- Freeradius-Users - lists.freeradius.org

No updates with radiusd log
by john＠jetcityorange.com 05 Oct '05

05 Oct '05

Hello, I've tried multiple sources and websites to no avail. I've set up FreeRadius 1.0.4 successfully. I've generated local certs also. We've tested accessing the FreeRadius server with Windows XP SP2 locally over the local access point. When we attempt to access the FreeRadius server via a remote AP, the radiusd log shows nothing. No attempt, nothing. Yet the XP client shows a 'validating identity' message. However, I see nothing in the logs to debug. Accounts are set to local authentication via EAP-TLS. Any ideas? I'd be happy to send a conf file if anyone would like. Thanks much!! John

2 1

expr in SQL no working
by Gunther 04 Oct '05

04 Oct '05

I am running Fedora FC4 with FR 1.0.4 (yum updated) with MySQL 4.1.12. I am trying to use in rad_reply table for Session-Timeout with the following value: `%{expr: %{sql:SELECT IF(NOW() <= user_stoptime, (TIME_TO_SEC(TIMEDIFF(user_stoptime, IF(NOW() >= user_starttime, now(), DATE_SUB(user_stoptime, INTERVAL 1 SECOND))))), 1) FROM phs_user WHERE user_username='%{User-Name}'}}` This doesn't work as the Session-Timeout value is not assigned. The sql statement alone works fine and returns the correct value. I then tried to get a simple expression up and running in rad_reply: Attr Op Value Session-Timeout = `%{expr:3600 - 300}` No success. In debug mode I can see that the expr module is loaded: Module: Loaded expr Module: Instantiated expr (expr) I then compiled and installed 1.0.5 ... with the same result. Then I created a user in the ./raddb/users file and assigned the Session-Timeout with above SQL statement and it works fine. What is wrong getting the Session-Timeout from the rad_reply table? When I assign a fixed value, e.g. 3500 in the sql row, it works fine. Anything with MySQL collation maybe? I changed it to different languages ... no success. This is the debug output when I use the users file, when using sql, I do not get this. Debug: rlm_sql (sql): - sql_xlat Debug: radius_xlat: 'gunther' Debug: rlm_sql (sql): sql_set_user escaped user --> 'gunther' Debug: radius_xlat: 'SELECT IF(NOW() <= user_stoptime, TIME_TO_SEC(TIMEDIFF(user_stoptime, IF(NOW() >= user_starttime, now(), DATE_SUB(user_stoptime, INTERVAL 1 SECOND)))), 1) FROM phs_user WHERE user_username='gunther4'' Debug: radius_xlat: '/var/log/radius/sqltrace.sql' Debug: rlm_sql (sql): Reserving sql socket id: 2 Debug: rlm_sql_mysql: query: SELECT IF(NOW() <= user_stoptime, TIME_TO_SEC(TIMEDIFF(user_stoptime, IF(NOW() >= user_starttime, now(), DATE_SUB(user_stoptime, INTERVAL 1 SECOND)))), 1) FROM phs_user WHERE user_username='gunther4' Debug: rlm_sql (sql): - sql_xlat finished Debug: rlm_sql (sql): Released sql socket id: 2 Debug: radius_xlat: ' 1' Debug: radius_xlat: '1' When I use the sql table, sql_xlat is not in the debug output. Gunther

3 6

What's Up Gold and Freeradius
by Linda Pagillo 04 Oct '05

04 Oct '05

Hi everyone: I'm using Ipswitch's What's Up Gold to monitor my network. I have it set to notify me when certain things in my network go down etc... I have it set to monitor Freeradius. I put an entry into my clients.conf file to give the What's Up Gold computer access to send a request to Freeradius. Here is what's happening... my What's Up Gold keeps telling me that my Freeradius is down when indeed it's not. I'm guessing that when a request gets sent from What's Up Gold to Freeradius, it is not getting there or something. I checked my radius logs and here is an example of an entry i get when What's Up Gold sends a request to Freeradius... Mon Oct 3 10:22:44 2005 : Auth: Login incorrect: [TEST/L\200\212\3101\215\277&\320\350\345\373\351\201\031\215] (from client old port 0) I don't know if the above will help any, but i thought i should include it in this post. Also, this problem does not always happen. It's kind of sporradic. There are lots of times when What's Up Gold sends a request to Freeradius and i get no errors. My worry is this... are my customers having to dial up several times before getting connected? Since Freeradius won't accept all requests from What's Up Gold, who's to say that it is accepting dial in requests from all of my customers all of the time? Any help or insight would be very much appreciated. Thanks! Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

