FreeRADIUS + MySQL + DHCP Opt82
I need help. Software: FreeRADIUS v2.1.11, MySQL v5.1.61. Hardware: RB SE100 under SEOS-6.4.1.4-Release BRAS sends Opt-82 related attributes in following format: Attributes Agent-* described in radius dictionary as 'octets'. Attributes ADSL-Agent-* described in radius dictionary as 'string'. I was try to store needed data in MySQL database from which Radius gets 'check' attributes: to Radius select that attributes to authenticate. But I got 'Login incorrect' message in Radius log. If I remove both Agent-* attributes from DB (that means that I dont validate Opt-82 parameters) - I got 'Login OK'. I think that I use wrong format for Agent-* attributes, but I was try some different variants without success. I was try to use ADSL-Agent-* instead Agent-* in DB, but I receive 'Login OK' with _any_ attributes values - match and mismatch. So I need help. Very need. And exuse me my english - it is not my native language. -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Fri, Mar 30, 2012 at 4:29 PM, IVB <ivb@is.ua> wrote:
I need help.
Software: FreeRADIUS v2.1.11, MySQL v5.1.61. Hardware: RB SE100 under SEOS-6.4.1.4-Release
BRAS sends Opt-82 related attributes in following format:
What format?
Attributes Agent-* described in radius dictionary as 'octets'. Attributes ADSL-Agent-* described in radius dictionary as 'string'.
AFAIK those are not DHCP dictionary. They're part of "normal" radius dictionary. So you just treat them like any other attribute.
I was try to store needed data in MySQL database from which Radius gets 'check' attributes:
to Radius select that attributes to authenticate. But I got 'Login incorrect' message in Radius log.
If I remove both Agent-* attributes from DB (that means that I dont validate Opt-82 parameters) - I got 'Login OK'.
I think that I use wrong format for Agent-* attributes, but I was try some different variants without success.
I was try to use ADSL-Agent-* instead Agent-* in DB, but I receive 'Login OK' with _any_ attributes values - match and mismatch.
So I need help. Very need.
You need to know what the NAS (i.e. BRAS) sends. An easy way to get that is to run FR in debug mode (-X) while the NAS is sending authentication packet. Then compare to what you have on radcheck. Note the operators (you probably need "=="). Then you need to find out what's going on. Again, debug mode would be the best way. -- Fajar
Fajar A. Nugraha-2 wrote
On Fri, Mar 30, 2012 at 4:29 PM, IVB <ivb@> wrote:
I need help.
Software: FreeRADIUS v2.1.11, MySQL v5.1.61. Hardware: RB SE100 under SEOS-6.4.1.4-Release
BRAS sends Opt-82 related attributes in following format:
What format?
Agent-Remote-Id = 0x0006001e58ab0304 ADSL-Agent-Remote-Id = "\000\006\000\036X\253\003\004" Agent-Circuit-Id = 0x000403fc0001 ADSL-Agent-Circuit-Id = "\000\004\003\374\000\001"
Attributes Agent-* described in radius dictionary as 'octets'. Attributes ADSL-Agent-* described in radius dictionary as 'string'.
AFAIK those are not DHCP dictionary. They're part of "normal" radius dictionary. So you just treat them like any other attribute.
I was try to store needed data in MySQL database from which Radius gets 'check' attributes:
INSERT INTO `radcheck` ( `UserName`, `Attribute`, `Value`, `op` ) VALUES ( '00:12:23:56:78:9A', 'Cleartext-Password', 'Redback', ':=' ), ( '00:12:23:56:78:9A', 'Agent-Circuit-ID', x'000403fc0001', '==' ), ( '00:12:23:56:78:9A', 'Agent-Remote-ID', x'0006001e58ab0304', '==' ) (most important part of message disappears from my post)
to Radius select that attributes to authenticate. But I got 'Login incorrect' message in Radius log.
If I remove both Agent-* attributes from DB (that means that I dont validate Opt-82 parameters) - I got 'Login OK'.
I think that I use wrong format for Agent-* attributes, but I was try some different variants without success.
I was try to use ADSL-Agent-* instead Agent-* in DB, but I receive 'Login OK' with _any_ attributes values - match and mismatch.
So I need help. Very need.
You need to know what the NAS (i.e. BRAS) sends. An easy way to get that is to run FR in debug mode (-X) while the NAS is sending authentication packet.
Yes, I know about debug mode, but BRAS and Radius are in project mode (using PPPoE authorisation now). DHCP testing uses same context and same Radius server. To run different Radius in debug mode I need to configure different context...
Then compare to what you have on radcheck. Note the operators (you probably need "==").
Then you need to find out what's going on. Again, debug mode would be the best way.
