- Freeradius-Users - lists.freeradius.org

freeradius + MySQL not working after upgrade from 1.0.1
by marc-ml＠neoharmonix.net 24 Aug '05

24 Aug '05

Hello. I have encountered a problem upon upgrading from freeradius version 1.0.1. I'm using the sql module (rlm_sql_mysql) for authorization and accounting of dialup users (reselling dialup from several networks). After upgrading to 1.0.2 with the same configuration, it no longer works. >From the logs I see that authorization works: Login OK: [xxxx(a)xxxxx.com] (from client xxxxxxxx port 15) and it sends "Access-Accept" but the connecting dialup user can't connect. I now have two servers with the same freeradius configuration (minus minor changes from the upgrade) and the same MySQL database with one running version 1.0.1 (which works) and the other running 1.0.4 (which does not work). Comparing the logs produced by "radiusd -X", I see that the only substantial difference is the X-Ascend-Data-Filter Attributes which look something like this: WORKING VERSION 1.0.1: Sending Access-Accept of id 158 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 Filter-Id = "data6330_1" Proxy-State = 0x3532 X-Ascend-Data-Filter += "ip in forward tcp est" X-Ascend-Data-Filter += "ip in forward dstip 200.100.100.10/32 0" X-Ascend-Data-Filter += "ip in forward dstip 66.55.44.0/24 0" X-Ascend-Data-Filter += "ip in forward dstip 66.44.55.0/24 0" X-Ascend-Data-Filter += "ip in drop tcp dstport = 25" X-Ascend-Data-Filter += "ip in forward 0" Finished request 0 Going to the next request NON-WORKING VERSION 1.0.4: Sending Access-Accept of id 154 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 X-Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 X-Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230392e3130322e3130372e37372f33322030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036342e32342e33352e302f32342030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036362e34352e3234332e302f32342030 X-Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 X-Ascend-Data-Filter += 0x697020696e20666f72776172642030 Filter-Id = "data6330_1" Proxy-State = 0x3234 Finished request 3 Going to the next request The working version proceeds to do accounting sometime after sending that while the other version stops there. I suspect those long strings are the culprit since everything else in the logs looks the same. The attributes come from the database and they look fine there. Any ideas how I can get the previous behavior or get the newer versions to work? Or maybe the problem is something else? Thanks, Marc

4 6

freeradius.net problem with reathentication
by Liaqat, Touseef 24 Aug '05

24 Aug '05

Hi All, I am using freeradius.net-1.0.2-r0.0.8.exe for windows which I downloaded from freeradius.net. I apologize if this distribution is not relevant to this mailing list. when testing I am getting some problem with authentication. Server authenticate the client but after one successful re-authentication it is denying next two re-authentications and then after those two , it is accepting two re-authentications and goes on with this pattern. I hope you understand what I am talking. This problem is very different then any other problem we faced related to radius server and we have never encountered this problem with freeradius with BSD. I have attached the debug log output of freeradius server for you comments. Please help me solving this problem. Thanks, Touseef Liaqat

1 0

Example of Mac OS X EAP-TLS process?
by Landon Cox 23 Aug '05

23 Aug '05

I've got a good, working FreeRadius running EAP-TLS on a SuSE 9.2 box. I've had good luck with WPA supplicants for XP SP2 and several vendor PCMCIA card supplicants - all on XP SP2. I've been trying to get an OS X (Tiger) machine up with the same type of setup, but each time I set the 802.1x "TLS" check box, I always get an error stating that there is no valid certificate available on the machine. I've imported both the client and root CA certs into the Mac OS X Keychain (the root CA imported into X509 anchors category and the client cert into 'logins'.) I've generated the Mac client cert in the same way as I do the XP client cert except without the xpextensions ASN.1 options on openSSL. I realize this isn't a FreeRadius question per-se but was hoping that someone else in FR land has done an 802.1x EAP-TLS setup on OS X w/FR and had success. Thank you, Landon

