- Freeradius-Users - lists.freeradius.org

user not found in freeradius "users" file
by Bertrand Poulet 23 Mar '06

23 Mar '06

hello all , i've got a vpn server which make authentication to a freeradius server. the user "someone" is authenticated (file users of freeradius) when tested locally via radtest, but not when the request comes from nas box in first case , the user is found in file users of freeradius at line 227 , and in the second case the same user isn't found in file. instead, the user is searched in system (/etc/passwd). why the user isn't found in file users of freeradius ? thanks . root@gringo raddb]# radtest someone thepass localhost 0 secret Sending Access-Request of id 161 to 127.0.0.1 port 1812 User-Name = "someone" User-Password = "thepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Request packet from host 127.0.0.1:35045, id=161, length=59 User-Name = "someone" User-Password = "thepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry someone at line 227 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found *Auth-Type Local* auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [someone/thepass] (from client localhost port 0) Sending Access-Accept of id 161 to 127.0.0.1 port 35045 ====================================================== root@gringo raddb]# rad_recv: Access-Request packet from host 192.168.10.1:1025, id=181, length=156 User-Name = "someone" User-Password = "thepass" NAS-Port = 546 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "191.254.137._" Calling-Station-Id = "66.147.66.24_" Tunnel-Client-Endpoint:0 = "66.147.66.24_" NAS-IP-Address = 192.168.10.1 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=66.147.66.24_" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found *Auth-Type System* auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: leaving group authenticate (returns notfound) for request 2 auth: *Failed *to validate the user.

3 3

Tagged Vlans
by radhika putty 23 Mar '06

23 Mar '06

Hi All, Does Free Radius support tagging of VLAN's --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 1

Ignoring request from unknown client *.*.*.* 2244
by yao guoxian 23 Mar '06

23 Mar '06

I have configured FreeRadius to use Mysql.It seemed Mysql works well when I input "Radiusd -X". However when I use NtRadPing to test,I always get the following error: rad_recv: Access-Request packet from host 202.117.15.164:2244, id=0, length=43 Ignoring request from unknown client 202.117.15.164:2244 --- Walking the entire request list --- I insert items into the table 'nas' int the 'radius' database like : +----+----------------+-----------+-------+-------+------------+-----------+---------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+----------------+-----------+-------+-------+------------+-----------+---------------+ | 1 | 202.117.15.164 | liv1 | other | NULL | testing123 | NULL | RADIUS Client | +----+----------------+-----------+-------+-------+------------+-----------+---------------+ But it doesn't work.

1 0

RE: Table radacct is empty
by Vincent MARGUERIE 23 Mar '06

23 Mar '06

Hi, Yes, SQL is ok to query in accounting section. Here is a part of my radiusd.conf : # The rlm_sql_log module appends the SQL queries in a log # file which is read later by the radsqlrelay program. # # This module only performs the dynamic expansion of the # variables found in the SQL statements. No operation is # executed on the database server. (this could be done # later by an external program) That means the module is # useful only with non-"SELECT" statements. # # See rlm_sql_log(5) manpage. # sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" } ...... ...... $INCLUDE ${confdir}/sql.conf ...... ...... authorize { sql ... ... accounting { sql sql_log .... .... session sql .... .... post-auth { sql sql_log .... .... Moreover, the information are written in a file (sql-relay) which (is I have understand correctly) is used by the radsqlrelay binary to put the information in database. The fact is that for the post-auth part, it works bacause i get all the information of the post authorisation in the "radpostauth" table. But in this sql-relay file, there's only information about post-auth...nothing about accounting !! The strange thing is that there's some informations about accounting in others file "auth-detail" and "reply-detail", but not in sql format. some lines of the files : "sql-relay" INSERT INTO radpostauth (user, pass, reply, date) VALUES ('joseph', 'Chap-Password', 'Access-Accept', '2006-03-21 15:28:48'); ----------------- "reply-detail" Packet-Type = Access-Accept Wed Mar 22 18:04:18 2006 Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 10000 Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Login-User Session-Timeout = 1000 Idle-Timeout = 500 Port-Limit = 10 Reply-Message = "Bye Mr Joseph !" MS-MPPE-Recv-Key = 0x315cddbc0724d537fdb446a4fc50756d12cc3b005e452caeafe6e867a8a273da MS-MPPE-Send-Key = 0x99246dc1071a72f26b069f36cf13c4c865705471f3dbd0dfa1515615affd3004 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "joseph" ------------------ "auth-detail" Packet-Type = Access-Request Wed Mar 22 17:46:52 2006 User-Name = "joseph" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Identifier = "default\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Calling-Station-Id = "00-12-f0-4f-19-26" EAP-Message = 0x0201000b016a6f73657068 NAS-IP-Address = 192.168.0.50 Message-Authenticator = 0x3796599b7cebc6895c6a57f7444cccfc Client-IP-Address = 192.168.0.50 ------------------- Best regards, Vincent ------------------------------ Message: 3 Date: Wed, 22 Mar 2006 09:17:08 -0500 From: "Alex M" <radiussupport(a)lrcommunications.net> Subject: RE: Table radacct is empty To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <001c01c64dbb$4dc706f0$e102fe0a@Alexm> Content-Type: text/plain; charset="us-ascii" Did u authorize SQL in accounting section? -----Original Message----- From: freeradius-users-bounces+radiussupport=lrcommunications.net(a)lists.freeradius .org [mailto:freeradius-users-bounces+radiussupport=lrcommunications.net@lists.fr eeradius.org] On Behalf Of Vincent MARGUERIE Sent: Wednesday, March 22, 2006 4:14 AM To: freeradius Subject: Table radacct is empty Hi, I've installed freeradius 1.1.1 on a Debian Sarge distribution, and the connection works fine with my wireless windows XP client but I have a problem to get information into radacct table in my mysql database. Does anyone get solution for this ? Rq : I use a Dlink-DWL-2000AP+ as Acces Point Regards, Vincent - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Replicate Accounting Records
by Tye Lougheed 22 Mar '06

