- Freeradius-Users - lists.freeradius.org

check-Item checked by ldap
by Florian Prester 17 Mar '06

17 Mar '06

Hi, I am using a LDAP-Directory as Information-DB for authorisation. Now my question is: I want to grant access, if a user fullfills a LDAP-attribute, for example: users-file: ... test LDAP-Group == "test" Service-Type = "Administrative-User", cisco-avpair= "shell:priv-lvl=15" ... ldap.attrmap: ... checkItem LDAP-Group Userid ... In LDAP the Iserid for the user test is test, therfore it should be mapped to the LDAP-Group-attribute and therfore the user should be granted access, or not? But the debug output shows something different: ###################################### ./radiusd -XXX rad_recv: Access-Request packet from host 232.122.28.222:2084, id=59, length=47 User-Name = "test" User-Password = "XXX" Fri Mar 17 08:31:44 2006 : Debug: Processing the authorize section of radiusd.conf Fri Mar 17 08:31:44 2006 : Debug: modcall: entering group authorize for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Fri Mar 17 08:31:44 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Fri Mar 17 08:31:44 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Mar 17 08:31:44 2006 : Debug: radius_xlat: 'ou=AAAuse ... ' Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: attempting LDAP reconnection Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: (re)connect to 232.122.3.22:400, authentication 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: bind as cn= Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: waiting for bind result ... request done: ld 3501a58 msgid 1 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: Bind was successful Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: performing search in ou=AA ... request done: ld 3501a58 msgid 2 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Mar 17 08:31:44 2006 : Debug: radius_xlat: '(|(&(objectClass=GroupOfNames)(member=...' Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: performing search in ou=AAA ... request done: ld 3501a58 msgid 3 Fri Mar 17 08:31:44 2006 : Debug: rlm_ldap: object not found or got ambiguous search result ############################### Now, somemore questions: 1.) why is there a reconnect? I thought I connect to the ldap once, retrieve user-information and then all comparsion iis done by the RADIUS? 2.) why is there no mapping from the Userid to the LDAP-Group, but a new search for the ldap-attribute: Fri Mar 17 08:31:44 2006 : Debug: radius_xlat: '(|(&(objectClass=GroupOfNames)(member=...'??? Thanks Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 1

Re: Freeradius & Mysql initial install
by Atkins, Dwane P 17 Mar '06

17 Mar '06

My mistake on the working. I had checked the clients.conf and it was correct. Does the login user need to have an account on the local radius server? In other words, do I need to create a user in mysql and link it to the radius database and ALSO complete a useradd statement on the Fedora box? No matter how I try it, I cannot get it to see past the shared key of the localhost. Thanks for all your help. Dwane

3 2

freebsd module rlm_sql Segmentation fault
by Vasco Santos 17 Mar '06

17 Mar '06

Hi folks, I have freebsd 4.10-RELEASE and freeradius version 1.0.1 and radiusd -x give me this error: The Debug: Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Segmentation fault I disable the sql module its works fine. I tested this in freeradius 1.0.1 and version 1.1.0 its give me the same "Segmentation fault". Is this a bug in freeradius? if yes, give-me a old version of freeradius that dont have this bug, or ways to correct it. Tanks.

1 0

Mysql problem
by Fabiano Rodrigo Boscatto 17 Mar '06

17 Mar '06

Hi there, i have freeradius working fine with mysql authentication. The problem is that the User-Password is stored in mysql table as clear text. Is there a way to crypt that? Thanx

4 4

Assigning DNS servers
by Tony Spencer 17 Mar '06

17 Mar '06

Hi I want to be able to assign DNS servers for each user to use as part of the users radius entry. If I use: MS-Primary-DNS-Server ="<ip address>", MS-Secondary-DSN-Server="<ip address> For each users radius config will this work? These users are ADSL users using DSL modems and routers. Thanks Tony -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

5 5

Re: Freeradius & Mysql initial install
by AM 17 Mar '06

17 Mar '06

I thought shared secret was in clients.conf

1 0

Freeradius & Mysql initial install
by Atkins, Dwane P 17 Mar '06

17 Mar '06

All, I appreciate the help you have given me on this and I am pretty sure I am like one or two changes off the correct path. When I do the radtest, it always tells me that: [root@cleveland ~]# radtest atkinsd xxxxx lhost 1645 xxxx Sending Access-Request of id 168 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "xxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Re-sending Access-Request of id 168 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "xxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=168, length=20 rad_decode: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) I have checked and double checked the shared secret in Users, sql.conf, radiusd.conf. Any ideas? Thanks again

