- Freeradius-Users - lists.freeradius.org

freeradius with EAP-TTLS and PAP auth
by Mathieu Geli 03 Aug '05

03 Aug '05

Hi folks, I'm trying to configure freeradius to authenticate users through a TTLS tunnel witth PA authentication scheme. Xsupplicant has been configured like : allow_types = eap_ttls eap-ttls { root_cert = /etc/xsupplicant/tls/ca_cert.pem phase2_type = pap pap { username = <BEGIN_UNAME>testuser<END_UNAME> password = <BEGIN_PASS>testpass<END_PASS> } } subsequently for freeradius, I enabled in radius.conf the pap module : pap { encryption_scheme = md5 } (tried also crypt and clear options without any success) But I do not see anything in eap.conf like ttls { ... pap { ... } } (the interesting part is the pap *inside* the ttls part) So I tried to enable PAP directly in radiusd.conf authenticate part : authenticate { Auth-Type PAP { pap } ... } And forces (even if I encountered several times that may not be done like that) in the users conf : testuser Auth-Type := PAP, User-Password == "testpass" and also tested EAP, and not specifying the Auth-Type (which then fallback to the System module and obviously fail) With EAP the error I get is : rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message (xsupplicant and freeradius are apparently not talking the same language) With PAP : rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: Attribute "Password" is required for authentication. modcall[authenticate]: module "pap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user (also tested to put 'Password' instead of 'User-Password' directive, still the same error.) Without Auth-Type : rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_unix: [testuser]: invalid password I'm maybe trying to test something that is not still finished ? By the way MD5 over TTLS works fine, tested with secureW2 WInXP supplicant. (Seems that xsupplicant does not support md5 as TTLS phase2) Thanks for your support ! -- Mathieu

1 0

Session-Timeout zero value
by Rashad Rustamoff 03 Aug '05

03 Aug '05

Plz, tell me the correct way. Our clients use prepaid hourly cards. I wrote external script that runs when Accounting-Stop packet received and decrements Session-Timeout attr. in database by value of Acct-Session-Time attr. in the Accounting-Stop packet. What method will be correct to reject user when Session-Timeout are exhausted. Has freeradius any built-in ability to realize a mechanism described above. Thanks. -----Original Message----- From: aland(a)nitros9.org [mailto:aland@nitros9.org]On Behalf Of Alan DeKok Sent: Tuesday, August 02, 2005 9:59 PM To: rashad(a)nakhchyvan.az; FreeRadius users mailing list Subject: Re: Session-Timeout zero value "Rashad Rustamoff" <rashad(a)nakhchyvan.az> wrote: > I'm wonder is it correct to reject user by setting Session-Timeout attribute > to zero. No. > In case of our NAS it works fine. That's blind luck. Alan DeKok.

2 1

sementation fault
by vicky 03 Aug '05

03 Aug '05

Hi all, I trying to install (compile from source) freeRADIUS 1.0.4 on a SuSe Linux system version 9.1. The configuration, compilation and installation goes well. The problem comes when I run it with -X -A. You can see the output from that attached with this mail. I have made sure the the mysql-devel packages is installed so I guess it is not that. The last two lines in the output are : sql: postauth_query = "INSERT into radpostauth (id, user, pass, session_id, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{Acct-Session-Id}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" It tries to insert to a table 'radpostauth' that doesn't exist and further more there are no tables at all in the database. Is that normal? Please help me shed some light on this, Thanks! --Vicky Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "psaadm" main: group = "psaadm" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius/lib Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded attr_rewrite attr_rewrite: attribute = "User-Name" attr_rewrite: searchfor = "promo.*" attr_rewrite: searchin = "packet" attr_rewrite: replacewith = "%{User-Password}" attr_rewrite: append = no attr_rewrite: ignore_case = no attr_rewrite: new_attribute = no attr_rewrite: max_matches = 10 Module: Instantiated attr_rewrite (attr_rewrite) Module: Loaded preprocess preprocess: huntgroups = "/opt/freeradius/etc/raddb/huntgroups" preprocess: hints = "/opt/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "prefix" realm: delimiter = "/" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (prefix) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/freeradius/etc/raddb/users" files: acctusersfile = "/opt/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "admin" sql: password = "sntrustive" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = yes sql: sqltracefile = "/opt/freeradius/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASIdentifier, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, ClientIPAddress, WISPrLocationId, WISPrLocationName) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Identifier}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Client-IP-Address}', '%{WISPr-Location-Id}', '%{WISPr-Location-Name}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, ClientIPAddress, WISPrLocationId, WISPrLocationName) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}', '%{Client-IP-Address}', '%{WISPr-Location-Id}', '%{WISPr-Location-Name}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, session_id, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{Acct-Session-Id}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Segmentation fault

3 7

slipstream and freeradius Reply-Message
by Paul Knibbs 03 Aug '05

03 Aug '05

I want to be able to specify a Reply-Message attribute which is passed to slipstream, which in turn picks up an replymsgs file. However, I only want this to happen when the login fails. Everything I do seems to make it return a Reply-message only when it is successful. I am using freeradius, mysql and slipstream 4.0.127. I have basic authentication working ok. What I am trying to do is create custom failure messages for each user <http://www.nitroglobal.com/clickthru.cgi?id=outside> Nitro Web Accelerator works in conjunction with acceleration servers on the Internet to provide dial-up users with the ability to rapidly access Web pages and e-mail, and to download files much faster than would otherwise be the case."

