- Freeradius-Users - lists.freeradius.org

RE: Hiding Passwords in Debug Output
by Garber, Neal 26 Sep '06

26 Sep '06

> The administrator has access to ALL secret information by simple > fact that he's an administrator. He can run tcpdump, and manually > decrypt the passwords. So hiding the password on the server is > pointless, and a waste of time. I realize that. I wasn't trying to *prevent* the admin. from getting the password if they felt they needed it (as if the admin. couldn't be trusted). Rather, I believe most of the time admins don't need to see it so why not have the *option* to suppress it since it's considered sensitive information. Displaying it increases the risk that others could see it and/or that an admin. would redirect debug output to disk because: they forgot it included sensitive information, they don't understand the risk, they're troubleshooting an intermittent problem and they need to save the output for later analysis, or because they normally redirect output of the server to disk just in case they need to troubleshoot a problem. Once it's on disk, it's the same issue that caused the eventual change to the detail module. > And that's the crux of the problem. The server is used by people > other than you, who DO need access to that information. That's unfair Alan. I was not trying to *dictate* that other admins shouldn't see it - I was proposing that admins should have a choice - because, IMO it's not needed to troubleshoot most problems. > Why not simply run the shell script I presented? I could and it would do most of what I wanted. However, it feels like a kludge and everyone on my team would need to remember to filter the output when running in debug mode. I just think it's safer (from the perspective of admins that don't want/need to see the passwords) to have a config. option that forces the suppression. With the config. option, you can change the server to run in debug mode without having to remember to pipe the output to sed (or to run a special script that pipes the output to sed). I've tried to articulate my point of view and why I see value in having this option. I've asked questions in an attempt to understand your point-of-view and you didn't answer them. I feel either I failed to explain myself clearly or you made up your mind from the start and aren't interested in hearing contrary opinions. Perhaps our difference is a matter of perspective, level of paranoia and the business environment in which the server is operating. In any case, it's not worth arguing about. After all, FreeRadius is open source so, if my team feels strongly enough about it, we can make the change and maintain it locally.

2 1

Apologies for Mr. Peter Nixon and updated sqlippool debug
by Guilherme Franco 26 Sep '06

26 Sep '06

Mr. Nixon, Please accept my humble apologies for the earlier spam. I would like to test your experimental module sqlippool in Oracle and in return, contribute somehow with my working configs and tables to the CVS. I understand that you are a busy man, so please excuse me if I did bother you. This question is not directed only to you but I'm asking it because module rlm_sqlippool have pnixon ownership. Please correct me with I'm wrong. With all the help from yours and everyone from freeradius-user-list, I've managed to make some progress with the sqlippool in Oracle, with just one error left. I'm not a SQL newbie, but I'm struggling to debug that error because I can't see the originating query as it is apparently mounted on the fly in lib/rlm_sqlippool* objects. I have C knowledge but didn't discovered what might be causing the error in rlm_sqlippool.c. Currently, I'm using freeradius-snapshot-20060925. I've compiled it with --enable-developer and ran radiusd -X through gdb. The error happens even when I'm using the default v1.4 of sqlippool.conf, without modifying it: ---------------------------------------------------------- Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' BEGIN rlm_sql_oracle: execute query failed in sql_query: ORA-06550: line 1, column 5: PLS-00103: Encountered the symbol "end-of-file" when expecting one of the following: begin case declare exit for goto if loop mod null pragma raise return select update while with <an identifier> <a double-quoted delimited-identifier> <a bind variable> << close current delete fetch lock insert open rollback savepoint set sql execute commit forall merge pipe rlm_sql_oracle: OCI_SERVER_NORMAL sqlippool_command: database query error ----------------------------------------------------------- Next is an output of Oracle's compatible version of sqlippool.conf that I've made. It works, but the IP from the sql pool does not get allocated because of the previous error: ----------------------------------------------------------- UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '2398432' SELECT framedipaddress FROM radippool WHERE pool_name = 'FOO' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> ''), expiry_time FOR UPDATE sqlippool_query1: SQL query did not succeed rlm_sqlippool: ip=[ ] len=0 radius_xlat: 'COMMIT' COMMIT rlm_sqlippool: IP number could not be allocated. rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test_user2' rlm_sql (sql): sql_set_user escaped user --> 'test_user2' modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 44 to 172.16.4.1 port 2243 Finished request 0 ----------------------------------------------------------- The question is: What is the complete BEGIN query? so I can debug the cause of the error through sqlplus. PS. gdb debug info: (gdb) info threads * 1 Thread 182896320192 (LWP 12546) 0x00000039718bf8f5 in __select_nocancel () from /lib64/tls/libc.so.6 (gdb) thread apply all bt full Thread 1 (Thread 182896320192 (LWP 12546)): #0 0x00000039718bf8f5 in __select_nocancel () from /lib64/tls/libc.so.6 No symbol table info available. #1 0x0000000000413271 in main (argc=Variable "argc" is not available. ) at radiusd.c:596 tv = {tv_sec = 1, tv_usec = 625000} request = (REQUEST *) 0x74f160 buffer = "* port 1814", '\0' <repeats 45 times>, "pôÿ¿\177\000\000\000àôÿ¿\177\000\000\000\021y\000s9\000\000\000`m\023s9\000\000\000pòÿ¿\177\000\000\000@(c)g\225*\000\000\000Ý\226`q9", '\0' <repeats 11 times>, "\ay\000s9\000\000\000\021y\000s9\000\000\000\t\000\000\000\000\000\000\000àôÿ¿\177\000\000\000ú\232`q9\000\000\0000/x\225*\000\000\000à3x\225*\000\000\000\2008x\225*\000\000\000(=x\225*\000\000\000\000ðU\225*\000\000\000P*x\225*\000\000\000ØAx\225*\000\000\000¨$x\225*", '\0' <repeats 11 times>, "`m\023s9"... readfds = {fds_bits = {448, 0 <repeats 15 times>}} argval = Variable "argval" is not available. Thank you very much.

