- Freeradius-Users - lists.freeradius.org

eap/ttls - hangs after initializing gtc
by Lohfink, Chris N 24 Aug '05

24 Aug '05

Hello, Im tring to get eap/ttls working on ubuntu(5.04) but when i istalled from apt-get im missing the shared libraries so i just decided to try compiling myself. After some work i got it with ./configure --without-rlm_x99_token --disable-shared --sysconfdir=/etc/ && make && make install I configured it as i was told at http://www.alphacore.net/spipen/article.php3?id_article=4 but im getting the following output running radiusd root@Anakin:/etc/raddb # radiusd -sfxxz -l stdout & [1] 29023 root@Anakin:/etc/raddb # Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc//raddb/proxy.conf Config: including file: /etc//raddb/clients.conf Config: including file: /etc//raddb/snmp.conf Config: including file: /etc//raddb/eap.conf Config: including file: /etc//raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc The program just hangs there where im assuming its doing something with tls' rsa keys? before i used --disable-shared it went down in same spot while looking for the tls shared libraries so im unsure if it has to do with that. any help or references as to where i can look to try to get past this would be greatly appreciated. Thanks, Chris

2 1

Re: MySQL radacct not updated
by sean 24 Aug '05

24 Aug '05

Hi Thor, Once again thanks for your help. I'm sorry but I don't understand your answer. Can you explain the debug of an accounting packet? Do you mean something like an Ethereal trace? How do I do a tcp dump on the Radius server. Regards, Sean

2 1

Re: MySQL radacct not updated (Thor Spruyt)
by sean 24 Aug '05

24 Aug '05

Hi Thor, Thanks for the reply. The NAS is a Linksys WRT-54G running DD-WRT firmware. I have made no changes to the NAS configuration and up to a while ago the radacct file was being updated. I suspect that the problem is either in radiued.conf, sql.conf or the MySQL access rights. I have noticed that by inserting sql in the post-auth section of radiusd.conf it updates the radpostauth part of the database. Is there a part of radiusd.conf that needs to be changed to do the the same for radacct? Below is the output when Radius starts up. I'm sorry to fill the post with so much info but if you look at the SQL part of the startup it seems OK. Can you spot anything wrong? Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter sqlcounter: counter-name = "Max-All-Session-Time" sqlcounter: check-name = "Max-All-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" sqlcounter: reset = "never" rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 1671 rlm_sqlcounter: Check attribute Max-All-Session is number 1672 rlm_sqlcounter: Current Time: 1124906492 [2005-08-24 18:01:32], Next reset 0 [2005-08-24 18:00:00] rlm_sqlcounter: Current Time: 1124906492 [2005-08-24 18:01:32], Prev reset 0 [2005-08-24 18:00:00] Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "radius" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct- Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct- Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('% {Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '% {Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input- Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling- Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '% S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '% {Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '% {Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '% {Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct- Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct- Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay- Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate- Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '% {reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client- IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 300 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Initializing the thread pool... thread: start_servers = 5 thread: max_servers = 32 thread: min_spare_servers = 3 thread: max_spare_servers = 10 thread: max_requests_per_server = 0 thread: cleanup_delay = 5 Thread 1 waiting to be assigned a request Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Regards, Sean

2 1

FreeRadius crashing
by Paul Khavkine 24 Aug '05

24 Aug '05

Hi Guys. I have FreeRadius 1.0.4 all of a sudden crash end exit. I have enabled core dumps but cannot find the core file anywhere. Where's the core file supposed to be written ? Thanx Paul

