- Freeradius-Users - lists.freeradius.org

Dlink + freeradius + Mysql gives me lots of problem
by Michael Calizo 01 Mar '06

01 Mar '06

Hi, I have a problem in my configuration using the mixed of Dlink + freeradius + Mysql. What i am trying to do is for my dlink hotspot to authenticate using freeradius with mysql module. I do some testing using radtest on both localhost and remote host and my freeradius seems to authenticate and is working fine. Below is the output of Radiusd -x: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded System Module: Instantiated unix (unix) radiusd.conf Auth-Type eap already configured - skipping Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@192.168.1.229:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. OUTPUT of RADTEST FROM REMOTE: rad_recv: Access-Request packet from host 192.168.1.13:56435, id=70, length=60 User-Name = "benjtest" User-Password = "benjtest" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Sending Access-Accept of id 70 to 192.168.1.13 port 56435 Framed-IP-Address := 192.168.0.50 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP OUTPUT when I try to Connect on wifi tru DLINK: rad_recv: Access-Request packet from host 192.168.1.22:65461, id=45, length=81 User-Name = "benjtest" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000d0162656e6a74657374 NAS-IP-Address = 192.168.1.22 Message-Authenticator = 0x6080434b26128348f34dc763d6c89192 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Sending Access-Reject of id 45 to 192.168.1.22 port 65461 My question is why is it that when i use my DLINK wireless access point it failed to authenticate. I use exactly the same login account and password when i use radtest . Anybody please help me. Thank You. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step

3 4

Password logging
by andre kip 01 Mar '06

01 Mar '06

hi! 1. how can I stop my freeradius server from logging entered passwords?? The following in radiusd.conf seems not to work: : log_auth = yes log_auth_badpass = no log_auth_goodpass = no : I would like to only have the following in my radius accounting file: Packet-Type = Access-Request Wed Mar 1 15:05:04 2006 User-Name = "Me" ######no password logging!!### NAS-IP-Address = x.x.x.x NAS-Identifier = "ssh" NAS-Port = 424 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = : 2. Is there a way of stopping the server from outputing the user password on debug mode?? as in: rad_recv: Access-Request packet from host 10.0.10.11:1449, id=17, length=87 User-Name = "Me" ##no User-Password##### NAS-IP-Address = x.x.x.x NAS-Identifier = "ssh" NAS-Port = 424 : 3. And finally is it possible to use enycrypted passwords in user file? e.g. Me Auth-Type := Crypt-Local, Crypt-Password == "098f6bcd4621d373cade4e832627b4f6" ......or something similar Thanks in Advance. Andy Trüffle ___________________________________________________________ Telefonate ohne weitere Kosten vom PC zum PC: http://messenger.yahoo.de

1 0

auth-reject with attributes
by freeradius＠list.coretech.ro 01 Mar '06

01 Mar '06

hello, I have tried to upgrade to the latest cvs version and I have noted that reply attributes are no longer sent with auth-reject messages. is this correct ? is there a configuration option to re enable sending of reply attributes with auth-reject messages ? thanks, Razvan Radu

2 2

freeradius & ppp
by Felice.pizzurro 01 Mar '06

01 Mar '06

Hi, excuse me for my bad english. I use freeradius mysql to authenticate the users of my wireless hotspot. I nedd that the authentication is made with ppp. In the users file I have this: DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP It's correct or I need other directives? thanks, Felice -- Computers are like air conditioners: they stop work properly when you open Windows... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: I migliori fun sound Jamba! Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=4843&d=20060301

1 0

freeradius & ppp
by Felice.pizzurro 01 Mar '06

01 Mar '06

Hi, excuse me for my bad english. I use freeradius mysql to authenticate the users of my wireless hotspot. I nedd that the authentication is made with ppp. In the users file I have this: DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP It's correct or I need other directives? thanks, Felice -- Computers are like air conditioners: they stop work properly when you open Windows... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Sei in cerca dellamore? Non perdere tempo, iscriviti gratis a Meetic! Potrai chattare con migliaia di single in linea. Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=4052&d=20060301