3 7

proxy.conf
by srg krn 26 Sep '06

26 Sep '06

Hello: I have a freeradius proxy working fine with one realm (radgroup) defined in proxy.conf. If it receives a query for user@radgroup if "sends" to another radius server striping the "@radgroup" from username and all is OK. Now, I need that if a query for "user2@ldapgroup" arrives, then freeradius will send it to an ldap server. It is possible to configure a realm with "type=ldap" or something like this? Thanks and best regards

2 1

How to use rlm_dbm module ???
by 나종현 26 Sep '06

26 Sep '06

1 0

rlm_perl and accounting
by Justin Church 25 Sep '06

25 Sep '06

I'm running freeradius v. 1.1.0 and am trying to use rlm_perl to rewrite accounting attributes before they are written to log with detail and then replicated with radrelay. Here is the version of example.pl that I'm using (I've only added a single statement to the preacct function): use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { # For debugging purposes only # &log_request_attributes; # Here's where your authorization code comes # You can call another function from here: &test_call; return RLM_MODULE_OK; } # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } # Function to handle preacct sub preacct { # For debugging purposes only #&log_request_attributes; $RAD_REPLY{'Acct-Session-Id'} = "new-session-value"; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { # For debugging purposes only # &log_request_attributes; # You can call another subroutine from here #&test_call; return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle pre_proxy sub pre_proxy { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_proxy sub post_proxy { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_auth sub post_auth { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only # &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only # &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } Here's the output of freeradius -X: root@black-pearl:/etc/freeradius# freeradius -X ... Module: Loaded perl perl: module = "/home/jcc/scripts/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" perl: max_clones = 32 perl: start_clones = 5 perl: min_spare_clones = 3 perl: max_spare_clones = 3 perl: cleanup_delay = 5 perl: max_request_per_clone = 0 Module: Instantiated perl (perl) ... Here's my radiusd.conf: ... modules { perl { module = /home/jcc/scripts/example.pl max_clones = 32 start_clones = 5 min_spare_clones = 3 max_spare_clones = 3 cleanup_delay = 5 max_request_per_clone = 0 } } ... preacct { preprocess acct_unique perl suffix files } accounting { local-detail radrelay-detail unix radutmp } ... Notice from my example.pl that I'm trying to rewrite the value for Acct-Session-Id. The freeradius -X output shows that I've added a new pair, Acct-Session-Id = new-session-value, but only the original value shows up in the radacct log, not the new value: rad_recv: Accounting-Request packet from host 127.0.0.1:32819, id=89, length=65 User-Name = "jcc" NAS-Port = 1 Acct-Session-Id = "accounting-session-1" Sip-Transport-Protocol = TCP Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "accounting-session-1",User-Name = "jcc"' rlm_acct_unique: Acct-Unique-Session-ID = "4f08f8eb92e050ff". modcall[preacct]: module "acct_unique" returns ok for request 0 perl_pool: item 0x8168260 asigned new request. Handled so far: 1 found interpetator at address 0x8168260 rlm_perl: Added pair Acct-Session-Id = new-session-value perl_pool total/active/spare [5/0/5] Could not get @DynaLoader::dl_librefs for unloading. Unreserve perl at address 0x8168260 modcall[preacct]: module "perl" returns ok for request 0 rlm_realm: No '@' in User-Name = "jcc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/detail-20060822' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20060822 modcall[accounting]: module "local-detail" returns ok for request 0 radius_xlat: '/var/log/freeradius/radacct/radrelay-detail' rlm_detail: /var/log/freeradius/radacct/radrelay-detail expands to /var/log/freeradius/radacct/radrelay-detail rlm_detail: Acquired filelock, tried 1 time(s) rlm_detail: Released filelock modcall[accounting]: module "radrelay-detail" returns ok for request 0 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 0 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 89 to 127.0.0.1 port 32819 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 89 with timestamp 44eb308c Nothing to do. Sleeping until we see a request. radrelay-detail log: Tue Aug 22 12:27:56 2006 User-Name = "jcc" NAS-Port = 1 Acct-Session-Id = "accounting-session-1" Sip-Transport-Protocol = TCP NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "4f08f8eb92e050ff" Timestamp = 1156264076 What am I missing? Thanks. -jc

