- Freeradius-Users - lists.freeradius.org

MSCHAPv2, MySQL, Freeradius
by Dan Russell 30 Sep '05

30 Sep '05

Hi, Is there a way in which I can have encrypted passwords in the mysql database and use MSCHAPv2 to authenticate users? If I used a third party tool like mkntpwd to create NT Hashes, could I put premade hashes in the database and use them to authenticate or would rlm_mschap encrypt the password attribute anyway? Thanks in advance for any help you can offer, Daniel Russell Lead Technician In-House IT Services PH (03) 50210044 FX (03) 50210066

2 1

RE: Proxy of accounting message
by Ashwin Gobind 30 Sep '05

30 Sep '05

Thanks nick. However when I proxy the message, the message-authenticator field has an <INVAILID TOKEN> (see trace below). Why is this Sending Accounting-Request of id 1 to 10.113.46.170:1813 Acct-Status-Type = Start Service-Type = Framed-User Called-Station-Id = "vlive" Framed-Protocol = GPRS-PDP-Context Framed-Protocol = GPRS-PDP-Context Acct-Delay-Time = 5 Calling-Station-Id = "27829800729" NAS-Identifier = "GMC-GGSN0-13-2" Acct-Session-Id = "20050529" User-Name = "27829800729" User-Name = "27829800729" NAS-Port = 6000 NAS-Port-Type = Virtual NAS-IP-Address = 10.111.14.46 Message-Authenticator <INVALID-TOKEN> 0x00000000000000000000000000000000 Proxy-State = 0x30 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

Re: SSL3_GET_CLIENT_KEY_EXCHANGE
by Juan Daniel Moreno 30 Sep '05

30 Sep '05

>Juan Daniel Moreno <juanitomoreno(a)gmail.com> wrote: >> Thank you Alan, but now I have a new problem. I have been reading the >> src/modules/rlm_eap/ to understand my problem but I don't find the >> issue. In TLS establishment, the public key in the server.cert is 128 >> bytes length. I generate a random string of 46 bytes and the protocol >> version (TLS 1.0 (0x03, 0x01)) and I use the SSL function >> RSA_public_encrypt() with server's public key to encrypt the >> PreMasterSecret. As a result I get a 128 length string. As I send this >> data to the server, I get a "tls rsa encrypted length is wrong: >> s3_srvr.c: 1450:" > I have no idea what the problem is, sorry. >Alan DeKok. Can you please tell me the client's exchange packet form the server is attempting? How is it calculated? Or, can you show me a typical byte suite from this message? (I hope you understand me) Tank you. Juan Daniel MORENO

