radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?
Hi, I have configured FR to connect to a backend MySQL DB which authenticates the NAS fine.... I removed the /etc/raddb/clients.conf file from the relevant places within the FR configuration. The setup I am trying to get working will use the DaloRADIUS web-ui frontend to setup users for MAB. Currently I have DaloRADIUS installed and setup to what I believe is properly as I can connect to the MySQL DB and create users in DR which appear in the MySQL DB. Additionally I have configured the NAS within DR which also works fine as radiusd -X doesn't suggest any type of NAS authentication error. My issue is that I am getting a "user not found" error with regards to the SQL DB backend. I have followed ever step of this guide: http://wiki.freeradius.org/SQL-HOWTO and configured appropriately to the instructions. This is the output of the MySQL radcheck table: mysql> select * from radcheck; +----+--------------+-------------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+-------------------------+----+----------+ | 1 | 0015c5537baa | Auth-Type | := | Accept | | 2 | 0015c5537baa | Tunnel-Type | = | VLAN | | 3 | 0015c5537baa | Tunnel-Medium-Type | = | IEEE-802 | | 4 | 0015c5537baa | Tunnel-Private-Group-Id | = | 20 | | 5 | 0015c5537baa | Tunnel-Preference | = | 0x000000 | +----+--------------+-------------------------+----+----------+ 5 rows in set (0.00 sec) The only difference between this and the wiki guide I can see is that examples on the wiki use capital lettering for the table headers.... (this might be my issue)?? Wiki example output: mysql> select * from radcheck; +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ Using radiusd -X I am getting this response: Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=120, length=159 User-Name = "0015c5537baa" User-Password = "0015c5537baa" Service-Type = Call-Check Framed-MTU = 1500 Called-Station-Id = "00-1B-8F-60-AB-8D" Calling-Station-Id = "00-15-C5-53-7B-AA" Message-Authenticator = 0x367e5a0d693f65b22391b00913162cc7 NAS-Port-Type = Ethernet NAS-Port = 50013 NAS-Port-Id = "GigabitEthernet0/13" NAS-IP-Address = 10.0.0.1 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [sql] expand: %{User-Name} -> 0015c5537baa [sql] sql_set_user escaped user --> '0015c5537baa' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0015c5537baa' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0015c5537baa' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User 0015c5537baa not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. I have attached the full file as an extra:
From the information above, the User-Name attribute is being passed to FR and being checked on the MySQL backend, however "Not Found" meaning that from the MySQL radcheck output - that either it isn't connecting to the DB in regards to the User-Name portion or that somehow there is malformed information in there.
As per the attached file the FreeRADIUS version is 2.1.10 running on CentOS 6.2 x64 build. The rlm_sql driver seems to be connecting to the DB (as stated the NAS is recognized after it has been provisioned within DaloRADIUS): rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=10.0.0.1,shortname=Switch,secret=pass rlm_sql (sql): Adding client 10.0.0.1 (Switch, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Would anybody be able to help me understand where the issue lies and perhaps how to correct it? Many thanks! Regards, Kaya
On Tue, Jul 31, 2012 at 11:31 PM, Kaya Saman <kayasaman@gmail.com> wrote:
mysql> select * from radcheck; +----+--------------+-------------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+-------------------------+----+----------+ | 1 | 0015c5537baa | Auth-Type | := | Accept |
Is this intentional? You DO know what setting that means, right?
| 2 | 0015c5537baa | Tunnel-Type | = | VLAN | | 3 | 0015c5537baa | Tunnel-Medium-Type | = | IEEE-802 | | 4 | 0015c5537baa | Tunnel-Private-Group-Id | = | 20 | | 5 | 0015c5537baa | Tunnel-Preference | = | 0x000000 | +----+--------------+-------------------------+----+----------+
I'd suggest you change "=" to ":=", but it looks like you don't know what the tables are for, as AFAIK those attributes should be in radreply (also with ":="), not in radcheck. So just delete those rows for now. I highly suggest you re-read the documentation, including the included doc/rlm_sql (also available on https://github.com/alandekok/freeradius-server/blob/v2.1.x/doc/rlm_sql) -- Fajar
On Tue, Jul 31, 2012 at 6:25 PM, Fajar A. Nugraha <list@fajar.net> wrote:
On Tue, Jul 31, 2012 at 11:31 PM, Kaya Saman <kayasaman@gmail.com> wrote:
mysql> select * from radcheck; +----+--------------+-------------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+-------------------------+----+----------+ | 1 | 0015c5537baa | Auth-Type | := | Accept |
Is this intentional? You DO know what setting that means, right?