9 37

Re: Segfault with EAP-PEAP/MSCHAPv2
by Paul A Roberts 25 Sep '06

25 Sep '06

This is the core dump. FreeBSD 6.1 host, 1.1.2 FreeRadius. Authenticates fine using NTRadPing with MS-CHAP but crashes each time trying to authenticate from an XP box using EAP-PEAP/MS-CHAPv2. cat gdb-radiusd.log * 8 LWP 100065 0x280ac4ab in pthread_testcancel () from /usr/lib/libpthread.so.2 7 Thread 0x8077000 (runnable) 0x282e775f in select () from /lib/libc.so.6 6 Thread 0x8143000 (LWP 100061) 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 5 Thread 0x8143200 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 4 Thread 0x8143400 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 3 Thread 0x8143600 (runnable) 0x281db323 in sk_value () from /lib/libcrypto.so.4 2 Thread 0x8143800 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 1 Thread 0x8143a00 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 Thread 8 (LWP 100065): #0 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a4e3c in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x2808e450 in ?? () No symbol table info available. Thread 7 (Thread 0x8077000 (runnable)): #0 0x282e775f in select () from /lib/libc.so.6 No symbol table info available. #1 0x2809503d in select () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x08056231 in main () No symbol table info available. Thread 6 (Thread 0x8143000 (LWP 100061)): #0 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a4e3c in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x2808e450 in ?? () No symbol table info available. Thread 5 (Thread 0x8143200 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. Thread 4 (Thread 0x8143400 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. Thread 3 (Thread 0x8143600 (runnable)): #0 0x281db323 in sk_value () from /lib/libcrypto.so.4 No symbol table info available. #1 0x28464f8c in ssl3_output_cert_chain () from /usr/local/lib/libssl.so No symbol table info available. Thread 2 (Thread 0x8143800 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. Thread 1 (Thread 0x8143a00 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. #0 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 -----Original Message----- >From: Alan DeKok <aland(a)deployingradius.com> >Sent: Sep 25, 2006 7:36 AM >To: Paul A Roberts <proberts(a)teleport.com>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Subject: Re: Segfault with EAP-PEAP/MSCHAPv2 > >Paul A Roberts <proberts(a)teleport.com> wrote: >> Segmentation fault (core dumped) > > doc/bugs describes what to do. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog

