<meta http-equiv="content-type" content="text/html; charset=utf-8">Hi my name is Sergio Ormeño, i am from Chile, and i with some partners are trying to create a Captive portal with NoCatAuth+RADIUS+LDAP and we have problems with the conection between RADIUS+LDAP with a radtest everything if fine and the packet is accepted, but in the login page of NoCat dosn`t log, here are the log of the radtest -X after a try with the login of NoCat<div>
<br></div><div><div>[root@ldap nocat]# radiusd -X</div><div>FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on Jan 21 2010 at 11:30:47</div><div>Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. </div>
<div>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A </div><div>PARTICULAR PURPOSE. </div><div>You may redistribute copies of FreeRADIUS under the terms of the </div><div>GNU General Public License v2. </div>
<div>Starting - reading configuration files ...</div><div>including configuration file /usr/local/etc/raddb/radiusd.conf</div><div>including configuration file /usr/local/etc/raddb/proxy.conf</div><div>including configuration file /usr/local/etc/raddb/clients.conf</div>
<div>including files in directory /usr/local/etc/raddb/modules/</div><div>including configuration file /usr/local/etc/raddb/modules/passwd</div><div>including configuration file /usr/local/etc/raddb/modules/smsotp</div><div>
including configuration file /usr/local/etc/raddb/modules/detail</div><div>including configuration file /usr/local/etc/raddb/modules/digest</div><div>including configuration file /usr/local/etc/raddb/modules/mschap</div><div>
including configuration file /usr/local/etc/raddb/modules/cui</div><div>including configuration file /usr/local/etc/raddb/modules/acct_unique</div><div>including configuration file /usr/local/etc/raddb/modules/inner-eap</div>
<div>including configuration file /usr/local/etc/raddb/modules/wimax</div><div>including configuration file /usr/local/etc/raddb/modules/exec</div><div>including configuration file /usr/local/etc/raddb/modules/perl</div><div>
including configuration file /usr/local/etc/raddb/modules/krb5</div><div>including configuration file /usr/local/etc/raddb/modules/smbpasswd</div><div>including configuration file /usr/local/etc/raddb/modules/sql_log</div>
<div>including configuration file /usr/local/etc/raddb/modules/mac2ip</div><div>including configuration file /usr/local/etc/raddb/modules/attr_rewrite</div><div>including configuration file /usr/local/etc/raddb/modules/ippool</div>
<div>including configuration file /usr/local/etc/raddb/modules/pap</div><div>including configuration file /usr/local/etc/raddb/modules/chap</div><div>including configuration file /usr/local/etc/raddb/modules/always</div><div>
including configuration file /usr/local/etc/raddb/modules/echo</div><div>including configuration file /usr/local/etc/raddb/modules/pam</div><div>including configuration file /usr/local/etc/raddb/modules/expiration</div><div>
including configuration file /usr/local/etc/raddb/modules/checkval</div><div>including configuration file /usr/local/etc/raddb/modules/ntlm_auth</div><div>including configuration file /usr/local/etc/raddb/modules/sradutmp</div>
<div>including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login</div><div>including configuration file /usr/local/etc/raddb/modules/attr_filter</div><div>including configuration file /usr/local/etc/raddb/modules/otp</div>
<div>including configuration file /usr/local/etc/raddb/modules/realm</div><div>including configuration file /usr/local/etc/raddb/modules/files</div><div>including configuration file /usr/local/etc/raddb/modules/etc_group</div>
<div>including configuration file /usr/local/etc/raddb/modules/radutmp</div><div>including configuration file /usr/local/etc/raddb/modules/detail.log</div><div>including configuration file /usr/local/etc/raddb/modules/linelog</div>
<div>including configuration file /usr/local/etc/raddb/modules/logintime</div><div>including configuration file /usr/local/etc/raddb/modules/<a href="http://detail.example.com" target="_blank">detail.example.com</a></div>
<div>including configuration file /usr/local/etc/raddb/modules/ldap</div><div>including configuration file /usr/local/etc/raddb/modules/counter</div><div>including configuration file /usr/local/etc/raddb/modules/preprocess</div>
<div>including configuration file /usr/local/etc/raddb/modules/unix</div><div>including configuration file /usr/local/etc/raddb/modules/expr</div><div>including configuration file /usr/local/etc/raddb/modules/mac2vlan</div>
<div>including configuration file /usr/local/etc/raddb/modules/policy</div><div>including configuration file /usr/local/etc/raddb/eap.conf</div><div>including configuration file /usr/local/etc/raddb/policy.conf</div><div>
including files in directory /usr/local/etc/raddb/sites-enabled/</div><div>including configuration file /usr/local/etc/raddb/sites-enabled/default</div><div>including configuration file /usr/local/etc/raddb/sites-enabled/control-socket</div>