2 1

RE: Proxy accounting message
by Ashwin Gobind 30 Sep '05

30 Sep '05

But doesn't this mean there has to be a realm in the username eg name@realm1 The problem is the user-name attribute does not contain a realm. Is it still possible to proxy the accounting start and stop messages originating from as certain NAS-IP-ADDRESS. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 29 September 2005 06:22 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 5, Issue 98 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Proxy of Accounting Requests (Ashwin Gobind) 2. Re: Proxy of Accounting Requests (Nicolas Baradakis) 3. RE: Proxy of Accounting Requests (Jonathan De Graeve) 4. Re: LDAP and groups (Dusty Doris) 5. Re: LDAP and groups (Kenneth Grady) 6. Re: SSL3_GET_CLIENT_KEY_EXCHANGE (Juan Daniel Moreno) 7. (no subject) (msah(a)otitelecom.bj) 8. Postgresql+freeradius configuration (msah(a)otitelecom.bj) ---------------------------------------------------------------------- Message: 1 Date: Thu, 29 Sep 2005 12:18:37 +0200 From: "Ashwin Gobind" <Ashwin.Gobind(a)vodacom.co.za> Subject: Proxy of Accounting Requests To: <freeradius-users(a)lists.freeradius.org> Message-ID: <753BF83740BB6C48BF8A15B5C61C88470BB847D7(a)zamdc02100.vodacom.corp> Content-Type: text/plain; charset="us-ascii" Good day. I am using freeradius 1.05 I want to proxy accounting requests originating from certain hosts to another server, how can I do this. Also I am using Jradius to handle accounting request. But this certain request I don't want JRadius to handle, but freeradius just to proxy it. Here is an example of the request Thanks Acct-Session-Id = C42EA2A31F96530 Framed-Protocol = GPRS-PDP-Context Called-Station-Id = vlive Calling-Station-Id = 27829800529 Framed-IP-Address = 10.19.128.6 3GPP-IMSI = 655019800002252 3GPP-Charging-ID = 33121584 3GPP-PDP-Type = 0 3GPP-GGSN-Address = 196.46.162.163 3GPP-IMSI-MCC-MNC = 65501 3GPP-GGSN-MCC-MNC = 65501 3GPP-NSAPI = 5 3GPP-Selection-Mode = 0 3GPP-Charging-Gateway-Address = 10.25.0.10 3GPP-GPRS-Negotiated-QoS-profile = 99-23931F9396979774FB0808 3GPP-SGSN-Address = 196.6.254.49 User-Name = 27829800529 Cisco-AVPair = connect-progress=Call Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Virtual Cisco-NAS-Port = GGSN NAS-Port = 60000 Class = [Binary Data] Service-Type = Framed-User NAS-IP-Address = 10.31.1.122 NAS-Identifier = GMC-GGSN0-12-2 Acct-Delay-Time = 0 Client-IP-Address = 10.113.60.6 Acct-Unique-Session-Id = b30a3d4d494c8a87 "This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx " ------------------------------ Message: 2 Date: Thu, 29 Sep 2005 13:55:16 +0200 From: Nicolas Baradakis <nbk(a)sitadelle.com> Subject: Re: Proxy of Accounting Requests To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050929115516.GA2365(a)asuka.tech.sitadelle.com> Content-Type: text/plain; charset=us-ascii Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis ------------------------------ Message: 3 Date: Thu, 29 Sep 2005 15:56:33 +0200 From: "Jonathan De Graeve" <Jonathan.De.Graeve(a)imelda.be> Subject: RE: Proxy of Accounting Requests To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <FFA36DAA4D9D62438D6DD1947C631316073263(a)exchangesrv.imz.be> Content-Type: text/plain; charset="us-ascii" Can you also do this in SQL? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Nicolas Baradakis Verzonden: donderdag 29 september 2005 13:55 Aan: FreeRadius users mailing list Onderwerp: Re: Proxy of Accounting Requests Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Thu, 29 Sep 2005 10:06:30 -0400 (EDT) From: Dusty Doris <freeradius(a)mail.doris.cc> Subject: Re: LDAP and groups To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050929100414.M98082(a)mail.doris.name> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > Hello there, > > I have a small problem. And I read the documentation. And I can't find > what's wrong. > > I have a corporate LDAP with users and group. > > Each group is a "groupOfUniqueNames", with "uniquemember". > In the user defintion, no group definition is set. > > I need to authenticate members of a certain groups, and not of another ... > > Every doc I read mention that you have to create an attribute "per user" ... > > Any other way ? > I chose to do groups per user with radiusgroupname attribute, which is in the ldap_howto. However, you don't have to do it that way. Try reading radiusd.conf in the ldap section under the default groupmembership_filter. Or reading doc/rlm_ldap. If you are trying that and not having success, then post your debug output. ------------------------------ Message: 5 Date: Thu, 29 Sep 2005 08:11:27 -0600 From: Kenneth Grady <klg(a)lanl.gov> Subject: Re: LDAP and groups To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1128003087.27966.29.camel(a)grady.lanl.gov> Content-Type: text/plain ldapsearch -x cn=my_group # # filter: cn=my_group # requesting: ALL # # my_group, group, lanl, gov dn: cn=my_group,ou=group,dc=lanl,dc=gov objectClass: groupOfNames cn: my_group member: employeeNumber=0067,ou=people,dc=lanl,dc=gov member: employeeNumber=0068,ou=people,dc=lanl,dc=gov ... ---------------------------------- radiusd.conf (file) ...modules ldap My-group_Users { server = "ldap" net_timeout = 1 timeout = 3 timelimit = 4 ldap_connections_number = 5 basedn = "dc=lanl,dc=gov" #access_attr = "employeeNumber" filter = "(&(cn=my-group)(member=employeeNumber=%{Stripped-User-Name:-%{User-Name }},ou=people,dc=lanl,dc=gov))" start_tls = no groupname_attribute = cn groupmembership_filter = "" groupmembership_attribute = my_group dictionary_mapping = ${raddbdir}/ldap.attrmap compare_check_items = yes access_attr_used_for_allow = yes } ... authorize Autz-Type MY-GROUP { redundant { My-group_Users notfound = reject } } ---------------------------------- users (file) ... DEFAULT NAS-IP-Address =~ "^123.123", Autz-Type := MY-GROUP There's probably a better way, but this worked for what I wanted. On Thu, 2005-09-29 at 03:10, Jean-Francois Gobin wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello there, > > I have a small problem. And I read the documentation. And I can't find > what's wrong. > > I have a corporate LDAP with users and group. > > Each group is a "groupOfUniqueNames", with "uniquemember". > In the user defintion, no group definition is set. > > I need to authenticate members of a certain groups, and not of another ... > > Every doc I read mention that you have to create an attribute "per user" > ... > > Any other way ? > > Regards, > Jean-Francois Gobin > > - ---------- > Jean-Francois Gobin - Administrateur gobinjf.be > http://www.gobinjf.be mailto:gobin@gobinjf.be > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (FreeBSD) > Comment: Made with pgp4pine 1.76 > > iD8DBQFDO6+pkkg3QInH2uURAkoTAJ9CiiYoljx0B2zP/tInkSG4TwiwIgCbBWft > g16kNx6wUzO1va189DJmHRA= > =kTQn > -----END PGP SIGNATURE----- > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 6 Date: Thu, 29 Sep 2005 16:22:12 +0200 From: Juan Daniel Moreno <juanitomoreno(a)gmail.com> Subject: Re: SSL3_GET_CLIENT_KEY_EXCHANGE To: freeradius-users(a)lists.freeradius.org Message-ID: <2e33d53305092907226e2de3a4(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 > > The protocol specification describes this. The implementation in > src/modules/rlm_eap/ contains diagrams of the packets it expects to > receive. > > Alan DeKok. > > Thank you Alan, but now I have a new problem. I have been reading the src/modules/rlm_eap/ to understand my problem but I don't find the issue. In TLS establishment, the public key in the server.cert is 128 bytes length. I generate a random string of 46 bytes and the protocol version (TLS 1.0 (0x03, 0x01)) and I use the SSL function RSA_public_encrypt() with server's public key to encrypt the PreMasterSecret. As a result I get a 128 length string. As I send this data to the server, I get a "tls rsa encrypted length is wrong: s3_srvr.c: 1450:" Can anybody please tell me where can be my problem? Here is my code for exemple. void Client_Key_Exchange (SSLData *ClientSSLData, unsigned short *length, char *HandshakeMessages, unsigned short *length_Hndshk, char *buff) { char *PreMasterSecret = (char*) _MEMORY_Allocate (58 , true); char *EncryptedPreMasterSecret = (char*) _MEMORY_Allocate (128, true); char *temp = (char*) _MEMORY_Allocate (58 , true); unsigned char *tmpCert = _MEMORY_Allocate (ClientSSLData->certificate_len + 128, true); _RANDOM_MakeCharString (temp, 46); PreMasterSecret [0] = 0x03; PreMasterSecret [1] = 0x01; for (register int i = 0; i<46; i++) { PreMasterSecret[i+2] = temp [i]; ClientSSLData->PreMasterSecret[i] = PreMasterSecret[i]; } for (i = 0; i < ClientSSLData->certificate_len; i++) tmpCert[i] =(unsigned char) ClientSSLData->certificate[i]; //----- OpenSSL Functions ----- RSA *server_public_key; X509 *cert = X509_new (); EVP_PKEY *evp = EVP_PKEY_new (); X509 *err = d2i_X509 (&cert, (unsigned char**) &tmpCert, (ClientSSLData->certificate_len) ); //----- d2i_509 Function retrives tmpCert pointer advanced the number of bytes read ----- tmpCert = tmpCert - (ClientSSLData->certificate_len); //----- We get the public key from the Server certificate ----- evp = X509_get_pubkey(cert); server_public_key = (RSA *) evp->pkey.ptr; int rsasize = RSA_size(server_public_key); //----- We get the PreMasterSecret encrypted ----- int Encrypted_len = RSA_public_encrypt(48, (BYTE*) PreMasterSecret, (unsigned char*)EncryptedPreMasterSecret, server_public_key, RSA_PKCS1_PADDING); ClientSSLData->bufferSSL[(*length)++] = 0x16; // Handshake Message ClientSSLData->bufferSSL[(*length)++] = 0x03; // Version ClientSSLData->bufferSSL[(*length)++] = 0x01; // Version ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) % 256; // Length ClientSSLData->bufferSSL[(*length)++] = 0x10; // Client key exchange ClientSSLData->bufferSSL[(*length)++] = 0x00; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) % 256; // Length //----- Public key exchange ----- for (i = 0; i < Encrypted_len; i++) { buff[i] = EncryptedPreMasterSecret[i]; HandshakeMessages[(*length_Hndshk)++] = EncryptedPreMasterSecret[i]; } free (PreMasterSecret); free (EncryptedPreMasterSecret); free (temp); free (tmpCert); } Thank you for your help. Juan Daniel MORENO ------------------------------ Message: 7 Date: Thu, 29 Sep 2005 16:59:00 +0100 From: msah(a)otitelecom.bj Subject: (no subject) Cc: freeradius-users(a)lists.freeradius.org Message-ID: <20050929165900.j5qtkf92v5cso808(a)webmail.otitelecom.bj> Content-Type: text/plain; charset=ISO-8859-1 Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance. ------------------------------ Message: 8 Date: Thu, 29 Sep 2005 17:00:47 +0100 From: msah(a)otitelecom.bj Subject: Postgresql+freeradius configuration To: freeradius-users(a)lists.freeradius.org Message-ID: <20050929170047.yclw6uck1huss8g0(a)webmail.otitelecom.bj> Content-Type: text/plain; charset=ISO-8859-1 Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 5, Issue 98 *********************************************** �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

