Re: Freeradius-Users Digest, Vol 35, Issue 80

25 Mar 2008

      No, it is ClearText-Password...

I told, when I test with same attributes, but with RadiusTest software, it 
works... I think it is something about NAS Type or something like 
that.......

I can post -X, but it only says Wrong password, nothing more...

radiusd -X:
************************************************************************************************
FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Mar 10 2008 
at 14:15:45

There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A

PARTICULAR PURPOSE.

You may redistribute copies of FreeRADIUS under the terms of the

GNU General Public License.

Starting - reading configuration files ...

including configuration file /etc/raddb/radiusd.conf

including configuration file /etc/raddb/proxy.conf

including configuration file /etc/raddb/clients.conf

including configuration file /etc/raddb/snmp.conf

including configuration file /etc/raddb/eap.conf

including configuration file /etc/raddb/sql.conf

including configuration file /etc/raddb/sql/mysql/dialup.conf

including configuration file /etc/raddb/sql/mysql/dialup1.conf

including configuration file /etc/raddb/sql/mysql/dialup2.conf

including configuration file /etc/raddb/sql/mysql/counter.conf

including configuration file /etc/raddb/policy.conf

including files in directory /etc/raddb/sites-enabled/

including configuration file /etc/raddb/sites-enabled/default

including dictionary file /etc/raddb/dictionary

main {

prefix = "/usr"

localstatedir = "/var"

logdir = "/var/log/radius"

libdir = "/usr/lib/freeradius"

radacctdir = "/var/log/radius/radacct"

hostname_lookups = no

max_request_time = 30

cleanup_delay = 5

max_requests = 35000

allow_core_dumps = yes

pidfile = "/var/run/radiusd/radiusd.pid"

checkrad = "/usr/sbin/checkrad"

debug_level = 0

proxy_requests = no

security {

max_attributes = 200

reject_delay = 0

status_server = yes

}

}

client Router {

ipaddr = 192.168.1.1

netmask = 16

require_message_authenticator = no

secret = "secrettest"

shortname = "LocalRouter"

nastype = "other"

}

radiusd: #### Loading Realms and Home Servers ####

proxy server {

retry_delay = 5

retry_count = 3

default_fallback = no

dead_time = 120

wake_all_if_all_dead = no

}

home_server_pool my_auth_failover {

type = fail-over

home_server = localhost

}

radiusd: #### Instantiating modules ####

instantiate {

Module: Linked to module rlm_logintime

Module: Instantiating logintime

logintime {

reply-message = "You are calling outside your allowed timespan "

minimum-timeout = 60

}

}

radiusd: #### Loading Virtual Servers ####

server {

modules {

Module: Checking authenticate {...} for more modules to load

Module: Linked to module rlm_chap

Module: Instantiating chap

Module: Linked to module rlm_mschap

Module: Instantiating mschap

mschap {

use_mppe = yes

require_encryption = no

require_strong = no

with_ntdomain_hack = no

}

Module: Checking authorize {...} for more modules to load

Module: Linked to module rlm_preprocess

Module: Instantiating preprocess

preprocess {

huntgroups = "/etc/raddb/huntgroups"

hints = "/etc/raddb/hints"

with_ascend_hack = no

ascend_channels_per_line = 23

with_ntdomain_hack = no

with_specialix_jetstream_hack = no

with_cisco_vsa_hack = no

with_alvarion_vsa_hack = no

}

Module: Linked to module rlm_sql

Module: Instantiating sql_instance1

sql sql_instance1 {

driver = "rlm_sql_mysql"

server = "localhost"

port = ""

login = "radius"

password = "lozinka"

radius_db = "radius"

read_groups = yes

sqltrace = no

sqltracefile = "/var/log/radius/sqltrace.sql"

readclients = no

deletestalesessions = yes

num_sql_socks = 10

sql_user_name = "%{User-Name}"

default_user_profile = ""

nas_query = "SELECT id,nasname,shortname,type,secret FROM nas"

authorize_check_query = "SELECT id, username, attribute, value, op FROM 
radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"

authorize_reply_query = "SELECT id, username, attribute, value, op FROM 
radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"

authorize_group_check_query = "SELECT id, groupname, attribute, value, op 
FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id"

authorize_group_reply_query = "SELECT id, groupname, attribute, value, op 
FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id"

accounting_onoff_query = "UPDATE radacct SET acctstoptime = '%S', 
acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), 
acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = 
%{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL 
AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'"