1 0

Mobile phone authentification
by Marc.Schlueter＠comneon.com 23 Aug '05

23 Aug '05

Hi all, I'd like to use FREERADIUS as an authentification method for mobile phones, but I'm not sure A) if this is possible and B) how to configure as I'm a newbie. Please find following scenario: A mobile phone user would like to access my server behind the proxy/gateway by using a gprs connection of an official provider (e.g. vodafone). Currently the mobile phone builds up a gprs connection to the providers network and send a get.request to the server through the proxy/gateway. My proxy/gateway simply forwards the request to the server but can not authentificate it. Especially authentification gets important for the application called "MMS-Multimedia Messaging Service". In this case the client POSTs a message, but leaves the sender-header in the message empty (=asks the network to insert the proper information). Then my proxy/gateway can not insert the proper information, but the server which has to process this request requires the sender-header to perform billing actions for example. Now I was told that RADIUS is the solution. RADIUS is able to detect the actual sender information and delivers this information to the proxy/gateway which is then able to insert the missing value into the sender-header and everybody's happy ;) Someone was able to follow my thoughts? What's currently available? A proxy/gateway, mobile-phones, GPRS-connectivity and a RedHat machine for freeradius. What's needed? Some support in configurating freeradius. Comments are really welcome, Rgds. Marc

2 1

ldap_connections_number
by Benedikt Panzer 23 Aug '05

23 Aug '05

Hello, it seems to me the FR doesn't open as many connections as in ldap_connections_number specified. Even tough there are many RADIUS requests in the queue (they have to be) and I allowed 50 connections to the ldap server FR opens justs 1 or 2. Why? That wouldn't bother me usually. But my ldap server delays responses when the password was wrong. And because FR uses only so few parallel connections also those requests with correct passwords are affected and delayed. That's why I'd really apreciate if FR used more connections. Is there a chance? Thanks a lot, Benedikt -- Benedikt Panzer Rechenzentrum Universität Stuttgart

2 1

RE: best place for logic - users file or custom module?
by Tariq Rashid 23 Aug '05

23 Aug '05

is python more stable than the support for perl? i have much more experience in python than perl. also is the "perl/python" stuff persistent - or is the interpreter invoked for every request? i am asking as i think this is the main reason for Radiator's performance issues - in theory even a big interpreter loaded into RAM should run fine ... but I suspect something inefficent is happening with Radiator. tariq rashid -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 23 August 2005 16:54 To: FreeRadius users mailing list Subject: Re: best place for logic - users file or custom module? Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > hi, i'm planning a significant migration from a different radius server > (Radiator, perl based). That's good to hear! > our tests with freeradius show a much lighter server - its faster, and > easier on memory and cpu. however the downside is that applying custom logic > to the radius process is a bit more difficult. Yes, there are trade-offs. > i'd like some advide on the best place to implement this logic. for example > - a common scenario is for a request to come from A, and the reply to A > contains instructions to extend a tunnel to a second device B. A second > query from B is then received. > > this case is handled easily in perl using "if()" constructs. My suggestion is to use Perl. :) rlm_perl is in 1.0.4, but it's not stable. The CVS head is in transition, too. I would suggest grabbing revision 1.19 of rlm_perl from CVS, and building it into 1.0.4. It should work, and it will get you the custom logic you need. And, it will be multi-threaded, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

