- Freeradius-Users - lists.freeradius.org

tinyPEAP has said they will comply
by Alan DeKok 09 Jun '05

09 Jun '05

>From http://www.tinypeap.com ... 6/9/2005 tinyPEAP has stopped distributing the binaries due to the copyright infringement against FreeRADIUS Project. ... The author also says in private email that he apologizes, takes our concerns seriously, will re-write the relevant code. Thanks to everyone for their support & patience in this matter. Alan DeKok.

1 0

FW: Trouble with HTTPS and mod_auth_radius
by Zawacki Jason D Contr AFRL/IFOS 09 Jun '05

09 Jun '05

Is there a mod_auth_radius list I can direct this question to? Thanks, Jason -----Original Message----- From: Zawacki Jason D Contr AFRL/IFOS Sent: Monday, June 06, 2005 11:43 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Trouble with HTTPS and mod_auth_radius Hey folks, I'm having trouble getting my configuration to work with SSL enabled in apache 1.3.33 using mod_auth_radius (mod_auth_radius.c,v 1.15 2003/03/24 19:16:15). This same setup works fine when SSL is not enabled. If I go to the page I've configured for radius auth, I get an Internal Server Error. I've shut off all other authentications for this location (NTLM) and the mod_auth module is not being activated. Even so, the apache error log indicates that it is looking for a user file as if I were using mod_auth. Here is my setup: ... LoadModule radius_auth_module libexec/mod_auth_radius.so ... #AddModule mod_auth.c ... AddModule mod_auth_radius.c ... AddRadiusAuth X.X.X.X:1812 XXXXXXXXXXXXXXXXXXXXXX AddRadiusCookieValid 5 ... <Location /test-radius> AllowOverride None order allow,deny allow from all AuthName "RRS Radius test" AuthType Basic NTLMAuthoritative off NTLMAuth off NTLMBasicAuth off AuthRadiusAuthoritative on AuthRadiusActive on require valid-user </Location> Like I said, the same setup works fine for a non-SSL URL, which puzzles me greatly. I'm using this box to test several authentication schemes including ldap, ntlm, and kerberos and none of demonstrated the same behavior. Any help is greatly appreciated. Jason

