- Freeradius-Users - lists.freeradius.org

disable FreeRadius checking of client certs
by devel 10 Oct '06

10 Oct '06

Is it possible to disable FreeRadius's checking of client certificates using EAP-TLS-PEAP? Certs can be quick a bother and a huge maintenance over-head. Thanks. FreeRadius 1.1.3 Travis J. Weaver Software Engineer Oberon, Inc. 1315 S. Allen St. Suite 405 State College, PA 16801 phone: (814)867-2312 ext. 210 fax: (814)867-2314 http://www.oberonwireless.com tjw(a)oberonwireless.com

2 3

One connection per username
by Ali Jawad 10 Oct '06

10 Oct '06

Hi How can I limit one connection per username..I.e. I do not want to allow multiple users to login using the same username password combination. -- With Regards Ali Jawad

2 1

Reversibly encrypted passwords in SQL
by Stefan Winter 09 Oct '06

09 Oct '06

Hello, is there any way of using reversibly encrypted passwords together with a mySQL backend? Currently, our passwords are stored as User-Password in clear text. I'd like to move on to using something like Crypt-Password := {algo-prefix}blablabla with an algorithm that encrypts reversibly. I failed to see a list of supported algorithms in the docs, a pointer would be nice... Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 4

RE: EAP-TLS Certificate problems.
by Jason-Wittlin-Cohen 09 Oct '06

09 Oct '06

> Message: 7 > Date: Mon, 9 Oct 2006 11:26:51 -0400 > From: "Brian vb" <nova5radius(a)gmail.com> > Subject: RE: EAP-TLS Certificate problems. > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <000f01c6ebb7$59118220$be01010a@lightwave> > Content-Type: text/plain; charset="us-ascii" > > Recreated certs, same issue came with the Issuer field. XPExtensions are > used. Password is the same in this file an what Freeradius has just changed > to protect it. > > > Here is the batch file I'm using to create the certs. I don't see anything > amiss between it and the page you sent.. any ideas? > > > PATH=C:\openssl\bin;C:\ssl1;%path% > export LD_LIBRARY_PATH=C:\openssl\lib > > > CD\SSL1 > > REM CA Creation > C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -export -in newreq.pem -out root.p12 -cacerts > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in root.p12 -out root.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in root.pem -out > root.der I'm not sure what you're doing here. First, "> C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved" You're outputting the private key and public key to the same file. I'm not sure if this will include both in the same file, or only create one. Regardless, it's not what you want to do. Give the files unique names. The clients and server need the public key and only the certificate signing machine needs the private key. You don't want to combine the keys. To create a CA: openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf Also, why are you creating a p12 file for the CA? You certainly don't want to hand out the private key to clients, and for certificate signing, you only need the private key which can be stored in cakey.pem for example. Clients should be given cacert.pem or cacert.der depending on the format you use. The p12 format should only be used for client certs because those need to combine private key + certificate (at least for the MS supplicant). > > REM Client cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, -keyout is used to creaate the private key, and -out to create the certificate signing request which is then passed on to the CA later. You're using the same filename, so I have no idea what's happening. Either you have a certificate signing request and no key, or a key without a signing request. Either way, it won't work. You need to do something like this: openssl req -new -keyout client_key.pem \ -out client_req.pem -days 730 -config ./openssl.cnf Notice that the key and the signing request are given different names. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpclient_ext -extfile > xpexts -infiles newreq.pem > > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-clt.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-clt.p12 -out cert-clt.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-clt.pem -out > cert-clt.der So, you convert from a PEM certificate and PEM key, to a P12 cert+key, to a PEM cert+key to DER cert+key. Why? The P12 cert+key will work fine. > > REM Server Cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, the key and certificate signing request must be given different names or else your setup will fail. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpserver_ext -extfile > xpexts -infiles newreq.pem > Do you need these steps? Freeradius will use a seperate certificate and key in PEM format. It works fine for me. It seems like your setup is overly complex. Keep it simple, and see if it works. Then you can change file formats- etc. For now, just make the changes I recommended and see if it gives you a working CA and client/server certificates. > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-srv.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-srv.pem -out > cert-srv.der > Jason Wittlin-Cohen