<div>including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel</div><div>main {</div><div> allow_core_dumps = no</div><div>}</div><div>including dictionary file /usr/local/etc/raddb/dictionary</div>
<div>main {</div><div> prefix = "/usr/local"</div><div> localstatedir = "/usr/local/var"</div><div> logdir = "/usr/local/var/log/radius"</div><div> libdir = "/usr/local/lib"</div>
<div> radacctdir = "/usr/local/var/log/radius/radacct"</div><div> hostname_lookups = no</div><div> max_request_time = 30</div><div> cleanup_delay = 5</div><div> max_requests = 1024</div>
<div> pidfile = "/usr/local/var/run/radiusd/radiusd.pid"</div><div> checkrad = "/usr/local/sbin/checkrad"</div><div> debug_level = 0</div><div> proxy_requests = yes</div><div>
log {</div><div> stripped_names = no</div><div> auth = yes</div><div> auth_badpass = no</div><div> auth_goodpass = no</div><div> }</div><div> security {</div><div> max_attributes = 200</div>
<div> reject_delay = 2</div><div> status_server = yes</div><div> }</div><div>}</div><div>radiusd: #### Loading Realms and Home Servers ####</div><div> proxy server {</div><div> retry_delay = 5</div><div>
retry_count = 3</div><div> default_fallback = no</div><div> dead_time = 120</div><div> wake_all_if_all_dead = no</div><div> }</div><div> home_server localhost {</div><div> ipaddr = 127.0.0.1</div>
<div> port = 1812</div><div> type = "auth"</div><div> secret = "testing123"</div><div> response_window = 20</div><div> max_outstanding = 65536</div><div> require_message_authenticator = no</div>
<div> zombie_period = 40</div><div> status_check = "status-server"</div><div> ping_interval = 30</div><div> check_interval = 30</div><div> num_answers_to_alive = 3</div><div> num_pings_to_alive = 3</div>
<div> revive_interval = 120</div><div> status_check_timeout = 4</div><div> irt = 2</div><div> mrt = 16</div><div> mrc = 5</div><div> mrd = 30</div><div> }</div><div> home_server_pool my_auth_failover {</div>
<div> type = fail-over</div><div> home_server = localhost</div><div> }</div><div> realm <a href="http://example.com" target="_blank">example.com</a> {</div><div> auth_pool = my_auth_failover</div><div>
}</div><div> realm LOCAL {</div><div> }</div><div>radiusd: #### Loading Clients ####</div><div> client 127.0.0.1 {</div><div> require_message_authenticator = no</div><div> secret = "secreto"</div>
<div> shortname = "localhost"</div><div> nastype = "other"</div><div> }</div><div> client <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> {</div><div> require_message_authenticator = no</div>
<div> secret = "secreto"</div><div> }</div><div> client 146.83.204.88 {</div><div> require_message_authenticator = no</div><div> secret = "secreto"</div><div> }</div><div>radiusd: #### Instantiating modules ####</div>
<div> instantiate {</div><div> Module: Linked to module rlm_exec</div><div> Module: Instantiating exec</div><div> exec {</div><div> wait = no</div><div> input_pairs = "request"</div><div> shell_escape = yes</div>
<div> }</div><div> Module: Linked to module rlm_expr</div><div> Module: Instantiating expr</div><div> Module: Linked to module rlm_ldap</div><div> Module: Instantiating ldap</div><div> ldap {</div><div> server = "127.0.0.1"</div>
<div> port = 389</div><div> password = "secreto"</div><div> identity = "cn=admin,dc=ufro,dc=cl"</div><div> net_timeout = 10</div><div> timeout = 20</div><div> timelimit = 20</div>
<div> tls_mode = no</div><div> start_tls = no</div><div> tls_require_cert = "allow"</div><div> basedn = "dc=ufro,dc=cl"</div><div> filter = "(cn=%u)"</div><div>
base_filter = "(objectclass=radiusprofile)"</div><div> password_attribute = "userpassword"</div><div> auto_header = no</div><div> access_attr_used_for_allow = yes</div><div>
groupname_attribute = "cn"</div><div> groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"</div>
<div> dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap"</div><div> ldap_debug = 0</div><div> ldap_connections_number = 5</div><div> compare_check_items = no</div><div> do_xlat = yes</div>
<div> set_auth_type = yes</div><div> }</div><div>rlm_ldap: Registering ldap_groupcmp for Ldap-Group</div><div>rlm_ldap: Registering ldap_xlat with xlat_name ldap</div><div>rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section.</div>
<div>rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap</div><div>rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$</div><div>rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$</div>
<div>rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type</div><div>rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use</div><div>rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id</div>
<div>rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id</div><div>rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password</div><div>rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password</div><div>rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password</div>
