- Freeradius-Users - lists.freeradius.org

Re: Freeradius hangs
by Karthik R 02 Nov '06

02 Nov '06

Karthik R" <kartthikr(a)gmail.com> wrote: > When I was observing the radius log, i was typing correct username and > password sometime it says "access was denied because username\password > invalid on the domain". I didnt see anything going wrong in the log message > but i didnt understand why i got the above error message. > > bash3.0#radiusd -X -A Which doesn't show that "access denied" message, and doesn't show the server hanging. I don't understand why posting this debug log would help solve the problem. It does NOT show the problem, and therefore is NOT useful. Alan DeKok Alan, Sorry i missed this part. I mean when i try to connect to remote vpn gateway using MS-VPN dialer interface, on the dialer interface i get this error message ie. "access was denied because username\password invalid on the domain". But when i checked the radius log i didnt find anything weird as attached before. Sometimes it hangs in btw authentication process, so i couldnt caputre the data of it and helpless here. can you help me now...

2 1

RADIUS MAC Authentication
by Van Der Westhuizen, Eldridge (Mr) (Summerstrand Campus North) 02 Nov '06

02 Nov '06

Hi All Need some advice please. Using Mikrotik as a NAS. Wireless clients connect to Mikrotik and i've got RADIUS MAC authentication setup on the Mikrotik. So all the clients MAC addresses are sent to the FreeRadius box in format 00:00:00:00:00:00 (which is the username) and blank password. So in the freeradius mysql db, i've got the following: In the radcheck table, i've got the mac as the username and blank password. In usergroup, i link the mac username to a group called Wireless. In Radgroupcheck i've got an entry for the Wireless group and telling it Auth-Type := Local. In Radgroupreply i only pass a service-type attribute for the wireless group with framed-user as value. Authentication seems to happen okay. In the radpostauth, i get an entry for the username, chap password authentication and access-accept message. The wireless client connect and get a DCHP ip from a pool in the Mikrotik NAS. Question: Is it possible to see which mac addresses/usernames got access-reject messages? I did take my mac out of the list and couldn't connect, but didn't get any messages in the radpostauth table. Also, i'm not getting any accounting in the accounting table. Do you only get accounting from making a PPP connection? Or is it possible to do RADIUS MAC authentication and get accounting detail from the session? Any help would be appreciated. Eldridge NOTICE: Please note that this eMail, and the contents thereof, is subject to the standard NMMU eMail disclaimer which may be found at: <http://www.nmmu.ac.za/disclaimer/email.htm>>

2 1

freeRADIUS on Solaris 10 - x86
by Michael Messner 02 Nov '06

02 Nov '06

hey freeRADIUS users, next step ... testing freeRADIUS on a Solaris 10 box and I'm completely new to solaris! :-( I've started with the configure again but there are so much things missing: aclocal autoconf autoheader locate libgdbm sys/security.h sys/prctl.h prot.h sia.h siad.h krb5.h gawk mawk ar ramlib strip argz.h libldap dl.h dld.h mach-o/dyld.h gdbm.h pam/pam_appl.h oci.h sql.h Where can I get all these things, do I need everything? We are trying to get freeradius working with 802.1x authentication to Microsoft Active directory with LDAP-groups and huntgroups: users-example: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys", Realm == ISALAB.local Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{Realm} - Domain, there are no restrictions for you in this network", Fall-Through = No I hope someone can help me a bit to find the right way! thanks mIke

3 2

Two sql queries in counter module
by Bishal 02 Nov '06

02 Nov '06

Hello all Is it possible to make two queries in sql counter module? like sqlcounter noresetcounter { driver = "rlm_sqlcounter" counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query1=SELECT activedate from radacct where username='%{%k}"' query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}' AND ActiveDate='$query1'" }

2 1

Database query failed: Table 'radius.radcheck' doesn't exist
by Dusan Djordjevic Liste 02 Nov '06

02 Nov '06

Hi all, I am trying to install dialup admin. I followed HOWTO located in doc/ directory. I created all tables in radius database using provided .sql files in sql/ dir. Now i have 4 tables in radius database: badusers, mtotacct, totacct, userinfo. When I connect to dialup admin and try to create new user, it gives me following error: Database query failed: Table 'radius.radcheck' doesn't exist (after bunch of error messages that some queries and inserts are not valid). I am not good with databases, but AFAIK this means that there is no radcheck table in radius database. Also, if i understand admin.conf properly, there is part that sayst following: sql_database: radius sql_accounting_table: radacct sql_badusers_table: badusers sql_check_table: radcheck sql_reply_table: radreply sql_user_info_table: userinfo sql_groupcheck_table: radgroupcheck sql_groupreply_table: radgroupreply sql_usergroup_table: usergroup sql_total_accounting_table: totacct sql_nas_table: nas Also lot of tables mentioned here do not exist. Did I missed something or ? TIA Dusan http://dj-dule.blogspot.com