1 0

Huntgroups, Realms, MySQL
by Brad McAllister 09 Oct '06

09 Oct '06

Sorry if this has already been addressed. I has been searching all day and haven't found the solution to my problem. I am attempting to setup multiple huntgroups to limit the types of connections that clients can make. Along with this I have a list of realms that are authenticated locally and others that are directed to remote radius servers. All of the user and group information is stored in a mysql db. I am having problems authenticating users with realms that are not passed to a remote server. Below is an example of a test without a realm: radtest test blah123 127.0.0.1 0 testing123Sending Access-Request of id 215 to 127.0.0.1:1812 User-Name = "test" User-Password = "blah123" NAS-IP-Address = localhost.localdomain NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=215, length=272 Framed-Protocol = PPP Framed-Routing = Broadcast Framed-Compression = None Framed-MTU = 1500 Idle-Timeout = 0 Cisco-AVPair = "lcp:interface-config=rate-limit input 256000 32000 32000 conform-action transmit exceed-action drop" Cisco-AVPair = "lcp:interface-config=rate-limit output 4500000 32000 32000 conform-action transmit exceed-action drop" Service-Type = Framed-User With a realm: radtest test(a)dls.net blah123 127.0.0.1 0 testing123 Sending Access-Request of id 223 to 127.0.0.1:1812 User-Name = "test(a)dls.net" User-Password = "blah123" NAS-IP-Address = localhost.localdomain NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=223, length=20 Output from the server: rad_recv: Access-Request packet from host 127.0.0.1:32770, id=223, length=77 User-Name = "test(a)dls.net" User-Password = "blah123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_sql (sql): - sql_groupcmp radius_xlat: 'test(a)dls.net' rlm_sql (sql): sql_set_user escaped user --> 'test(a)dls.net' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='test(a)dls.net'' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 rlm_sql (sql): - sql_groupcmp finished: User does not belong in group 3072BY256 No huntgroup access: [test(a)dls.net] (from client localhost port 0) modcall[authorize]: module "preprocess" returns reject for request 2 modcall: group authorize returns reject for request 2 If I removed the huntgroups out of the picture, is works fine. The problem seems to be that the realm is not being stripped off of the username when it checks it against the usergroup table. If more information is needed, please let me know. I would really like to get this working. Thanks! - Brad

2 5

Debian stableFreeradius 1.0.2 + IOdbc + FreeTDS + MSSQL Segmentation fault.
by Angelo Compagnucci 09 Oct '06