radiusd TLS error
by Riccardo Veraldi 30 Sep '05

30 Sep '05

Hello, my users authenticate with EAP-TLS and everything is working fine, but I Always have errors like this in hte log file Fri Sep 30 10:45:33 2005 : Error: TLS_accept:error in SSLv3 read client certificate A what could it be related to ? thanks Rick

1 0

Unexpected Accounting Response
by Giuseppe 30 Sep '05

30 Sep '05

Hi. I'm configuring the radius server so that no duplicate Calling-Station-Id values are found in the DB I'm logging to (Oracle), which is the only destination I'm logging onto (not even "detail"). The quickest way I thought of was to add a unique index to the RADACCT table so that any Accounting Start for a Calling-Station-Id already present in the DB would fail. Indeed I can see through the server log (started with -X) that the INSERT statement fails because it attempts to violate the unique constraint: ------ rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated ------ However, just a few lines below I see: ------ modcall[accounting]: module "sql" returns ok for request 0 ------ which probably is the root cause of unexpected (to me): ------ Sending Accounting-Response of id 241 to XXX.XXX.XXX.XXX:33863 ------ This Accounting Response is unexpected to me because RFC 2866 says: "If the RADIUS accounting server is unable to successfully record the accounting packet it MUST NOT send an Accounting-Response acknowledgment to the client". Any help ? Thanks in advance Giuseppe P.S. Here there's the whole log section related to the request processing that raises the above issue: --------- rad_recv: Accounting-Request packet from host XXX.XXX.XXX.XX:33863, id=241, length=92 User-Name = "testuser" User-Password = "\001\272O\257UN\214\307\245\333%\261 <\020d" Acct-Status-Type = Start Calling-Station-Id = "393480000000" Framed-IP-Address = XXX.XXX.XXX.XX Acct-Session-Id = "c16a444a16927797" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = XXX.XXX.XXX.XXX,NAS-IP-Address = XXX.XXX.XXX.XXX,Acct-Session-Id = "c16a444a16927797",User-Name = "testuser"' rlm_acct_unique: Acct-Unique-Session-ID = "aecc66663df0011c". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: group preacct returns ok for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XXX', '', '0')' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 4 INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XXX', '', '0') rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XX', '', '0') rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated radius_xlat: '' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 0 modcall: group accounting returns ok for request 0 Sending Accounting-Response of id 241 to XXX.XXX.XXX.XX:33863 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 241 with timestamp 433b0133 Nothing to do. Sleeping until we see a request. -------------

