Need Help to Troubleshoot MySQL Auth FreeRadius 2.1.X
Dear Freeradius Hackers, This is new implementation. Can someone help me to troubleshoot why freeradius mysql authentication is failing. i have cross check every expect but still seem that something is not in place. What is i have done: installed Freeradius + MySQL Databases Configured Freeradius & Created MySQL Database. configured the following files: "sql.conf" "radiusd.conf" "default" enabled in radiusd.conf to "$INCLUDE = sql.conf" Radius is up and running without authentication even from localhost. Radius database is setup properly, no problem to start/stop "radiusd" radios_log are shown in section below. Results: tail -f "/var/log/radius/radius.log - Output Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sat Dec 15 11:20:34 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sat Dec 15 11:20:34 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sat Dec 15 11:20:34 2012 : Info: Loaded virtual server <default> Sat Dec 15 11:20:34 2012 : Info: Loaded virtual server inner-tunnel Sat Dec 15 11:20:34 2012 : Info: ... adding new socket proxy address * port 32959 Sat Dec 15 11:20:34 2012 : Info: Ready to process requests. ========================================================================= Output of "radiusd -X" ... adding new socket proxy address * port 51412 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ======================================================================== Command to Check the radius Authentication: radtest mark mypassword localhost 1812 99THi49UGotool Output: Sending Access-Request of id 48 to 41.171.71.61 port 1812 User-Name = "mark" User-Password = "radmin" NAS-IP-Address = 192.168.3.106 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 ====================================================================== Two MySQL Radius Users PAY attention to the field "OP" (:= & ==) But auth is not working for any user. mysql> select * from radcheck where UserName='mark'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 3 | mark | radmin | := | 99THi49UGotool | +----+----------+-----------+----+-----------------+ 1 row in set (0.00 sec) mysql> select * from radcheck where UserName='dany'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 1 | dany | badmin | == | 99THi49UGotool | +----+----------+-----------+----+-----------------+ radius is up and running without authentication "== or :=" make no difference none of the user can authenticate. ============================================ selinux off freeradius is up mysql db is up there are two database users why auth would be failing? Any tip or clue would be greatly appreciated Thanks / Regards
Prabhpal S. Mavi wrote:
This is new implementation. Can someone help me to troubleshoot why freeradius mysql authentication is failing. i have cross check every expect but still seem that something is not in place.
You haven't read the documentation which says to run the server in debugging mode.
Results:
tail -f "/var/log/radius/radius.log - Output
You WILL NOT solve the problem by doing this. The documentation DOES NOT say to do this, because it is NOT HELPFUL.
Output of "radiusd -X"
... adding new socket proxy address * port 51412 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.
Which is completely and totally useless. You do realize that the ENTIRE POINT of running the server in debugging mode is to see what happens when it receives packets...
Command to Check the radius Authentication:
We don't care. The documentation doesn't say to post this command to the list, because it is NOT HELPFUL.
PAY attention to the field "OP" (:= & ==) But auth is not working for any user.
No. YOU need to pay attention to the documentation.
mysql> select * from radcheck where UserName='mark'; +----+----------+-----------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-----------------+ | 3 | mark | radmin | := | 99THi49UGotool | +----+----------+-----------+----+-----------------+
This is completely wrong. It's hard to describe just how wrong this is. Read the Wiki. It has DETAILED INSTRUCTIONS for getting SQL working. It includes EXAMPLES. These examples WILL WORK.
radius is up and running without authentication "== or :=" make no difference none of the user can authenticate.
Because you've done something completely wrong.
Any tip or clue would be greatly appreciated
Follow the instructions on the wiki for configuring SQL. It should take no more than 10 minutes. Alan DeKok.
participants (2)
-
Alan DeKok -
Prabhpal S. Mavi