3 6

RE: Database query failed: Table 'radius.radcheck' doesn't exist
by John Longland 02 Nov '06

02 Nov '06

Dusan 1. I assume you did run the db_sql_mysql.sql script to create the database schema ?? This will create the majority of the schema. 2. Did you run the sql-scripts in /usr/local/dialup_admin/sql ? They are executed in a similar fashion. Note: In my case , I got error messages when executing some of these scripts. What I did was to remove the "DEFAULT '0'" from the scripts that failed. You execute a script as follows: First you log into mysql : mysql -uroot -p<password> Then you create the database: CREATE DATABASE radius; Then execute the script: mysql -uroot -p<rootpassword> radius < db_sql_mysql.sql Hope this helps John -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of Dusan Djordjevic Liste Sent: 02 November 2006 12:06 To: freeradius-users(a)lists.freeradius.org Subject: Database query failed: Table 'radius.radcheck' doesn't exist Hi all, I am trying to install dialup admin. I followed HOWTO located in doc/ directory. I created all tables in radius database using provided .sql files in sql/ dir. Now i have 4 tables in radius database: badusers, mtotacct, totacct, userinfo. When I connect to dialup admin and try to create new user, it gives me following error: Database query failed: Table 'radius.radcheck' doesn't exist (after bunch of error messages that some queries and inserts are not valid). I am not good with databases, but AFAIK this means that there is no radcheck table in radius database. Also, if i understand admin.conf properly, there is part that sayst following: sql_database: radius sql_accounting_table: radacct sql_badusers_table: badusers sql_check_table: radcheck sql_reply_table: radreply sql_user_info_table: userinfo sql_groupcheck_table: radgroupcheck sql_groupreply_table: radgroupreply sql_usergroup_table: usergroup sql_total_accounting_table: totacct sql_nas_table: nas Also lot of tables mentioned here do not exist. Did I missed something or ? TIA Dusan http://dj-dule.blogspot.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

(no subject)
by benodilo＠free.fr 02 Nov '06

02 Nov '06

Hi, My freeradius work fine (freeradius in server 1 + Mysql in server 2). But i have errors in my logs(see bottom LOGS 1) and all solutions i try don't solve this. I have : -Increase the number of sql connections to 10 --> num_sql_socks = 10 -Increase the time to wait before cleaning up a reply --> cleanup_delay = 8 -Verify if the index are in the good collums(charte_valide is as custom for a php application) : Requete: EXPLAIN SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ben' AND charte_valide = 'o' ORDER BY id Result : +----+-------------+----------+------+------------------------+----------+---------+-------+------+-----------------------------+ | id | select_type | table | type | possible_keys | key | key_len | ref | rows | Extra | +----+-------------+----------+------+------------------------+----------+---------+-------+------+-----------------------------+ | 1 | SIMPLE | radcheck | ref | UserName,charte_valide | UserName | 66 | const | 1 | Using where; Using filesort | +----+-------------+----------+------+------------------------+----------+---------+-------+------+-----------------------------+ The NAS is a ISA SERVER and the students use a navigator without tab so isa server send too much querys to freeradius (see bottom LOGS 2)... And I don't see à otion in ISA server for caching the querys. What can i try more ? I have only one Nas in this time and i have used all ideas. I will add more NAs in the future so this little problem can will be a big problem... Your solutions are welcomes ! Best regards. LOGS 1: [root@fedora ~]# cat /var/log/radius/radius.log | grep "DB" Wed Nov 1 15:04:59 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Nov 1 19:28:27 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Nov 1 19:28:27 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Nov 1 20:56:27 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Nov 1 20:56:27 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 00:08:01 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 00:08:01 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 02:01:29 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 09:30:32 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 09:30:40 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 09:30:40 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 11:01:09 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 11:01:09 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thu Nov 2 11:02:53 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 LOGS 2 : Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1238761472) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1238827008) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1238919533) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1238958080) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239023616) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239089152) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239154688) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239220224) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239416832) Thu Nov 2 11:56:47 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239482368) Thu Nov 2 11:56:48 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239678976) Thu Nov 2 11:56:48 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239744512) Thu Nov 2 11:56:49 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239860756) Thu Nov 2 11:56:49 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239906816) Thu Nov 2 11:56:49 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1239941120) Thu Nov 2 11:56:49 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1240006656) Thu Nov 2 11:56:49 2006 : Auth: Login OK: [reda.achour] (from client isaserver2 port 1240072192)