accounting_update_query = "UPDATE radacct SET framedipaddress = 
'%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', 
acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | 
'%{%{Acct-Input-Octets}:-0}', acctoutputoctets = 
'%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE 
acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND 
nasipaddress = '%{NAS-IP-Address}'"

accounting_update_query_alt = "INSERT INTO radacct (acctsessionid, 
acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, 
acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, 
acctinputoctets, acctoutputoctets, calledstationid, callingstationid, 
servicetype, framedprotocol, framedipaddress, acctstartdelay, 
xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', 
'%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', 
'%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', 
INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), 
'%{Acct-Session-Time}', '%{Acct-Authentic}', '', 
'%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', 
'%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', 
'%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', 
'%{Framed-Protocol}', '%{Framed-IP-Address}', '0', 
'%{X-Ascend-Session-Svr-Key}')"

accounting_start_query = ""

accounting_start_query_alt = "UPDATE radacct SET acctstarttime = '%S', 
acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = 
'%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = 
'%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"

accounting_stop_query = "UPDATE radacct SET acctstoptime = '%S', 
acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = 
'%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', 
acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | 
'%{%{Acct-Output-Octets}:-0}', acctterminatecause = 
'%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', 
connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = 
'%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = 
'%{NAS-IP-Address}'"

accounting_stop_query_alt = "INSERT INTO radacct (acctsessionid, 
acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, 
acctstarttime, acctstoptime, acctsessiontime, acctauthentic, 
connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, 
calledstationid, callingstationid, acctterminatecause, servicetype, 
framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES 
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', 
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', 
DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + 
%{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', 
'%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' 
<< 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 
| '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', 
'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', 
'%{Framed-Protocol}', '%{Framed-IP-Address}', '0', 
'%{%{Acct-Delay-Time}:-0}')"

group_membership_query = "SELECT groupname FROM radusergroup WHERE username 
= '%{SQL-User-Name}' ORDER BY priority"

connect_failure_retry_delay = 2

simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = 
'%{SQL-User-Name}' AND acctstoptime = NULL"

simul_verify_query = "SELECT radacctid, acctsessionid, username, 
nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol 
FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL"

postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) 
VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', 
'%{reply:Packet-Type}', '%S')"

safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"

}

rlm_sql (sql_instance1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded 
and linked

rlm_sql (sql_instance1): Attempting to connect to radius@localhost:/radius

rlm_sql (sql_instance1): starting 0

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #0

rlm_sql_mysql: Starting connect to MySQL server for #0

rlm_sql (sql_instance1): Connected new DB handle, #0

rlm_sql (sql_instance1): starting 1

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #1

rlm_sql_mysql: Starting connect to MySQL server for #1

rlm_sql (sql_instance1): Connected new DB handle, #1

rlm_sql (sql_instance1): starting 2

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #2

rlm_sql_mysql: Starting connect to MySQL server for #2

rlm_sql (sql_instance1): Connected new DB handle, #2

rlm_sql (sql_instance1): starting 3

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #3

rlm_sql_mysql: Starting connect to MySQL server for #3

rlm_sql (sql_instance1): Connected new DB handle, #3

rlm_sql (sql_instance1): starting 4

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #4

rlm_sql_mysql: Starting connect to MySQL server for #4

rlm_sql (sql_instance1): Connected new DB handle, #4

rlm_sql (sql_instance1): starting 5

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #5

rlm_sql_mysql: Starting connect to MySQL server for #5

rlm_sql (sql_instance1): Connected new DB handle, #5

rlm_sql (sql_instance1): starting 6

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #6

rlm_sql_mysql: Starting connect to MySQL server for #6

rlm_sql (sql_instance1): Connected new DB handle, #6

rlm_sql (sql_instance1): starting 7

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #7

rlm_sql_mysql: Starting connect to MySQL server for #7

rlm_sql (sql_instance1): Connected new DB handle, #7

rlm_sql (sql_instance1): starting 8

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #8

rlm_sql_mysql: Starting connect to MySQL server for #8

rlm_sql (sql_instance1): Connected new DB handle, #8

rlm_sql (sql_instance1): starting 9

rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #9

rlm_sql_mysql: Starting connect to MySQL server for #9

rlm_sql (sql_instance1): Connected new DB handle, #9

Module: Checking preacct {...} for more modules to load

Module: Linked to module rlm_acct_unique

Module: Instantiating acct_unique

acct_unique {

key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address"

