- Freeradius-Users - lists.freeradius.org

Setup freeradius for intranet desktop client
by mahesh luhar 16 Nov '05

16 Nov '05

Dear All, I have installed radius server Version 1.0.5 on linux 9. I would like to use feeradius server following usage. (1) Intranet desktop client authentication for internet access with limited no of ports as outgoing destination ports. (2) Few users on cable modem. Can i setup radius functionality for such users. Please guide Regards, Mahesh Luhar -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

2 1

Regx Question
by Mike O'Connor 16 Nov '05

16 Nov '05

Hi All I have the following in the users and acct_users files DEFAULT Called-Station-Id == "0198334115", Proxy-To-Realm := "xxxx.com" I would like to match on "198334115" with a possibility of about 4 to 6 more number on the front of this number. I have tried a number of difference regx's but non of them have worked so I must have something wrong :) Any ideas would be great. Thanks Mike

3 4

Login incorrect- RAS autentication
by Danny Zenzano 15 Nov '05

15 Nov '05

hi, I am trying to make work an RAS(lucent-max6000) with the freeRADIUS,I configure the MAX6000, and the radius obtains an authentication order from the RAS, but as result I obtain a login error message. somebody could help me? this is the result: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:1812, id=51, length=72 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=52, length=78 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=53, length=64 User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=54, length=66 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=55, length=63 Sending Access-Reject of id 51 to 192.168.1.3:1812 Sending Access-Reject of id 52 to 192.168.1.3:1812 Sending Access-Reject of id 53 to 192.168.1.3:1812 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=56, length=68 Login incorrect: [dovbs-1/ascend] (from client RAS port 0) User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [appleroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=57, length=70 User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 54 to 192.168.1.3:1812 Sending Access-Reject of id 55 to 192.168.1.3:1812 Sending Access-Reject of id 56 to 192.168.1.3:1812 Sending Access-Reject of id 57 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 10.40.4.35:2328, id=12, length=44 User-Name = "root" User-Password = "viva123" Login OK: [root/viva123] (from client ZenzanoPC port 0) Sending Access-Accept of id 12 to 10.40.4.35:2328 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=60, length=71 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=61, length=74 User-Name = "route-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "ipxroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=62, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=63, length=69 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=64, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=65, length=75 User-Name = "appleroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=66, length=72 User-Name = "pools-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "permconn-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=67, length=78 User-Name = "frdlink-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=68, length=64 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [permconn-RAS-1/ascend] (from client RAS port 0) Login incorrect: [pools-RAS/ascend] (from client RAS port 0) Login incorrect: [ipxroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [frdlink-RAS-1/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [appleroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [route-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=69, length=63 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [dovbs-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=70, length=66 Sending Access-Reject of id 60 to 192.168.1.3:1812 Sending Access-Reject of id 61 to 192.168.1.3:1812 Sending Access-Reject of id 62 to 192.168.1.3:1812 Sending Access-Reject of id 63 to 192.168.1.3:1812 Sending Access-Reject of id 64 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=71, length=68 Sending Access-Reject of id 65 to 192.168.1.3:1812 Sending Access-Reject of id 66 to 192.168.1.3:1812 Sending Access-Reject of id 67 to 192.168.1.3:1812 Sending Access-Reject of id 68 to 192.168.1.3:1812 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=72, length=70 Login incorrect: [appleroute-1/ascend] (from client RAS port 0) User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 69 to 192.168.1.3:1812 Sending Access-Reject of id 70 to 192.168.1.3:1812 Sending Access-Reject of id 71 to 192.168.1.3:1812 Sending Access-Reject of id 72 to 192.168.1.3:1812