09 Oct '06

Hi to all! I've a GREAT problem ... Freeradius exits abnormally with a segmentation fault error when user logoff ... This is the log: ... Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 45,Client-IP-Address = 192.168.0.2,NAS-IP-Address = 192.168.0.2,Acct-Session-Id = "81700000",User-Name = "tester6"' rlm_acct_unique: Acct-Unique-Session-ID = "14ec0af158f89db2". modcall[preacct]: module "acct_unique" returns ok for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'tester6' modcall[accounting]: module "radutmp" returns ok for request 2 radius_xlat: 'tester6' rlm_sql (sql): sql_set_user escaped user --> 'tester6' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-10-09 16:28:21', AcctSessionTime = '5', AcctInputOctets = '96', AcctOutputOctets = '200', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81700000' AND UserName = 'tester6' AND NASIPAddress = '192.168.0.2' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 1 Segmentation fault --------------- This is the strace: time(NULL) = 1160408543 getsockname(4, {sa_family=AF_INET, sin_port=htons(1813), sin_addr=inet_addr("0.0.0.0")}, [23053941335916560]) = 0 recvmsg(4, {msg_name(16)={sa_family=AF_INET, sin_port=htons(1035), sin_addr=inet_addr("192.168.0.2")}, msg_iov(1)=[{"\4 [\0\302\362n\337zq`9\211\335\320@^\n\307\360\214\6\6"..., 4096}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = 194 write(1, "rad_recv: Accounting-Request pac"..., 82rad_recv: Accounting-Request packet from host 192.168.0.2:1035, id=91, length=194 ) = 82 time(NULL) = 1160408543 write(1, "\tService-Type = Framed-User\n", 28 Service-Type = Framed-User ) = 28 write(1, "\tFramed-Protocol = PPP\n", 23 Framed-Protocol = PPP ) = 23 write(1, "\tNAS-Port = 47\n", 15 NAS-Port = 47 ) = 15 write(1, "\tNAS-Port-Type = Ethernet\n", 26 NAS-Port-Type = Ethernet ) = 26 write(1, "\tUser-Name = \"tester6\"\n", 23 User-Name = "tester6" ) = 23 write(1, "\tCalling-Station-Id = \"00:02:3F:"..., 42 Calling-Station-Id = "00:02:3F:17:65:34" ) = 42 write(1, "\tCalled-Station-Id = \"service1\"\n", 32 Called-Station-Id = "service1" ) = 32 write(1, "\tNAS-Port-Id = \"ether1\"\n", 24 NAS-Port-Id = "ether1" ) = 24 write(1, "\tAcct-Session-Id = \"81800001\"\n", 30 Acct-Session-Id = "81800001" ) = 30 write(1, "\tFramed-IP-Address = 10.0.102.17"..., 34 Framed-IP-Address = 10.0.102.175 ) = 34 write(1, "\tFramed-IP-Netmask = 255.255.255"..., 35 Framed-IP-Netmask = 255.255.255.0 ) = 35 write(1, "\tAcct-Authentic = RADIUS\n", 25 Acct-Authentic = RADIUS ) = 25 write(1, "\tAcct-Session-Time = 5\n", 23 Acct-Session-Time = 5 ) = 23 write(1, "\tAcct-Input-Octets = 96\n", 24 Acct-Input-Octets = 96 ) = 24 write(1, "\tAcct-Input-Gigawords = 0\n", 26 Acct-Input-Gigawords = 0 ) = 26 write(1, "\tAcct-Input-Packets = 9\n", 24 Acct-Input-Packets = 9 ) = 24 write(1, "\tAcct-Output-Octets = 200\n", 26 Acct-Output-Octets = 200 ) = 26 write(1, "\tAcct-Output-Gigawords = 0\n", 27 Acct-Output-Gigawords = 0 ) = 27 write(1, "\tAcct-Output-Packets = 11\n", 26 Acct-Output-Packets = 11 ) = 26 write(1, "\tAcct-Status-Type = Stop\n", 25 Acct-Status-Type = Stop ) = 25 write(1, "\tAcct-Terminate-Cause = User-Req"..., 37 Acct-Terminate-Cause = User-Request ) = 37 write(1, "\tNAS-Identifier = \"MikroTik\"\n", 29 NAS-Identifier = "MikroTik" ) = 29 write(1, "\tNAS-IP-Address = 192.168.0.2\n", 30 NAS-IP-Address = 192.168.0.2 ) = 30 write(1, "\tAcct-Delay-Time = 0\n", 21 Acct-Delay-Time = 0 ) = 21 