -D radius Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 134 to server version: 3.23.54-log Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id; +----+----------+---------------+----------+----+ | id | UserName | Attribute | Value | op | +----+----------+---------------+----------+----+ | 3 | test1 | User-Password | password | := | +----+----------+---------------+----------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------+----+ | 1 | retea | Simultaneous-Use | 1 | = | | 2 | retea | Auth-Type | Local | := | +----+-----------+------------------+-------+----+ 2 rows in set (0.01 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id; +----+----------+--------------------+----------------+----+ | id | UserName | Attribute | Value | op | +----+----------+--------------------+----------------+----+ | 7 | test1 | Framed-Compression | NONE | = | | 8 | test1 | Service-Type | Framed | = | | 10 | test1 | Framed-IP-Address | 193.226.57.105 | = | | 11 | test1 | Framed-IP-Netmask | 255.255.255.0 | = | | 12 | test1 | Framed-MTU | 1492 | = | +----+----------+--------------------+----------------+----+ 5 rows in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+-------------------+-----------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+-----------------+----+ | 1 | retea | Framed-Protocol | PPP | = | | 2 | retea | Port-Limit | 1 | = | | 3 | retea | Framed-IP-Address | 255.255.255.254 | = | | 4 | retea | Framed-MTU | 1492 | = | | 5 | retea | Service-Type | Framed | = | +----+-----------+-------------------+-----------------+----+ 5 rows in set (0.01 sec) Do you have any idea why is it failing? Thanks, Alex

3 5

help on pppd chap authorize by freeradius
by Alexandru Matei 16 Nov '06

16 Nov '06

Hi, I encounter an chap authorization problem using pppoe3.8, ppp 2.4.4b1 and Freeradius 1.1.3. The relevant logs are: PPP dump: Nov 15 17:43:29 localhost pppd[7486]: rcvd [LCP ConfReq id=0x2 <magic 0x1b31752> <pcomp> <accomp> <callback CBCP>] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Nov 15 17:43:29 localhost pppd[7486]: sent [LCP ConfRej id=0x2 <pcomp> <accomp> <callback CBCP>] Nov 15 17:43:29 localhost pppd[7486]: rcvd [LCP ConfReq id=0x3 <magic 0x1b31752>] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Nov 15 17:43:29 localhost pppd[7486]: sent [LCP ConfAck id=0x3 <magic 0x1b31752>] Nov 15 17:43:29 localhost pppd[7486]: sent [LCP EchoReq id=0x0 magic=0xbe000118] Nov 15 17:43:29 localhost pppd[7486]: sent [CHAP Challenge id=0x2 <dd114655881b93c9111ba4122068632faa63f98d>, name = "localhost"] Nov 15 17:43:29 localhost pppd[7486]: rcvd [CHAP Response id=0x2 <3e7ffb922fcba977f3dc8c2418d7dec2>, name = "test1"] 00 00 00 00 00 00 00 00 00 00 00 00 Nov 15 17:43:29 localhost pppd[7486]: rc_avpair_new: unknown attribute 60 Nov 15 17:43:31 localhost pppd[7486]: Peer test1 failed CHAP authentication Nov 15 17:43:31 localhost pppd[7486]: sent [CHAP Failure id=0x2 ""] Nov 15 17:43:31 localhost pppd[7486]: sent [LCP TermReq id=0x2 "Authentication failed"] Nov 15 17:43:31 anton pppd[7486]: rcvd [LCP TermAck id=0x2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... Nov 15 17:43:31 anton pppd[7486]: Connection terminated. Nov 15 17:43:31 anton pppoe-server[7171]: Sent PADT Freeradius log rad_recv: Access-Request packet from host 127.0.0.1:32769, id=64, length=89 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test1" CHAP-Password = 0x023e7ffb922fcba977f3dc8c2418d7dec2 Calling-Station-Id = "00:20:18:8E:6C:0E" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf ..... modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 1 rlm_chap: login attempt by "test1" with CHAP password rlm_chap: Using clear text password password for user test1 authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 1 modcall: leaving group CHAP (returns reject) for request 1 auth: Failed to validate the user. Altough I can obtain authorization using: [root@localhost]# echo "User-Name = test1, CHAP-Password=password" | radclient localhost auth password Received response ID 100, code 2, length = 62 Framed-Compression = None Service-Type = Framed-User Framed-IP-Address = 193.226.57.105 Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1492 Framed-Protocol = PPP Port-Limit = 1 Do anyone encounter the same problem? I can add that chap fails with all ppp versions (>=2.4.2) Thank you, Alex

3 3

how radius server differentiates users with same name from different ip addresses
by Sri 16 Nov '06

16 Nov '06

Hi List, Pls find the following scenario: When two users Admin1 and Admin2 are trying to get authentication against freeRadius server, how FR diffentiates the two requests. Is it based on Source ip address? Sri.

1 0

Radius and Mysql
by Marilene Lima 16 Nov '06

16 Nov '06

Sr Alan DeKok, When I used radiusd -X, I got just the message: Access Denied, but the username and the passsword is correct. I use the Debian, I dont´t know if the others linux servers are different. Thanks a lot, Marilene

2 1