- Freeradius-Users - lists.freeradius.org

freeradius 1.0.4 + mysql cannot authincate
by Jonathan Carpenter 11 Jan '06

11 Jan '06

I am running freeradius 1.0.4 + mysql 4.1.16. I have use the mysql database schema from the freeradius tar ball. Everything seems to be setup correctly I can authenticate from flat text files but not from any database usernames. Here is the output from my /usr/sbin/radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "before" main: lower_pass = "no" main: nospace_user = "before" main: nospace_pass = "before" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32784, id=125, length=58 User-Name = "scooby" User-Password = "scooby" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_lowerpair: User-Name now 'scooby' rad_rmspace_pair: User-Name now 'scooby' rad_rmspace_pair: User-Password now 'scooby' auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [scooby/scooby] (from client localhost port 10) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 125 to 127.0.0.1:32784 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 125 with timestamp 43c3dc9c Nothing to do. Sleeping until we see a request. Here is my syntax for radtest: radtest scooby scooby localhost:1645 10 secret My entries in the mysql table radcheck: mysql> select * from radcheck; +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 1 | scooby | User-Password | := | scooby | +----+----------+---------------+----+----------+ Do I have my information specified wrong in my database or not enough information in my database? I can not figure out why I get authentications errors when running radtest. I am not sure where I should specify the auth-type. Any help would be appreciated. Thanks, -- Jonathan Carpenter Linux System Administrator Windows System Administrator <The Unix Geek>

9 12

possible ascend data filter problems
by Chuck 11 Jan '06

11 Jan '06

i have been working with our upstream dialup provider for a week now and he has come to the conclusion that freeradius is passing the data as ascii rather than abinary. his tests used flat files while we use mysql. the filters we define are listed below from our support tech's email: -------------------------------------- That too did not change anything. In my testing If I just plug the ascend attributes in my users file as follows Ascend-data-filter += "ip in forward tcp est", Ascend-data-filter += "ip in forward dstip 64.113.34.0/24", Ascend-data-filter += "ip in drop tcp srcport = 80", Ascend-data-filter += "ip in drop tcp dstport = 25", Ascend-data-filter += "ip in forward", And they translate to Abinary fine. This leads me to believe it has to do with the way sql is passing it to you radius server. ----------------------------------- any idea why /how this is happening? it is affecting our entire structure since we are also a proxy for approx 25 realms and it affects many of their setups too. these need to be passed to our upstream as abinary. -- Chuck

2 5

[Auth Problem] FreeRADIUS with GnuGK and ATA
by ByoungJu Jeon 11 Jan '06

11 Jan '06

Hi, I am now in using FreeRADIUS 1.0.5 with ATA 188 v3.1.2 and GunGK 2.2.2_4 on FreeBSD 6.0. When GnuGK send Access Request for ATA, RADIUS reject it. You can check the log from FreeRADIUS as below. When authorization, RADIUS set Auth-Type as CHAP. (In the log, you can see "rlm_chap: Setting 'Auth-Type := CHAP'".) But when authentication, RADIUS set Auth-Type as Reject. (In the log, you can see "rad_check_password: Found Auth-Type Reject".) I don't know why Auth-Type is changed. Could you tell me what I am wrong in configuration? Thanks in advance. Bye. BJ. =========================== The log from FreeRADIUS =========================== rad_recv: Access-Request packet from host 152.102.50.225:64821, id=117, length=145 User-Name = "happian" CHAP-Password = 0x04b3d9e7363592e0e15a4fc9c7ec90e627 CHAP-Challenge = 0x43c44e1a NAS-IP-Address = 152.102.50.225 NAS-Identifier = "Gatekeeper" NAS-Port-Type = Virtual Service-Type = Login-User Framed-IP-Address = 152.102.50.223 Cisco-AVPair = "h323-ivr-out=terminal-alias:happian,0175722139;" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 radius_xlat: '/var/log/radius/radacct//auth-detail-20060111' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct//auth-detail-20060111 modcall[authorize]: module "auth_log" returns ok for request 5 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 5 radius_xlat: 'happian' rlm_sql (sql): sql_set_user escaped user --> 'happian' radius_xlat: 'SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_check_attrs('happian', NULLIF('152.102.50.223', ' ')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE ELSE FALSE EN D, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'terminal-alias') ???)' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_check_attrs('happian', NULLIF('152.10 2.50.223', '')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE E LSE FALSE END, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'termi nal-alias') ???) rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: '' radius_xlat: 'SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_reply_attrs('happian', NULLIF('152.102.50.223', ' ')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE ELSE FALSE EN D, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'terminal-alias') ???)' rlm_sql_postgresql: query: SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_reply_attrs('happian', NULLIF('152.10 2.50.223', '')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE E LSE FALSE END, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'termi nal-alias') ???) rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 5 modcall: group authorize returns ok for request 5 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [happian/<CHAP-Password>] (from client Gatekeeper port 0) Sending Access-Reject of id 117 to 152.102.50.225:64821 Finished request 5 ====================================================================== =========================== radiusd.conf =========================== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/ log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 0 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 2 max_servers = 5 min_spare_servers = 1 max_spare_servers = 2 max_requests_per_server = 0 } modules { chap { authtype = CHAP } preprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } $INCLUDE ${confdir}/postgresql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no } } instantiate { expr } authorize { preprocess auth_log chap sql } authenticate { Auth-Type CHAP { chap } } preacct { } accounting { acct_unique sql } session { } post-auth { reply_log } pre-proxy { } post-proxy { } =====================================================================

