Hi Guys,
1) Basic MySql Config Questions
========================
I am evaluating freeradius-0.3 ...
* I managed to authenticate with a user in /usr/local/etc/raddb/users.
Now I want to use MySql.
* I have created a "radius" DB and created the tables
as described in src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql
* I have added "sql" in the "authorize {}" section of radiusd.conf
* I have populated the tables with the following commands ( No other
commands !!)
insert into radcheck values ('','fablab','Password','LetMeIn');
insert into usergroup values ('','fablab','PPP');
insert into radgroupcheck values ('','PPP','Service-Type','Framed-User');
insert into radgroupcheck values ('','PPP','Framed-Protocol','PPP');
insert into radgroupreply values
('','PPP','Framed-IP-Address','255.255.255.254');
insert into radgroupreply values ('','PPP','Framed-MTU','576');
insert into radgroupreply values ('','PPP','Service-Type','Framed-User');
insert into radgroupreply values ('','PPP','Framed-Protocol','PPP');
insert into radgroupreply values
('','PPP','Framed-Compression','Van-Jacobson-TCP-IP');
But a radtest fails to authenticate!!!
Question 1:
------------
If I want to use MySQL do I have to put data in the TABLE nas / TABLE
dictionary
or is it enough to have a working clients.conf ??
Question 2:
-----------
I don't understand why i get this "rlm_sql: Pairs do not match [fablab] "
what pairs are not matching ??
Am I missing something in my insert list ? Or is it in my radiusd.conf ??
Can someone provide me a list of complete working INSERT statement to make a
dummy test work ?
2) IP+NAS-PORT // IP Pool Allocation question .
I have read in the newsgroup that it is the NAS that SHOULD be allocating
the IP ... and I could not agree more. Bad luck: the NAS is not mine
and the owner refuses to allocate the IP.
I have tested , and it is working in -0.3 , that in the users file
if you provide
Framed-IP-Address = x.x.x.x+,
the IP will be allocated with the formula Base+NAS-Port
Question 1:
------------
[Once you guys will have helped me to get the MySQL config to work,]
can I count on the same IP-Allocation feature to work with MySql ??
Question 2:
------------
let's say that my base IP is 192.168.1.1.
what if I have more that 253 simultanious users / Nas-Port available ?
will the users who get NAS-PORT 254 and 255 be allocated
IP 192.168.1.255 and 192.168.2.0 ??????? is FreeRadius taking cae of this
problems ?
any known workaround ? or Can I use more than one pool? to go around those
"bad" IPs ?
thanks for your help
Fabrice LABORIE
---------8<--------------------------
# /usr/local/sbin/radiusd -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/proxy.conf
Config: including file: /usr/local/etc/raddb/clients.conf
Config: including file: /usr/local/etc/raddb/snmp.conf
Config: including file: /usr/local/etc/raddb/sql.conf
main: prefix = "/usr/local"
main: localstatedir = "/usr/local/var"
main: logdir = "/usr/local/var/log/radius"
main: libdir = "/usr/local/lib"
main: radacctdir = "/usr/local/var/log/radius/radacct"
main: hostname_lookups = no
read_config_files: reading dictionary
read_config_files: reading clients
read_config_files: reading realms
read_config_files: reading naslist
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_auth = yes
main: log_auth_badpass = yes
main: log_auth_goodpass = yes
main: pidfile = "/usr/local/var/run/radiusd.pid"
main: user = "root"
main: group = "root"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: dead_time = 120
main: debug_level = 0
read_config_files: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded SQL
sql: driver = "rlm_sql_mysql"
sql: server = "localhost"
sql: port = ""
sql: login = "root"
sql: password = "xxxxxxxxxxxxx"
sql: radius_db = "radius"
sql: acct_table = "radacct"
sql: acct_table2 = "radacct"
sql: authcheck_table = "radcheck"
sql: authreply_table = "radreply"
sql: groupcheck_table = "radgroupcheck"
sql: groupreply_table = "radgroupreply"
sql: usergroup_table = "usergroup"
sql: nas_table = "nas"
sql: dict_table = "dictionary"
sql: sqltrace = no
sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql"
sql: deletestalesessions = yes
sql: num_sql_socks = 5
sql: sql_user_name = "%{User-Name}"
sql: authorize_check_query = "SELECT id,UserName,Attribute,Value FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id"
sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value FROM
radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id"
sql: authorize_group_check_query = "SELECT
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche
ck.Value FROM radgroupcheck,usergroup WHERE usergroup.Username =
'%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER
BY radgroupcheck.id"
sql: authorize_group_reply_query = "SELECT
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep
ly.Value FROM radgroupreply,usergroup WHERE usergroup.Username =
'%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER
BY radgroupreply.id"
sql: authenticate_query = "SELECT Value,Attribute FROM radcheck WHERE
UserName = '%{User-Name}' AND ( Attribute = 'Password' OR Attribute =
'Crypt-Password' ) ORDER BY Attribute DESC"
sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S',
AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime),
AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay =
%{Acct-Delay-Time} WHERE AcctSessionTime=0 AND AcctStopTime=0 AND
NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'"
sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress =
'%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND
UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'"
sql: accounting_start_query = "INSERT into radacct (RadAcctId,
AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,
NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic,
ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets,
CalledStationId, CallingStationId, AcctTerminateCause, ServiceType,
FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('',
'%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}',
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S',
'0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0',
'%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}',
'%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')"
sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S',
AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}'
WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}'
AND NASIPAddress = '%{NAS-IP-Address}'"
sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S',
AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets =
'%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}',
AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay =
'%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE
AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND
NASIPAddress = '%{NAS-IP-Address}'"
sql: accounting_stop_query_alt = "INSERT into radacct (RadAcctId,
AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,
NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic,
ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets,
CalledStationId, CallingStationId, AcctTerminateCause, ServiceType,
FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('',
'%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}',
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '0',
'%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}',
'%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}',
'%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')"
sql: connect_failure_retry_delay = 60
rlm_sql: Driver rlm_sql_mysql loaded and linked
rlm_sql: Attempting to connect to root@localhost:/radius
rlm_sql: Connected new DB handle, #0
rlm_sql: Connected new DB handle, #1
rlm_sql: Connected new DB handle, #2
rlm_sql: Connected new DB handle, #3
rlm_sql: Connected new DB handle, #4
Module: Instantiated sql (sql)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded detail
detail: detailfile =
"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail"
detail: detailperm = 384
detail: dirperm = 493
Module: Instantiated detail (detail)
Module: Loaded System
unix: cache = no
unix: passwd = "/usr/local/etc/passwd.radiusd"
unix: shadow = "(null)"
unix: group = "/etc/group"
unix: radwtmp = "/usr/local/var/log/radius/radwtmp"
unix: usegroup = no
Module: Instantiated unix (unix)
Module: Loaded radutmp
radutmp: filename = "/usr/local/var/log/radius/radutmp"
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on IP address *, ports 1645/udp and 1646/udp, with proxy on
1647/udp.
Ready to process requests.
rad_recv: Access-Request packet from host 212.46.32.174:1025, id=29,
length=55
User-Name = "fablab"
Password = "\242\235\202\344\005\031\347\\\013\036\036\203q\374S`"
NAS-IP-Address = 255.255.255.255
NAS-Port-Id = "1"
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "suffix" returns ok
users: Matched DEFAULT at 153
modcall[authorize]: module "files" returns ok
rlm_sql: Reserving sql socket id: 4
radius_xlat: 'fablab'
sql_escape in: 'fablab'
sql_escape out: 'fablab'
sql_set_user: escaped user --> 'fablab'
radius_xlat: 'SELECT id,UserName,Attribute,Value FROM radcheck WHERE
Username = 'fablab' ORDER BY id'
Password = "LetMeIn"
radius_xlat: 'SELECT
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche
ck.Value FROM radgroupcheck,usergroup WHERE usergroup.Username = 'fablab'
AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
Password = "LetMeIn"
Service-Type = Framed-User
Password = "LetMeIn"
Service-Type = Framed-User
Framed-Protocol = PPP
radius_xlat: 'SELECT id,UserName,Attribute,Value FROM radreply WHERE
Username = 'fablab' ORDER BY id'
radius_xlat: 'SELECT
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep
ly.Value FROM radgroupreply,usergroup WHERE usergroup.Username = 'fablab'
AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
Framed-IP-Address = 255.255.255.254
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
rlm_sql: Released sql socket id: 4
rlm_sql: Pairs do not match [fablab]
modcall[authorize]: module "sql" returns notfound
modcall: group authorize returns ok
rad_check_password: Found Auth-Type System
auth: type "System"
auth: Failed to validate the user.
Login incorrect: [fablab/LetMeIn] (from nas ids port 0)
Sending Access-Reject of id 29 to 212.46.32.174:1025
Finished request 0
Going to the next request
--------->8--------------------------
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