1 0

No matching entry in the database for request from user...
by kno 01 Mar '06

01 Mar '06

Hi, I've just start "playing" with freeradius and I'm doing some test to learn. The authorization via files works: radtest kno1 kk 80.xx.xx.xx 1 testing123 Sending Access-Request of id 128 to 80.xx.xx.xx port 1812 User-Name = "kno1" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Accept packet from host 80.xx.xx.xx:1812, id=128, length=33 Reply-Message = "Hello, kno1" But I want to do it via mysql, and here is the problem. I've try to follow the notes at http://www.frontios.com/freeradius.html I've an user in the DB: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'kno' ORDER BY id; +----+----------+-----------+-------+----+ | id | UserName | Attribute | Value | op | +----+----------+-----------+-------+----+ | 1 | kno | Password | kk | == | +----+----------+-----------+-------+----+ But the authorization fails: radtest kno kk 80.xx.xx.xx 1 testing123 Sending Access-Request of id 110 to 80.xx.xx.xx port 1812 User-Name = "kno" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Re-sending Access-Request of id 110 to 80.xx.xx.xx port 1812 User-Name = "kno" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 [re-sending 4 times] rad_recv: Access-Reject packet from host 80.xx.xx.xx:1812, id=110, length=20 The server side log: rad_recv: Access-Request packet from host 80.xx.xx.xx:59115, id=110, length=55 User-Name = "kno" User-Password = "kk" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'kno' ORDER BY id; rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'kno' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'kno' ORDER BY id; rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'kno' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; rlm_sql (sql): No matching entry in the database for request from user [kno] rlm_sql (sql): Released sql socket id: 4 Login incorrect (No password configured for the user): [kno/kk] (from client kno port 1) Login incorrect: [kno/kk] (from client kno port 1) rad_recv: Access-Request packet from host 80.xx.xx.xx:59115, id=110, length=55 Sending Access-Reject of id 110 to 80.xx.xx.xx:59115 I don't know where is the error, any ideas? Thanks, kNo

3 5

MS CHAP V2 authentication failure...
by Jon 01 Mar '06

01 Mar '06

here is [most] of the -X -A output rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x0105003119001403010001011603010020f640f17cc4d9b95c689f37535f0c167e7ef85920fa1a584ae45ca46e4e27be88 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89c31ab5692851c1b54665f205acfdb1 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=138 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0x89c31ab5692851c1b54665f205acfdb1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x86ad4528b700aed9bb049bed435eeb10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x0106002019001703010015c0b9557e082a58271186f1038ce6579a67a52b2c30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4641f1c68dfd842fbecaa2555be47878 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=166 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0x4641f1c68dfd842fbecaa2555be47878 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206002219001703010017c6caefa5edac16bea7db9a9ee8f16dec3d5db28d1111ef Message-Authenticator = 0xceffd3aede7f9a429813aa64fde5fc65 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 6 length 34 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - jboast rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of jboast PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to jboast Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 6 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x010700371900170301002c822385e6e9fb2b3f8f6155f76311e50bfbdb2a4d27557ae1de8893be311197d14003ff17cb0259d2b452ce2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb931efb43a135bd61a8d7beedcd95701 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=220 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0xb931efb43a135bd61a8d7beedcd95701 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700581900170301004dcd9e19e4f8d3efb85c7af02264394c0effdc9df18751700ce7a51ddb927afa8d37e5e0a96c4dc4e54c62183f32aa2a9af1da58a06434e307bde2540bf10bc20fafbeefd8fbdc591c3a111133f1 Message-Authenticator = 0x72c9d318441ce6bedfb78bff20d6ef6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 7 length 88 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to jboast PEAP: Adding old state with 07 73 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 7 length 65 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 0 to 127.0.0.1:1025 EAP-Message = 0x010800261900170301001bef481fb0682ffedaef80653a2b14e3ce38c357d2ac27693b8b5b7e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc1d1f811200e081feb3c7e131c64e96b Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1025, id=0, length=170 User-Name = "jboast" NAS-IP-Address = 127.0.0.1 Called-Station-Id = "0014bf1c0216" Calling-Station-Id = "0090967ee1f9" NAS-Identifier = "0014bf1c0216" NAS-Port = 38 Framed-MTU = 1400 State = 0xc1d1f811200e081feb3c7e131c64e96b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001b2e1b4f233395cb709a8d40be375a07c87f3d040c139b8989f41d4e Message-Authenticator = 0x8e4f17e45575d244747d1f0d76b2f772 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 127.0.0.1:1025 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 8 ID 0 with timestamp 4404fa1e Nothing to do. Sleeping until we see a request. im sure it's something simple, i've been working at it all day, i need a break, hopefully someone can help. Thanks Jon

2 1

another sql database
by debik 28 Feb '06

28 Feb '06

I have got onother database on my serwer. I it used by ISP accounting. In this database is the table called users where are logins and passwords. I have tried to put in radiusd.conf another module called sql1 and create file sql1.conf When i start radius it says me that the parameters are in attribute = format. I know what im doing wrong, but is there anyway to correct this. I know the RFC about freeradius and supouse there is not anyway to do this.

