- Freeradius-Users - lists.freeradius.org

mysql and huntgroups
by Norbert Wegener 11 Sep '06

11 Sep '06

I am using freeradius having all the users stored in a mysql database. This works fine. Now I have the need to introduce huntgroups. This also works fine, when using the huntgroups file. As the mysql database is replicated automatically, all changes to user accounts on the main database also appear on the backup server. Can freeradius be configured, so that also the huntfile is handled by mysql and changes within that file are also replicated to the backup database? I did not find information about that. Thanks Norbert Wegener

2 1

Problem with Solaris 8 to Solaris 10 migration (same radius version).
by James Vautin 11 Sep '06

11 Sep '06

Hello, We have a Solaris 8 box running freeradius 1.0.4. This machine is being upgraded to a bigger beast running Solaris 10. The problem I am having has occurred on all versions of freeradius I have tested on the new Solaris 10 machine - including 1.0.4, 1.0.5, and 1.1.1. The error, when running radiusd -X is this: auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Facts: 1. We are connecting the same NAS box to the new machine and getting the same error. 2. We are using the same exact configuration files (and obviously the same secret.) 3. The NAS box is a Cisco Catalyst 3450 (24 DC Powered) Protocol 1645, IOS 12.1[13]EA1C. 4. I have verified that the same configuration file with the same secret is being read, and that the secret on the NAS box stays the same when connecting to both hosts. 5. I am sending no extra options to ./configure at compile time. I thank you so much for any leads anyone can give me into the cause of this. Here is the entire output: bash-3.00# /usr/local/sbin/radiusd -X -p 1645 Ignoring deprecated command-line option -pStarting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Using deprecated realms file. Support for this will go away soon. radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded System unix: cache = yes unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 300 HASH: Reinitializing hash structures and lists for caching... HASH: user root found in hashtable bucket 11726 HASH: user daemon found in hashtable bucket 11668 HASH: user bin found in hashtable bucket 86651 HASH: user sys found in hashtable bucket 64201 HASH: user adm found in hashtable bucket 26466 HASH: user lp found in hashtable bucket 54068 HASH: user uucp found in hashtable bucket 38541 HASH: user nuucp found in hashtable bucket 74587 HASH: user smmsp found in hashtable bucket 13600 HASH: user listen found in hashtable bucket 49327 HASH: user gdm found in hashtable bucket 50360 HASH: user webservd found in hashtable bucket 39570 HASH: user nobody found in hashtable bucket 99723 HASH: user noaccess found in hashtable bucket 80609 HASH: user nobody4 found in hashtable bucket 84789 HASH: user c927693 found in hashtable bucket 51401 HASH: Stored 16 entries from /etc/passwd HASH: Stored 21 entries from /etc/group Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 144.133.145.11:1812, id=164, length=82 NAS-IP-Address = 144.133.145.11 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "c927693" Calling-Station-Id = "144.133.188.238" User-Password = "TI.\331\255\254Z3\036\247sj\262\274[\222" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "c927693", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 HASH: user c927693 found in hashtable bucket 51401 users: Matched entry DEFAULT at line 40 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 HASH: user c927693 found in hashtable bucket 51401 modcall[authenticate]: module "unix" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 164 to 144.133.145.11:1812 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 164 with timestamp 44a38917 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 144.133.145.11:1812, id=165, length=82 NAS-IP-Address = 144.133.145.11 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "c927693" Calling-Station-Id = "144.133.188.238" User-Password = "\036\000\247\352!m\001\251\3149\220HZKqP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "c927693", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 HASH: user c927693 found in hashtable bucket 51401 users: Matched entry DEFAULT at line 40 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 HASH: user c927693 found in hashtable bucket 51401 modcall[authenticate]: module "unix" returns reject for request 1 modcall: group authenticate returns reject for request 1 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 165 to 144.133.145.11:1812 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 165 with timestamp 44a389a7 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 144.133.145.11:1812, id=166, length=79 NAS-IP-Address = 144.133.145.11 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "fred" Calling-Station-Id = "144.133.188.238" User-Password = "8y\356\005\243\251\252W\234\rT\220\262{\347?" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Prefix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "fred", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 40 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 166 to 144.133.145.11:1812 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 166 with timestamp 44a389df Nothing to do. Sleeping until we see a request. ^C bash-3.00#

2 1

Autoreply: Reid Canavan is on vacation.
by Reid Canavan 11 Sep '06

11 Sep '06

I will be out of the office starting 09/11/2006 and will not return until 09/18/2006. I will respond to your message when I return.