1 0

rlm_exec and retriving RAD_REQUEST attribute values
by Matt morris 24 Aug '05

24 Aug '05

Hello list, This has probably been asked a lot times before, but I just couldn't get the attributes values from accounting request packets with my perl script. I am trying to do some database queries when I received stop accounting request packets, here are the relevant sections of my radiusd.conf and script file: ============= radiusd.conf: ============= modules { exec { wait = yes input_pairs = request } exec custom123 { wait = no program = "/usr/src/myscript.pl %{Acct-Unique-Session-Id} %{User-Name} %{Called-Station-Id}" input-pairs = request output-pairs = reply packet-type = Accounting-Request } } instantiate { exec custom123 expr } accounting { detail unix radutmp sql custom123 } ============================================================= myscript.pl (simplifed the accounting section for the purpose of posting): ============================================================= #!/usr/bin/perl use DBI; use Data::Dumper; use strict 'vars'; use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; my %RAD_REQUEST; my %RAD_REPLY; my %RAD_CHECK; use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ &test_call; return RLM_MODULE_OK; } sub authorize { &test_call; return RLM_MODULE_OK; } sub authenticate { if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } sub preacct { return RLM_MODULE_OK; } sub accounting { if ($RAD_REQUEST{'Acct-Status-Type'} eq "Stop") { open(FILEWRITE, "> /downloads/tronsun/testperlfile.log"); print FILEWRITE "Logging RAD Request Attributes\n"; print FILEWRITE "Acct-Unique-Session-Id : $RAD_REQUEST{'Acct-Unique-Session-Id'}\n"; close FILEWRITE; return RLM_MODULE_OK; } else { return RLM_MODULE_NOOP; } } sub checksimul { return RLM_MODULE_OK; } sub xlat { my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } sub detach { &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } sub log_request_attributes { for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } &accounting(); ========================================================================== End myscript.pl ========================================================================== ============================= My Accounting-Request packet: ============================= Acct-Session-Id = "1124643784.6" h323-connect-time = "2005-08-22 01:04:29" h323-setup-time = "2005-08-22 01:04:25" Cisco-NAS-Port = "SIP/14002-081332c8" Called-Station-Id = "18001112345" Acct-Status-Type = Stop h323-conf-id = "A46B7F2B-0D73-4E75-ABCF-F6CA7140B9D5(a)192.168.1.101" NAS-IP-Address = 123.123.123.123 Acct-Session-Time = 67 Calling-Station-Id = "9871234" h323-disconnect-time = "2005-08-22 01:05:36" Cisco-AVPair = "codec-type-rate=ulaw;useragent=X-Lite release 1103m;" User-Name = "9871234" NAS-Identifier = "Asterisk" NAS-Port = 5070 Acct-Delay-Time = 4 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "44e82fcfd875db6f" Timestamp = 1124643865 ====================== After the script is ran in freeradius, there is no value in $RAD_REQUEST{'Acct-Status-Type'} and $RAD_REQUEST{'Acct-Unique-Session-Id'} Right now I'm putting the attributes into the arugments when executing myscript.pl (as shown in radiusd.conf), which works fine. But I would like to know the proper way. Please point me the right direction. Thank you very much. _________________________________________________________________ MSN® Calendar keeps you organized and takes the effort out of scheduling get-togethers. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 1

Replaying data with tcpdump/netcat
by Wesley Spadola 24 Aug '05

24 Aug '05

There is probably something pretty simple I'm forgetting, but please bear with me. :) We're in the process of migrating our Cistron server to FreeRADIUS. We are currently testing FreeRADIUS 1.1.0 CVS HEAD because of our need to accept and log MAX TNT TAOS v11 Ascend-* 16bit attributes. We are logging to both ASCII detail files and a MySQL database. We will be using both servers in parallel periodically checking to see if FreeRADIUS keeps up, and eventually shutting down the Cistron server. In the meantime, the NASes will be switched in between the both of them. Because we do not want accounting data terribly out of sync, we are shifting the accounting data over from our live machine to a test machine in increments of a few minutes, and I'm logging such data with "tcpdump -s 1500 -w raw.txt port 1813 and udp". I hope to catch some log data that I can easily replay to the test machine while the accounting is shifted back to our live server. To replay that data. I am using "cat raw.txt | nc -u <ip of test server> radius-acct". When the data starts to flow, I receive this output from radiusd -X: WARNING: Bad RADIUS packet from host x.x.x.x: unknown packet code 212 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. WARNING: Bad RADIUS packet from host x.x.x.x: unknown packet code 102 Nothing to do. Sleeping until we see a request. WARNING: Bad RADIUS packet from host x.x.x.x: unknown packet code 171 Nothing to do. Sleeping until we see a request. WARNING: Malformed RADIUS packet from host x.x.x.x: too long (length 29290 > maximum 4096) Nothing to do. Sleeping until we see a request. WARNING: Malformed RADIUS packet from host x.x.x.x: too long (length 14643 > maximum 4096) Nothing to do. Sleeping until we see a request. WARNING: Bad RADIUS packet from host x.x.x.x: unknown packet code 0 Nothing to do. Sleeping until we see a request. WARNING: Malformed RADIUS packet from host x.x.x.x: too short (received 4 < minimum 20) Nothing to do. Sleeping until we see a request. WARNING: Malformed RADIUS packet from host x.x.x.x: too long (length 12294 > maximum 4096) Nothing to do. Sleeping until we see a request. I realize that the accounting port may not understand and handle authorization requests, but I do know that there are /some/ accounting requst packets in this raw file that FR should be handling. Should I not be seeing debug lines that reference these accounting requests logging to ASCII detail files or SQL INSERT/UPDATE s? I'm also using -s 0 and -s 512 in tcpdump in case that may be an issue. Still no dice. Am I using tcpdump/netcat in the correct manner? Should I capture /much more data/ for FreeRADIUS to work this way? Is there something else I could do to capture raw UDP streams and replay them? Thanks for all the help. I'm new to RADIUS, be gentle. :) Wes

3 2

Problem with PEAP and LDAP
by Carlos Martínez-Troncoso Cera 24 Aug '05

24 Aug '05

Hello. We are trying to use FreeRadius with PEAP and LDAP. Our access point is a 3Com 8750, is talking with a FreeRadius 1.0.4, Freeradius talks with LDAP (Sun One Messaging Server 5.1) and our PEAP clients are Windows XP and 2000. First we configured FreeRadius with LDAP, it works well, then we tried to use this with EAP, it works when we use local users, but when we try to authenticate and authorize PEAP users in LDAP, it doesn´t work. The error is: modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 5 rlm_mschap: Told to do MS-CHAPv2 for cmartinez with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: group Auth-Type returns reject for request 5 I was looking how Sun ONE stores the passwords, it uses SSHA (Salted Secure Hashing Algoritm), I think this is the problem, because I suposse it looks for NT-LM Hashing passwords, what can I do and where can I find info about it? Thank you in advance. Carlos

