- Freeradius-Users - lists.freeradius.org

Cryptocards and freeradius
by Greg Woods 15 Nov '05

15 Nov '05

If I get yelled at for asking this here, so be it; it will be just one more stumbling block in a long research project. What I want to do, in a nutshell, is use the rlm_x99_token module to authenticate users with Cryptocards. But everything I've tried so far comes down to needing to know the DES key that is programmed into the card. Obviously, there can't be an easy way to get the key out of the card, or the card would be useless. So this means you need to program the card with a known key. My problem is that I cannot figure out a way to do this. This isn't really a freeradius question (which is why I might get yelled at), but it is clearly relevant to anyone who wants to use freeradius to authenticate via Cryptocards. This list is a likely source of people who have successfully done this. But my question is, how do I program the cards with a known key? I tried setting the randomkey = no parameter in the cryptocard.cfg file and restarting the cadmind but the CAClient still seems to use an internally-generated key when initializing. I am using freeradius 1.0.1 from RPM on CentOS 4 (based directly on Red Hat Enterprise 4) and cadmin 5.1 if it matters. Also, we have the RB-1 "calculator" style tokens. Another possibility might be to find a way to extract the key from the very long hex string stored in the MySQL database by the cadmind server, called the "encrypted key", but I haven't found any way to do that either. Is anybody using freeradius with rlm_x99_token module and Cryptocard RB-1 tokens successfully? How do you initialize your cards and sync them with freeradius? For what it's worth, I have gotten basic functionality of the x99_token module to work with our Cisco VPN 3000 concentrator, authenticating via freeradius. I have gotten as far as having the special password "resync" generate a display of the challenge, but without the proper keys for the cards in the x99passwd file, I can't actually authenticate users with them. Thanks, --Greg

