problem with freeeradius, mysql setup
Hi all, I have some problems setting up Freeradius 1.1.3, with mysql 3.23.54 on Redhat9. Here's the log for radiusd (relevant part): Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=216, length=57 User-Name = "test1" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 500 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [test1] modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 216 to 127.0.0.1 port 32769 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 216 with timestamp 4559bead Nothing to do. Sleeping until we see a request. On the mysql front all seems good: mysql -u dialup_admin -ppassword -D radius Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 134 to server version: 3.23.54-log Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id; +----+----------+---------------+----------+----+ | id | UserName | Attribute | Value | op | +----+----------+---------------+----------+----+ | 3 | test1 | User-Password | password | := | +----+----------+---------------+----------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------+----+ | 1 | retea | Simultaneous-Use | 1 | = | | 2 | retea | Auth-Type | Local | := | +----+-----------+------------------+-------+----+ 2 rows in set (0.01 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id; +----+----------+--------------------+----------------+----+ | id | UserName | Attribute | Value | op | +----+----------+--------------------+----------------+----+ | 7 | test1 | Framed-Compression | NONE | = | | 8 | test1 | Service-Type | Framed | = | | 10 | test1 | Framed-IP-Address | 193.226.57.105 | = | | 11 | test1 | Framed-IP-Netmask | 255.255.255.0 | = | | 12 | test1 | Framed-MTU | 1492 | = | +----+----------+--------------------+----------------+----+ 5 rows in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+-------------------+-----------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+-----------------+----+ | 1 | retea | Framed-Protocol | PPP | = | | 2 | retea | Port-Limit | 1 | = | | 3 | retea | Framed-IP-Address | 255.255.255.254 | = | | 4 | retea | Framed-MTU | 1492 | = | | 5 | retea | Service-Type | Framed | = | +----+-----------+-------------------+-----------------+----+ 5 rows in set (0.01 sec) Do you have any idea why is it failing? Thanks, Alex
mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupch eck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------+----+
| id | GroupName | Attribute | Value | op |
+----+-----------+------------------+-------+----+
| 1 | retea | Simultaneous-Use | 1 | = | | 2 | retea | Auth-Type | Local | := |
+----+-----------+------------------+-------+----+ 2 rows in set (0.01 sec)
Simultaneous-Use should have the op := -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Thank you, that was it! Still, I'll be gratefull if somebody can point me into right direction with some documentation describing what Attributes -Type -Values are more usually used. That's besides the dictionaries... One last tought: I think Freeradius could de improved if in debug mode caould say what is the sql result it doesn't like. Regards, Alex Stefan Winter wrote:
mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupch eck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------+----+
| id | GroupName | Attribute | Value | op |
+----+-----------+------------------+-------+----+
| 1 | retea | Simultaneous-Use | 1 | = | | 2 | retea | Auth-Type | Local | := |
+----+-----------+------------------+-------+----+ 2 rows in set (0.01 sec)
Simultaneous-Use should have the op :=
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alexandru Matei <alex@qb.ro> wrote:
One last tought: I think Freeradius could de improved if in debug mode caould say what is the sql result it doesn't like.
Sure. Send a patch. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi again, I run into trouble again. I want to authenticate with chap and radius failed with: rad_recv: Access-Request packet from host 127.0.0.1:32769, id=110, length=70 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test1" CHAP-Password = 0xfaf5457967797fc6264e6925d24689d299 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 14 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 14 modcall: leaving group authorize (returns ok) for request 14 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 14 rlm_chap: login attempt by "test1" with CHAP password rlm_chap: Using clear text password password for user test1 authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 14 modcall: leaving group CHAP (returns reject) for request 14 auth: Failed to validate the user. I don't undrestand why in "rlm_chap: login attempt by "test1" with CHAP password" the password isn't listed, altough the freeradius is in debug mode. Alex Alexandru Matei wrote:
Thank you, that was it! Still, I'll be gratefull if somebody can point me into right direction with some documentation describing what Attributes -Type -Values are more usually used. That's besides the dictionaries... One last tought: I think Freeradius could de improved if in debug mode caould say what is the sql result it doesn't like.
Regards, Alex Stefan Winter wrote:
I don't undrestand why in "rlm_chap: login attempt by "test1" with CHAP password" the password isn't listed, altough the freeradius is in debug mode.
The CHAP-Password is listed (sortof): the packet dump of the incoming packet contains it. The clear-text password that is used to authenticate the user is not listed because it comes from mySQL, and the query results aren't shown. The failed login very probably is because the password on the client side was wrong. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
participants (3)
-
Alan DeKok -
Alexandru Matei -
Stefan Winter