- Freeradius-Users - lists.freeradius.org

mysql 4.1 - dialup_admin - badusers.sql and usersinfo.sql
by Hernan Antolini 25 Oct '06

25 Oct '06

Hi all, found that badusers.sql and usersinfo.sql wont work "as-is" with mysql => 4.1 because it did not support "DEFAULT" statements on auto_increment fields; verified that without DEFAULT the scripts runs ok. I am new on the list, found on the archives that it was reported before, but would like to know if it was reported to the authors to fix it. Thanks and hope it helps ! Hernan Antolini

1 0

Version Question
by King, Michael 25 Oct '06

25 Oct '06

I'm still struggling with my server throwing Error: TLS Alert write:fatal:bad record mac Error: TLS_accept:error in SSLv3 read certificate verify A Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. errors. So I've downgraded to 1.0.4, since that is the latest version that we have in production right now. This box had 1.1.3 installed (as a redhat package) I removed that, and and compiled 1.0.4 from source and installed it. (since I couldn't get 1.0.4 to build as a package) Two things I've noticed.. 1. The server is printing out this in the radius.log Wed Oct 18 17:35:53 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Oct 18 17:35:53 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Oct 18 17:35:53 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Oct 18 17:35:53 2006 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Oct 18 17:35:53 2006 : Auth: Login OK: [m2murray] (from client localhost port 0) Wed Oct 18 17:35:53 2006 : Auth: Login OK: [m2murray] (from client BUWiSM-1-1 port 29 cli 00-13-CE-14-B7-05) I thought the errors (SSL error error:00000000:lib(0):func(0):reason(0)) only started printing in version 1.1.3 (It was something to do with sending it to the log instead of stdout) 2. The server died with the "bad record mac" error, which has only happened to me in the 1.1.3 and the 1.1.2 versions. I've done a search, and the only binary I have on my machine states that it is version 1.0.4 So my question is: did the increased SSL logging come from FreeRADIUS, or from somewhere else, and could it be related to the "bad record mac"?

2 4

Problems with freeradius set up
by Mike Pearson 25 Oct '06

25 Oct '06

I'm new to the list and I'm having problems getting freeradius to authenticate users. I migrated from an old server running gnu-radius to a new server running freeradius both servers are using mysql. I made sure the tables in mysql match what freeradius required, I also made sure that the database user for freeradius had the same permissions as gnu-radius. My problems is I can't get the users to authenticate, I pasted the output from radtest and radiusd -X. I can provide any more information that my be needed. Thanks Mike Sending Access-Request of id 16 to 127.0.0.1:1645 User-Name = "mpearson" User-Password = "test" NAS-IP-Address = ip-208-109-22-193.ip.secureserver.net NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1645, id=16, length=20 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "dialup" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:57929, id=16, length=60 User-Name = "mpearson" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "mpearson", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "mpearson" rlm_realm: Proxying request from user mpearson to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'mpearson' rlm_sql (sql): sql_set_user escaped user --> 'mpearson' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'mpearson' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mpearson' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'mpearson' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mpearson' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [mpearson] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 16 to 127.0.0.1:57929 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 16 with timestamp 453e1d31 Nothing to do. Sleeping until we see a request.