2 1

Re: Problem with EAP/TLS and XP SP2
by Axel F 15 Nov '05

15 Nov '05

Look at this Thread: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg00284.… I think that's the same problem. Axel ----- Original Message ----- > Radius Server: Freeradius 1.0.5 on Solaris 8 (Sparc) > Client: Windows XP (SP2), Intel PRO/Wireless 2915 (a/b/g) > Access Point: DLink DI-784 > > I'm having trouble getting my laptop (running Windows XP SP2) to > authenticate to my access point using EAP/TLS. XP shows the wireless > interface hung forever in "Attempting to authenticate" state. I've > been beating my head against this all day without success, although I > think I'm close and just missing something stupid and obvious. > > In the debugging log from "radiusd -X" below, I can see my laptop > communicating with the radius server. I'm definitely seeing the > correct username ("HalPomeranz") from the certificate I installed > on the laptop. The radius server is finding the username entry > in my "users" file. The only thing that looks like an error is > the lines that read: > > rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest > TLS_accept: SSLv3 write certificate request A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A > > I Googled a bit for this error message and turned up some mailing list > traffic describing similar problems, but no solutions. Perhaps this > is a red herring, however. > > Note that I am successfully using this same radius server to > authenticate some older clients which use LEAP to connect via a > different access point, so I'm thinking my radius config is basically > sound. > > Does anybody have any suggestions for how to resolve my problem? > Anybody seen anything like this before? Thanks in advance... > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Hal Pomeranz, Founder/CEO Deer Run Associates [EMAIL PROTECTED] > Network Connectivity and Security, Systems Management, Training > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /var/freeradius/etc/raddb/proxy.conf > Config: including file: /var/freeradius/etc/raddb/clients.conf > Config: including file: /var/freeradius/etc/raddb/snmp.conf > Config: including file: /var/freeradius/etc/raddb/eap.conf > Config: including file: /var/freeradius/etc/raddb/sql.conf > main: prefix = "/var/freeradius" > main: localstatedir = "/var/freeradius/var" > main: logdir = "/var/freeradius/var/log/radius" > main: libdir = "/var/freeradius/lib" > main: radacctdir = "/var/freeradius/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 1812 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/freeradius/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/freeradius/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/var/freeradius/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /var/freeradius/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/freeradius/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/var/freeradius/etc/raddb/certs/server_key.pem" > tls: certificate_file = "/var/freeradius/etc/raddb/certs/server_cert.pem" > tls: CA_file = "/var/freeradius/etc/raddb/certs/cacert.pem" > tls: private_key_password = "" > tls: dh_file = "/var/freeradius/etc/raddb/certs/dh" > tls: random_file = "/var/freeradius/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = yes > tls: check_cert_cn = "%{User-Name}" > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/var/freeradius/etc/raddb/huntgroups" > preprocess: hints = "/var/freeradius/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/var/freeradius/etc/raddb/users" > files: acctusersfile = "/var/freeradius/etc/raddb/acct_users" > files: preproxy_usersfile = "/var/freeradius/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/freeradius/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=199, > length=139 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020100100148616c506f6d6572616e7a > Message-Authenticator = 0xe476642b4d621276fdcfa07fc848c5d6 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 1 length 16 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: group authenticate returns handled for request 0 > Sending Access-Challenge of id 199 to 192.168.100.4:1435 > EAP-Message = 0x010200060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xf5332abd7af77b9911176ec9aa69e0e8 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=200, > length=221 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = > 0x020200500d800000004616030100410100003d030143696dabf9029fc190693ca4dc70364a394a56ff89289a020122f2e7346c770500001600040005000a000900640062000300060013001200630100 > > State = 0xf5332abd7af77b9911176ec9aa69e0e8 > Message-Authenticator = 0x438ea47659b46e7e17bb9a54f66f02be > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 2 length 80 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 1 > modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Length Included > eaptls_verify returned 11 > (other): before/accept initialization > TLS_accept: before/accept initialization > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello > TLS_accept: SSLv3 read client hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello > TLS_accept: SSLv3 write server hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 0510], Certificate > TLS_accept: SSLv3 write certificate A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest > TLS_accept: SSLv3 write certificate request A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A > In SSL Handshake Phase > In SSL Accept mode eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 