1 0

Realm and LDAP authentication
by Rio Yang 02 Nov '06

02 Nov '06

Hi, I wanna to authenticate user by LDAP server. But I have two LDAP servers for different group of users. For example, students or staffs, each has different realm name. Students' realm name is @stud.test and staffs' realm name is @staf.test. Realm (@stud.test) must pass to LDAP server one to authenticate. And realm (@staff.test) must pass to LDAP server two to authenticate. Does freeradius support this scenario ?? And how to do it ?? Thanks. Rio

1 0

Multiple input_pairs?
by Patric 02 Nov '06

02 Nov '06

Hi, Is it possible to specify multiple input pairs? EG: exec { wait = yes input_pairs = request,config shell_escape = yes output = none } If it is possible would the above syntax be correct? TIA Patric

2 2

Re: Problem connecting Client to dot1x-Network over Cisco AP
by Habegger Lukas, ERZ-AZD-AIL 02 Nov '06

02 Nov '06

Hi On all clients is the same certificate installed. I tried it with two installations. First i tried with a certificate from the CA.all script and after with a certificate from a MS CA Server. Now i use the certificate from the CA.all script. On my notebook i tested it wired and wireless with this certificate. Wired it works and wireless not. Could it be something with the certificate options Here the certificate from the CA.all script ------------------------------------------------------- -----BEGIN CERTIFICATE----- MIIC+DCCAmGgAwIBAgIJAMpuxH83nFddMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNV BAYTAkNIMQ0wCwYDVQQIEwRCZXJuMQ0wCwYDVQQHEwRCZXJuMQwwCgYDVQQKEwNF UloxDDAKBgNVBAsTA05PQzETMBEGA1UEAxMKRnJlZXJhZGl1czAeFw0wNjA2MDky MTA3MTdaFw0wODA2MDgyMTA3MTdaMFwxCzAJBgNVBAYTAkNIMQ0wCwYDVQQIEwRC ZXJuMQ0wCwYDVQQHEwRCZXJuMQwwCgYDVQQKEwNFUloxDDAKBgNVBAsTA05PQzET MBEGA1UEAxMKRnJlZXJhZGl1czCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA v20r19aCPNjLcOT08mzXtSQiw86yXCiWPJHZaG2wF+rV7D66f3wzN2UzviNjjDrL 0kh2KDaLp4J7hhom4LjDzb9CLhSgdRnYMSpY5IUmGzIctsEPAsuWGMAlzTSlKEaY /z9cviuqS0P9Zu+lMMN1BdiZy8n1XKf6qE2UxYRksKsCAwEAAaOBwTCBvjAdBgNV HQ4EFgQUNC9D8X9AV03R5xmh8lCYu6q4DuYwgY4GA1UdIwSBhjCBg4AUNC9D8X9A V03R5xmh8lCYu6q4DuahYKReMFwxCzAJBgNVBAYTAkNIMQ0wCwYDVQQIEwRCZXJu MQ0wCwYDVQQHEwRCZXJuMQwwCgYDVQQKEwNFUloxDDAKBgNVBAsTA05PQzETMBEG A1UEAxMKRnJlZXJhZGl1c4IJAMpuxH83nFddMAwGA1UdEwQFMAMBAf8wDQYJKoZI hvcNAQEFBQADgYEAE1HDhrsuhju+NDVBjEX23OMvsTp4Hjf6gbiRblDwI70N7sbT +IKU/CGV/kzbKu56J63fX3XGokp1lTRwu/fcLLMhJd5B8q0Z6HiATohSHczZXcOu xFYubxo7eAcQTG/RzCLjrF53U1/CmzFhqEZoEvnBYk90EqZrdSWx8zs1Gow= -----END CERTIFICATE----- ------------------------------------------------------- Lukas -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+lukas.habegger=erz.be.ch(a)lists.freeradius.org [mailto:freeradius-users-bounces+lukas.habegger=erz.be.ch@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Mittwoch, 1. November 2006 17:38 An: FreeRadius users mailing list Betreff: Re: Problem connecting Client to dot1x-Network over Cisco AP "Habegger Lukas, ERZ-AZD-AIL" <lukas.habegger(a)erz.be.ch> wrote: > I try to connect a wireless client (WinXP) to my dot1x-Network over a > Cisco AP 1242AG. > > On my FreeRADIUS i get the following error: ... > Wed Nov 1 14:59:08 2006 : Debug: rlm_eap_tls: <<< TLS 1.0 Alert > [length 0002], fatal bad_certificate Ok... it doesn't like the certificate. > With my wired clients i don't any problems and the same setup runs > with a Cisco ACS With the same certificate? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0