<div>rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password</div><div>rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password</div><div>rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT</div><div>rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration</div>
<div>rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address</div><div>rlm_ldap: LDAP radiusUserPassword mapped to RADIUS userPassword</div><div>rlm_ldap: LDAP User-Name mapped to RADIUS User-Name</div><div>rlm_ldap: LDAP userPassword mapped to RADIUS Clear-text-Password</div>
<div>rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type</div><div>rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol</div><div>rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address</div>
<div>rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask</div><div>rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route</div><div>rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing</div>
<div>rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id</div><div>rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU</div><div>rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression</div>
<div>rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host</div><div>rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service</div><div>rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port</div>
<div>rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number</div><div>rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id</div><div>rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network</div>
<div>rlm_ldap: LDAP radiusClass mapped to RADIUS Class</div><div>rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout</div><div>rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout</div><div>rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action</div>
<div>rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service</div><div>rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node</div><div>rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group</div>
<div>rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link</div><div>rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network</div><div>rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone</div>
<div>rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit</div><div>rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port</div><div>rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message</div><div>
rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type</div><div>rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type</div><div>rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id</div>
<div>conns: 0x83a8460</div><div> Module: Linked to module rlm_expiration</div><div> Module: Instantiating expiration</div><div> expiration {</div><div> reply-message = "Password Has Expired "</div><div>
}</div><div> Module: Linked to module rlm_logintime</div><div> Module: Instantiating logintime</div><div> logintime {</div><div> reply-message = "You are calling outside your allowed timespan "</div><div>
minimum-timeout = 60</div><div> }</div><div> }</div><div>radiusd: #### Loading Virtual Servers ####</div><div>server inner-tunnel {</div><div> modules {</div><div> Module: Checking authenticate {...} for more modules to load</div>
<div> Module: Linked to module rlm_pap</div><div> Module: Instantiating pap</div><div> pap {</div><div> encryption_scheme = "auto"</div><div> auto_header = no</div><div> }</div><div> Module: Linked to module rlm_chap</div>
<div> Module: Instantiating chap</div><div> Module: Linked to module rlm_mschap</div><div> Module: Instantiating mschap</div><div> mschap {</div><div> use_mppe = yes</div><div> require_encryption = no</div>
<div> require_strong = no</div><div> with_ntdomain_hack = no</div><div> }</div><div> Module: Linked to module rlm_unix</div><div> Module: Instantiating unix</div><div> unix {</div><div> radwtmp = "/usr/local/var/log/radius/radwtmp"</div>
<div> }</div><div> Module: Linked to module rlm_eap</div><div> Module: Instantiating eap</div><div> eap {</div><div> default_eap_type = "md5"</div><div> timer_expire = 60</div><div> ignore_unknown_eap_types = no</div>
<div> cisco_accounting_username_bug = no</div><div> max_sessions = 4096</div><div> }</div><div> Module: Linked to sub-module rlm_eap_md5</div><div> Module: Instantiating eap-md5</div><div> Module: Linked to sub-module rlm_eap_leap</div>
<div> Module: Instantiating eap-leap</div><div> Module: Linked to sub-module rlm_eap_gtc</div><div> Module: Instantiating eap-gtc</div><div> gtc {</div><div> challenge = "Password: "</div><div> auth_type = "PAP"</div>
<div> }</div><div> Module: Linked to sub-module rlm_eap_tls</div><div> Module: Instantiating eap-tls</div><div> tls {</div><div> rsa_key_exchange = no</div><div> dh_key_exchange = yes</div><div> rsa_key_length = 512</div>