1 > modcall: group authenticate returns handled for request 1 > Sending Access-Challenge of id 200 to 192.168.100.4:1435 > EAP-Message = > 0x0103040a0dc0000005c7160301004a02000046030143696da6a2b012e765aa3f113c4c1ed6e28c40f51807859cd4394962388ae6e0202f9cf584c484b68b3aa0eb66ee1d1edec787b87407a2bf043891da3dc798f42b00040016030105100b00050c00050900024730820243308201aca003020102020101300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139323533385a170d3036313130323139323533385a3069310b300906 > > EAP-Message = > 0x0355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573311a301806035504031311646565722e646565722d72756e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c0511b635bded2881c4db827a89c521fbcc5a06b435b4ad56cd1b9b8ad0e78815ef2bd5d1e60e7a4c7f6b1a154cde960cf5de365fdd2fa462b3b90934d252245e87996b4031326e118dc68f9c9f6e3efb08958ba388f7677c47ecbf35514a74f27926b6a39d7f452c9caa2fb9d98fd3bdde64c4aa8f1b81228f502d1 > > EAP-Message = > 0x117dcd5f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003818100243b1d366876ce82374e51d6e84e0a7e93a70558baad71a2a43ddc3602bc87df8c8d96fc2e903e1b68ae3bfdd5e1e8e1764d7d636d7bcdd0aa4a2f33598115ad1b6d90d43596654f4f956f26ad6cfc6d47330bc0d2a57e8e1998b9fc6da570c117a643bb699091f80f5aff0c44f6bb875ef27e0d79fbfda8ca01763debfff8960002bc308202b830820221a003020102020100300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d0603 > > EAP-Message = > 0x5504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139313931355a170d3036313130323139313931355a304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f63696174657330819f300d06092a864886f70d010101050003818d0030818902818100c16d27eab105d0e179e6a58207dd1b7d0c1a5a64f761506275abebf495254f4e242f9d13926e56bfe0bb8d9130afca9287746c12c5eed4f0ae5233ecc412bba6693cf9fad4e1db0f > > EAP-Message = 0x4f4b39c0f47ed5293975a9448d479ca38fbddeef68e1 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xf608c3c340e7dcd273e77d1ca5afd315 > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=201, > length=147 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020300060d00 > State = 0xf608c3c340e7dcd273e77d1ca5afd315 > Message-Authenticator = 0x399bf08221ad337dec5353e34d1f3f9e > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 2 > modcall[authorize]: module "preprocess" returns ok for request 2 > modcall[authorize]: module "chap" returns noop for request 2 > modcall[authorize]: module "mschap" returns noop for request 2 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 2 > rlm_eap: EAP packet type response id 3 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 2 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 2 > modcall: group authorize returns updated for request 2 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 2 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 2 > modcall: group authenticate returns handled for request 2 > Sending Access-Challenge of id 201 to 192.168.100.4:1435 > EAP-Message = > 0x010401d10d80000005c709eeaeeb99893a248df35086a268947b61542d3988e761db738040976f08e84fd7830203010001a381a73081a4301d0603551d0e0416041400b41eff09bcce9ad9f1b04ba50419a7db44a7f030750603551d23046e306c801400b41eff09bcce9ad9f1b04ba50419a7db44a7f0a151a44f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573820100300c0603551d13040530030101ff300d06092a864886f70d010104050003818100b8ddea1e6f5851b78cca0feab23bd8 > > EAP-Message = > 0x9b7d268ab9250ccd7a7d720d6c2cf103477a6445773dca5be28fd44611b9e4a2a9a6331550fbad950e21fea1ff8e70a3d178c9d1ebf13b12cd80d6ce561be9699a922a722207d4950140bb0aeb3d8b3e22021a83c91948f1903b4eaedb66a1288837436871f1a57bda39f374a3fb8af28b160301005e0d0000560201020051004f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f6369617465730e000000 > > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x86870d983715d15f6919bdba762433c2 > Finished request 2 > Going to the next request > --- Walking the entire request list --- > Waking up in 5 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, id=202, > length=147 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020400060d00 > State = 0x86870d983715d15f6919bdba762433c2 > Message-Authenticator = 0xeda680bdf69e5dd588260e1c36169581 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 3 > modcall[authorize]: module "preprocess" returns ok for request 3 > modcall[authorize]: module "chap" returns noop for request 3 > modcall[authorize]: module "mschap" returns noop for request 3 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 3 > rlm_eap: EAP packet type response id 4 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 3 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 3 > modcall: group authorize returns updated for request 3 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 3 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 3 > modcall: group authenticate returns handled for request 3 > Sending Access-Challenge of id 202 to 192.168.100.4:1435 > EAP-Message = 0x0105000a0d8000000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x2b04eed7fe0be0ec28fbba826e52b47c > Finished request 3 > Going to the next request > --- Walking the entire request list --- > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 199 with timestamp 43696da6 > Cleaning up request 1 ID 200 with timestamp 43696da6 > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 2 ID 201 with timestamp 43696da7 > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 3 ID 202 with timestamp 43696da8 > Nothing to do. Sleeping until we see a request. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