1 0

Multiple prefixes and suffixes in hints
by Doug Hardie 09 Sep '06

09 Sep '06

I don't see anything in the docs, but is it possible to have hints entries that distinguish between: userid xx+userid userid@yyy xx+userid@yyy Such that a different hint is given for each of the above forms. The first 3 are easy. The last one is the issue. I am guessing that an entry along the form of: DEFAULT Prefix == "xx", Suffix== "@yyy", Strip-User-name = Yes Hint = "4th-form" would be used.

1 0

How to enable session-timeout in freeradius
by Ranjeet Kumar 09 Sep '06

09 Sep '06

Hi, I am using freeradius and backend as mysql. Can you tell how to enable session-timeout? Thanks, Ranjeet The information contained in, or attached to, this e-mail, contains confidential information and is intended solely for the use of the individual or entity to whom they are addressed and is subject to legal privilege. If you have received this e-mail in error you should notify the sender immediately by reply e-mail, delete the message from your system and notify your system manager. Please do not copy it for any purpose, or disclose its contents to any other person. The views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of the company. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused, directly or indirectly, by any virus transmitted in this email. www.aztecsoft.com

2 1

Freeradius 1.1.3 not forking child processes
by Jonathan De Graeve 09 Sep '06

09 Sep '06

Hello, I just installed 1.1.3 on my system and it doesn't fork the 5 freeradius processes. (start_servers = 5) No errors in radius.log and offcourse debugging mode doesn't help because that only starts a single process. Build from scratch on a debian sarge system with adapted configure rules: ---./configure \ >--->---$(confflags) \ >--->-----config-cache \ >--->-----prefix=/usr \ >--->-----exec-prefix=/usr \ >--->-----mandir=$(mandir) \ >--->-----sysconfdir=/etc \ >--->-----libdir=$(libdir) \ >--->-----datadir=/usr/share \ >--->-----localstatedir=/var \ >--->-----with-raddbdir=$(raddbdir) \ >--->-----with-logdir=/var/log/$(package) \ -----with-system-libtool >--->--disable-ltdl-install \ -----with-large-files --with-udpfromto >--->--with-edir \ -----with-snmp \ -----enable-strict-dependencies \ >--->-----enable-developer \ >--->-----with-rlm-perl-lib-dir=/usr/lib/libperl.so \ >--->-----with-experimental-modules \ ---${buildssl} Kind Regards, J. -- Jonathan De Graeve Network/System Engineer Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be

3 2

Proxy problem in FreeRADIUS 1.1.3
by Chris A. Kalin 08 Sep '06

08 Sep '06

OK, I've got a bit of a weird issue here. I've beat my head against it and I'm turning to the list for help. I have local UNIX authentication, and I also proxy a few realms. The problem seems to arise when I have the same username both locally and going to a particular realm. We have bob(a)realm.com and bob. Bob (the local user) is disabled, he's in a certain group on my server that locks him out completely. On my backup RADIUS server, which is version 0.8-pre, I get the expected behavior - if bob tries to log in, he gets a "Your account has been disabled" message, but if bob(a)domain.com tries to log in, the proxy request goes to the remote server and it'll work. But on 1.1.3 I get weird results. Bob (local) gets the same "disabled" message, but so does bob(a)domain.com. But if I take bob out of the local passwd file, bob(a)domain.com proxies to where it's supposed to go and works fine. What's even weirder is in the above failure, I don't even get anything in radius.log about bob(a)domain.com failing auth - I have to hear about it from the customer himself. I'm assuming something major changed in the proxy code in the past, what, four years? But this is kind of a show stopper for me, so any help would be appreciated. I can post whatever config files anyone needs, but maybe I'm just missing something stupid here. Thanks in advance! Chris Kalin

