- Freeradius-Users - lists.freeradius.org

Load-balance and Auth-Type
by Evil I_Am 22 Mar '06

22 Mar '06

Hi all I have this scenario: 2 radius servers must point to 2 ldap servers with a load-balancing and fault-tolerant configuration. I tried to implement this on one of the radius servers this way: modules { ldap ldap1 { ........... authtype = ldap #added later but seems not to work } ldap ldap2 { ........... authtype = ldap #added later but seems not to work } } authorize { preprocess load-balance { # between two redundant sections below redundant { ldap1 ldap2 } redundant { ldap2 ldap1 } } } authenticate { Auth-Type LDAP { load-balance { # between two redundant sections below redundant { ldap1 ldap2 } redundant { ldap2 ldap1 } } } but if i try to authenticate a user i see this in debug: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:25702, id=169, length=77 User-Name = "XXXXXX" User-Password = "XXXXXX" NAS-IP-Address = XXX.XXX.XXX.XXX NAS-Identifier = "login" NAS-Port = 24677 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering load-balance group for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for XXX radius_xlat: '(uid=XXX)' radius_xlat: 'dc=XXXXXXX,dc=XX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to XXX.XXX.XXX.XXX:389, authentication 0 rlm_ldap: bind as / to XXX.XXX.XXX.XXX:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=XXXXXXX,dc=XX, with filter (uid=XXX) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusServiceType as Service-Type, value Shell-User & op=11 rlm_ldap: extracted attribute Cisco-AVPair from generic item cisco-avpair="shell:priv-lvl=15" rlm_ldap: user futhwo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: load-balance group returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 169 to XXX.XXX.XXX.XXX port 25702 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 169 with timestamp 44212404 Nothing to do. Sleeping until we see a request. If i keep only 1 module,call it simply ldap and give up on load balancing everything works ok. How can i resolv this issue?

2 1

Failed Compilation of Freeradius with Mysql since 1.1.0 (Works on 1.0.5)
by Philippe JOYEZ 22 Mar '06

22 Mar '06

Hello All, I've seen many topics about that problem but no one of them has solved my problem. I'm trying to upgrade my 1.0.5 Freeradius server to 1.1.1 on my Solaris 8 system but it fails to find mysql libs. On the same server, I use the same configure scripts options: ./configure --localstatedir=/var --with-logdir=/var/log/radius/log --with-radacctdir=/var/log/radius/radacct --with-mysql-lib-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc/l- ib --with-mysql-include-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-spa- rc/include --with-mysql-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc It works for 1.0.5 but not for 1.1.1 (and also KO for 1.1.0): configuring in ./drivers/rlm_sql_mysql running /bin/sh ./configure --localstatedir=/var --with-logdir=/var/log/radius/log --with-radacctdir=/var/log/radius/radacct --with-mysql-lib-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc/l- ib --with-mysql-include-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-spa- rc/include --with-mysql-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for mysql_config... (cached) no checking for pthread_create in -lpthread... (cached) yes checking for mysql_init in -lmysqlclient_r... no configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql/mysql.h... yes configure: warning: sql submodule 'mysql' disabled creating ./config.status creating Makefile creating config.h config.h is unchanged Best regards -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

4 3

(no subject)
by vignesh 22 Mar '06

22 Mar '06

Hello guys This is Vignesh here. I have just started with RADIUS. We are planning to build a VoIP billing system using Free RADIUS and Oracle as the backend and using CISCO IPIP gateway . We were planning to implement both postpaid and prepaid scenario. I believe most of you must be doing the same thing. So far we were working on PostPaid Solution. There some problems that we are facing 1. we are using triggers to do the accounting of the call. i.e. calculating the rates etc for that particular call. There many users who can call from either using gateway or using soft phones, hard phones etc. the problem is that while accounting using the trigger, there is no single column from where we can identify the user. The user can be accounted based on his ani or his remote gateway. Also we want multi leg accounting. 2. also we would like to know how we can build a prepaid solution. What are the changes that needs to be done for doing the same. Vignesh vignesh(a)novanet.net

1 0

Doubt regarding sql.conf
by vignesh 22 Mar '06

22 Mar '06

Hello guys I am trying to modify the query for authorization in sql.conf file. I will let you know what I exactly want I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and the call for this particular user has to come from a set of ips like 222.223.33.24 or 33.44.334.44 and many more. the user will be authenticated only when the ani is 9204 and the ip is either of these only. But I am not sure how to modify the query or is there something else That I need to do.. Vignesh vignesh(a)novanet.net

1 0

Table radacct is empty
by Vincent MARGUERIE 22 Mar '06

22 Mar '06

Hi, I've installed freeradius 1.1.1 on a Debian Sarge distribution, and the connection works fine with my wireless windows XP client but I have a problem to get information into radacct table in my mysql database. Does anyone get solution for this ? Rq : I use a Dlink-DWL-2000AP+ as Acces Point Regards, Vincent