}

Module: Checking accounting {...} for more modules to load

Module: Linked to module rlm_detail

Module: Instantiating detail

detail {

detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"

header = "%t"

detailperm = 384

dirperm = 493

locking = no

log_packet_header = no

}

Module: Instantiating sql_instance2

sql sql_instance2 {

driver = "rlm_sql_mysql"

server = "localhost"

port = ""

login = "radius"

password = "lozinka"

radius_db = "radius"

read_groups = yes

sqltrace = no

sqltracefile = "/var/log/radius/sqltrace.sql"

readclients = no

deletestalesessions = yes

num_sql_socks = 5

sql_user_name = "%{User-Name}"

default_user_profile = ""

nas_query = "SELECT id,nasname,shortname,type,secret FROM nas"

authorize_check_query = ""

authorize_reply_query = ""

authorize_group_check_query = ""

authorize_group_reply_query = ""

accounting_onoff_query = ""

accounting_update_query = ""

accounting_update_query_alt = ""

accounting_start_query = "INSERT INTO online VALUES('%{User-Name}','%S')"

accounting_start_query_alt = ""

accounting_stop_query = "DELETE FROM online WHERE username='%{User-Name}'"

accounting_stop_query_alt = ""

connect_failure_retry_delay = 2

simul_count_query = ""

simul_verify_query = ""

postauth_query = ""

safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"

}

rlm_sql (sql_instance2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded 
and linked

rlm_sql (sql_instance2): Attempting to connect to radius@localhost:/radius

rlm_sql (sql_instance2): starting 0

rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #0

rlm_sql_mysql: Starting connect to MySQL server for #0

rlm_sql (sql_instance2): Connected new DB handle, #0

rlm_sql (sql_instance2): starting 1

rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #1

rlm_sql_mysql: Starting connect to MySQL server for #1

rlm_sql (sql_instance2): Connected new DB handle, #1

rlm_sql (sql_instance2): starting 2

rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #2

rlm_sql_mysql: Starting connect to MySQL server for #2

rlm_sql (sql_instance2): Connected new DB handle, #2

rlm_sql (sql_instance2): starting 3

rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #3

rlm_sql_mysql: Starting connect to MySQL server for #3

rlm_sql (sql_instance2): Connected new DB handle, #3

rlm_sql (sql_instance2): starting 4

rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #4

rlm_sql_mysql: Starting connect to MySQL server for #4

rlm_sql (sql_instance2): Connected new DB handle, #4

Module: Instantiating sql_instance3

sql sql_instance3 {

driver = "rlm_sql_mysql"

server = "localhost"

port = ""

login = "radius"

password = "lozinka"

radius_db = "radius"

read_groups = yes

sqltrace = no

sqltracefile = "/var/log/radius/sqltrace.sql"

readclients = no

deletestalesessions = yes

num_sql_socks = 5

sql_user_name = "%{User-Name}"

default_user_profile = ""

nas_query = "SELECT id,nasname,shortname,type,secret FROM nas"

authorize_check_query = ""

authorize_reply_query = ""

authorize_group_check_query = ""

authorize_group_reply_query = ""

accounting_onoff_query = ""

accounting_update_query = ""

accounting_update_query_alt = ""

accounting_start_query = "UPDATE status SET status=1 where 
username='%{User-Name}'"

accounting_start_query_alt = ""

accounting_stop_query = "UPDATE status SET status=0 where 
username='%{User-Name}'"

accounting_stop_query_alt = ""

connect_failure_retry_delay = 2

simul_count_query = ""

simul_verify_query = ""

postauth_query = ""

safe-characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"

}

rlm_sql (sql_instance3): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded 
and linked

rlm_sql (sql_instance3): Attempting to connect to radius@localhost:/radius

rlm_sql (sql_instance3): starting 0

rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #0

rlm_sql_mysql: Starting connect to MySQL server for #0

rlm_sql (sql_instance3): Connected new DB handle, #0

rlm_sql (sql_instance3): starting 1

rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #1

rlm_sql_mysql: Starting connect to MySQL server for #1

rlm_sql (sql_instance3): Connected new DB handle, #1

rlm_sql (sql_instance3): starting 2

rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #2

rlm_sql_mysql: Starting connect to MySQL server for #2

rlm_sql (sql_instance3): Connected new DB handle, #2

rlm_sql (sql_instance3): starting 3

rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #3

rlm_sql_mysql: Starting connect to MySQL server for #3

rlm_sql (sql_instance3): Connected new DB handle, #3

rlm_sql (sql_instance3): starting 4

rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #4

rlm_sql_mysql: Starting connect to MySQL server for #4

rlm_sql (sql_instance3): Connected new DB handle, #4

Module: Linked to module rlm_attr_filter

Module: Instantiating attr_filter.accounting_response

attr_filter attr_filter.accounting_response {

attrsfile = "/etc/raddb/attrs.accounting_response"

key = "%{User-Name}"