2 1

rlm_perl segfault
by Grant Zanetti 16 Mar '06

16 Mar '06

I've just tried to get the rlm_perl module working. I'm running debian 3.1 with perl 5.8.8. I've tried installing the prebuilt debian packages as well as from source with "dpkg-buildpackage -rfakeroot -uc -b" However after loading the module freeradius segfaults. Freeradius config: modules { perl ipalloc { module = /etc/freeradius/dynip.pl func_accounting = accounting func_post_auth = post_auth } } post-auth { ipalloc } When running freeradius I get traffic:/etc/freeradius# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded perl perl: module = "/etc/freeradius/dynip.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Segmentation fault The file "/etc/freeradius/dynip.pl" exists and is readable but the segfault is the same whether it exists or not. This is the output from gdb Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1210271424 (LWP 866)] 0xb7c12ca2 in Perl_hv_clear_placeholders () from /usr/lib/libperl.so.5.8 (gdb) bt #0 0xb7c12ca2 in Perl_hv_clear_placeholders () from /usr/lib/libperl.so.5.8 #1 0xb7c13369 in Perl_hv_delayfree_ent () from /usr/lib/libperl.so.5.8 #2 0xb7c142cc in Perl_hv_fetch () from /usr/lib/libperl.so.5.8 #3 0xb7bbf7ba in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.8 #4 0xb7bbc14a in Perl_my_failure_exit () from /usr/lib/libperl.so.5.8 #5 0xb7bbe97d in perl_parse () from /usr/lib/libperl.so.5.8 #6 0xb7cbcd5d in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #7 0x0812e590 in ?? () #8 0xb7cbc130 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #9 0x00000003 in ?? () #10 0xbffa29b0 in ?? () #11 0x00000000 in ?? () #12 0x0812e590 in ?? () #13 0xb7cc0060 in rlm_perl () from /usr/lib/freeradius/rlm_perl-1.1.0.so #14 0xb7cc0350 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #15 0xb7b99618 in ?? () from /usr/lib/libperl.so.5.8 #16 0xb7cc0344 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #17 0x0811a9e8 in ?? () #18 0x08119c68 in ?? () #19 0x00000000 in ?? () #20 0x0812e4c8 in ?? () #21 0xb7cbf6a0 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #22 0x08050455 in log_debug () #23 0x08055332 in find_module_instance () #24 0x08056a4f in modcallable_free () #25 0x080559e4 in setup_modules () #26 0x0804cd80 in main () I have tried with perl 5.8.4 with the same result. Any help would be appreciated. I'm not sure how to get more debug out of freeradius with gdb.

6 12

problem with MD5 encrypted secret
by Guido 16 Mar '06

16 Mar '06

Another question about secret... How can I configure freeradius to work with MD5 secret ? The secret now, is coming MD5 encrypted and I see the following error: ---rad_recv: Accounting-Request packet from host 192.168.1.12:1813, id=0, length=772 ---Received Accounting-Request packet from 192.168.1.12 with invalid signature! (Shared secret is incorrect.) ---Server rejecting request 11. Regards, Guido

2 1

Vendor Specific IDs
by Eliot, Wireless and Server Administrator, Great Lakes Internet 16 Mar '06

16 Mar '06

Before I start, let me just ask if there are any already created attributes that control bandwidth rates in the Tx and Rx directions which take a string as a value? I found USR-Initial-Tx-Link-Data-Rate and USR-Initial-Rx-Link-Data-Rate, but they take enumerated values that will not allow me to set up generic service rate (like 256Kbps or 1Mbps). I found a couple of other attributes that specific just "Data-Rate", but I can't find any that do Rx and Tx data rates. So, barring the existence of already created attributes, I'd like to set up my own vendor specific attributes -- which leads me to my main question: How do I choose a number for the Vendor-Id? For instance, Bristol's vendor ID is: VENDOR Bristol 4363 Do we have to request these from somewhere? Or, can we just pick a free one? Our AS number from ARIN is free (11541); can I just use that? Also, I have a secondary question related to this. I am setting up some bandwidth limiting scripts on our router that will limit customers' bandwidth usage. The idea is to execute a script when they authenticate which receives the AVPs from the Access-Accept packet (which would include the above mentioned Rx and Tx data rates). The script would take those attributes and instate some tc and iptables rules to shape the customers' bandwidth. When the user logs off, or the AP notices the client is gone, the AP sends an Accounting-Stop record FreeRADIUS. FreeRADIUS would then execute a cleanup script which brings down the rules that the first script instated. So, my second question is: When FreeRADIUS calls that second script, can/does it send the original Access-Accept attributes to the cleanup script? Thanks for any and all help. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1