3 4

Freeradius denies auth when "Framed-IP-Address" set
by Gerret Apelt 24 Aug '05

24 Aug '05

Hi all -- Debian Sarge 2.4.27-2-386 kernel freeRadius (dpkg version 1.0.2-4) MySQL Server (dpkg version 4.1.11a-4) I have been using FreeRadius successfully for half a year. All my setup does is authenticate dialup connections. Radius auth requests come in from a NAS, and once authentication has been successful, the NAS will assign an IP address out of its pool. I use mysql to store 'User-Password' attribute/value pairs, where the password is stored in cleartext (there is PAP and CHAP authentication). This all works very well. I am now trying to have FreeRadius also assign IP Address and Netmask to a subset of the user accounts, and that's where I'm getting stuck: As soon as I add the additional attributes "Framed-IP-Address" and "Framed-IP-Netmask" to the table, FreeRadius will reject the authentication request. When using PAP, radius.log reports: Wed Aug 24 09:31:27 2005 : Auth: Login incorrect: [gerret/testme] When using CHAP, radius.log reports: Wed Aug 24 09:33:25 2005 : Auth: Login incorrect (rlm_chap: Clear text password not available): [gerret/<CHAP-Password>] This issue goes away as soon as I delete rows with id 1343 and 1344 below: mysql> select id, username, attribute, value, op from login_accounts where username='gerret'; +------+----------+-------------------+----+---------------+ | id | username | attribute | op | value | +------+----------+-------------------+----+---------------+ | 414 | gerret | User-Password | == | testme | | 1343 | gerret | Framed-IP-Address | == | 65.166.58.202 | | 1344 | gerret | Framed-IP-Netmask | == | 255.255.254.0 | +------+----------+-------------------+----+---------------+ When running in full debug mode, FreeRadius outputs the exact queries it fires at the database. I have run these queries manually: the 'authorize_check_query' returns the three rows listed above. All other queries return the empty set. Then at the end of the debug output: rlm_sql (sql): No matching entry in the database for request from user [gerret] rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 7 modcall: group authorize returns ok for request 7 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [gerret/testme] (from client north port 0 cli 00:02:6F:37:D9:D4) Am I filling the wrong rows into the database? I dont understand how authentication can fail due to the addition of two extra attributes -- especially since the queries still return the "User-Password" information. It looks like this post describes a similar issue: http://lists.cistron.nl/pipermail/freeradius-users/2005-January/039705.html Any help on this is much appreciated :) cheers Gerret

2 1

Re: Mobile phone authentication
by sean 24 Aug '05

24 Aug '05

Hi, If I understand you properly you are trying to authenticate users by their mobile phone number.If that's right you need Kannel. You can download the latest version from http://www.kannel.org There is a bit of a learning curve but once you have authenticated the user you can pass them off to your Radius billing system. I presume that the authentication will arrive via SMS, WAP or HTTP if it's 3G. I hope this helps. If you need more advice you can email me at sean(a)topup.ie Regards, Sean

1 0

Constructing imcoming message.
by Iandc Davies 24 Aug '05

24 Aug '05

Hi all, I'm trying to construct a simple program that will allow me to take some information from another source (possibly a pointer to a structure passed in) and populate the RADIUS_PACKET template. A separate process will then be used to send this message over UDP to the radius server. The information I'm trying to parse is as follows (these are test values only) :- Code=1 packet->code Identifier=1 (can increase due to how many requests) packet->id Length=total length of message packet->data_len Authenticator=32 octets (random to send to RADIUS but md5 hashed on reply) packet->vector Attributes: packet->data NAS-IP-Address=eg. d5 89 45 26 (213.137.69.38) PW_NAS_IP_ADDERSS NAS-PORT-TYPE=5 (virtual) PW_NAS_PORT_TYPE User-Name="12345678" PW_USER_NAME Disgest-Response=16 octets PW_DIGEST_REPONSE Digest-Attributes= Realm(1) = "deltathree" PW_DIGEST_REALM Nonce(2) = "3bada1a0" PW_DIGEST_NONCE Method(3) = "INVITE" PW_DIGEST_METHOD URI(4) = "sip:96226491335@213.137.69.38" PW_DIGEST_URI Algorithm(5) = "md5" PW_DIGEST_ALGORITHM User-Name(10) = "12345678" PW_DIGEST_USER_NAME On the right for the Code/Id/length/Authenticator are straight forward, as they have their own types. For the attributes, I'm getting a bit stuck as these are VSA AVP's. I think I've managed to id the functions that I need ( paircreate() and pairadd() ) but unsure how they are used. I've stated what I think each AVP is represented by (as these are #define int) but the VALUE_PAIR structure has name, attribute and type information relating to them. Is the name just a straight car string ? (left hand side of equals above) Any help gratefully received. Ian Davies IMS-SIPAC Software Development Engineer

2 1