}

Module: Checking session {...} for more modules to load

Module: Linked to module rlm_radutmp

Module: Instantiating radutmp

radutmp {

filename = "/var/log/radius/radutmp"

username = "%{User-Name}"

case_sensitive = yes

check_with_nas = yes

perm = 384

callerid = yes

}

Module: Checking post-auth {...} for more modules to load

Module: Linked to module rlm_ippool

Module: Instantiating main_pool

ippool main_pool {

session-db = "/etc/raddb/db.ippool"

ip-index = "/etc/raddb/db.ipindex"

key = "%{NAS-IP-Address} %{NAS-Port}"

range-start = 192.168.1.100

range-stop = 192.168.1.254

netmask = 255.255.255.255

cache-size = 154

override = no

maximum-timeout = 0

}

Module: Instantiating attr_filter.access_reject

attr_filter attr_filter.access_reject {

attrsfile = "/etc/raddb/attrs.access_reject"

key = "%{User-Name}"

}

}

}

radiusd: #### Opening IP addresses and Ports ####

listen {

type = "auth"

ipaddr = *

port = 1812

}

listen {

type = "acct"

ipaddr = *

port = 0

}

main {

snmp = no

smux_password = ""

snmp_write_access = no

}

Listening on authentication address * port 1812

Listening on accounting address * port 1813

Ready to process requests.

rad_recv: Access-Request packet from host 192.168.1.1 port 1812, id=76, 
length=57

User-Name = "testuser"

CHAP-Password = 0xc51357f23c896c36ac81e6237b4934c122

NAS-IP-Address = 212.200.103.3

+- entering group authorize

++[preprocess] returns ok

rlm_chap: Setting 'Auth-Type := CHAP'

++[chap] returns ok

expand: %{User-Name} -> testuser

rlm_sql (sql_instance1): sql_set_user escaped user --> 'testuser'

rlm_sql (sql_instance1): Reserving sql socket id: 9

expand: SELECT id, username, attribute, value, op FROM radcheck WHERE 
username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, 
value, op FROM radcheck WHERE username = 'testuser' ORDER BY id

rlm_sql (sql_instance1): User found in radcheck table

expand: SELECT id, username, attribute, value, op FROM radreply WHERE 
username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, 
value, op FROM radreply WHERE username = 'testuser' ORDER BY id

expand: SELECT groupname FROM radusergroup WHERE username = 
'%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup 
WHERE username = 'testuser' ORDER BY priority

expand: SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE 
groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, 
value, op FROM radgroupcheck WHERE groupname = 'VPNUsers' ORDER BY id

rlm_sql (sql_instance1): Released sql socket id: 9

++[sql_instance1] returns ok

rad_check_password: Found Auth-Type CHAP

auth: type "CHAP"

+- entering group CHAP

rlm_chap: login attempt by "testuser" with CHAP password

rlm_chap: Using clear text password "nipal28ilula" for user nipalilula 
authentication.

rlm_chap: Password check failed

++[chap] returns reject

auth: Failed to validate the user.

Login incorrect (rlm_chap: Wrong user password): 
[nipalilula/<CHAP-Password>] (from client LocalRouter port 0)

Found Post-Auth-Type Reject

+- entering group REJECT

expand: %{User-Name} -> testuser

attr_filter: Matched entry DEFAULT at line 11

++[attr_filter.access_reject] returns updated

Sending Access-Reject of id 76 to 192.168.1.1 port 1812

Finished request 0.

Going to the next request

Waking up in 0.9 seconds.

Waking up in 4.0 seconds.

Cleaning up request 0 ID 76 with timestamp +78

Ready to process requests.

*********************************************************************************************

THX in advance....
...
From: "Ivan Kalik" <tnt@kalik.net>
Subject: Re: FreeRad 2.0.2, l2tp & CHAP problem
To: "FreeRadius users mailing list"
<freeradius-users@lists.freeradius.org>
Message-ID: <zHhPuP8b.1206438461.5050800.tnt@kalik.co.yu>
Content-Type: text/plain; charset=ISO-8859-2
Is the password in the database encrypted? If it is:
http://deployingradius.com/documents/protocols/compatibility.html
If it isn't - post the radiusd -X debug.
Ivan Kalik
Kalik Informatika ISP

Re: Freeradius-Users Digest, Vol 35, Issue 80

srdjan mish