3 2

Problem getting FR/MySQL to work with CHAP
by shadur＠systemec.nl 09 Jun '05

09 Jun '05

Hello all, Due to a policy change with MCI we now have to change our authentication/authorization scheme for dial-in users to CHAP, but for some reason I just gan't get it to work. I've checked mailing list archives and google, and as far as I can see I've done everything right, but I'm still getting "Cleartext password not available." Here's the log from freeradius -X : rad_recv: Access-Request packet from host 195.129.12.34:1645, id=129, length=228 User-Name = "testflex(a)systemec.nl" CHAP-Password = 0x01cf2e2a27fc74a7b6271039f9c3e1b0e6 NAS-IP-Address = 213.116.1.36 NAS-Port = 70 NAS-Port-Type = ISDN Service-Type = Framed-User Framed-Protocol = PPP State = 0x Calling-Station-Id = "774642968" Called-Station-Id = "0676011850" Acct-Session-Id = "436504632" X-Ascend-Data-Rate = 64000 X-Ascend-Xmit-Rate = 64000 Proxy-State = 0x50583031000065bd93266f974b08f6115766e0d35d7719e900020691d574012400000000000000000002066dc2e5a4030000000000000000000000030000000200000f73008d192a9815e82047235efbe3c5fbb341 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok rlm_realm: Looking up realm "systemec.nl" for User-Name = "testflex(a)systemec.nl" rlm_realm: Found realm "systemec.nl" rlm_realm: Adding Stripped-User-Name = "testflex" rlm_realm: Proxying request from user testflex to realm systemec.nl rlm_realm: Adding Realm = "systemec.nl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop radius_xlat: 'testflex(a)systemec.nl' rlm_sql (sql): sql_set_user escaped user --> 'testflex(a)systemec.nl' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testflex(a)systemec.nl' ORDER BY id' * This returns the following data when run in a mysql shell: +-----+----------------------+----------------+-------+------+ | id | UserName | Attribute | Value | op | +-----+----------------------+----------------+-------+------+ | 186 | testflex(a)systemec.nl | Password | ----- | == | | 271 | testflex(a)systemec.nl | CHAP-Challenge | ----- | == | | 272 | testflex(a)systemec.nl | Auth-Type | Local | := | +-----+----------------------+----------------+-------+------+ (password and challenge secret changed for security purposes) rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testflex(a)systemec.nl' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' +----+-----------+----------------+-------+------+ | id | GroupName | Attribute | Value | op | +----+-----------+----------------+-------+------+ | 3 | flex | Huntgroup-Name | flex | == | | 4 | flex | Auth-Type | Local | := | +----+-----------+----------------+-------+------+ radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testflex(a)systemec.nl' ORDER BY id' Empty set (0.00 sec) radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testflex(a)systemec.nl' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' +----+-----------+-----------------+-------------+------+ | id | GroupName | Attribute | Value | op | +----+-----------+-----------------+-------------+------+ | 1 | flex | Auth-Type | Local | := | | 4 | flex | Framed-Protocol | PPP | := | | 5 | flex | Service-type | Framed-User | := | +----+-----------+-----------------+-------------+------+ rlm_sql (sql): No matching entry in the database for request from user [testflex(a)systemec.nl] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound modcall: group authorize returns ok rad_check_password: Found Auth-Type CHAP auth: type "CHAP" modcall: entering group Auth-Type rlm_chap: login attempt by "testflex" with CHAP password rlm_chap: Could not find clear text password for user testflex modcall[authenticate]: module "chap" returns invalid modcall: group Auth-Type returns invalid auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [testflex(a)systemec.nl/<CHAP-Password>] (from client worldcom4 port 70 cli 774642968) Delaying request 0 for 1 seconds Finished request 0 I've tried using the attribute names 'Password', 'User-Password', 'CHAP-Password', as well as forcing Auth-Type to CHAP, in pretty much every configuration I could think of, but the end result remains the same. Does anyone have a suggestion on what I've missed? (Version 0.9.1, by the way) -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://swordbreaker.systemec.nl/~shadur/shadur.key.asc

2 1

Strange Group Reply
by Fabrice Delambre 09 Jun '05

09 Jun '05

Hi, I'm getting a strange reply from the server : versions are FreeRadius 1.02 + MySQL 3.23 . Basic authentication works. Problem comes from radgroupreply : my user 'test' authenticates but when I add an entry like : Username : test Attribute : Class Value : 34 in the radgroupreply table, the server replies with Class := 0x3334. More generally, it does always reply with 0x33XX, XX being the value of Class in radgroupreply. Any ideas ? -- Fabrice Delambre <fabrice.delambre(a)free.fr>

2 1

RE: Problems with LDAP
by Mitchell, Michael J 09 Jun '05

09 Jun '05

Hi, Check /usr/local/radius/lib for rlm_ldap* to ensure that rlm_ldap actually built and was installed. Cheers, Mike > > Hello, > first, excuseme for my english > > I have freeradius running with EAP and PEAP authentication > very well, but i would like use Openldap like database, but > when after i do the changes, and I restart the radius appears > the error: > segmetation fault >