4 7

pam_radius_auth threading issues
by Rich Graves 04 Oct '05

04 Oct '05

I've inherited a setup with authentication information on a local freeradius 1.0.5 server and OpenLDAP (with pthreads) configured to authenticate to SASL (v1 interface), which in turn uses PAM, which in turn is configured to check passwords with pam_radius_auth 1.3.16. All of this is on Linux RHEL3. This setup regularly fails under any sort of concurrency. Threading issues seem one likely reason. pam_radius_auth.c hasn't been touched in a while and hasn't had the same attention to thread safety as the core freeradius code. Has anyone else been down the road of cleaning up the calls to gethostbyname, variable scoping, etc? I know enough to recognize the problem, but don't really trust myself to fix it. Obvious workarounds for me include switching from SASL1/PAM to SASL2 and saslauthd; de-threading OpenLDAP (ick); or migrating the authoritative password store out of Radius entirely. But all of these have performance or operational issues here. I'd really like to get pam_radius_auth working as my predecessors (wrongly) thought it would.

2 3

Radius server configuration for challenge messages
by Nagaraj Venkatapuram 04 Oct '05

04 Oct '05

Hi, Does any body has any idea how to configure radius server to generate challenge messages per user per radius client ? I could not find any documentation on freeradius website regarding the same. Please let me know. Regards, N

2 1

FreeRADIUS - FreeBSD - Segmentation fault
by Christian Meutes 04 Oct '05

04 Oct '05

Hi Alan and others, are there any new findings in context to the problem with FreeRADIUS(rlm_sql_mysql?) > 1.0.4 under FreeBSD? I have just tested it with FreeBSD5.4-Release and FreeRADIUS out of the ports and the problem still exists: --- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@127.0.0.1:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Segmentation fault (core dumped) --- > "Thomas Krause (Webmatic)" <tk(a)webmatic.de> wrote: >> I tried both, version 1.0.4 (from ports) and 1.0.5 - and both crashed. >> Also I tried with mysql 4.0.26 with the same result. > > It looks like the bug exists *only* on FreeBSD. For the life of me, > I can't figure out why. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > Christian Meutes systems engineer -- claranet gmbh internet service provider tel +49 (0) 69 - 40 80 18 - 300 email: christian.meutes(a)de.clara.net http://www.claranet.de/

3 3

freeradius and MS SQL -- anyone got it working?
by Arne Götje (高盛華) 04 Oct '05

04 Oct '05

Hi list, What is the status of MS SQL support for freeradius? Did anyone get it working? And if yes, which version do you use and what is required to get it work? I'm currently using freeradius 1.0.2 on Debian Sarge and I didn't manage to get it connect to the MS SQL server. As the rlm_sql_freetds module states that it is under development ans so, not enabled by default, I was wondering, if the iODBC or the unixodbc modules would work and if yes, how to set this up (aside from freeradius.. seems the 'drivers' are missing, whatever this means). Need some help here. Anyone? Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