time(NULL) = 1160408543 write(1, " Processing the preacct section"..., 49 Processing the preacct section of radiusd.conf ) = 49 time(NULL) = 1160408543 write(1, "modcall: entering group preacct "..., 46modcall: entering group preacct for request 2 ) = 46 time(NULL) = 1160408543 write(1, " modcall[preacct]: module \"prep"..., 67 modcall[preacct]: module "preprocess" returns noop for request 2 ) = 67 time(NULL) = 1160408543 write(1, "rlm_acct_unique: Hashing \'NAS-Po"..., 153rlm_acct_unique: Hashing 'NAS-Port = 47,Client-IP-Address = 192.168.0.2,NAS-IP-Address = 192.168.0.2,Acct-Session-Id = "81800001",User-Name = "tester6"' ) = 153 time(NULL) = 1160408543 write(1, "rlm_acct_unique: Acct-Unique-Ses"..., 62rlm_acct_unique: Acct-Unique-Session-ID = "8132fc6445e0c224". ) = 62 time(NULL) = 1160408543 write(1, " modcall[preacct]: module \"acct"..., 66 modcall[preacct]: module "acct_unique" returns ok for request 2 ) = 66 time(NULL) = 1160408543 write(1, "modcall: leaving group preacct ("..., 58modcall: leaving group preacct (returns ok) for request 2 ) = 58 time(NULL) = 1160408543 write(1, " Processing the accounting sect"..., 52 Processing the accounting section of radiusd.conf ) = 52 time(NULL) = 1160408543 write(1, "modcall: entering group accounti"..., 49modcall: entering group accounting for request 2 ) = 49 time([1160408543]) = 1160408543 time(NULL) = 1160408543 write(1, "radius_xlat: \'/var/log/radius/r"..., 40radius_xlat: '/var/log/radius/radutmp' ) = 40 time(NULL) = 1160408543 write(1, "radius_xlat: \'tester6\'\n", 24radius_xlat: 'tester6' ) = 24 open("/var/log/radius/radutmp", O_RDWR|O_CREAT, 0600) = 11 fcntl(11, F_SETLKW, {type=F_WRLCK, whence=SEEK_CUR, start=0, len=112}) = 0 lseek(11, 6944, SEEK_SET) = 6944 read(11, "tester6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 112) = 112 lseek(11, -112, SEEK_CUR) = 6944 write(11, "tester6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 112) = 112 close(11) = 0 time(NULL) = 1160408543 write(1, " modcall[accounting]: module \"r"..., 65 modcall[accounting]: module "radutmp" returns ok for request 2 ) = 65 time(NULL) = 1160408543 write(1, "radius_xlat: \'tester6\'\n", 24radius_xlat: 'tester6' ) = 24 time(NULL) = 1160408543 write(1, "rlm_sql (sql): sql_set_user esca"..., 55rlm_sql (sql): sql_set_user escaped user --> 'tester6' ) = 55 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=951, ...}) = 0 time(NULL) = 1160408543 write(1, "radius_xlat: \'UPDATE radacct SE"..., 338radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-10-09 17:42:23', AcctSessionTime = '5', AcctInputOctets = '96', AcctOutputOctets = '200', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81800001' AND UserName = 'tester6' AND NASIPAddress = '192.168.0.2' AND AcctStopTime = 0' ) = 338 time(NULL) = 1160408543 write(1, "rlm_sql (sql): Reserving sql soc"..., 42rlm_sql (sql): Reserving sql socket id: 1 ) = 42 time(NULL) = 1160408543 select(7, NULL, [6], NULL, NULL) = 1 (out [6]) sendto(6, "\1\1\1I\0\0\0\0UPDATE radacct SET AcctS"..., 329, MSG_NOSIGNAL, NULL, 0) = 329 time(NULL) = 1160408543 select(7, [6], NULL, NULL, NULL) = 1 (in [6]) recvfrom(6, "\4\1\0\21\0007\1\0", 8, MSG_NOSIGNAL, NULL, NULL) = 8 time(NULL) = 1160408543 time(NULL) = 1160408543 select(7, [6], NULL, NULL, NULL) = 1 (in [6]) recvfrom(6, "\375\20\0\305\0\1\0\0\0", 9, MSG_NOSIGNAL, NULL, NULL) = 9 time(NULL) = 1160408543 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 3981 detached