1 0

SQL and MSSQL databases diference
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, here is another question. In the first case I'm using an mssql module to connect to my database and the "radiusd -X" command tell me something like this: radiusd -X ------------------- rlm_sql (mssql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (mssql): Attempting to connect to testmk@MSSQL-DB:/mk rlm_sql (mssql): starting 0 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (mssql): Connected new DB handle, #0 rlm_sql (mssql): starting 1 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (mssql): Connected new DB handle, #1 rlm_sql (mssql): starting 2 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (mssql): Connected new DB handle, #2 rlm_sql (mssql): starting 3 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (mssql): Connected new DB handle, #3 rlm_sql (mssql): starting 4 rlm_sql (mssql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (mssql): Connected new DB handle, #4 Module: Instantiated sql (mssql) ------------------------------ When I change the module to sql the answer is diferent: radiusd -X ------------------- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id ------------------------------ In this case I've this extra line: "rlm_sql_mysql: Starting connect to MySQL server for #1", that it is missing in the previous case. Is that corect or I've something missing in the configuration of the mssql module? Thanks!! NanO

1 0

MSSQL Querys -> No matching entry
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to make a simple authorization using the mssql module but when Radius execute all the querys "No matching entry..." is the answer. I'm completely sure that all the data store in my database is correct, but I always had the same responce: radiusd -X ------------------------- radius_xlat: '00:11:7C:00:01:57' rlm_sql (mssql): sql_set_user escaped user --> '00:11:7C:00:01:57' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:11:7C:00:01:57' ORDER BY id' rlm_sql (mssql): Reserving sql socket id: 4 query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:11:7C:00:01:57' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'usergroup'. ' rlm_sql_getvpdata: database query error radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:11:7C:00:01:57' ORDER BY id' query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:11:7C:00:01:57' ORDER BY id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'radreply'. ' rlm_sql_getvpdata: database query error radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:11:7C:00:01:57' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql_unixodbc: 'HY000 [unixODBC] Msg 208, Level 16, State 1, Server RELLIKII, Line 1 Invalid object name 'usergroup'. ' rlm_sql_getvpdata: database query error rlm_sql (mssql): No matching entry in the database for request from user [00:11:7C:00:01:57] rlm_sql (mssql): Released sql socket id: 4 modcall[authorize]: module "mssql" returns notfound for request 0 ------------------------------------ Is there something that I'm missing?!?! Thanks!! NanO

2 1

Re: FreeRadius using two SQL servers
by Dusty Doris 15 Nov '05

15 Nov '05

> what do you think if we try to use a Perl module inside of the autorize > section?!?!. I want the Perl module to decide between my two sql servers > depending of the incoming realm, I think this can be a possible way to > take. If you have any idea please let me know. Thanks!! That should work too. However, you can do this with Autz-Type, I am currently doing it right now, but using ldap instead of sql. Comment out your Autz-Type entries in your users file and try this. Actually, comment out all your entries if you're not on a production system. DEFAULT Realm == "wireless", Autz-Type := SQL1 DEFAULT Realm == "dhcp", Autz-Type := SQL2 Notice that the check item Realm == is first, then Autz-Type. Make sure your sql1.conf and sql2.conf files look like this at the top. sql1.conf sql sql1 { ... } sql2.conf sql sql2 { ... } Then give it a shot. If that does not work, try change it to add Auth-Type to the end. DEFAULT Realm == "dhcp", Autz-Type := SQL2, Auth-Type := Local If neither of those work for you, please post your debug again. Also, make sure to reply to all, so your replies go back to the list, not just me. -Dusty

2 1

detail files and accounting Alive packets
by Christopher Carver 15 Nov '05

15 Nov '05

Several NAS's we lease, whose configurations we cannot change, authenticate through our freeradius server. The Alive packets we are receiving from these machines are filling up our hard drive. Is there any way to deny just these Alive type packets and continue to accept Start and Stop packets? Everything I read seems to indicate this is impossible. Can someone please confirm or deny? Thanks