MySQL radacct not updated
by sean 23 Aug '05

23 Aug '05

Hi, I have a strange problem with MySQL and FreeRadius. The system had been performing perfectly but it is no longer updating radacct. The result is that when users login the counter on their login page counts down their remaining time. But when they logout and then login again the counter is reset back to its origional value. This means that user names and passwords last forever. The sql log file used to show Quote: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='bebbik6'; INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('42e4494400000000', '3f1c519e5a66e2fe', 'bebbik6', '', '0.0.0.0', '0', 'Wireless-802.11', '2005-07-26 06:04:07', '0', '0', '', '', '', '0', '0', '00-12-17-B7- A1-70', '00-C0-49-5C-40-48', '', '', '', '192.168.182.2', '', '0'); UPDATE radacct SET AcctStopTime = '2005-07-26 06:04:13', AcctSessionTime = '6', AcctInputOctets = '1403', AcctOutputOctets = '5179', AcctTerminateCause = 'User-Request', AcctStopDelay = '', ConnectInfo_stop = '' WHERE AcctSessionId = '42e4494400000000' AND UserName = 'bebbik6' AND NASIPAddress = '0.0.0.0'; But now it only shows Quote: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='bebbik6'; I'd really appreciate any help to solve this problem. Regards from Ireland. Sean Bracken

2 1

problems with the detail file
by jgruwell＠cox.net 23 Aug '05

23 Aug '05

Hello, I am running freeradius version 1.0.4 on Fedora Core 4. I have a problem with the detail file that writes to the radacct directory. I noticed that this log file is setup to write by default. I have uncomment the appropriate lines to have the auth-detail and replay-detail log files written to that same directory. There is no problem with these files being written to that directory either. I receive no errors for these three log files during the daemon startup or during debug output. It looks like this should be working but only the auth-detail and reply-detail log files are being written to that directory. I have no detail file in that directory. Here is the debug output of the server. Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication 192.168.1.222:1645 Listening on accounting 192.168.1.222:1646 Ready to process requests. I cant see any differences for the output between the three files. I receive no erros during startup as well. I think this should be working, but I only get two log files auth-detail and reply-detail, not the detail file. Any help you may be able to give me would be greatly appriciated, thanks in advance. I attached the whole debug output in case you may need it. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 60 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.222 IP address [192.168.1.222] main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/etaxradius_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/etaxradius_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" tls: private_key_password = "my key" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication 192.168.1.222:1645 Listening on accounting 192.168.1.222:1646 Ready to process requests.

1 0

best place for logic - users file or custom module?
by Tariq Rashid 23 Aug '05

23 Aug '05

hi, i'm planning a significant migration from a different radius server (Radiator, perl based). one advantage of that server is that it is very easy to code custom hooks to apply business logic to post-(ldap)-search and post-auth points of the radius sequence. the disadvantage is the performance of the system (single-threaded, low peak performance intorducing latency into system). our tests with freeradius show a much lighter server - its faster, and easier on memory and cpu. however the downside is that applying custom logic to the radius process is a bit more difficult. i'd like some advide on the best place to implement this logic. for example - a common scenario is for a request to come from A, and the reply to A contains instructions to extend a tunnel to a second device B. A second query from B is then received. this case is handled easily in perl using "if()" constructs. in theory - and for simple cases - i can do this in the "users" file with the matching conditions to provide the logic - but that's not a scalable or sensible way i think - correct me if i'm wrong. i'll be handling many conditions (if nas-identifier = x, .., if domain/realm = y ... ). so i guess i have to write a custom module for this? comments appreciated. pointers to examples / tutorials also appreciated - i couldn't find any in the documentation or on the website. tariq

4 3

EAP-MD5 usage
by Bilal Shahid 23 Aug '05

23 Aug '05

Hello, I have a question about EAP-MD5 usage. Would appreciate any help. I am using FreeRADIUS as the Authentication Server with Open1X Supplicant. When I set Supplicant Identity different from EAP-MD5 username, the RADIUS Server sends my Supplicant an Access-Reject. My questions are the following: 1- Where do we set the "Supplicant Identity" in the FreeRADIUS Server? Do we set it in the "users file? If yes, then where do we set the EAP-MD5 user information? 2- Is it necesasry that the EAP-MD5 "username" must match the Supplicant identity that open1x Supplicant returns to the Ethernet switch in response to an EAP-Request/Identity packet? Thanks, Bilal _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1