1 0

RE: Login incorrect- RAS autentication
by Danny Zenzano 15 Nov '05

15 Nov '05

-----Mensaje original----- De: Danny Zenzano [mailto:danny.zenzano@nuevatel.com] Enviado el: martes, 15 de noviembre de 2005 19:57 Para: 'freeradius-users(a)lists.freeradius.org' Asunto: Login incorrect- RAS autentication hi, I am trying to make work an RAS(lucent-max6000) with the freeRADIUS,I configure the MAX6000, and the radius obtains an authentication order from the RAS, but as result I obtain a login error message. somebody could help me? this is the result: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:1812, id=51, length=72 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=52, length=78 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=53, length=64 User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=54, length=66 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=55, length=63 Sending Access-Reject of id 51 to 192.168.1.3:1812 Sending Access-Reject of id 52 to 192.168.1.3:1812 Sending Access-Reject of id 53 to 192.168.1.3:1812 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=56, length=68 Login incorrect: [dovbs-1/ascend] (from client RAS port 0) User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [appleroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=57, length=70 User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 54 to 192.168.1.3:1812 Sending Access-Reject of id 55 to 192.168.1.3:1812 Sending Access-Reject of id 56 to 192.168.1.3:1812 Sending Access-Reject of id 57 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 10.40.4.35:2328, id=12, length=44 User-Name = "root" User-Password = "viva123" Login OK: [root/viva123] (from client ZenzanoPC port 0) Sending Access-Accept of id 12 to 10.40.4.35:2328 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=60, length=71 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=61, length=74 User-Name = "route-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "ipxroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=62, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=63, length=69 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=64, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=65, length=75 User-Name = "appleroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=66, length=72 User-Name = "pools-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "permconn-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=67, length=78 User-Name = "frdlink-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=68, length=64 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [permconn-RAS-1/ascend] (from client RAS port 0) Login incorrect: [pools-RAS/ascend] (from client RAS port 0) Login incorrect: [ipxroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [frdlink-RAS-1/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [appleroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [route-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=69, length=63 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [dovbs-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=70, length=66 Sending Access-Reject of id 60 to 192.168.1.3:1812 Sending Access-Reject of id 61 to 192.168.1.3:1812 Sending Access-Reject of id 62 to 192.168.1.3:1812 Sending Access-Reject of id 63 to 192.168.1.3:1812 Sending Access-Reject of id 64 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=71, length=68 Sending Access-Reject of id 65 to 192.168.1.3:1812 Sending Access-Reject of id 66 to 192.168.1.3:1812 Sending Access-Reject of id 67 to 192.168.1.3:1812 Sending Access-Reject of id 68 to 192.168.1.3:1812 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=72, length=70 Login incorrect: [appleroute-1/ascend] (from client RAS port 0) User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 69 to 192.168.1.3:1812 Sending Access-Reject of id 70 to 192.168.1.3:1812 Sending Access-Reject of id 71 to 192.168.1.3:1812 Sending Access-Reject of id 72 to 192.168.1.3:1812

1 0

changing password_attribute
by Brian A. Seklecki 15 Nov '05

15 Nov '05

Cisco AP1200 + OpenLDAP + MS-CHAPv2 + EAP configuration (WPA2, basically, right?) So obviously, everyone's userPassword attribute cannot be maintained in cleartext in the LDAP database. If I modify my schema and create a "weakPassword" attribute using the following template: #attributetype ( 2.5.4.35 NAME 'userPassword' # DESC 'RFC2256/2307: password of user' # EQUALITY octetStringMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) Populate it with a {clear} prefix ...and then change the password_attribute in radiusd.conf(5). When the user associates to the AP, authorize works but authenticate fails because the LDAP module is then attempting to bind to the LDAP server as the user. Why does it do this? It can pull all of the LDIF info for the user when it first connects. rlm_ldap: - authorize rlm_ldap: performing user authorization for bkaplan rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to blah:389, authentication 0 rlm_ldap: setting TLS CACert File to /blah rlm_ldap: starting TLS rlm_ldap: bind as cn=RADIUS,foo... to foo.com:11 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=blah rlm_ldap: Added password {CLEAR}secret in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusAuthType as Auth-Type, value wifi & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user bkaplan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" *********** But then: ***** Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "bkaplan" with password "WRONG" rlm_ldap: user DN: blah... rlm_ldap: (re)connect to foo:389, authentication 1 rlm_ldap: setting TLS CACert File to /blah rlm_ldap: starting TLS rlm_ldap: bind as cn=blah=foo,blahfoo,blah blah rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [bkaplan/WRONG] (from client blah port 1812) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Why in the world is it using different logic to authorize v.s. authenticate? Head -> Wall Head -> Wall ~BAS

