Radius problem with EAP

[Rakesh Jha]

Hi,

 

I am having in starting radius. Following is text output of "radiusd -X"

 

reread_config:  reading radiusd.conf

Config:   including file: /usr/local/etc/raddb/proxy.conf

Config:   including file: /usr/local/etc/raddb/clients.conf

Config:   including file: /usr/local/etc/raddb/snmp.conf

Config:   including file: /usr/local/etc/raddb/eap.conf

Config:   including file: /usr/local/etc/raddb/sql.conf

 main: prefix = "/usr/local"

 main: localstatedir = "/usr/local/var"

 main: logdir = "/usr/local/var/log/radius"

 main: libdir = "/usr/local/lib"

 main: radacctdir = "/usr/local/var/log/radius/radacct"

 main: hostname_lookups = no

 main: max_request_time = 30

 main: cleanup_delay = 5

 main: max_requests = 1024

 main: delete_blocked_requests = 0

 main: port = 0

 main: allow_core_dumps = no

 main: log_stripped_names = no

 main: log_file = "/usr/local/var/log/radius/radius.log"

 main: log_auth = no

main: log_auth_badpass = no

 main: log_auth_goodpass = no

 main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid"

 main: user = "(null)"

 main: group = "(null)"

 main: usercollide = no

 main: lower_user = "no"

 main: lower_pass = "no"

 main: nospace_user = "no"

 main: nospace_pass = "no"

 main: checkrad = "/usr/local/sbin/checkrad"

 main: proxy_requests = yes

 proxy: retry_delay = 5

 proxy: retry_count = 3

 proxy: synchronous = no

 proxy: default_fallback = yes

 proxy: dead_time = 120

 proxy: post_proxy_authorize = no

 proxy: wake_all_if_all_dead = no

 security: max_attributes = 200

 security: reject_delay = 1

 security: status_server = no

main: debug_level = 0

read_config_files:  reading dictionary

read_config_files:  reading naslist

Using deprecated naslist file.  Support for this will go away soon.

read_config_files:  reading clients

read_config_files:  reading realms

radiusd:  entering modules setup

Module: Library search path is /usr/local/lib

Module: Loaded exec

 exec: wait = yes

 exec: program = "(null)"

 exec: input_pairs = "request"

 exec: output_pairs = "(null)"

 exec: packet_type = "(null)"

rlm_exec: Wait=yes but no output defined. Did you mean output=none?

Module: Instantiated exec (exec)

Module: Loaded expr

Module: Instantiated expr (expr)

Module: Loaded PAP

 pap: encryption_scheme = "crypt"

 pap: auto_header = yes

Module: Instantiated pap (pap)

Module: Instantiated pap (pap)

Module: Loaded CHAP

Module: Instantiated chap (chap)

Module: Loaded MS-CHAP

 mschap: use_mppe = yes

 mschap: require_encryption = no

 mschap: require_strong = no

 mschap: with_ntdomain_hack = no

 mschap: passwd = "(null)"

 mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--domain=%{mschap:burgan_dom} --username=%{Str

ipped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Respo

nse:-00}"

Module: Instantiated mschap (mschap)

Module: Loaded System

 unix: cache = no

 unix: passwd = "(null)"

 unix: shadow = "(null)"

 unix: group = "(null)"

 unix: radwtmp = "/usr/local/var/log/radius/radwtmp"

 unix: usegroup = no

 unix: cache_reload = 600

Module: Instantiated unix (unix)

Module: Loaded eap

eap: default_eap_type = "peap"

 eap: timer_expire = 60

 eap: ignore_unknown_eap_types = no

 eap: cisco_accounting_username_bug = no

rlm_eap: Loaded and initialized type md5

rlm_eap: Loaded and initialized type leap

 gtc: challenge = "Password: "

 gtc: auth_type = "PAP"

rlm_eap: Loaded and initialized type gtc

 tls: rsa_key_exchange = no

 tls: dh_key_exchange = yes

 tls: rsa_key_length = 512

 tls: dh_key_length = 512

 tls: verify_depth = 0

 tls: CA_path = "(null)"

 tls: pem_file_type = yes

 tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem"

 tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem"

 tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem"

 tls: private_key_password = "whatever"

 tls: dh_file = "/usr/local/etc/raddb/certs/dh"

 tls: random_file = "/dev/urandom"

tls: fragment_size = 1024

 tls: include_length = yes

 tls: check_crl = no

 tls: check_cert_cn = "(null)"

 tls: cipher_list = "(null)"

 tls: check_cert_issuer = "(null)"

rlm_eap_tls: Loading the certificate file as a chain

rlm_eap: Loaded and initialized type tls

rlm_eap: No such sub-type for default EAP type peap

radiusd.conf[10]: eap: Module instantiation failed.

radiusd.conf[1954] Unknown module "eap".

radiusd.conf[1901] Failed to parse authenticate section.

[root at authserv sbin]#

 

 

The eap.conf has following configuration -

 

eap {

                        default_eap_type = peap

                        timer_expire     = 60

                        ignore_unknown_eap_types = no

                        cisco_accounting_username_bug = no

                        md5 {

                        }

                        

                        leap {

                        }

                        gtc {

                                    

                                    auth_type = PAP

                        

                        tls {

                                    private_key_password = whatever

                                    private_key_file =
${raddbdir}/certs/cert-srv.pem

 

                                    

                                    certificate_file =
${raddbdir}/certs/cert-srv.pem

 

                                    #  Trusted Root CA list

                                    CA_file =
${raddbdir}/certs/demoCA/cacert.pem

 

                                    dh_file = ${raddbdir}/certs/dh

                                    

                                    random_file = /dev/urandom

                                    

                        #          fragment_size = 1024                 

                         peap {

                                                

                        }

 

                        mschapv2 {

            }

 

Can you please suggest remedy?

 

Rakesh

 


Attention: 
Any non-official business related views, opinions and other information presented in this electronic mail
are solely those of the sender/author.
Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed 
indicated in this mail or responsible for delivering this message to the intended,
you should delete this message and notify the sender immediately.
-------------------------------------------------------
Burgan Bank S.A.K
www.burgan.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20070828/0cf5c8d1/attachment.html>