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Debug mode help me nothing. When I try to connect without Agent-* attributes in DB, I see in debug output 'User found in radcheck table' after performing "check" SQL. And finally I login successfully. When I try to connect with Agent-* attributes in DB, I don't see message 'User found in radcheck table' after "check" SQL, and "reply" SQL don't executed. And finally I don't login. But I don't see in debug output what exactly was returned in SQL query. -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
IVB wrote:
But I don't see in debug output what exactly was returned in SQL query.
Have you tried running the SQL queries from an SQL client on the command line? That's why they're printed out in debugging mode: so you can see them, and re-run them yourself. Alan DeKok.
Alan DeKok-2 wrote
IVB wrote:
But I don't see in debug output what exactly was returned in SQL query.
Have you tried running the SQL queries from an SQL client on the command line?
That's why they're printed out in debugging mode: so you can see them, and re-run them yourself.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes, I run queries by hand and see results as strings, non-printable chars not printed, but attribute itself has non-zero length. -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Alan DeKok-2 wrote
You can't put binary data into an ASCII "string" field.
But that was my question! FreeRADIUS offers following schema for radcheck table: CREATE TABLE radcheck ( id int(11) unsigned NOT NULL auto_increment, username varchar(64) NOT NULL default '', attribute varchar(64) NOT NULL default '', op char(2) NOT NULL DEFAULT '==', value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY username (username(32)) ) ; So it expects attribute value as varchar. The question is: How I can put Opt82 attributes (which contains non-printable bytes) into database to offer it later for FreeRADIUS using SELECT statement? INSERT INTO `radcheck` ( `UserName`, `Attribute`, `Value`, `op` ) VALUES ( '00:12:23:56:78:9A', 'Cleartext-Password', 'Redback', ':=' ), ( '00:12:23:56:78:9A', 'Agent-Circuit-ID', ?????, '==' ), ( '00:12:23:56:78:9A', 'Agent-Remote-ID', ?????, '==' ) What I must put in place of ????? to be correctly accepted by Radius in following SELECT: SELECT `id`, `UserName`, `Attribute`, `Value`, `op` FROM `radcheck` WHERE `UserName` = '00:12:23:56:78:9A' -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
IVB wrote:
But that was my question! ... How I can put Opt82 attributes (which contains non-printable bytes) into database to offer it later for FreeRADIUS using SELECT statement?
You don't. The database is intended for ASCII data. You could also edit the dictionaries to make the data "octets", which would take care of the problem. Alan DeKok.
Hello Alan, Monday, April 2, 2012, 1:59:03 PM, you wrote: AD> IVB wrote:
But that was my question! AD> ... How I can put Opt82 attributes (which contains non-printable bytes) into database to offer it later for FreeRADIUS using SELECT statement?
AD> You don't. Are you kidding? AD> The database is intended for ASCII data. Are you kidding again? The database is intended for data of any type. Do you mean that FreeRADIUS can't accept non-ASCII data from database? AD> You could also edit the dictionaries to make the data "octets", which AD> would take care of the problem. The dictionaries contains right attributes definitions: ATTRIBUTE Agent-Remote-Id 96 octets ATTRIBUTE Agent-Circuit-Id 97 octets -- Best regards, Igor mailto:ivb@is.ua
Igor Belikov wrote:
AD> You don't.
Are you kidding?
If you insist on going down that path, you'll be unsubscribed and banned. I'm tried of people who can't read the documentation, and who use that ignorance to put me down.
Do you mean that FreeRADIUS can't accept non-ASCII data from database?
It means that FreeRADIUS expects ASCII data from the database. The attribute names and values are all *printable*.
AD> You could also edit the dictionaries to make the data "octets", which AD> would take care of the problem.
The dictionaries contains right attributes definitions:
ATTRIBUTE Agent-Remote-Id 96 octets ATTRIBUTE Agent-Circuit-Id 97 octets
Then you need to read the documentation to see how to represent data type "octets" in the DB and config files. HINT: Look at the debug output. What does it print for data type "octets"? Alan DeKok.
Hello Alan, Monday, April 2, 2012, 2:53:15 PM, you wrote: AD2vF> Igor Belikov wrote:
AD> You don't.
Are you kidding?
AD2vF> If you insist on going down that path, you'll be unsubscribed and AD2vF> banned. I'm tried of people who can't read the documentation, and who AD2vF> use that ignorance to put me down. Please exuse me.
Do you mean that FreeRADIUS can't accept non-ASCII data from database?
AD2vF> It means that FreeRADIUS expects ASCII data from the database. The AD2vF> attribute names and values are all *printable*.
AD> You could also edit the dictionaries to make the data "octets", which AD> would take care of the problem.
The dictionaries contains right attributes definitions:
ATTRIBUTE Agent-Remote-Id 96 octets ATTRIBUTE Agent-Circuit-Id 97 octets
AD2vF> Then you need to read the documentation to see how to represent data AD2vF> type "octets" in the DB and config files. Yes, I will be very happy to read how to represent 'octets' data in DB. And I ask about this several times. I don't find this info in documentation, sorry. Please give me link to right place. -- Best regards, Igor mailto:ivb@is.ua -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Fri, Mar 30, 2012 at 6:12 PM, IVB <ivb@is.ua> wrote:
Agent-Circuit-Id = 0x000403fc0001
let's start with that one.