2 2

Re:Database connection failure and retry
by Marko Dinic 28 Feb '06

28 Feb '06

>>"Ming-Ching Tiew" <mingching.tiew at redtone.com> wrote: >> >> A little while ago I posted about in my configuration, using unixodbc/freetds, >> we noticed that database/network failure causes permanent disability in >> radius server to stop logging and I was given the reply that it is in the >> feature of radius server to retry upon failure. >> >> So there is a discrepancy between what I noticed verses the "supposed to be" >> behaviour. >> >> Upon further investigation I explored into the code, I found this in sql_mysql.c :- >> >> static int sql_fetch_row(SQLSOCK * sqlsocket, SQL_CONFIG *config) >> { >> rlm_sql_mysql_sock *mysql_sock = sqlsocket->conn; >> >> /* >> * Check pointer before de-referencing it. >> */ >> if (!mysql_sock->result) { >> return SQL_DOWN; >> } >> >> sqlsocket->row = mysql_fetch_row(mysql_sock->result); >> >> if (sqlsocket->row == NULL) { >> return sql_check_error(mysql_errno(mysql_sock->sock)); >> } >> return 0; >> } >> >> >> However the code in sql_unixodbc.c is like this :- >> >> >> static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { >> rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; >> >> sqlsocket->row = NULL; >> >> if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) >> return 0; >> >> /* XXX Check if return suggests we should return error or SQL_DOWN */ >> >> sqlsocket->row = unixodbc_sock->row; >> return 0; >> } >> >> >> There is no checking whatsoever, so unixodbc driver is unable to reconnect >> upon failure. > > Ok... are you willing to supply a patch? > > Alan DeKok. > A while ago Alan suggested I should use odbc instead of native sybase driver, so I set up unixODBC 2.2.11 with freetds 0.63 ODBC driver, but I encountered the same problem as described above. However, I couldn't afford waiting for a patch, so I patched it myself. I've never used ODBC API before, so I cannot be sure if this is a complete solution to the problem, or whether it will work for everyone - the only thing i do know is that it works well for me. Here it is: -------------------------------------PATCH STARTS HERE------------------------------------------ --- freeradius-1.1.0/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c 2005-08-29 19:01:58.000000000 +0200 +++ freeradius-1.1.0-unixodbcfix/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c 2006-02-28 17:25:27.000000000 +0100 @@ -40,6 +40,7 @@ /* Forward declarations */ static char *sql_error(SQLSOCK *sqlsocket, SQL_CONFIG *config); +static int sql_state(long err_handle, SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_free_result(SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_affected_rows(SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_num_fields(SQLSOCK *sqlsocket, SQL_CONFIG *config); @@ -67,23 +68,23 @@ /* 1. Allocate environment handle and register version */ err_handle = SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&unixodbc_sock->env_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate environment handle %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate environment handle\n"); return -1; } err_handle = SQLSetEnvAttr(unixodbc_sock->env_handle, SQL_ATTR_ODBC_VERSION, (void*)SQL_OV_ODBC3, 0); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't register ODBC version %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't register ODBC version\n"); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; } /* 2. Allocate connection handle */ err_handle = SQLAllocHandle(SQL_HANDLE_DBC, unixodbc_sock->env_handle, &unixodbc_sock->dbc_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate connection handle %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate connection handle\n"); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; } @@ -93,9 +94,9 @@ (SQLCHAR*) config->sql_server, strlen(config->sql_server), (SQLCHAR*) config->sql_login, strlen(config->sql_login), (SQLCHAR*) config->sql_password, strlen(config->sql_password)); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Connection failed %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Connection failed\n"); SQLFreeHandle(SQL_HANDLE_DBC, unixodbc_sock->dbc_handle); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; @@ -103,9 +104,9 @@ /* 4. Allocate the statement */ err_handle = SQLAllocStmt(unixodbc_sock->dbc_handle, &unixodbc_sock->stmt_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate the statement %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate the statement\n"); return -1; } @@ -139,16 +140,17 @@ static int sql_query(SQLSOCK *sqlsocket, SQL_CONFIG *config, char *querystr) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; long err_handle; + int