User authentication - users config file and MySQL databases
Hello all I would like to transfer all the configured users in the user conf file to MySQL database, is it possible? I've configured Radius to work with MySQL and created a test user in radcheck database with a test password. Folllow the entry. username - testeattribute - cleartext-passwordop - :=value - teste I also created an entry in radreply database the following entry. username - testeattribute - fall-throughop - =value - yes For this test all others databases are empty. I've started freeradius in debug mode to see if there where any erros, but there wasn't. The log file output. Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnelTue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669Tue Sep 8 23:53:00 2015 : Info: Ready to process requests. After radius server was running I tested if the user, teste, was going to be authenticated, and it wasn't. I've received an Reject message. Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=147, length=20 Neither the debug or the log show if Freeradius was searching for this user to the user conf file or in MySQL databases. Since in radius documentation states that if the user is not found it is reject, I wonder where is it searching. Is not clear if it is only searching in the user conf file or if it also searching in radckeck database. Is it possible to add in the debug or in log file where Freeradius is searching for the user? When I test the authentication with an user, teste1, configured in the user conf file, it was accepted. root@Ubuntu-Radius-Server:~# radtest teste1 teste localhost 1812 testing123Sending Access-Request of id 210 to 127.0.0.1 port 1812 User-Name = "teste1" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=210, length=20 I didn't found in the radiusd.conf file or in the sql.conf file a way to configure Radius to force it to use the MySQL databases to authenticate the users. Is it possible to configure it? Thanks for the help. Regards Alex
On Sep 9, 2015, at 10:26 AM, Alexandre Vilarinho <vilarinhomail-dev@yahoo.com.br> wrote:
I would like to transfer all the configured users in the user conf file to MySQL database, is it possible?
If you do it right.
I've configured Radius to work with MySQL and created a test user in radcheck database with a test password. Folllow the entry. username - testeattribute - cleartext-passwordop - :=value - teste I also created an entry in radreply database the following entry. username - testeattribute - fall-throughop - =value - yes For this test all others databases are empty. I've started freeradius in debug mode to see if there where any erros, but there wasn't. The log file output. Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnelTue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669Tue Sep 8 23:53:00 2015 : Info: Ready to process requests.
a) horrible formatted. It isn't difficult to fix that. b) it doesn't show the server receiving any packets. i.e. the debug output is completely useless.
After radius server was running I tested if the user, teste, was going to be authenticated, and it wasn't. I've received an Reject message.
We don't care about the output from the client. We DO care that people follow instructions.
Neither the debug or the log show if Freeradius was searching for this user to the user conf file or in MySQL databases.
Because you didn't read the debug output from when the server RECEIVED A PACKET. That's the entire reason for running it in debug mode. To see what happens when the server RECEIVES A PACKET. Good luck solving the problem. You're going to need it. I've been trying to help you, and you haven't followed simple instructions. So there's nothing more I can do for you. Alan DeKok.
Yes. It's possible. If you don't see the server using mysql and see the process occurring in debug then you are not calling mysql where its needed (ensure you have calls to sql in the authenticate section! ) alan
I could be wrong but in the following output from Freeradius -X, doesn’t it shows the link between freeradius and mysql? rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Released sql socket id: 4 Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 41681 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. I’ve checked the inner-tunnel file and I’ve found that in says to see “Authorization Queries” and “Authentication logging queries” in sql.conf, but when i search for them in my sql.conf but when I search for them in the sql.conf file I find the following. # Allow for storing data after authentication postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = “radusergroup” Do I need to add anything else? Regards Alex
On 09/09/2015, at 12:27, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Yes. It's possible. If you don't see the server using mysql and see the process occurring in debug then you are not calling mysql where its needed (ensure you have calls to sql in the authenticate section! )
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Your debug shows FR connected to mysql To actually USE mysql in the process you need to ensure you have calls to sql in your virtual servers (default/inner-tunnel by default) alan
Alan I didn’t quit understand how can I do that. In the inner-tunnel file I have uncomment most of the lines that reference SQL. Do I have do add another line? Unfortunately is not that obvious to me. Alex
On 09/09/2015, at 13:51, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Your debug shows FR connected to mysql
To actually USE mysql in the process you need to ensure you have calls to sql in your virtual servers (default/inner-tunnel by default)
alan
Buy this book. It teaches you how to: FreeRADIUS Beginner's Guide You can't test blindly.
Alan
I didn’t quit understand how can I do that.
In the inner-tunnel file I have uncomment most of the lines that reference SQL. Do I have do add another line?
Unfortunately is not that obvious to me.
Alex
On 09/09/2015, at 13:51, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Your debug shows FR connected to mysql
To actually USE mysql in the process you need to ensure you have calls to sql in your virtual servers (default/inner-tunnel by default)
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Timmy I didn’t, I just past me.. I’ve read several times and I didn’t saw it. Only after the test was successful that I saw it, unfortunately. Thanks for the help. Regards
On 09/09/2015, at 14:58, Timmy <moonyhk@netscape.net> wrote:
Buy this book. It teaches you how to: FreeRADIUS Beginner's Guide
You can't test blindly.
Alan
I didn’t quit understand how can I do that.
In the inner-tunnel file I have uncomment most of the lines that reference SQL. Do I have do add another line?
Unfortunately is not that obvious to me.
Alex
On 09/09/2015, at 13:51, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Your debug shows FR connected to mysql
To actually USE mysql in the process you need to ensure you have calls to sql in your virtual servers (default/inner-tunnel by default)
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
I didn’t quit understand how can I do that.
In the inner-tunnel file I have uncomment most of the lines that reference SQL. Do I have do add another line?
are you using inner-tunnel? - ie what authentication method are you using? show the full debug the server comes with inline documentation - you'll see the lines that have # sql uncomment those where needed. alan
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Alan DeKok -
Alexandre Oliveira -
Alexandre Vilarinho -
Timmy