1 1

Cryptocards and freeradius
by Greg Woods 15 Nov '05

15 Nov '05

If I get yelled at for asking this here, so be it; it will be just one more stumbling block in a long research project. What I want to do, in a nutshell, is use the rlm_x99_token module to authenticate users with Cryptocards. But everything I've tried so far comes down to needing to know the DES key that is programmed into the card. Obviously, there can't be an easy way to get the key out of the card, or the card would be useless. So this means you need to program the card with a known key. My problem is that I cannot figure out a way to do this. This isn't really a freeradius question (which is why I might get yelled at), but it is clearly relevant to anyone who wants to use freeradius to authenticate via Cryptocards. This list is a likely source of people who have successfully done this. But my question is, how do I program the cards with a known key? I tried setting the randomkey = no parameter in the cryptocard.cfg file and restarting the cadmind but the CAClient still seems to use an internally-generated key when initializing. I am using freeradius 1.0.1 from RPM on CentOS 4 (based directly on Red Hat Enterprise 4) and cadmin 5.1 if it matters. Also, we have the RB-1 "calculator" style tokens. Another possibility might be to find a way to extract the key from the very long hex string stored in the MySQL database by the cadmind server, called the "encrypted key", but I haven't found any way to do that either. Is anybody using freeradius with rlm_x99_token module and Cryptocard RB-1 tokens successfully? How do you initialize your cards and sync them with freeradius? For what it's worth, I have gotten basic functionality of the x99_token module to work with our Cisco VPN 3000 concentrator, authenticating via freeradius. I have gotten as far as having the special password "resync" generate a display of the challenge, but without the proper keys for the cards in the x99passwd file, I can't actually authenticate users with them. Thanks, --Greg