22 Mar '06

I am running FreeRadius version 0.9.3 and need to determine the method for replicating an accounting record and forwarding it to a secondary accounting server. I am also not clear on how to specify the secondary accounting server in order to accomplish this. I am only interested in receiving the start/stop packets no other updates are required. Thanks,

2 1

Error building version 1.1.1
by Sandworm 22 Mar '06

22 Mar '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi While attempting to build the RPMs for FreeRadius version 1.1.1, I get an error during the build of libradius. Extract of the output is shown below. Build being done with 'rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec', where the spec file is taken from the 'redhat' directory in the tarball. The build is being done on Redhat Enterprise Server 3 (ES) Update 6. Looks like the Makefile in the tarball's src/lib directory is removing the '/var/tmp/freeradius-root/usr/lib/' directory and the symbolic link creation then does not find it. Making install in lib... gmake[4]: Entering directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src/lib' /usr/bin/libtool --mode=install /usr/src/redhat/BUILD/freeradius- 1.1.1/install-sh -c -c libradius.la /var/tmp/freeradius- root/usr/lib /usr/src/redhat/BUILD/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /var/tmp/freeradius-root/usr/libradius- 1.1.1.so (cd /var/tmp/freeradius-root/usr && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /usr/src/redhat/BUILD/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /var/tmp/freeradius-root/usr/libradius.la /usr/src/redhat/BUILD/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /var/tmp/freeradius-root/usr/libradius.a ranlib /var/tmp/freeradius-root/usr/libradius.a chmod 644 /var/tmp/freeradius-root/usr/libradius.a libtool: install: warning: remember to run `libtool --finish /usr/lib' rm -f /var/tmp/freeradius-root/usr/lib/libradius-1.1.1.la; ln -s libradius.la /var/tmp/freeradius-root/usr/lib/libradius- 1.1.1.la ln: creating symbolic link `/var/tmp/freeradius- root/usr/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/redhat/BUILD/freeradius- 1.1.1' make: *** [install] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.72933 (%install) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.72933 (%install) -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQfptQACgkQmw4BJyaatJ3CjQCgkE3PssxUgCxIgcQCyCOF/7akj1cA n3uM4/Yu6y5ko1XNO+2j9dfwvd3j =Kl6m -----END PGP SIGNATURE-----

4 7

Want to use 2 different authentication-methods
by Hans-Peter Fuchs 22 Mar '06

22 Mar '06

I use freeradius 1.0.5 for a special NAS I want to use 2 user databases. requests from nas-special should first verified per sql If and only if sql does not verify the user try pam. In users I have: ##### new DEFAULT NAS-IP-Address == special, Autz-Type := SQL Idle-Timeout = 3600, Session-Timeout= 7200, Fall-Through = yes #### end new #### begin old config: works DEFAULT Auth-Type = Pam Service-Type = Framed-User, Nomadix-Bw-Up = 128, Fall-Through = yes ### end old config ### begin new config # pam-authentified users from ssg get Ainternet-attribute DEFAULT NAS-IP-Address == special Service-Type = Framed-User, Idle-Timeout = 3600, Session-Timeout= 7200, Cisco-Account-Info += "KW0", Fall-Through = yes ### end new config But with this users who are verified by sql are also checked against pam. Do you have some tips? Output from radiusd -X: rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: group Autz-Type returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radius> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <test>. Reason: Permission denied modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RZKR, Zimmer 20 Zentrum fuer angewandte Informatik - Universitaetsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 1