2 1

Avoiding ldapsearch on LDAP authentication
by MAEDA 22 Mar '06

22 Mar '06

Hello, I'm running Freeradius 1.0.4 with OpenLDAP 2.2.29 on my Fedora Core 4 box and try to configure radiusd so that ldap_search is not performed on authentication (i.e. just use ldap_bind for authentication). But so far, I've got no success. Radiusd seems to perform search anyway. I've read the document doc/rlm_ldap and followed the instruction, but I couldn't get it working (I must be missing something). I configured radiusd as follows: In users: DEFAULT Ldap-UserDn := `uid=%{User-Name},ou=people,dc=atusi,dc=org`, Auth-Type = LDAP In radiusd.conf: modules { ldap { server = "localhost" ldap_debug = 0xFFFF # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=people,dc=atusi,dc=org" # filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "dialupAccess" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } ... } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } # All other parts are left as default. When I test my setup with: (echo 'User-Name=mytestuser'; echo 'User-Password = mypassword') | radclient -c 1 127.0.0.1 auth testing123 radiusd (run with -X option) says: rad_recv: Access-Request packet from host 127.0.0.1:32791, id=183, length=43 User-Name = "mytestuser" User-Password = "mypassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "mytestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 214 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "mypassword" radius_xlat: '(uid=mytestuser)' radius_xlat: 'ou=people,dc=atusi,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 6 tm: 1 async: 0 ldap_ndelay_on: 6 ldap_is_sock_ready: 6 ldap_ndelay_off: 6 ldap_open_defconn: successful ldap_send_server_request rlm_ldap: waiting for bind result ... ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue Mar 21 13:31:12 2006 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ldap_read: message type bind msgid 1, original id 1 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=atusi,dc=org, with filter (uid=mytestuser) ldap_search put_filter: "(uid=mytestuser)" put_filter: simple put_simple_filter: "uid=mytestuser" ldap_send_initial_request ldap_send_server_request ldap_result msgid 2 ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 2 wait4msg continue, msgid 2, all 1 ** Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue Mar 21 13:31:12 2006 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 2, all 1 ldap_read: message type search-result msgid 2, original id 2 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 2 request 2 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result rlm_ldap: object not found or got ambiguous search result ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: group Auth-Type returns notfound for request 0 auth: Failed to validate the user. According to the log lines: rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 I guessed (by reading rlm_ldap.c) Ldap-UserDn valuepair is not passed to ldap_authenticate() for some reason. I tried to write `Ldap-UserDn := ...' as reply item of the DEFAULT entry in users file but in that case radiusd says: WARNING! Check item "Ldap-UserDn" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items and still got the same result. I also tried in radiusd.conf: modules { ldap { identity = "%{Ldap-UserDN}" password = `%{User-Password}` ... } } but these attributes are not xlated and passed to LDAP as they are. Any clues would be greately appreciated.

3 3

Accounting-Response packet with invalid signature!
by Ryan Melendez 21 Mar '06

21 Mar '06

Hello, I am getting Accounting-Response packets from one particular NAS with an invalid signature. I verified the shared secret is correct. Radiusd is configured to proxy Accounting-Request packets the following way. proxy server { synchronous = no retry_delay = 10 retry_count = 30 dead_time = 300 } This particular NAS take about 25 seconds to send the Accounting-Response. By the time it's sent its response freeradius has moved on to the second or third retry. The authenticator calculated by the NAS is for the initial accounting packet and is invalid for the second request due to a change in the Acct-Delay-Time (and possibly proxy-state). Freeradius then bails out: Received Accounting-Response packet from with invalid signature! Server rejecting request 1. Finished request 1 Going to the next request rl_next: returning NULL Cleaning up request 1 ID 11 with timestamp 44206de3 If I change the config to: retry_delay = 30 retry_count = 1 then freeradius sleeps for 30 seconds and does not send a second packet. Waking up in 31 seconds... rad_recv: Accounting-Response packet from host :1813, id=1, length=25 Proxy-State = 0x323233 Sending Accounting-Response of id 223 to :51818 Finished request 0 What is the correct way to do this according to the RFC? 25 seconds is an extremely long delay but it seems there should be a way to handle this. I tried playing with cleanup_delay, but I'm not getting anywhere. Do I have to set the retry_delay very high to have a better chance? 25 seconds is a long time to wait if the host is actually down. Thanks, Ryan

2 1

Limiting number of EAP connexion
by JVUVANT Yahoo 21 Mar '06

21 Mar '06

Hi people Someone can tell me how to limit number of simultaneous EAP connexions with same login/password ? Thanks Jacques

2 1

Using a LDAP attribute value as the complete HA1 digest string
by Alan 21 Mar '06

21 Mar '06

I would like to use encrypted passwords stored as an attribute value in LDAP. How can I tell the rlm_digest driver to use the complete User-Password attribute value as the full Digest-HA1 string? Instead it takes the value and appends it to the end of the of the A1 string. Please help. ~Alan -- This hash value placed in the LDAP User-Password attribute: $ echo -n 'alan:sip.host.com:test' | md5sum eeee888a05bbdb4b18a5ab5abd3b37c2 Authentication from a SIP server to FreeRadius rlm_ldap and rlm_digest modules: rlm_ldap: - authorize rlm_ldap: performing user authorization for alan radius_xlat: '(uid=alan)' radius_xlat: 'ou=People,o=host.com,o=isp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,o=host.com,o=isp, with filter (uid=alan) rlm_ldap: Added password eeee888a05bbdb4b18a5ab5abd3b37c2 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user alan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3634 modcall: leaving group authorize (returns ok) for request 3634 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3634 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "alan" Digest-Realm = "sip.host.com" Digest-Nonce = "44202102581bdded7ea02108890770e6ad22e27e" Digest-URI = "sip:sip.host.com" Digest-Method = "REGISTER" A1 = alan:sip.host.com:eeee888a05bbdb4b18a5ab5abd3b37c2 A2 = REGISTER:sip:sip.host.com KD = 263c616981c1331d745557f8c7685613:442025f0efb6eb92635e3b938327dfee91ea8b12:f0 8bbaef30f8f1f7c252330c693a3bb3 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 3634 modcall: leaving group authenticate (returns reject) for request 3634 auth: Failed to validate the user.

3 2

Mod_auth_radius
by Cris Boisvert 21 Mar '06

21 Mar '06

I have a couple macs running apache (Preconfigured via Apple) The source is not supplied and the apple didn't apxs.. Has anyone installed mod_auth_radius on a Apple running osx? Thanx

1 0