3 12

Problems with SER, MySQL & FreeRADIUS
by Roberto Lopes 08 Sep '06

08 Sep '06

Hello! I'm having some problems when wanting the database of SER to be the one FreeRADIUS will be checking on, instead of the radius database. Like that I changed the file /etc/raddb/sql.conf At the end is the output of the problems. Hope somebody can help, Thanks in advance Roberto #----------------------------------------------------------------------------------------------------------------------------------------------# #SQL.conf sql { driver = "rlm_sql_mysql" server = "localhost" login = "root" password = "**********" # Database table configuration radius_db = "ser" # Allow for storing data after authentication postauth_table = "authenticate" authcheck_table = "subscriber" authreply_table = "subscriber2" ### postauth_table = "radpostauth" ### authcheck_table = "radcheck" ### authreply_table = "radreply" ### groupcheck_table = "radgroupcheck" ### groupreply_table = "radgroupreply" ### usergroup_table = "usergroup" # Table to keep radius client info ### nas_table = "nas" authorize_check_query = "SELECT phplib_id, username, password\ FROM ${authcheck_table} \ WHERE LOWER(username) = LOWER('%{SQL-User-Name}') \ ORDER BY phplib_id" authorize_reply_query = "SELECT phplib_id, username, password\ FROM ${authreply_table} \ WHERE LOWER(username) = LOWER('%{SQL-User-Name}') \ ORDER BY phplib_id" authorize_check_query = "SELECT phplib_id, username, password\ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY phplib_id" authorize_reply_query = "SELECT phplib_id, username, password\ FROM ${authreply_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY phplib_id" postauth_query = "INSERT into ${postauth_table} (phplib_id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" #SQL.conf #----------------------------------------------------------------------------------------------------------------------------------------------# I thought that i neede to create some more tables so here they are Subscriber2 will act like- authcheck_table Authenticate will actlike - postauth_table #----------------------------------------------------------------------------------------------------------------------------------------------# #Tables created in databaseSER CREATE TABLE authenticate ( phplib_id varchar(32) not null default '', user varchar(64) not null default '', pass varchar(25) not null default '', reply varchar(25) not null default '', date datetime NOT NULL default '0000-00-00 00:00:00', PRIMARY KEY phplib_id(phplib_id)); table subsciber had exactly the same structure of subscriber2 CREATE TABLE subscriber2 ( phplib_id varchar(32) NOT NULL default '', $USERCOL varchar(64) NOT NULL default '', domain varchar(128) NOT NULL default '', password varchar(25) NOT NULL default '', first_name varchar(25) NOT NULL default '', last_name varchar(45) NOT NULL default '', phone varchar(15) NOT NULL default '', email_address varchar(50) NOT NULL default '', datetime_created datetime NOT NULL default '0000-00-00 00:00:00', datetime_modified datetime NOT NULL default '0000-00-00 00:00:00', confirmation varchar(64) NOT NULL default '', flag char(1) NOT NULL default 'o', sendnotification varchar(50) NOT NULL default '', greeting varchar(50) NOT NULL default '', ha1 varchar(128) NOT NULL default '', ha1b varchar(128) NOT NULL default '', allow_find char(1) NOT NULL default '0', timezone varchar(128) default NULL, rpid varchar(128) default NULL, domn int(10) default NULL, uuid varchar(64) default NULL, UNIQUE KEY phplib_id (phplib_id), PRIMARY KEY ($USERCOL, domain), KEY user_2 ($USERCOL) ) ; #Tables created in databaseSER #----------------------------------------------------------------------------------------------------------------------------------------------# Output Problems reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf /etc/raddb/sql.conf[243]: Line is not in 'attribute = value' format Errors reading radiusd.conf

2 2

IP Address lease time
by John Williams 08 Sep '06

08 Sep '06

I want to set a lease time on IP address assignment. Does Freeradius do this or the device the connection is terminated on? We have an L2TP tunnel terminating dialup customers on a Cisco 7403. Is there an attribute to assign users from Freeradius or a Cisco config line that does this? Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.12.2/441 - Release Date: 07/09/2006

4 3

Different ldap authentications
by Angel L. Mateo 08 Sep '06

08 Sep '06

Hello, We are using freeradius as our radius server and we use it for authentication and authorization in different applications. Our users backend is a ldap directory, so in radiusd.conf we've got: server = "ldap.domain.com" identity = "cn=radiususer,dc=domain,dc=com" password = radiuspw basedn = "ou=People,dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Now, we need to configure our radius server so it could use another different ldap configuration for some of its clients. I know I could discriminate clients, but I haven't found how to make it use another different ldap configuration, if it is possible. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 1