3 6

RE: authenticating question
by Garber, Neal 25 Oct '06

25 Oct '06

> Ok, Well that might be what I'm looking for. How do you get > Radius to check for username,password and vlan/ssid? Well, as you might expect, that depends upon what data store you plan to go against (unix passwd file, freeradius users file, LDAP, etc.) You mentioned LDAP last time so I'll give you some pointers on that. We use LDAP for authorization and ntlm_auth via PEAP/MS-CHAP-V2 for authentication of 802.11 users. We require authentication via the AP to associate as opposed to using "open" on the AP with a Web-based portal. To configure LDAP authorization, look in ldap.attrmap. Within this file, you'll see checkItem entries within. These entries define what LDAP attribute to look for and the radius attribute to which it should be mapped. In our case, we check for membership in a specific AD group, based upon the SSID to which they are connecting. So, I have a checkItem for the "memberOf" LDAP attribute and I map it to Ldap-Group. The LDAP module will create a Ldap-Group check attribute for each AD group to which the user is a member (other than their primary group). Then, I have a perl script that determines the required group and checks for membership (by looking in the %RAD_CHECK{'Ldap-group'} variable - it will be an array if the user is a member of more than 1 group). It then returns RLM_REJECT if they aren't a member of a required group. You could also use attr_rewrite, probably with a regular expression, to create a custom Group-Requirement attribute based upon the SSID/VLAN information in the request. Then, you could use the checkval module to do the testing. (I used perl because it is much more flexible and because I like perl :-).) > Can you do a quick cut/paste job of what I need to place > in my conf files? Not unless you can articulate your specific requirements. If you need more info. than the above, state more specifically what you're trying to do (what LDAP attribute and what values). Or, if you're not using LDAP, what are you using? > Also what AP's are you using that allow you to get them to send the > ssid/vlan to Radius? Cisco 1232. You can get it to send the SSID via: dot11 location ... (will send WISPr-Location-ID as a request attribute with the SSID contained within the string) or radius-server vsa send authentication (will send cisco-AVPair as a request attribute with ssid=xxxx within the string) By the way, it is generally preferred to send all messages to the mailing list. In this way, you can take advantage of everyone's experience.

1 0

RE: authenticating question
by Garber, Neal 25 Oct '06

25 Oct '06

> We are trying to authenticate users based on the username/password given > AND the vlan they are authenticating from. Is this possible? Yes, if you can pass the information to freeradius. We currently do this by having our APs pass the SSID to which the user is connecting. It sounds like you aren't authenticating from the AP though, so you would need to do it differently. If you are authenticating from the portal and you have control over what it passes, then you can pass an attribute with the SSID or VLAN info. and then validate it during the authorize stage of freeradius processing.

2 1

sql.conf problem
by Norbert Wegener 25 Oct '06

25 Oct '06

In a certain context I want to accept all incoming requests. FreeRADIUS is 1.1.3. I hold the accounts in MySQL. This is, what I have stored in the database for one account: mysql> select * from usergroup where UserName='000000000009'; +---------+--------------+--------------+---------------------+---------------------+---------+ | id | UserName | GroupName | loaddate | validto | konftyp | +---------+--------------+--------------+---------------------+---------------------+---------+ | 1160351 | 000000000009 | sondergeraet | 2006-10-24 09:26:59 | 2006-10-31 00:00:00 | NULL | +---------+--------------+--------------+---------------------+---------------------+---------+ 1 row in set (0.00 sec) mysql> select * from radcheck where UserName='000000000009'; +---------+--------------+--------------+----+----------+---------------------+ | id | UserName | Attribute | op | Value | validto | +---------+--------------+--------------+----+----------+---------------------+ | 1159463 | 000000000009 | Hint | += | assignvl | 2006-10-31 00:00:00 | | 2512785 | 000000000009 | Auth-Type | := | Accept | NULL | | 2512786 | 000000000009 | Idle-Timeout | = | 123 | NULL | +---------+--------------+--------------+----+----------+---------------------+ 3 rows in set (0.00 sec) mysql> select * from radreply where UserName='000000000009'; +----+--------------+--------------+----+-------+------------+--------------+---------+ | id | UserName | Attribute | op | Value | ra_nasname | ra_GroupName | validto | +----+--------------+--------------+----+-------+------------+--------------+---------+ | 6 | 000000000009 | Idle-Timeout | = | 123 | NULL | NULL | NULL | +----+--------------+--------------+----+-------+------------+--------------+---------+ 1 row in set (0.00 sec) authorize_check_query from sql.conf is: authorize_check_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' and ( radcheck.Attribute !='Hint' ) \ ORDER BY id" radtest 000000000009 000b5d28f24x4 localhost 1812 testing123 Sending Access-Request of id 243 to 127.0.0.1 port 1812 User-Name = "000000000009" User-Password = "000b5d28f24x4" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=243, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Not the shared secret, the password is incorrect. Nevertheless, I want to ignore this and assign the check-item Auth-Type:=Accept from radcheck. radiusd -AX shows me: ... modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: '000000000009' rlm_sql (sql): sql_set_user escaped user --> '000000000009' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '000000000009' and ( radcheck.Attribute !='Hint' ) ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.UserName = '000000000009' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: '' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE ( usergroup.Username = '000000000009' AND usergroup.GroupName = radgroupreply.Value ) or (usergroup.UserName='000000000009' and (radgroupreply.GroupName in (select type from nas where nasname = '255.255.255.255') and radgroupreply.GroupName='Cisco' and radgroupreply.Attribute!='Tunnel-Private-Group-ID' ) ) ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 rlm_sql: check items Auth-Type := Accept Idle-Timeout = 123 Hint == "assignvl" ^^^^^^^^^^^^^^ (enabled debugging in rlm_sql.c around line 850) rlm_sql: reply items rlm_sql (sql): No matching entry in the database for request from user [000000000009] modcall[authorize]: module "sql" returns notfound for request 0 Why do I get a 'No matching entry in the database for request from user [000000000009]', although the expanded authorize_check_query , copied from above in mysql direct gives me the following: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '000000000009' and ( radcheck.Attribute !='Hint' ) ORDER BY id; +---------+--------------+--------------+--------+----+ | id | UserName | Attribute | Value | op | +---------+--------------+--------------+--------+----+ | 2512785 | 000000000009 | Auth-Type | Accept | := | | 2512786 | 000000000009 | Idle-Timeout | 123 | = | +---------+--------------+--------------+--------+----+ 2 rows in set (0.00 sec) Thanks Norbert Wegener