1 0

RE: EAP-TLS Certificate problems.
by Jason Wittlin-Cohen 09 Oct '06

09 Oct '06

> Hi, I'm trying to get Freeradius up and running on a WinXP box (win haters. > be nice ;) ) I have downloaded, installed, and configured the Freeradius > version from www.freeradius.net. The server starts seemingly without errors. > However when I try to connect with my XP laptop I get a certificate error on > the radius systems log. I have created 3 certificates, Root, Client, Server. > The Root and Client certificates were installed via the MMC snapin and > Import wizard in XP. Any idea on what could be causing the errors? If I > need to post file contents, let me know which ones. Using EAP-TLS(cert > based) not EAP-TTLS(user-pass based). Xp laptop is stuck at "Attempting to > Authenticate." > Welcome to the Freeradius mailing list, and thank you for providing debug log to help us sort out this issue. The debug information will tell you exactly why it's being rejected (i.e. no certificate was sent, certificate was signed by another CA). I believe I know what's going wrong. The CA public cert should be stored in the "Trusted Root Certification Authorities" certificate store. If it's anywhere else, Windows won't authenticate the server and it will look like it's failing- when it's doing what you asked it to do. In this scenario you won't see any error output from Freeradius because Windows has stopped attempting to connect. Your user public certificate must be stored in either your User or Machine Account "Personal" Certificate store (this is the first option in the snap-in). Also, if you have more than one certificate in your personal store, do not use "simply certificate selection". Windows will choose the one highest in the list (It did for me). Manually select the certificate you want to use. Read this howto and follow the "Configuring Windows XP Clients" guide. It will tell you exactly what to do. See http://www.linuxjournal.com/node/8151/print Here is what's happening currently: > Error 1 is seen if I have Validate Server Certificate check on the XP > Laptop. > > --Error 1-- > Sat Oct 7 19:35:58 2006 : Error: TLS_accept:error in SSLv3 read client > certificate A > ------ > > When you enable Server verification, Windows checks to see if the server's certificate is signed by a trusted Root CA that you specify. Since you didn't install the CA to the "Trusted Root Certificate Authorities" certificate store, the Windows supplicant refuses to continue authenticating and Freeradius has nothing to do. This error doesn't actually mean anything. I see it when I have a successful login. You're not seeing an error- which means the problem is on the client side. This can be remedied by installing your Root CA in the "Trusted Root Certification Authorities" certificate store. Here's a successful authenticaiton from my radiusd.log. You'll notice the read client certificate A error. It can safely be ignored. Sun Oct 8 03:13:56 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Auth: Login OK: [Jason Wittlin-Cohen] (from client WLAN port 8 cli 00095b93459e) > Error 2 is seen if Validate is unchecked on the laptop > > --Error 2-- > Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client > certificate A > Sat Oct 7 19:34:35 2006 : Error: --> verify error:num=20:unable to get > local issuer certificate > Sat Oct 7 19:34:35 2006 : Error: TLS Alert write:fatal:unknown CA > Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client > certificate B > Sat Oct 7 19:34:35 2006 : Error: rlm_eap_tls: SSL_read failed in a system > call (-1), TLS session fails. > Sat Oct 7 19:34:35 2006 : Auth: Login incorrect: [shadowwolf/<no > User-Password attribute>] (from client netnas port 11 cli 0014a5104864) > ----- > > Error 2 tells us exactly what the problem is. "Unable to get local issuer certificate" AND "Unknown CA". In other words, the certificate used is not the one it should be using as it's signed by another CA. This can be remedied by either installing the correct certificate in the "Personal" user certificate store and turning off "simple certificate selection". I hope this resolves your problem. Jason Wittlin-Cohen

2 3

free radius ntlm_auth problem
by Alan DeKok 09 Oct '06

09 Oct '06

Andris wrote: ... > Usernames without whitespaces authorize succesfully. When > run ntlm_auth manal and write usernames like 'user 1' than work. And > i want put a NT group requirment too like a 'Domain Users' ntlm_auth > string is: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" Try using: ntlm_auth = '...', i.e. use single quotes rather than double quotes. The issue appears to be that the User-Name string is expanded *before* the 'exec program' code is being called. That means the splitting of the program arguments by spaces is hitting the space in the username. What *should* happen is that entire string gets sent to the 'exec program' code, which splits the string by spaces, and *then* expands User-Name. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 2

Multiple users mysql backend
by Collen Blijenberg 09 Oct '06

09 Oct '06

I'm still looking for a good solution, authenticating multiple users with the same login name and with mysql as backend. in the mysql table 'radcheck' i have entered the following: UserName Attribute op Value gebruiker Calling-Station-Id == 00166f980e78 gebruiker NT-Password := <NT-HASH> gebruiker Calling-Station-Id == 00166f97d99d gebruiker NT-Password := <NT-HASH> it does work with the 'Users' plain text file. but as soon as i turn to mysql, it failles... ?! dunno is there some bug, or incomplete code, for the mysql backend ? Cheers, Collen.

2 2

rlm_perl CLONE/thread identification ?
by Jakub Wartak 09 Oct '06

09 Oct '06

Hello group, I tried using "use threads" and quering by simple: my $id = threads->tid; But it always returns 0 ( meaning that the perl code is running under main() program ), but how do I identifiy each CLONE ?? I want to obtain unique identified of each CLONE, because the goal is to create DB connection for each CLONE for performance reasons, the DBI object/handle AFAIK shouldn't be shared. Maybe enumerating in sub CLONE() ?? Is this launching CLONE of perl module serialized ? And I could fetch current running CLONE id from authorize () ? wiki.freeradius.org states ( about CLONE() ): "In this function you can initialize some variables that should be local for this thread. For example an Database connection." -- Jakub Wartak -vnull http://vnull.pcnet.com.pl/

2 1