I am not 100% sure what this attribute means.... I however didn't include it - I think DaloRADIUS put that in. I used the MAC address authentication portion in DaloRADIUS when creating the user. I would think that it simple 'accepts' the username 0015.... without any other checks etc.... It does however come up here: http://wiki.freeradius.org/Mac-Auth/693d45c56f0152ba1e0e0166f525f10a2e7cd74b and it is stated that it shouldn't be used for dot1x which is what I am trying to use it with.
| 2 | 0015c5537baa | Tunnel-Type | = | VLAN | | 3 | 0015c5537baa | Tunnel-Medium-Type | = | IEEE-802 | | 4 | 0015c5537baa | Tunnel-Private-Group-Id | = | 20 | | 5 | 0015c5537baa | Tunnel-Preference | = | 0x000000 | +----+--------------+-------------------------+----+----------+
I'd suggest you change "=" to ":=", but it looks like you don't know what the tables are for, as AFAIK those attributes should be in radreply (also with ":="), not in radcheck. So just delete those rows for now.
Yes good observation - I am still learning RADIUS and don't have much experience as a professional admin either but I am eager to learn though I know it will be a long and hard road :-) In the meantime I applied the settings you suggested by putting in the := instead of = and also using REPLY too over CHECK. It is now working :-) eth0 Link encap:Ethernet HWaddr 00:15:C5:53:7B:AA inet addr:10.10.10.3 without having MAB enabled on the switch the default subnet the system goes to is on the 10.0.0.0/24 range which is VLAN1 (and what I provisioned my test setup to do) so this is all but perfect! I should have seen from the CHECK or REPLY that it was kind of obvious boolean logic - check if username & password := accept, if yes then respond (reply) with values (defined). - rookie mistake :-)
I highly suggest you re-read the documentation, including the included doc/rlm_sql (also available on https://github.com/alandekok/freeradius-server/blob/v2.1.x/doc/rlm_sql)
Many thanks for this! P.s. since information on FreeRADIUS is quite sparse and takes a lot of practiced knowledge and experience - what is the best way for a beginner to understand the fundamental concepts of the MySQL tables and the types of information that RADIUS can dish out, as obviously it is quite versatile and can be used from Wireless hotspots to ISP's? As stated I am keen and interested but while most people on this list have n amount of years experience I still haven't clocked 1 year yet.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Best Regards, Kaya
On Wed, Aug 1, 2012 at 1:22 AM, Kaya Saman <kayasaman@gmail.com> wrote:
what is the best way for a beginner to understand the fundamental concepts of the MySQL tables and the types of information that RADIUS can dish out
The usual: included docs, wiki, the list. It usually helps if you have a use case in mind ("This is what I want. How can I do that?") instead of "tell me everything that FR can do". -- Fajar
On 07/31/2012 10:50 PM, Fajar A. Nugraha wrote:
On Wed, Aug 1, 2012 at 1:22 AM, Kaya Saman <kayasaman@gmail.com> wrote:
what is the best way for a beginner to understand the fundamental concepts of the MySQL tables and the types of information that RADIUS can dish out The usual: included docs, wiki, the list.
It usually helps if you have a use case in mind ("This is what I want. How can I do that?") instead of "tell me everything that FR can do".