Version 1.1.1 has been released
by Alan DeKok 22 Mar '06

22 Mar '06

Version 1.1.1 has just been released. http://www.freeradius.org/security.html Upgrade now, or disable EAP-MSCHAPv2. That's a bad bug. ChangeLog: Security fixes * Additional state checking in the EAP-MSCHAPv2 module. Bug found by Steffen Schuster. Feature improvements * More dictionary updates * Additional tests and fixes for Digest module from Phillipe Sultan. * Add new "phone" response mode to rlm_otp/cryptocard. * Put the eap sessions into a tree, so that looking them up is very fast, and no longer O(n) in the number of sessions. * Install the schema examples for a set of backends with the rest of the documentation. * Add support for xlat expansion of attributes from LDAP. Bug fixes * Fix rlm_perl crash. (closes: #348) * Fix handling of CoA-Request packets (close #344). Also correct name of CoA packets. * Fix an error on x86_64 machines when reading dictionaries. (closes: #312) * Fix compilation errors on FreeBSD and NetBSD because of rlm_otp module. (closes: #314 #328) * Workaround Cisco bug in State attribute handling in rlm_otp. * Support LP64 for async mode in rlm_otp. * Fix libtool problems on Debian with rlm_eap_peap and rlm_eap_ttls modules. (closes: #75) * Make "use_tunneled_reply" work properly for PEAP. * Copy the whole string when getting a one-to-one-mapped attribute from LDAP (closes: #261) * Fix net-snmp's ucd-snmp compatibility mode.

5 6

request object pointer offset
by jasonatx0001 22 Mar '06

22 Mar '06

I am having some difficulty accessing the data in the request object inside my module. It seems the pointers are offset ... inside the authenticate method of my module ... DEBUG ("MYMODULE: request->config_items->name = %s", request->config_items->name); DEBUG ("MYMODULE: request->config_items->strvalue = %s", request->config_items->strvalue); if (!request->username) { DEBUG ("MYMODULE: no username found\n"); } else { DEBUG ("MYMODULE: request->username->strvalue = %s\n", request->username->strvalue); } if (!request->password) { DEBUG ("MYMODULE: no password found\n"); } else { DEBUG ("MYMODULE: request->password->strvalue = %s\n", request->password->strvalue); } DEBUG ("MYMODULE: request->number = %d\n", request->number); return RLM_MODULE_REJECT; ... and this is the output i get from radiusd -X ... auth: type "mymodule" Processing the authenticate section of radiusd.conf modcall: entering group mymodule for request 0 MYMODULE: request->config_items->name = User-Name MYMODULE: request->config_items->strvalue = testuser MYMODULE: request->username->strvalue = test MYMODULE: no password found MYMODULE: request->number = 0 modcall[authenticate]: module "mymodule" returns reject for request 0 modcall: leaving group mymodule (returns reject) for request 0 auth: Failed to validate the user. ... As you can see, the config_items VP* points to the User-name VP and the username VP* points to the password and the password VB* is NULL. Any ideas ? -- View this message in context: http://www.nabble.com/request-object-pointer-offset-t1325410.html#a3537076 Sent from the FreeRadius - User forum at Nabble.com.

2 2

Questions about FreeRadius proxy
by Dovelet 22 Mar '06

22 Mar '06

Hi all, I am new in FreeRadius and I hope someone can kindly help me. I have several questions: Q1) I just setup a FreeRadius server and I want to set it as a Radius Proxy server. I know Realm can do it but I found that to use Realm, the user needs to append the domain @xxx.com (i.e. user01(a)xxx.com) at the end. Is it true? Can I skip the domain @xxx.com? (i.e. user just type the username [user01] and the FreeRadius can proxy to another RADIUS server). Q2) Can I setup a table in the FreeRadius server with username only so that when the Application server request for authentication, the FreeRadius will proxy to another RADIUS server only if the username is listed in the table? Q3) If Q2 is feasible, can I have several Application Servers and I limit the users from the Application servers? i.e. If user01 login Appliation server1, Application Server1 request the FreeRadius server. The FreeRaidus server check the user01 is belongs to Application Server1 group and it proxy the request to another RADIUS server. Application Server1 - user01 - user02 Application Server2 - user03 - user04 Any suggestions are welcome. Sorry for so many questions. Regards, Dovelet -- View this message in context: http://www.nabble.com/Questions-about-FreeRadius-proxy-t1297096.html#a34536… Sent from the FreeRadius - User forum at Nabble.com.

3 4