2 1

radutmp bug?
by François Delawarde 11 Jan '06

11 Jan '06

Hello, I noticed today that one user was connected, but missing when I used the radwho utility. I suspect an error from the server when it writes to the radutmp file, because checking the accounting in mysql as well as in the radacct log files showed him connected (no Accounting stop message). Thanks! François. A few details: Freeradius 1.0.5 > RADWHO OUTPUT: bliblou:/var/log/freeradius# radwho -u 375242 Login Name What TTY When From Location bliblou:/var/log/freeradius# >ACCOUNTING LOGS: bliblou:/var/log/freeradius# cat radacct/detail-200* | grep 375242 -B 2 Sat Jan 7 23:51:54 2006 Acct-Status-Type = Start User-Name = "375242" -- Sun Jan 8 16:29:22 2006 Acct-Status-Type = Stop User-Name = "375242" -- Mon Jan 9 16:08:56 2006 Acct-Status-Type = Start User-Name = "375242" bliblou:/var/log/freeradius# >MYSQL OUTPUT: mysql> select acctstarttime,acctstoptime from radacct where username=375242; +---------------------+---------------------+ | acctstarttime | acctstoptime | +---------------------+---------------------+ | 2006-01-07 23:51:54 | 2006-01-08 16:29:22 | | 2006-01-09 16:08:56 | 0000-00-00 00:00:00 | +---------------------+---------------------+ 2 rows in set (0.07 sec) mysql>

2 1

Re: MySQL settings causing FreeRADIUS to segfault
by Sean 10 Jan '06

10 Jan '06

Hi, Have you installed the MySQL development extensions? They are essential. You also need to compile FreeRadius with experimental modules to enable MySQL. Regards, Sean http://swarmhotspots.com

1 0

Noone anny idea fot --> TLS Athentifikation before Domain, Logon XP?
by Armin Krämer 10 Jan '06

10 Jan '06

Sorry, forgotte to attach the files... Okay, i tested on and found an difference. I attach 2 Files. One is the output with an normal Client-Certificate the other with an Certifikate with the OID 1.3.6.1.4.1.311.17.2. In both cases the Certifikate is rejected with Error in Certifikate A. The Client Certifikate ist tested as Client-Certifikate and works when installed as an normal Account Certifikate. Sems like the mistake is at the Certifikate itself??? When i generated the Special Machine Certifikate i changed out the normal OID against the other one described above. Or may i have to add OID as a second OID to the certifikate? Thanks for helping. :-) -----Ursprüngliche Nachricht----- Von: j.cluzel(a)online.fr [mailto:j.cluzel@online.fr] Gesendet: Freitag, 6. Januar 2006 21:11 An: Kraemer.Armin(a)web.de Betreff: Re: Noone anny idea fot --> TLS Athentifikation before Domain, Logon XP? Hello, - login as local administrateur - start mmc.exe - add certificate / computer account / local computer (note sure for names, my XP is french, so I translate) - Then, in the tree, select root certification autority/Certificates - Right click, All tasks/Import - select your "root.der" - Then, in the tree, select Personnal/Certificates - Right click, All tasks/Import - select your "machine.p12" - enter your "private key" - close mmc - set AuthMode to "2" in registry - in computer panel/Network connection/wireless connection - tab "Association" WPA & TKIP - tab "Auth" check "Authenticate as computer..." - tab "Auth"/Properties check "Validate serveur certificate" and select your certificate in the list, !!! Be aware, in "property", you add to check "Connexion to these servers", but let it uncheck for testing - Pray... ;-) Hope it helps. FYI, it works for me. Regards, Jeremy

2 2

MySQL settings causing FreeRADIUS to segfault
by radius＠smartfoxsoftware.com 10 Jan '06

10 Jan '06

Hello again, I got the DialupAdmin/SQL problem fixed (Thanks) but now I'm running into a problem with FreeRADIUS. I've tried following several different guides I've found on the net for setting up FreeRADIUS and MySQL and each time, I get the same results. Whenever, I enable anything regarding SQL in radiusd.conf and start up radiusd in debug mode (radiusd -X), FreeRADIUS segfaults. If I start the program with -x, I get the same results however when I start up radiusd without any options (radiusd, by itself), the program starts fine. Could this be a configuration issue in FreeRADIUS or something messed up with my Ubuntu install? We've tried authenticating when FreeRADIUS is started without command-line options and it does not accept the information in the MySQL database inputed via Dialupadmin. If needed, I can post my config files. I figured I'd wait to see if it was needed before doing so. Thanks