2 1

FreeRADIUS 1.0.2 Segfaulting
by Bubba Parker 09 Jun '05

09 Jun '05

I'm using freeradius 1.0.2 with openssl 0.9.7g, configured for PEAP, trying to authenticate a Windows XP client. The script I'm running that invokes freeradius looks like this: --snip-- #!/bin/sh -x LD_LIBRARY_PATH=/usr/local/openssl/lib LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so export LD_LIBRARY_PATH LD_PRELOAD /usr/local/radius/sbin/radiusd $@ --snip-- Here's the log of starting up freeradius and the client trying to authenticate. # ./radiusd -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 216.10.80.87:1028, id=18, length=150 User-Name = "shiv" NAS-IP-Address = 192.168.101.3 NAS-Port = 1 Called-Station-Id = "00-02-6F-36-A6-1F:SecureAP" Calling-Station-Id = "00-02-6F-09-5A-23" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020800090173686976 Message-Authenticator = 0xa5af462a81e9444b13fa7cd8c31a32a4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "shiv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 8 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry shiv at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 18 to 216.10.80.87:1028 EAP-Message = 0x010900061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6b9c6125025382ebbe258f73f08b29a3 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 216.10.80.87:1028, id=17, length=239 User-Name = "shiv" NAS-IP-Address = 192.168.101.3 NAS-Port = 1 Called-Station-Id = "00-02-6F-36-A6-1F:SecureAP" Calling-Station-Id = "00-02-6F-09-5A-23" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0206005019800000004616030100410100003d030142a8639b5be4fe2e2bdd626583a78defb96e1457fac96ff8379d641df3f12c3c00001600040005000a000900640062000300060013001200630100 State = 0x9c6125025382ebe309269c9df1a1894a Message-Authenticator = 0xb1d2c75b22288ab1c716d71be11648ad Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "shiv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 6 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry shiv at line 1 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 17 to 216.10.80.87:1028 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 18 with timestamp 42a863d8 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 17 with timestamp 42a863da Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 216.10.80.87:1028, id=19, length=150 User-Name = "shiv" NAS-IP-Address = 192.168.101.3 NAS-Port = 1 Called-Station-Id = "00-02-6F-36-A6-1F:SecureAP" Calling-Station-Id = "00-02-6F-09-5A-23" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020b00090173686976 Message-Authenticator = 0xbbfd6022efa5f513c6d8719ca5029862 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "shiv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 11 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry shiv at line 1 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 19 to 216.10.80.87:1028 EAP-Message = 0x010c00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c6e4590a68920d0ff65194282f2656b Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 216.10.80.87:1028, id=20, length=239 User-Name = "shiv" NAS-IP-Address = 192.168.101.3 NAS-Port = 1 Called-Station-Id = "00-02-6F-36-A6-1F:SecureAP" Calling-Station-Id = "00-02-6F-09-5A-23" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020c005019800000004616030100410100003d030142a863fcea678e3eb751546b85e93e9ab7b8d6fcfd8269bd1e1e21990887154500001600040005000a000900640062000300060013001200630100 State = 0x4c6e4590a68920d0ff65194282f2656b Message-Authenticator = 0xc98ab4ad8612057da15e5018714d6cda Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "shiv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 12 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry shiv at line 1 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A ./radiusd: line 8: 3113 Segmentation fault /usr/local/radius/sbin/radiusd $@ Any help would be greatly appreciated, thanks. -- Bubba Parker sysadmin(a)citynetwireless.net CityNet LLC http://www.citynetinfo.com/

1 0

syslog
by Miguel Sennoun 09 Jun '05

09 Jun '05

Dear freeradius users, I wonder if there is a way to treat freeradius logs with the syslog deamon (or syslog-ng). I tried the option "-l syslog" but It appears it doesn't works fine. Is there someone who has succeeded to configure freeradius with syslog? Thank you MS

2 6

RADIUS Session Closing
by "Ferreira, André" 09 Jun '05

09 Jun '05

Is there or which attribute is used to tell RADIUS to close all connections from the NASses? Thus something saying, close global...etc. Apart from restarting the RADIUS daemon. Thanx. André Ferreira

1 0

segmentation fault
by yuniva wati 09 Jun '05

09 Jun '05

hello freeradius users, I have configure my freeradius for accounting but when I run it using : [root@localhost raddb]# /usr/local/radius/sbin/radiusd -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/root.pem" tls: private_key_password = "telkom" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "src/radiusd/src/modules/rlm_sql/drivers/rlm_sql_mysql" sql: server = "localhost" sql: port = "3306" sql: login = "root" sql: password = "telkom" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = yes sql: sqltracefile = "/usr/local/radius/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-Use-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" segmentation fault that I want ask is : -Why I got that message and what part is wrong?? thanks for all of you. I hope anyone can help me __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

db model
by Thomas Huber 09 Jun '05

09 Jun '05

Hi, I am building the clients list from the nas table and experienced some problems: 1) There is not nas_query prepared int the configuration file. Would it be supported? 2) select * from nas; does not return the records in the right order. I think the clients list is built from the first four fields, which are: ID (ignored) | nasname=IP | shortname=Name | secret=something With the current table structure, the fourth field is Port and not secret. How should this be solved? Thomas

1 0