( '00:12:23:56:78:9A', 'Agent-Circuit-ID', x'000403fc0001', '==' ),
Does that work? Shouldn't it be something like ( '00:12:23:56:78:9A', 'Agent-Circuit-ID', 0x000403fc0001, '==' ), ? Another alternative is to insert something like this (note the operator) ( '00:12:23:56:78:9A', 'Agent-Circuit-ID', 0x000403fc0001, ':=' ), ... and then on authorize section add something like this (just for check) if ( (request:User-Name == "00:12:23:56:78:9A") && (control:Agent-Circuit-ID != "%{request:Agent-Circuit-ID}") ) { update control { Auth-Type := "Reject" } } then use debug mode again. It should print out what it recognize control:Agent-Circuit-ID (which is from db) and request:Agent-Circuit-ID. Then you just need to edit entry on db to match what's on the request. -- Fajar
Fajar A. Nugraha-2 wrote
On Fri, Mar 30, 2012 at 6:12 PM, IVB <ivb@> wrote:
Agent-Circuit-Id = 0x000403fc0001
let's start with that one.
( '00:12:23:56:78:9A', 'Agent-Circuit-ID', x'000403fc0001', '==' ),
Does that work?
No. And this is the problem. Fajar A. Nugraha-2 wrote
Shouldn't it be something like
( '00:12:23:56:78:9A', 'Agent-Circuit-ID', 0x000403fc0001, '==' ),
?
0x000403fc0001 and x'000403fc0001' are synonyms (as written in MySQL documentation). But I check both variants - without success. Fajar A. Nugraha-2 wrote
Another alternative is to insert something like this (note the operator)
( '00:12:23:56:78:9A', 'Agent-Circuit-ID', 0x000403fc0001, ':=' ),
... and then on authorize section add something like this (just for check)
if ( (request:User-Name == "00:12:23:56:78:9A") && (control:Agent-Circuit-ID != "%{request:Agent-Circuit-ID}") ) { update control { Auth-Type := "Reject" } }
then use debug mode again. It should print out what it recognize control:Agent-Circuit-ID (which is from db) and request:Agent-Circuit-ID. Then you just need to edit entry on db to match what's on the request.
OK, I'll try this and write results. -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Fajar A. Nugraha-2 wrote
... and then on authorize section add something like this (just for check)
if ( (request:User-Name == "00:12:23:56:78:9A") && (control:Agent-Circuit-ID != "%{request:Agent-Circuit-ID}") ) { update control { Auth-Type := "Reject" } }
then use debug mode again. It should print out what it recognize control:Agent-Circuit-ID (which is from db) and request:Agent-Circuit-ID. Then you just need to edit entry on db to match what's on the request.
Construction shown above don't help me, because there was no output of control:Agent-Circuit-ID and request:Agent-Circuit-ID. But I use another construction: if (request:User-Name == "20:cf:30:e1:e6:29") { update control { Auth-Type := "Reject" } update reply { Context-Name := "%{control:Agent-Circuit-ID} %{request:Agent-Circuit-ID}" } } so in Acces-Reject I can see in Context-Name attribute both request and control attributes. And I have bad news. I got following: Context-Name = "0x 0x000403fc0017" Request attribute is OK, but control attribute is zero-length string. I think this is because first byte in string is 0, and Radius treat this as end-of-string. I tested this - I try to return attribute with only printable chars, and got it in Context-Name exactly as it stored in DB. So I urgently need help - how I can store needed value to adequately accepted by Radius? -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
This is incorrect: IVB wrote
INSERT INTO `radcheck` ( `UserName`, `Attribute`, `Value`, `op` ) VALUES ( '00:12:23:56:78:9A', 'Cleartext-Password', 'Redback', ':=' ), ( '00:12:23:56:78:9A', 'Agent-Circuit-ID', x'000403fc0001', '==' ), ( '00:12:23:56:78:9A', 'Agent-Remote-ID', x'0006001e58ab0304', '==' )
This is correct: INSERT INTO `radcheck` ( `UserName`, `Attribute`, `Value`, `op` ) VALUES ( '00:12:23:56:78:9A', 'Cleartext-Password', 'Redback', ':=' ), ( '00:12:23:56:78:9A', 'Agent-Circuit-ID', '0x000403fc0001', '==' ), ( '00:12:23:56:78:9A', 'Agent-Remote-ID', '0x0006001e58ab0304', '==' ) Thanks to all for help. -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRADIUS-MySQL-DHCP-Opt82-tp560614... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (4)
-
Alan DeKok -
Fajar A. Nugraha -
Igor Belikov -
IVB