2 1

Re: how to compile freeradius without ssl
by Sean 10 Jan '06

10 Jan '06

Hi, If you are using FreeRadius to manage WiFi hotspots with Chillispot I have a PHP login script that works without SSL. Email me if you want a copy. Regards, Sean Bracken http://swarmhotspots.com

1 0

how to compile freeradius without ssl
by Alvaro Quiñones 10 Jan '06

10 Jan '06

Hi I want to compile freeradius without ssl, i tried with ./configure --disable-ssl ./configure --disable-openssl ./configure --without-ssl ./configure --without-openssl however always i see checking for regex.h... yes checking for openssl/ssl.h... no checking for off_t... yes how can i compile without support ssl Thanks Alvaro

2 1

RE: Cisco to FreeRadius to AD-LDAP authentication
by Dickson, John 10 Jan '06

10 Jan '06

>> My question is, how do I get an "Accept" from the request and is there >> a way around the basedn naming conventions that will alllow FreeRadius >> to work with Windowz? > > The issue here isn't with basedn naming conventions. It's that you haven't set up FreeRADIUS to ask AD about authenticating the user.? > > If the users log in with clear-text passwords, my suggestion is to set up rlm_smb, and point it to the domain controller. That will let FreeRADIUs use >AD for authentication. > > Alan DeKok. I made some changes to the radiusd.conf to exclude what I thought was not needed and have much joy. The localhost client test is accepted. With regard to the basedn naming convention I will explain my problem. Users created in AD with a first name and last name have a "cn=radius test" and the actual logon credentials are in "sAMAccountName=radtest". This presents a problem when a querry is passed. In the text below I have broken the "cn=" First and Last name entry by adding a backslash to the tail of the first name. The actual user account that was querried has a logon of "radtest" and not "radius test". Basically it is creating it's "distinguishedName" within the record, from one of two different places depending how the account was creted. Is there a way to work around this issue? Here is an "ldapsearch result" for 2 separate users The actual account logon credential is the "sAMAccountName" 111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111111111 # radius test, Users, xxxx1.xxxx1.edu dn: CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu objectClass: user cn: radius test sn: test givenName: radius distinguishedName: CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu displayName: radius test name: radius test logonCount: 0 sAMAccountName: radtest sAMAccountType: 805306368 userPrincipalName: radtest(a)xxxx1.xxxx2.edu objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=xxxx1,DC=xxxx2,DC=edu 222222222222222222222222222222222222222222222222222222222222222222222222 22222222222222222222222 # testing, Users, xxxx1.xxxx2.edu dn: CN=testing,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu objectClass: user cn: testing givenName: testing distinguishedName: CN=testing,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu displayName: testing name: testing logonCount: 0 sAMAccountName: testing sAMAccountType: 805306368 userPrincipalName: testing(a)xxxx1.xxxx2.edu objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=xxxx1,DC=xxxx2,DC=edu ************************************************************************ *************************************** Here is the output from the localhost requesting "radtest on logon radtest" and the debug from the FreeRADIUS: [john@magellan ~]$ radtest radius\ test Passw0rd localhost 0 testing123 Sending Access-Request of id 62 to 10.1.1.27:1812 User-Name = "radius test" User-Password = "Passw0rd" NAS-IP-Address = localhost.xxxx1.xxxx2.edu NAS-Port = 0 rad_recv: Access-Accept packet from host 10.1.1.27:1812, id=62, length=20 And the debug.... Waking up in 31 seconds... Thread 5 got semaphore Thread 5 handling request 34, (7 handled so far) User-Name = "radius test" User-Password = "Passw0rd" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 34 modcall[authorize]: module "preprocess" returns ok for request 34 modcall[authorize]: module "mschap" returns noop for request 34 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 34 rlm_ldap: - authorize rlm_ldap: performing user authorization for radius test radius_xlat: '(cn=radius test)' radius_xlat: 'ou=Users,dc=xxxx1,dc=xxxx2,dc=EDU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Users,dc=xxxx1,dc=xxxx2,dc=EDU, with filter (cn=radius test) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user radius test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 34 modcall: group authorize returns ok for request 34 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 34 rlm_ldap: - authenticate rlm_ldap: login attempt by "radius test" with password "Passw0rd" rlm_ldap: user DN: CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu rlm_ldap: (re)connect to xxxx1.xxxx2.EDU:389, authentication 1 rlm_ldap: bind as CN=radius test,OU=Users,DC=xxxx1,DC=xxxx2,DC=edu/Passw0rd to xxxx1.xxxx2.EDU:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user radius test authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 34 modcall: group Auth-Type returns ok for request 34 Sending Access-Accept of id 62 to 10.1.1.27:32858 Finished request 34 Going to the next request Thread 5 waiting to be assigned a request --- Walking the entire request list --- Cleaning up request 34 ID 62 with timestamp 43c3bea7 Nothing to do. Sleeping until we see a request.

1 0