2 2

Accounting-Response
by Ruslan A Dautkhanov 15 Nov '05

15 Nov '05

Hello ! Short question ------------------ My FR 1.0 doesn't send Accounting-Response when sql module fail. Is it correct? I think it must always send response packets as an indication that acct packet just recieved. My NAS send acct-request packets in infinity loop until response pkt recived. Explanation --------------- Is it normal behaviour of FreeRADIUS when it does not send Accounting-Response packet to Accounting-Request? My sql module fails to insert data to DB because server due to different reasons send duplicated accounting-stop packet, and I have unique index on sessions table. We use Nomadix HSG as an our central access server for wireless connections. Nomadix send acct-request packets in infinity loop until response pkt recived. Radius debug ----------------- Tue Nov 15 12:40:33 2005 : Error: rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (WIFI.RADACCT_UNIQUEID) violated Tue Nov 15 12:40:33 2005 : Error: rlm_sql (sql): failed after re-connect Tue Nov 15 12:40:33 2005 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - ORA-00001: unique constraint (WIFI.RADACCT_UNIQUEID) violated Tue Nov 15 12:40:33 2005 : Debug: rlm_sql (sql): Released sql socket id: 1 Tue Nov 15 12:40:33 2005 : Debug: modsingle[accounting]: returned from sql (rlm_sql) for request 17 Tue Nov 15 12:40:33 2005 : Debug: modcall[accounting]: module "sql" returns fail for request 17 Tue Nov 15 12:40:33 2005 : Debug: modcall: group accounting returns fail for request 17 Tue Nov 15 12:40:33 2005 : Debug: Finished request 17 Tue Nov 15 12:40:33 2005 : Debug: Going to the next request Tue Nov 15 12:40:33 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:33 2005 : Debug: Waking up in 2 seconds... Tue Nov 15 12:40:35 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:35 2005 : Debug: Cleaning up request 14 ID 2 with timestamp 437974c7 Tue Nov 15 12:40:35 2005 : Debug: Waking up in 1 seconds... Tue Nov 15 12:40:36 2005 : Debug: --- Walking the entire request list --- Tue Nov 15 12:40:36 2005 : Debug: Cleaning up request 15 ID 6 with timestamp 437974c9 Tue Nov 15 12:40:36 2005 : Debug: Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 213.24.217.233:1025, id=8, length=162 Thanks a lot for your help -- Ruslan A Dautkhanov

2 1

Interaction between accounting data and radutmp
by TK Lew 15 Nov '05

15 Nov '05

hi all :: I have a weird problem. If I am not mistaken sessions are logged and remove on accouting-start and accouting-stop but I have encountered where an active session for a particular users have been deleted from the session database without the corresponding accounting stop packet. I am running Freeradius 1.0.4 on Solaris 9. Is there a problem with radutmp ?? My config file for radutmp under radiusd.conf :: =========================== radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = no # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } Thanks !

2 5

RE: Problem using exec module
by Mitchell, Michael J 15 Nov '05

15 Nov '05

Hi Nan0, The authorize section of radiusd.conf is actually run twice when an Access-Request is received by the server. The first time, Autz-Type is not set. During the first run through the authorize section, one of the modules may set Autz-Type, for example, a module may set Autz-Type to MY_AUTZ_TYPE. The second time through the authorize section only modules contained within the subsection defined by the Autz-Type variable will be run. eg: Autz-Type MY_AUTZ_TYPE { echo } Hope that helps, Mike > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 15 November 2005 8:38 AM > To: 'FreeRadius users mailing list' > Subject: Problem using exec module > > Hi, I'm trying to use the next exec module: > > radius.conf ------------------- > > modules { > exec { > wait = yes > input_pairs = request > } > exec echo { > wait = yes > program = "/bin/echo %{Autz-Type}" > input_pairs = request > output_pairs = reply > } > } > > authorize { > suffix > echo > files > sql > auth_log > } > > ------------------------------- > > > And the Radiusd gave me the next output: > > radiusd -X -------------------- > > WARNING: Attempt to use unknown xlat function, or > non-existent attribute in string %{Autz-Type} > radius_xlat: '/bin/echo ' > Exec-Program: /bin/echo > Exec-Program output: > Exec-Program-Wait: plaintext: > Exec-Program: returned: 0 > > ------------------------------- > > > I hope someone can help me. Thanks and bye, > > > NanO > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Problem using exec module
by Fernando Brito 15 Nov '05

15 Nov '05

Hi, I'm trying to use the next exec module: radius.conf ------------------- modules { exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{Autz-Type}" input_pairs = request output_pairs = reply } } authorize { suffix echo files sql auth_log } ------------------------------- And the Radiusd gave me the next output: radiusd -X -------------------- WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Autz-Type} radius_xlat: '/bin/echo ' Exec-Program: /bin/echo Exec-Program output: Exec-Program-Wait: plaintext: Exec-Program: returned: 0 ------------------------------- I hope someone can help me. Thanks and bye, NanO

2 2