Thanks Fajar..... I appreciate the response. Currently my use case is basic MAB to get rid of VMPS which I got working thanks to Alan Buxey's help! From what I can see it's quite non-complex config though one needs to understand the process of how RADIUS works and additionally the 'radius' way of doing things rather then say, a corporate network vendor way. For now I have all the pieces to my jigsaw puzzle, minus defining a VLAN (tunnel ID) of last resort so if FR doesn't recognize the L2 address of a machine it should give it a specific tunnel-ID (VLAN). I'm sure I will just need to Google more and read more, and actually the documentation reminds me quite a bit of the OpenBSD project in that it's quite sparse and high level and really not for beginners. Oh well.... I am really happy to have got this far and now it's just get more experience and learn more :-) Regards, Kaya
On Wed, Aug 1, 2012 at 5:03 AM, Kaya Saman <kayasaman@gmail.com> wrote:
From what I can see it's quite non-complex config though one needs to understand the process of how RADIUS works and additionally the 'radius' way of doing things rather then say, a corporate network vendor way.
This helps: http://wiki.freeradius.org/Concepts
For now I have all the pieces to my jigsaw puzzle, minus defining a VLAN (tunnel ID) of last resort so if FR doesn't recognize the L2 address of a machine it should give it a specific tunnel-ID (VLAN).
There should be many ways to do that. If you assume that "normal" users would always have ONE Tunnel-Private-Group-Id reply attribute (in radreply), then you should be able to use unlang: http://freeradius.org/radiusd/man/unlang.html You would then need to do something like this: - have "sql" module active in authorize block (you should already have that), which would populate reply attributes from rad(group)reply table - under that, have an unlang block that says "if there's no Tunnel-Private-Group-Id attribute in the reply, then add one". Something like (untested) update reply { Tunnel-Private-Group-Id = 10 } Replace the "10" there with whatever your Tunnel-Private-Group-Id for unknown users is, and the "=" operator will "Add the attribute to the list, if and only if an attribute of the same name is not already present in that list" (see unlang man page). -- Fajar
On Wed, Aug 1, 2012 at 4:52 AM, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Aug 1, 2012 at 5:03 AM, Kaya Saman <kayasaman@gmail.com> wrote:
From what I can see it's quite non-complex config though one needs to understand the process of how RADIUS works and additionally the 'radius' way of doing things rather then say, a corporate network vendor way.
This helps: http://wiki.freeradius.org/Concepts
For now I have all the pieces to my jigsaw puzzle, minus defining a VLAN (tunnel ID) of last resort so if FR doesn't recognize the L2 address of a machine it should give it a specific tunnel-ID (VLAN).
There should be many ways to do that. If you assume that "normal" users would always have ONE Tunnel-Private-Group-Id reply attribute (in radreply), then you should be able to use unlang: http://freeradius.org/radiusd/man/unlang.html
You would then need to do something like this: - have "sql" module active in authorize block (you should already have that), which would populate reply attributes from rad(group)reply table - under that, have an unlang block that says "if there's no Tunnel-Private-Group-Id attribute in the reply, then add one". Something like (untested)
update reply { Tunnel-Private-Group-Id = 10 }
Replace the "10" there with whatever your Tunnel-Private-Group-Id for unknown users is, and the "=" operator will "Add the attribute to the list, if and only if an attribute of the same name is not already present in that list" (see unlang man page).
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks a lot Fajar for that!! Unfortunately your suggestion didn't work and reading through the UNLANG doc you sent I came up with this: ...under Authorize section: sql #if (User-Name !== "") { if %{User-Name}:-{ update reply { Tunnel-Private-Group-Id = 80 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Preference = 0x000000 } } Which to my understanding should evaluate the %{User-Name} field and IF there is information in there return with the values provided after.... I'm almost there as I do get that in the response: rlm_sql (sql): Released sql socket id: 3 [sql] User 0015c5537baa not found ++[sql] returns notfound ++? if % Evaluating (%) -> TRUE ++? if % -> TRUE ++- entering if % {...} +++[reply] returns notfound ++- if % returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} ++- group REJECT returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 142 to 10.0.0.1 port 1645 Tunnel-Private-Group-Id:0 = "80" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Preference:0 = 0 Waking up in 4.9 seconds. Cleaning up request 0 ID 142 with timestamp +16 Ready to process requests. But unfortunately the user is getting an Access-Reject ID :-( Could it be that I have failed to include something?? Perhaps: update reply { Access = Accept .... Regards, Kaya
participants (2)
-
Fajar A. Nugraha -
Kaya Saman