2 1

Re: Problem with EAP/TLS and XP SP2
by Axel F 15 Nov '05

15 Nov '05

Look at this Thread: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg00284.… I think that's the same problem. Axel ----- Original Message ----- > Radius Server: Freeradius 1.0.5 on Solaris 8 (Sparc) > Client: Windows XP (SP2), Intel PRO/Wireless 2915 (a/b/g) > Access Point: DLink DI-784 > > I'm having trouble getting my laptop (running Windows XP SP2) to > authenticate to my access point using EAP/TLS. XP shows the wireless > interface hung forever in "Attempting to authenticate" state. I've > been beating my head against this all day without success, although I > think I'm close and just missing something stupid and obvious. > > In the debugging log from "radiusd -X" below, I can see my laptop > communicating with the radius server. I'm definitely seeing the > correct username ("HalPomeranz") from the certificate I installed > on the laptop. The radius server is finding the username entry > in my "users" file. The only thing that looks like an error is > the lines that read: > > rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest > TLS_accept: SSLv3 write certificate request A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A > > I Googled a bit for this error message and turned up some mailing list > traffic describing similar problems, but no solutions. Perhaps this > is a red herring, however. > > Note that I am successfully using this same radius server to > authenticate some older clients which use LEAP to connect via a > different access point, so I'm thinking my radius config is basically > sound. > > Does anybody have any suggestions for how to resolve my problem? > Anybody seen anything like this before? Thanks in advance... > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Hal Pomeranz, Founder/CEO Deer Run Associates [EMAIL PROTECTED] > Network Connectivity and Security, Systems Management, Training > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /var/freeradius/etc/raddb/proxy.conf > Config: including file: /var/freeradius/etc/raddb/clients.conf > Config: including file: /var/freeradius/etc/raddb/snmp.conf > Config: including file: /var/freeradius/etc/raddb/eap.conf > Config: including file: /var/freeradius/etc/raddb/sql.conf > main: prefix = "/var/freeradius" > main: localstatedir = "/var/freeradius/var" > main: logdir = "/var/freeradius/var/log/radius" > main: libdir = "/var/freeradius/lib" > main: radacctdir = "/var/freeradius/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 1812 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/freeradius/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/freeradius/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/var/freeradius/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /var/freeradius/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/freeradius/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/var/freeradius/etc/raddb/certs/server_key.pem" > tls: certificate_file = "/var/freeradius/etc/raddb/certs/server_cert.pem" > tls: CA_file = "/var/freeradius/etc/raddb/certs/cacert.pem" > tls: private_key_password = "" > tls: dh_file = "/var/freeradius/etc/raddb/certs/dh" > tls: random_file = "/var/freeradius/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = yes > tls: check_cert_cn = "%{User-Name}" > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/var/freeradius/etc/raddb/huntgroups" > preprocess: hints = "/var/freeradius/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/var/freeradius/etc/raddb/users" > files: acctusersfile = "/var/freeradius/etc/raddb/acct_users" > files: preproxy_usersfile = "/var/freeradius/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/freeradius/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=199, > length=139 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020100100148616c506f6d6572616e7a > Message-Authenticator = 0xe476642b4d621276fdcfa07fc848c5d6 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 1 length 16 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: group authenticate returns handled for request 0 > Sending Access-Challenge of id 199 to 192.168.100.4:1435 > EAP-Message = 0x010200060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xf5332abd7af77b9911176ec9aa69e0e8 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=200, > length=221 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = > 0x020200500d800000004616030100410100003d030143696dabf9029fc190693ca4dc70364a394a56ff89289a020122f2e7346c770500001600040005000a000900640062000300060013001200630100 > > State = 0xf5332abd7af77b9911176ec9aa69e0e8 > Message-Authenticator = 0x438ea47659b46e7e17bb9a54f66f02be > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 2 length 80 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 1 > modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Length Included > eaptls_verify returned 11 > (other): before/accept initialization > TLS_accept: before/accept initialization > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello > TLS_accept: SSLv3 read client hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello > TLS_accept: SSLv3 write server hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 0510], Certificate > TLS_accept: SSLv3 write certificate A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest > TLS_accept: SSLv3 write certificate request A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A > In SSL Handshake Phase > In SSL Accept mode eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 1 > modcall: group authenticate returns handled for request 1 > Sending Access-Challenge of id 200 to 192.168.100.4:1435 > EAP-Message = > 0x0103040a0dc0000005c7160301004a02000046030143696da6a2b012e765aa3f113c4c1ed6e28c40f51807859cd4394962388ae6e0202f9cf584c484b68b3aa0eb66ee1d1edec787b87407a2bf043891da3dc798f42b00040016030105100b00050c00050900024730820243308201aca003020102020101300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139323533385a170d3036313130323139323533385a3069310b300906 > > EAP-Message = > 0x0355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573311a301806035504031311646565722e646565722d72756e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c0511b635bded2881c4db827a89c521fbcc5a06b435b4ad56cd1b9b8ad0e78815ef2bd5d1e60e7a4c7f6b1a154cde960cf5de365fdd2fa462b3b90934d252245e87996b4031326e118dc68f9c9f6e3efb08958ba388f7677c47ecbf35514a74f27926b6a39d7f452c9caa2fb9d98fd3bdde64c4aa8f1b81228f502d1 > > EAP-Message = > 0x117dcd5f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003818100243b1d366876ce82374e51d6e84e0a7e93a70558baad71a2a43ddc3602bc87df8c8d96fc2e903e1b68ae3bfdd5e1e8e1764d7d636d7bcdd0aa4a2f33598115ad1b6d90d43596654f4f956f26ad6cfc6d47330bc0d2a57e8e1998b9fc6da570c117a643bb699091f80f5aff0c44f6bb875ef27e0d79fbfda8ca01763debfff8960002bc308202b830820221a003020102020100300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d0603 > > EAP-Message = > 0x5504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139313931355a170d3036313130323139313931355a304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f63696174657330819f300d06092a864886f70d010101050003818d0030818902818100c16d27eab105d0e179e6a58207dd1b7d0c1a5a64f761506275abebf495254f4e242f9d13926e56bfe0bb8d9130afca9287746c12c5eed4f0ae5233ecc412bba6693cf9fad4e1db0f > > EAP-Message = 0x4f4b39c0f47ed5293975a9448d479ca38fbddeef68e1 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xf608c3c340e7dcd273e77d1ca5afd315 > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=201, > length=147 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020300060d00 > State = 0xf608c3c340e7dcd273e77d1ca5afd315 > Message-Authenticator = 0x399bf08221ad337dec5353e34d1f3f9e > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 2 > modcall[authorize]: module "preprocess" returns ok for request 2 > modcall[authorize]: module "chap" returns noop for request 2 > modcall[authorize]: module "mschap" returns noop for request 2 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 2 > rlm_eap: EAP packet type response id 3 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 2 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 2 > modcall: group authorize returns updated for request 2 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 2 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 2 > modcall: group authenticate returns handled for request 2 > Sending Access-Challenge of id 201 to 192.168.100.4:1435 > EAP-Message = > 0x010401d10d80000005c709eeaeeb99893a248df35086a268947b61542d3988e761db738040976f08e84fd7830203010001a381a73081a4301d0603551d0e0416041400b41eff09bcce9ad9f1b04ba50419a7db44a7f030750603551d23046e306c801400b41eff09bcce9ad9f1b04ba50419a7db44a7f0a151a44f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573820100300c0603551d13040530030101ff300d06092a864886f70d010104050003818100b8ddea1e6f5851b78cca0feab23bd8 > > EAP-Message = > 0x9b7d268ab9250ccd7a7d720d6c2cf103477a6445773dca5be28fd44611b9e4a2a9a6331550fbad950e21fea1ff8e70a3d178c9d1ebf13b12cd80d6ce561be9699a922a722207d4950140bb0aeb3d8b3e22021a83c91948f1903b4eaedb66a1288837436871f1a57bda39f374a3fb8af28b160301005e0d0000560201020051004f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f6369617465730e000000 > > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x86870d983715d15f6919bdba762433c2 > Finished request 2 > Going to the next request > --- Walking the entire request list --- > Waking up in 5 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=202, > length=147 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020400060d00 > State = 0x86870d983715d15f6919bdba762433c2 > Message-Authenticator = 0xeda680bdf69e5dd588260e1c36169581 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 3 > modcall[authorize]: module "preprocess" returns ok for request 3 > modcall[authorize]: module "chap" returns noop for request 3 > modcall[authorize]: module "mschap" returns noop for request 3 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 3 > rlm_eap: EAP packet type response id 4 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 3 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 3 > modcall: group authorize returns updated for request 3 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 3 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 3 > modcall: group authenticate returns handled for request 3 > Sending Access-Challenge of id 202 to 192.168.100.4:1435 > EAP-Message = 0x0105000a0d8000000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x2b04eed7fe0be0ec28fbba826e52b47c > Finished request 3 > Going to the next request > --- Walking the entire request list --- > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 199 with timestamp 43696da6 > Cleaning up request 1 ID 200 with timestamp 43696da6 > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 2 ID 201 with timestamp 43696da7 > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 3 ID 202 with timestamp 43696da8 > Nothing to do. Sleeping until we see a request. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