2 3

EAP: client certificates and double authentication messages
by Florian Prester 24 Oct '06

24 Oct '06

Hi, I am using freeradius successfully, but I still have some questions. Fistly, how can I disable to verify client certificates? Mon Sep 5 12:17:12 2005 : Error: TLS_accept:error in SSLv3 read client certificate A I mean I have disabled the comand in the config-file. But still I get the error above. Secondly, how comes I always see a successfull authentication twice, when using eap: Mon Sep 5 12:17:16 2005 : Auth: Login OK: [unrzwlan5] (from client localhost port 0) Mon Sep 5 12:17:16 2005 : Auth: Login OK: [unrzwlan5] (from client airbrush port 0 cli 00-11-09-0B-01-4D) Thanks Florian Prester -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 1

RE: Decreasing connection time (Session-Timeout)
by Jonathan De Graeve 24 Oct '06

24 Oct '06

> Now, how could I subtract the elapsed time from the original Session- > Timeout time? So that the user will, at the next login, only have > 40minutes left. > SQLcounter is the module you need. J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

5 7

EAP-TTLS success
by Rafiqul Ahsan 24 Oct '06

24 Oct '06

Hi all, I found the issue for below error "EAP-request timed out OR EAP-response to an unknown EAP-request" --- NAS was not responding with the state attribute received from radius server. As soon as we fixed this at NAS, it went through all the steps required to authenticate an user using TTLS-MSCHAPV2. My plaform was Solaris 10, with freeradius version 1.1.3 Thanks all for your valuable input. Rafi

1 0

RE: freeradius+hpidm+cisco
by Jonathan De Graeve 24 Oct '06

24 Oct '06

> All, > We have an hp infrastructure and use identity driven management to enforce > some additional rights to users(as forcing vlan assignment). > We have a mixed wireless environment with hp procurve and cisco(1200) > For hp access points we don't have any problem, but when trying with cisco > devices freeradius crasches with a segmentation fault. > The segmentation fault happens when accessing the module hpidm.post- > auth.conf which is loaded through radius.conf. > (if i comment out this module i don't get the error, but then vlan > assignment does't work for the hp's). > It would be usefull to debug and to post whats in the hpidm.post-auth.conf J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

3 5