4 7

RE: MSCHAPv2, MySQL, Freeradius
by Dan Russell 04 Oct '05

04 Oct '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: Tuesday, 4 October 2005 3:17 PM > To: FreeRadius users mailing list > Subject: Re: MSCHAPv2, MySQL, Freeradius > > "Dan Russell" <dan(a)in-house.com.au> wrote: > > > Because you put it into the NT-Password attribute, instead of the > > > User-Password attribute. > > > > Okay, I've tried that and not found it to work for me. > > Sorry, it *does* work. Since you didn't provide any debug logs or > config examples, I can only suggest that you probably did it wrong. > Hey, I'm not having a go at you, I believe it does work, I'm just having issue getting it working.. Here is the log of someone attempting to log in : rad_recv: Access-Request packet from host x.x.x.x:32775, id=33, length=177 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 422 NAS-Port-Type = Ethernet User-Name = "wolfer" Calling-Station-Id = "00:50:FC:68:E6:32" NAS-Port-Id = "ether2" MS-CHAP-Challenge = 0x700b1e514cb6628c25441cb76ce17109 MS-CHAP2-Response = 0x010051c12db8db344c7c72d03bda36fd556d000000000000000076fb28d715a538d4ae 05b012cd5edb6e86ee71d8f6d6bbc0 NAS-Identifier = "NAS" NAS-IP-Address = x.x.x.x Tue Oct 4 15:10:39 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group authorize for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "preprocess" returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "chap" returns noop for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 5 Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'wolfer' Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'wolfer' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wolfer' ORDER BY id' Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wolfer' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wolfer' ORDER BY id' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wolfer' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the database for request from user [wolfer] Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "sql" returns notfound for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "mschap" returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall: group authorize returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: rad_check_password: Found Auth-Type MS-CHAP Tue Oct 4 15:10:39 2005 : Debug: auth: type "MS-CHAP" Tue Oct 4 15:10:39 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group Auth-Type for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for wolfer with NT-Password Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authenticate]: module "mschap" returns reject for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall: group Auth-Type returns reject for request 5 Tue Oct 4 15:10:39 2005 : Debug: auth: Failed to validate the user. Tue Oct 4 15:10:39 2005 : Auth: Login incorrect: [wolfer/<no User-Password attribute>] (from client build port 422 cli 00:50:FC:68:E6:32) Tue Oct 4 15:10:39 2005 : Debug: Delaying request 5 for 1 seconds Tue Oct 4 15:10:39 2005 : Debug: Finished request 5 Tue Oct 4 15:10:39 2005 : Debug: Going to the next request Tue Oct 4 15:10:39 2005 : Debug: --- Walking the entire request list --- Tue Oct 4 15:10:39 2005 : Debug: Waking up in 1 seconds... Tue Oct 4 15:10:40 2005 : Debug: --- Walking the entire request list --- Tue Oct 4 15:10:40 2005 : Debug: Waking up in 1 seconds... rad_recv: Access-Request packet from host x.x.x.x:32775, id=33, length=177 Sending Access-Reject of id 33 to x.x.x.x:32775 Here is a snippet of the radcheck table : ID UserName Attribute op Value 25 wolfer SMB-Account-CTRL == 16 27 wolfer NT-Password == 0x47C8F8E50C470E37AAD3B435B51404EE Any help? Thanks for any help in advance, Daniel Russell > > It tries to get the 'User-Password' attribute first (which it fails on, > > I don't have one), then it tried to get the 'LM-Password' attribute > > which it also fails on. After dealing with that it tries the same thing > > with 'NT-Password'. For some reason it isn't pulling these attributes > > out of mysql.. > > Read the debug log. It will tell you what it *is* getting from MySQL. > > > After looking at the debug output from freeradius, the sql statement > > that it executes when it receives an authentication request should > > return the LM-Password and NT-Password. > > Does it return those attributes when you run the query by hand? > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

rlm_eap(peap):unknown error
by Kouji Amemiya 04 Oct '05

04 Oct '05

Hi, I am using FreeRADIUS-1.0.5 under cygwin. I used "./configure --without-snmp --disable-shared --enable-static" option. I started "radiusd -f -X", "unknown error" occured. Log and eap.conf are shown below. $ radiusd -f -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/etc/raddb/newcerts/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/newcerts/serverkey.pem" tls: certificate_file = "/usr/local/etc/raddb/newcerts/servercert.pem" tls: CA_file = "/usr/local/etc/raddb/newcerts/cacert.pem" tls: private_key_password = "bbbb" tls: dh_file = "/usr/local/etc/raddb/newcerts/dh" tls: random_file = "/usr/local/etc/raddb/newcerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: Failed to link EAP-Type/peap: unknown error radiusd.conf[9]: eap: Module instantiation failed. //////////////////// // eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = bbbb private_key_file = ${raddbdir}/newcerts/serverkey.pem certificate_file = ${raddbdir}/newcerts/servercert.pem CA_file = ${raddbdir}/newcerts/cacert.pem dh_file = ${raddbdir}/newcerts/dh random_file = ${raddbdir}/newcerts/random CA_path = ${raddbdir}/newcerts/ } peap { default_eap_type = mschapv2 } mschapv2 { } } However, "radiusd -f -X" is successful when "default_eap_type = peap" is changed into "default_eap_type = md5" and "peap" secion is commented out. If some may be understood, please let me know. Best Regards.

2 1

Postgresql+freeradius configuration
by msah＠otitelecom.bj 04 Oct '05

04 Oct '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. Please help me.

4 3