1 0

SQL and MSSQL databases diference
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, here is another question. In the first case I'm using an mssql module to connect to my database and the "radiusd -X" command tell me something like this: radiusd -X ------------------- rlm_sql (mssql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (mssql): Attempting to connect to testmk@MSSQL-DB:/mk rlm_sql (mssql): starting 0 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (mssql): Connected new DB handle, #0 rlm_sql (mssql): starting 1 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (mssql): Connected new DB handle, #1 rlm_sql (mssql): starting 2 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (mssql): Connected new DB handle, #2 rlm_sql (mssql): starting 3 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (mssql): Connected new DB handle, #3 rlm_sql (mssql): starting 4 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (mssql): Connected new DB handle, #4 Module: Instantiated sql (mssql) ------------------------------ When I change the module to sql the answer is diferent: radiusd -X ------------------- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id ------------------------------ In this case I've this extra line: "rlm_sql_mysql: Starting connect to MySQL server for #1", that it is missing in the previous case. Is that corect or I've something missing in the configuration of the mssql module? Thanks!! NanO

1 0

MSSQL Querys -> No matching entry
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to make a simple authorization using the mssql module but when Radius execute all the querys "No matching entry..." is the answer. I'm completely sure that all the data store in my database is correct, but I always had the same responce: radiusd -X ------------------------- radius_xlat: '00:11:7C:00:01:57' rlm_sql (mssql): sql_set_user escaped user --> '00:11:7C:00:01:57' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:11:7C:00:01:57' ORDER BY id' rlm_sql (mssql): Reserving sql socket id: 4 query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:11:7C:00:01:57' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'usergroup'. ' rlm_sql_getvpdata: database query error radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:11:7C:00:01:57' ORDER BY id' query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:11:7C:00:01:57' ORDER BY id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'radreply'. ' rlm_sql_getvpdata: database query error radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'usergroup'. ' rlm_sql_getvpdata: database query error rlm_sql (mssql): No matching entry in the database for request from user [00:11:7C:00:01:57] rlm_sql (mssql): Released sql socket id: 4 modcall[authorize]: module "mssql" returns notfound for request 0 ------------------------------------ Is there something that I'm missing?!?! Thanks!! NanO

2 1

Re: FreeRadius using two SQL servers
by Dusty Doris 15 Nov '05

15 Nov '05

> what do you think if we try to use a Perl module inside of the autorize > section?!?!. I want the Perl module to decide between my two sql servers > depending of the incoming realm, I think this can be a possible way to > take. If you have any idea please let me know. Thanks!! That should work too. However, you can do this with Autz-Type, I am currently doing it right now, but using ldap instead of sql. Comment out your Autz-Type entries in your users file and try this. Actually, comment out all your entries if you're not on a production system. DEFAULT Realm == "wireless", Autz-Type := SQL1 DEFAULT Realm == "dhcp", Autz-Type := SQL2 Notice that the check item Realm == is first, then Autz-Type. Make sure your sql1.conf and sql2.conf files look like this at the top. sql1.conf sql sql1 { ... } sql2.conf sql sql2 { ... } Then give it a shot. If that does not work, try change it to add Auth-Type to the end. DEFAULT Realm == "dhcp", Autz-Type := SQL2, Auth-Type := Local If neither of those work for you, please post your debug again. Also, make sure to reply to all, so your replies go back to the list, not just me. -Dusty

2 1