2 2

Freeradius + EAP-TLS + DHCP = not working. Help!
by AIbarra＠mex.boehringer-ingelheim.com 30 Sep '05

30 Sep '05

I have the same problem do you have any solution? Saludos Alberto Ibarrarán G. Information Technology Boehringer Ingelheim Promeco (52) 55 56 29 8300 ext. 8631

2 1

how to config radiusclient!
by zhangshuai 30 Sep '05

30 Sep '05

Dear all, I wish to use softphone X-lite on SER and radius in db_mode. When I installed both freeradius 1.0.4 and radiusclient 0.4.3 on the same server which ser 0.8.14 has installed on, I could log in X-lite through radius authorization. And now I want radiusclient (on server A) to send the request to a remote radius server (on server B) to realize authorization. I have changed those config files: /usr/local/etc/radiusclient/servers, /usr/local/etc/radiusclient/radiusclient.conf and /usr/local/etc/raddb/clients.conf as the document (http://www.iptel.org/ser/doc/ser_radius/ser_radius.html#AEN193) did. Then I test the radius server as the above document said on server A: radclient -f digest server B auth testing123 and I received expected replied message from server B. But when I log in x-lite (UA), there are error messages: Sep 29 17:11:06 localhost ser[4408]: rc_ip_hostname: couldn't look up host by addr: DA61FC29 Sep 29 17:11:06 localhost ser[4408]: rc_send_server: no reply from RADIUS server unknown:1812 And the number "DA61FC29" is exactly the hexadecimal value of the ip address of radius server. How come? Did I mis-config anything? Many thanks for your reply! Shuai http://www.goldentek.biz

1 0

PEAP and ntlm_auth
by Dick 29 Sep '05

29 Sep '05

Hi all, I've got a small problem with FreeRadius, I'm trying to forward NTLM authentication to a NT domain by using ntlm_auth but the %{Stripped-User-Name} is empty. I've enabled ntdomain in authorize { } and preacct { }, but it doesn't seem to translate "%{User-name}" as "NTCORP01\\USER" to "%{Stripped-User-Name}" as"USER". When I use "ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=USER" it works (but only for USER ;-)). with_ntdomain_hack in preprocess { } it breaks PEAP (as mentioned earlier on this list). Should I create a wrapper script for ntlm_auth (to strip the %{User-name}) as a workaround or can I use another FreeRadius trick? Thanks, Dick

1 0

setting password from an application
by Nagaraj Venkatapuram 29 Sep '05

29 Sep '05

All, I am having a problem setting password from the http application. It is getting reset to NULL inside pam_authenticate somehow. The only place I can see password is set to NULL is in the function *void _pam_sanitize(pam_handle_t *pamh)* in pam_misc.c file. I've also commented out the invocation of _pam_sanitize from pam api. Also I have syslog trace in the *pam_sanitize *function. However, for some reason I am losing the password inside pam_authenticate inspite of all the changes and also I don't see any trace from the function *pam_sanitize. *If anybody has any idea about this, please reply. retval = pam_start("http", auth_userpass, &conv, &pamh); syslog(LOG_INFO, "before pam_set_item..........................\n"); pam_set_item(pamh, PAM_AUTHTOK, pwd); if (retval == PAM_SUCCESS) { retval = pam_authenticate(pamh, 0); /* is user really user? */ } else { syslog(LOG_INFO, "--Not authenticated - pam start failed\n"); } /* This is where we have been authorized or not. */ if (retval == PAM_SUCCESS) { syslog(LOG_INFO, "Authentication successful for %s from %s\n", auth_userpass, req->remote_ip_addr); strncpy(req->user, auth_userpass, 15); req->user[15] = '\0'; if (pam_end(pamh,retval) != PAM_SUCCESS) { /* close Linux-PAM */ pamh = NULL; syslog(LOG_ERR, "http: failed to release pam authenticator\n"); } return 1; } Thanks, N

1 0