Quick Guide to XTRadius and MySQL

(written by Frederic Faure)

1. Next, run make createdb, followed by make createtables to create the needed database and tables in MySQL.
2. Log on to MySQL, and create the test account with a hashed password as protection against prying eyes:
   

   # mysql -u root -ptest accounting
   mysql> insert into users values("mysqluser",encrypt("mysqlpassword","AB"),"Just a test account","Active");
   

   ---

   Important: Although Paul DuBois mentions the use of PASSWORD() to hash passwords in his otherwise excellent book on MySQL available from NewRiders, and that (on page 458) the algorithm used by this MySQL function is different from Unix's traditional crypt(), MySQL does support crypt() by using ENCRYPT() when creating/updating a user's password.
   
   
   As explained on page 546, remember to use a salt if you don't want the generated password to be different every time, and that starting with MySQL 3.22.16, salt can be longer than 2 characters. FYI, Ian's radauth.c reads the first two bytes to extract the salt from the password that it reads in MySQL, generates its own hashed password through the crypt() function, and compares the two strings.

   ---

3. Next, rename the original to /etc/raddb/users.orig, create an empty users file, and add the following stuff:
   

   #/etc/raddb/users
   DEFAULT Acct-Status-Type = "Start"
   Exec-Program-Account = "/usr/local/bin/radacct %u"
   
   DEFAULT Acct-Status-Type = "Stop"
   Exec-Program-Account = "/usr/local/bin/radacct %u %t %f %i %o"
   
   DEFAULT Auth-Type = External
   Exec-Program-Wait = "/usr/local/bin/radauth %u",
   Fall-Through = Yes
   
   

   Note that the users sample that came with the tarball that Ian sent me still contained Ahmad's original entries, namely accounting and authmysql, respectively.
   
   
   Pay also attention to the trailing , before the Fall-Through line: You must not use a comma on the first line, but you must use one if you have another statement following. Here, "Exec-Program-Wait" is followed by another line in this section, namely "Fall-Through". Therefore, you must add a comma to show Radius that this section is not over yet. I like Windows' and Samba's INI configuration files better...
   
   
4. At this point, run make, followed by make install. Have XTRadius re-read its configuration files through /etc/rc.d/init.d/radiusd reload, and run radtest mysqluser mysqlpassword localhost localhost testing123. Hopefully, XTRadius will tell you that the user was authenticated successfully. If you get "Access Denied", make sure that you did use ENCRYPT() with a salt when setting the user's password in MySQL.

In addition to XTRadius, the packages I checked where FreeRadius, and ICRadius, which are all derived from Cistron, itself an open-source package derived from the Mother of all Radius servers, namely Livingston's. Livingston stuff is available at ftp://ftp.livingston.com/pub/le/radius/