1 0

radius problem
by dilip mansukhani 03 Aug '05

03 Aug '05

hi , i my using cent os 3.3(Red Hat linux 3.2.3-39) and the kernel version 2.4 and the freeradius version iam using is 1.148.23 the problem is every time i start the radius server by issuing command radiusd iam getting this error radiusd:error while loading shared libraries:libradius-1.0.1.so:cannot open shared object file :no such file or directory even i tried rebuilding the server still the same problem is there will any body help me Thanks&Regards From Dilip.J.Mansukhani cell +91 9820789882

1 0

// in user name ?
by alfred hitch 03 Aug '05

03 Aug '05

Hi, I asked this in morning also, and am still looking for ana answer. My set up is very simple winxp,-> wireless router -> free radius PEAP -MSCHPv2 .. How am I supposed to configure free radius for clients with "//" in their user name ? like by default it will send domainname//user-name are // allowed ? if I just add user names like this, PEAP is failing .. Anyone please guide this new bie. Cheers, Alfred

2 2

huntgroups/groups with sql
by Michel Jansens 02 Aug '05

02 Aug '05

Hi, I want to use FR to control the access to different ressources (radius clients). I've put my users in 'radcheck', defined groups in 'radgroupcheck' according to Client-IP-Address and put the users in their groups in 'usergroup'. Some users are in more than one group, but they can only access to the first matching group defined in 'radgroupcheck'. Tryed to add 'Fall-Through = Yes' to all 'radgroupcheck' entries, but it didn't work. Now I've found a workaround: I added a column 'groupIPaddr' varchar(15) in 'radgroupcheck'. I put there the Client-IP-Address and changed the query in sql.conf to: authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName, ${groupcheck_table}.Attribute,${groupcheck_table}.Value, ${groupcheck_table}.op FROM ${groupcheck_table},${usergroup_table} WHERE ${groupcheck_table}.groupIPaddr ='%{Client-IP-Address}' AND ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName ORDER BY ${groupcheck_table}.id" Now My users have access to all their authorized nasses whatever the order of definition of the groups. Was there an easier/more standard way of doing? Michel

2 1

Using a database schema other than the one created by db_mysql.sql
by Ana Bizarro 02 Aug '05

02 Aug '05

Hi, We have a (mysql) database where we have usernames and passwords and I recently installed freeradius on our server. I would like the freeradius server to authenticate using the database but, obviously, our database schema is completely different than the one created by db_mysql.sql. All the documentation (and examples) I've seen so far mention the db_mysql.sql script (even in the RADIUS book) and I was wondering, if it's possible to use our own database, how do I tell RADIUS that "uid" in the users table is the username and "pwd" is the password? For the tables names, I'm assuming I can just change the sql.conf file and replace whatever is inside " " by our own table names Like: usergroup_table = "usergroup" replace by usergroup_table = "users" Thanks, -Ana

3 2

Accounting to db, duplicate entries (again)
by Roger Kristiansen 02 Aug '05

02 Aug '05

Hi, I'm having some problems with Alive messages that follow immediately after Start messages. Sometimes this causes two entries with the same acctuniqeid to be entered into the database, the only thing separating the two being a few hundreds of a second on the acctstarttime field. I find this behaviour rather annoying, and as I mentioned in an earlier mail, that was confirmed by Alan DeKok, it is cause by the following: 1) Receives a Start packet and inserts a new entry/session in the db 2) Receives Alive packet _immediately_ after the Start packet, and queries the database to see if the unique-session-id already exists. 3) The query doesn't return anything, since postgresql hasn't had time to complete the INSERT-query for the Start packet, and accounting_update_query_alt is thus run. I'm not at all experienced with databases, but I was thinking I could lock the accounting table while inserting the Start message, so that the query in pnt. 2 could not be performed until the Insert in pnt. 1 is finished. Wouldn't this elminate the problem in pnt. 3? How does freeradius react to a situation like this.. does it keep trying to perform the SELECT query in 2 until it succeds, or is the Alive packed just dropped? If the latter is the case, does anyone here know if I can make postgresql queue requests that get blocked because of the lock? Anyone else had this problem, and if so, how did you get around it, if you got around it at all? Any pointers would be highly appreciated :) Regards, Roger Kristiansen

2 1

accounting records per nasid, not ip address
by freeradius＠puchol.com 02 Aug '05

02 Aug '05

hi, this is my first time using freeradius. had a good experience so far. i had to coerce the latest cvs version into fedora core 3 with more hacks than i would have liked, but that's ok, it's up and running. one issue i find so far is that my NASs have a dynamic ip. i managed this externally at great pains, however, for the purposes of radius accounting, i'd like to see the accounting records on a per-nasid file in /var/log/radius/radacct/<nasid> rather than what i see now as: /var/log/radius/radacct/<ip-address> i could not find a simple way to do this by looking around, though i may be missing something. is this doable as-is? if not, any hint on where to hack this would be greatly appreciated. while i am on the list, and at the risk of irking someone i would like to (lazily) ask if anyone knows offhand where can i find a document that i saw a few months back on "hardening" radiusd. the process exited on me a couple of times due to dynamic ip issues, creating multi-hour blackouts that i rather not see again. looking for freeradius hardening or crashing i cannot seem to find that most excellent list of things to restart or manage a crashed server. thanks in advance!

4 5