state; if (config->sqltrace) radlog(L_DBG, "query: %s", querystr); /* Executing query */ err_handle = SQLExecDirect(unixodbc_sock->stmt_handle, (SQLCHAR *)querystr, strlen(querystr)); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); - return -1; + if ((state = sql_state(err_handle, sqlsocket, config))) { + if(state == SQL_DOWN) + radlog(L_ERR, "rlm_sql_unixodbc: rlm_sql should attempt to reconnect\n"); + return state; } return 0; } @@ -165,9 +167,11 @@ rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; SQLINTEGER column, len; int numfields; + int state; - if(sql_query(sqlsocket, config, querystr) < 0) - return -1; + /* Only state = 0 means success */ + if((state = sql_query(sqlsocket, config, querystr))) + return state; numfields=sql_num_fields(sqlsocket, config); if(numfields < 0) @@ -214,11 +218,9 @@ int num_fields = 0; err_handle = SQLNumResultCols(unixodbc_sock->stmt_handle,(SQLSMALLINT *)&num_fields); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); + if (sql_state(err_handle, sqlsocket, config)) return -1; - } + return num_fields; } @@ -247,14 +249,19 @@ *************************************************************************/ static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; + long err_handle; + int state; sqlsocket->row = NULL; - if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) - return 0; - - /* XXX Check if return suggests we should return error or SQL_DOWN */ - + err_handle = SQLFetch(unixodbc_sock->stmt_handle); + if(err_handle == SQL_NO_DATA_FOUND) + return 0; + if ((state = sql_state(err_handle, sqlsocket, config))) { + if(state == SQL_DOWN) + radlog(L_ERR, "rlm_sql_unixodbc: rlm_sql should attempt to reconnect\n"); + return state; + } sqlsocket->row = unixodbc_sock->row; return 0; } @@ -346,6 +353,41 @@ SQLINTEGER errornum = 0; SQLSMALLINT length = 255; static char result[1024]; /* NOT thread-safe! */ + + rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; + + SQLError( + unixodbc_sock->env_handle, + unixodbc_sock->dbc_handle, + unixodbc_sock->stmt_handle, + state, + &errornum, + error, + 256, + &length); + + sprintf(result, "%s %s", state, error); + result[sizeof(result) - 1] = '\0'; /* catch idiot thread issues */ + return result; +} + +/************************************************************************* + * + * Function: sql_state + * + * Purpose: Returns 0 for success, SQL_DOWN if the error was + * connection related or -1 for other errors + * + *************************************************************************/ +static int sql_state(long err_handle, SQLSOCK *sqlsocket, SQL_CONFIG *config) { + SQLCHAR state[256] = ""; + SQLCHAR error[256] = ""; + SQLINTEGER errornum = 0; + SQLSMALLINT length = 255; + int res = -1; + + if(SQL_SUCCEEDED(err_handle)) + return 0; /* on success, just return 0 */ rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; @@ -359,9 +401,25 @@ 256, &length); - sprintf(result, "%s %s", state, error); - result[sizeof(result) - 1] = '\0'; /* catch idiot thread issues */ - return result; + if(state[0] == '0') { + switch(state[1]) { + case '1': /* SQLSTATE 01 class contains info and warning messages */ + radlog(L_ERR, "rlm_sql_unixodbc: Warning %s %s\n", state, error); + case '0': /* SQLSTATE 00 class means success */ + res = 0; + break; + case '8': /* SQLSTATE 08 class describes various connection errors */ + radlog(L_ERR, "rlm_sql_unixodbc: SQL down %s %s\n", state, error); + res = SQL_DOWN; + break; + default: /* any other SQLSTATE means error */ + radlog(L_ERR, "rlm_sql_unixodbc: Error %s %s\n", state, error); + res = -1; + break; + } + } + + return res; } /************************************************************************* @@ -378,11 +436,9 @@ int affected_rows; err_handle = SQLRowCount(unixodbc_sock->stmt_handle, (SQLINTEGER *)&affected_rows); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); + if (sql_state(err_handle, sqlsocket, config)) return -1; - } + return affected_rows; } -------------------------------------PATCH ENDS HERE------------------------------------------ -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. -----

2 1

Fw: Help needed with MS-CHAP
by Charles Blake 28 Feb '06

28 Feb '06

I am sorry. I just want to know what happens when Radius receives a request with a MS-CHAP password, how it authenticates the user? Thank you, Charles ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, February 24, 2006 10:52 AM Subject: Re: Help needed with MS-CHAP > "Charles Blake" <charles(a)neutel.com> wrote: >> I just want to authenticate MS-CHAPv2 passwords. My question is: >> >> Where do I have those passwords in my Linux server? > > I've been trying to say you don't. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 3