AAA Services with multiple SQL
I've configured my freeradius conf files to accept Authorization and Accounting Request using two different sql instances and driving them with Realms, looking at various posts about this argument. It works with accounting, but not with authorization. I've run freeradius in debug mode (freeradius -x) and i saw that it loads the right sql instance depending the right realm, but it EVER gives "wrong username and password" despite i copy the sql query that i see in the debug and i get my username!!!!!! ### radiusd.conf authorize { Autz-Type wic { wic } Autz-Type no { no } } ### users DEFAULT Mikrotik-Realm == "wic", Autz-Type := "wic" DEFAULT Mikrotik-Realm == "novara", Autz-Type := "no" and in my NAS i put that realms.... -- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a1383323... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Paolo Serafino Via wrote: ...
I've run freeradius in debug mode (freeradius -x) and i saw that it loads the right sql instance depending the right realm, but it EVER gives "wrong username and password" despite i copy the sql query that i see in the debug and i get my username!!!!!!
Debug mode is "-X". This is mentioned in the FAQ, README, INSTALL, and daily on this list. Post the debug output here. That's the only way to solve it.
### radiusd.conf authorize { ...
And no "files" module..
### users
Which is read only if the "files" module is run. Alan DeKok.
my authorize section has "files" entry too...sorry for this lack.... ok i've used freeradius -X it seems to give me other info...but still problems to understand: why gives me an error on processing password using Auth-Type := System, i'have no entry with that! here is the flow for this request: rad_recv: Access-Request packet from host 192.168.1.159:1026, id=2, length=208 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:15:00:4A:1E:DB" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "paolo" NAS-Port = 2159017987 Acct-Session-Id = "80b00003" Framed-IP-Address = 172.20.20.126 Mikrotik-Attr-10 = 0xac14147e CHAP-Challenge = 0x693b0be4addb3334aa2f339ffdf81223 CHAP-Password = 0x5d5b150a3b83260c74b7a73469f21de54f Service-Type = Login-User WISPr-Logoff-URL = "http://172.20.20.1/logout" NAS-Identifier = "HOTTEST" NAS-IP-Address = 192.168.1.159 Mikrotik-Realm = "novara" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "paolo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 202 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 Found Autz-Type no Processing the authorize section of radiusd.conf modcall: entering group no for request 2 radius_xlat: 'paolo' rlm_sql (no): sql_set_user escaped user --> 'paolo' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'paolo' ORDER BY id' rlm_sql (no): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'paolo' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'paolo' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'paolo' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (no): Released sql socket id: 1 modcall[authorize]: module "no" returns ok for request 2 modcall: leaving group no (returns ok) for request 2 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [paolo] (from client HOTTEST port 2159017987 cli 00:15:00:4A:1E:DB) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.1.159:1026, id=2, length=208 Sending Access-Reject of id 2 to 192.168.1.159 port 1026 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 2 with timestamp 47418827 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a1383583... Sent from the FreeRadius - User mailing list archive at Nabble.com.
There is an entry in users file setting Auth-Type System. Comment it out. Ivan Kalik Kalik Informatika ISP Dana 19/11/2007, "Paolo Serafino Via" <paolo.via@halservice.it> piše:
my authorize section has "files" entry too...sorry for this lack....
ok i've used freeradius -X it seems to give me other info...but still problems to understand: why gives me an error on processing password using Auth-Type := System, i'have no entry with that!
here is the flow for this request:
rad_recv: Access-Request packet from host 192.168.1.159:1026, id=2, length=208 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:15:00:4A:1E:DB" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "paolo" NAS-Port = 2159017987 Acct-Session-Id = "80b00003" Framed-IP-Address = 172.20.20.126 Mikrotik-Attr-10 = 0xac14147e CHAP-Challenge = 0x693b0be4addb3334aa2f339ffdf81223 CHAP-Password = 0x5d5b150a3b83260c74b7a73469f21de54f Service-Type = Login-User WISPr-Logoff-URL = "http://172.20.20.1/logout" NAS-Identifier = "HOTTEST" NAS-IP-Address = 192.168.1.159 Mikrotik-Realm = "novara" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "paolo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 202 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 Found Autz-Type no Processing the authorize section of radiusd.conf modcall: entering group no for request 2 radius_xlat: 'paolo' rlm_sql (no): sql_set_user escaped user --> 'paolo' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'paolo' ORDER BY id' rlm_sql (no): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'paolo' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'paolo' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'paolo' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'paolo' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (no): Released sql socket id: 1 modcall[authorize]: module "no" returns ok for request 2 modcall: leaving group no (returns ok) for request 2 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [paolo] (from client HOTTEST port 2159017987 cli 00:15:00:4A:1E:DB) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.1.159:1026, id=2, length=208 Sending Access-Reject of id 2 to 192.168.1.159 port 1026 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 2 with timestamp 47418827 Nothing to do. Sleeping until we see a request.
-- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a1383583... Sent from the FreeRadius - User mailing list archive at Nabble.com.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Now it's perfect! before using realms i didn't use users file! so when i commented out users in authorize it took System AUth-Type too!! thank you to all! Paolo -- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a1383616... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
my authorize section has "files" entry too...sorry for this lack....
ok i've used freeradius -X it seems to give me other info...but still problems to understand: why gives me an error on processing password using Auth-Type := System, i'have no entry with that!
if your 'users' file does not contain DEFAULT Auth-Type := System then you are not looking at the right users file - check what users file freeradius is REALLY using. alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Paolo Serafino Via -
tnt＠kalik.co.yu