3 2

RE: Hiding Passwords in Debug Output
by Garber, Neal 25 Sep '06

25 Sep '06

Let me start by saying that I appreciate the amount of time and effort you and others expend toward maintaining FreeRadius, answering countless/repetitive "my thing don't work, what's wrong" and "how do I..." questions, and responding to seemingly ridiculous enhancement requests *g* from people like me. You have certainly provided me information that was helpful to me in getting FreeRadius working. Thank you for sharing your time and knowledge Alan. > The whole purpose of debugging mode is to print out what the server > is doing. Hiding information is a guaranteed way to create problems. I agree with you 100% that having the server show what it is doing is very helpful when troubleshooting problems. Can you help me understand how displaying the plaintext password tells me what the server is doing? Even though the password is hidden by encryption in many other protocols, it is possible to properly configure and troubleshoot FreeRadius for these protocols. Are you saying you don't see any value in having the option to hide secret information? I freely admit that I'm fairly new to FreeRadius and this list, but I bet it's atypical that the actual value of the password (not whether the attribute is present) is necessary for non-FreeRadius developers to troubleshoot server problems. If you disagree, can you help enlighten me? > a) Why is it a security exposure? You haven't explained. Security exposure is perhaps the wrong term. I believe it increases the risk of user account compromise with little or no benefit to the administrator. Displaying the password while troubleshooting our FreeRadius deployment did not help me solve any problems. I'm open to the idea that it might help some people solve problems. But, if it's not normally needed and it's secret information, why not give administrators the option to suppress it (as the detail module does)? > You're really saying that it's a security exposure to show passwords > to the administrator who has permission to stop and start the server? What I'm saying is that displaying plaintext passwords and/or potentially storing them unencrypted on electronic media (e.g., redirected output from FreeRadius that is stored on disk and in backups), increases the risk of user account compromise. Also, being a FreeRadius administrator does not imply that you are an administrator of the backend user database. I'm not sure I understand the relevance of having permission to stop and start the server.. > b) If the default is changed to not show the passwords, are *you* > going to answer umpteen questions on this list about "why does the > password show up as ***"? That's an excellent point - I could easily see that outcome. Would you feel differently if the mask was different (e.g., "<password hidden by config. option>")? What if the default was to show the passwords so the server acts the same as it does now unless the administrator goes out of their way to change it?

2 1

Rewriting reply attributes
by Graham Beneke 25 Sep '06

25 Sep '06

Hi guys Is there any way (in some post processing module perhaps) to rewrite the name of a reply attribute without changing the value. One of the modules that I am using has the reply attribute 'hardwired' but it is returning the exact attribute value that I require. The more elegant solution would be to make the module more customisable - which is something I plan to pursue on the devel list shortly. But it would be really good if I can find a stop gap solution in the mean time. -- Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> Cell: 082-432-1873 <callto://+27824321873> Skype: grbeneke <callto://grbeneke> WEB: www.apolix.co.za <http://www.apolix.co.za/>

2 2

testing freeRadius
by Mike May 25 Sep '06

25 Sep '06

Hello Everyone, I am looking for some help with testing my installation of freeRadius. Here is my environment, I have 2 radius servers behind a very tight firewall that I do not admin, I need a way that I can test various forms of auth from the radius servers themselves, is that possible, does freeRadius come with it's own set of testing tools that can be run from the command line. Thanks in advaced Mike

3 2

FreeRADIUS + MySQL + md5 passwords?
by Jan Mulders 25 Sep '06

25 Sep '06

Hello all. I'm trying to get FreeRADIUS to authenticate against MD5 passwords. Here's the relevant part of my config... ............ modules { pap { encryption_scheme = md5 } ...... instantiate { #mysqlcounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess } accounting { #acct_unique #detail sql radutmp # ? } session { radutmp # ? sql } [end of file] I have the passwords in my database as MD5 (I have included a testuser2 with a plaintext password for troubleshooting): id UserName Attribute op Value 1 testuser1 Password == ae2b1fca515949e5d54fb22b8ed95575 2 testuser2 Password == testing What do I need to do to make FreeRADIUS authenticate passwords sent as plaintext to it from a client NAS, to MD5 stored in the database? Is this possible? (please see attempt logs below) Regards, Jan Mulders ### client request ### www~# radtest testuser1 testing localhost:1812 3 testing123 Sending Access-Request of id 111 to 127.0.0.1 port 1812 User-Name = "testuser1" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 3 Re-sending Access-Request of id 111 to 127.0.0.1 port 1812 User-Name = "testuser1" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 3 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=111, length=20 0www~# ### radiusd log ### Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:49086, id=111, length=61 User-Name = "testuser1" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 3 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [testuser1] Login incorrect: [testuser1/testing] (from client localhost port 3) rad_recv: Access-Request packet from host 127.0.0.1:49086, id=111, length=61 Sending Access-Reject of id 111 to 127.0.0.1 port 49086

3 2