<div> dh_key_length = 512</div><div> verify_depth = 0</div><div> pem_file_type = yes</div><div> private_key_file = "/usr/local/etc/raddb/certs/server.pem"</div><div> certificate_file = "/usr/local/etc/raddb/certs/server.pem"</div>
<div> CA_file = "/usr/local/etc/raddb/certs/ca.pem"</div><div> private_key_password = "whatever"</div><div> dh_file = "/usr/local/etc/raddb/certs/dh"</div><div> random_file = "/usr/local/etc/raddb/certs/random"</div>
<div> fragment_size = 1024</div><div> include_length = yes</div><div> check_crl = no</div><div> cipher_list = "DEFAULT"</div><div> make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"</div>
<div> cache {</div><div> enable = no</div><div> lifetime = 24</div><div> max_entries = 255</div><div> }</div><div> }</div><div> Module: Linked to sub-module rlm_eap_ttls</div><div> Module: Instantiating eap-ttls</div>
<div> ttls {</div><div> default_eap_type = "md5"</div><div> copy_request_to_tunnel = no</div><div> use_tunneled_reply = no</div><div> virtual_server = "inner-tunnel"</div>
<div> include_length = yes</div><div> }</div><div> Module: Linked to sub-module rlm_eap_peap</div><div> Module: Instantiating eap-peap</div><div> peap {</div><div> default_eap_type = "mschapv2"</div>
<div> copy_request_to_tunnel = no</div><div> use_tunneled_reply = no</div><div> proxy_tunneled_request_as_eap = yes</div><div> virtual_server = "inner-tunnel"</div><div> }</div><div>
Module: Linked to sub-module rlm_eap_mschapv2</div><div> Module: Instantiating eap-mschapv2</div><div> mschapv2 {</div><div> with_ntdomain_hack = no</div><div> }</div><div> Module: Checking authorize {...} for more modules to load</div>
<div> Module: Linked to module rlm_realm</div><div> Module: Instantiating suffix</div><div> realm suffix {</div><div> format = "suffix"</div><div> delimiter = "@"</div><div> ignore_default = no</div>
<div> ignore_null = no</div><div> }</div><div> Module: Checking session {...} for more modules to load</div><div> Module: Linked to module rlm_radutmp</div><div> Module: Instantiating radutmp</div><div> radutmp {</div>
<div> filename = "/usr/local/var/log/radius/radutmp"</div><div> username = "%{User-Name}"</div><div> case_sensitive = yes</div><div> check_with_nas = yes</div><div> perm = 384</div>
<div> callerid = yes</div><div> }</div><div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div><div> Module: Linked to module rlm_attr_filter</div>
<div> Module: Instantiating attr_filter.access_reject</div><div> attr_filter attr_filter.access_reject {</div><div> attrsfile = "/usr/local/etc/raddb/attrs.access_reject"</div><div> key = "%{User-Name}"</div>
<div> }</div><div> } # modules</div><div>} # server</div><div>server {</div><div> modules {</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Checking authorize {...} for more modules to load</div>
<div> Module: Linked to module rlm_preprocess</div><div> Module: Instantiating preprocess</div><div> preprocess {</div><div> huntgroups = "/usr/local/etc/raddb/huntgroups"</div><div> hints = "/usr/local/etc/raddb/hints"</div>
<div> with_ascend_hack = no</div><div> ascend_channels_per_line = 23</div><div> with_ntdomain_hack = no</div><div> with_specialix_jetstream_hack = no</div><div> with_cisco_vsa_hack = no</div>
<div> with_alvarion_vsa_hack = no</div><div> }</div><div> Module: Checking preacct {...} for more modules to load</div><div> Module: Linked to module rlm_acct_unique</div><div> Module: Instantiating acct_unique</div>
<div> acct_unique {</div><div> key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"</div><div> }</div><div> Module: Checking accounting {...} for more modules to load</div><div>
Module: Linked to module rlm_detail</div><div> Module: Instantiating detail</div><div> detail {</div><div> detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"</div><div> header = "%t"</div>
<div> detailperm = 384</div><div> dirperm = 493</div><div> locking = no</div><div> log_packet_header = no</div><div> }</div><div> Module: Instantiating attr_filter.accounting_response</div><div>
attr_filter attr_filter.accounting_response {</div><div> attrsfile = "/usr/local/etc/raddb/attrs.accounting_response"</div><div> key = "%{User-Name}"</div><div> }</div><div> Module: Checking session {...} for more modules to load</div>
<div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div><div> } # modules</div><div>} # server</div><div>radiusd: #### Opening IP addresses and Ports ####</div>
<div>listen {</div><div> type = "auth"</div><div> ipaddr = *</div><div> port = 0</div><div>}</div><div>listen {</div><div> type = "acct"</div><div> ipaddr = *</div><div>
port = 0</div><div>}</div><div>listen {</div><div> type = "control"</div><div> listen {</div><div> socket = "/usr/local/var/run/radiusd/radiusd.sock"</div><div> }</div><div>}</div>
<div>Listening on authentication address * port 1812</div><div>Listening on accounting address * port 1813</div><div>Listening on command file /usr/local/var/run/radiusd/radiusd.sock</div><div>Listening on proxy address * port 1814</div>
<div>Ready to process requests.</div><div><div>rad_recv: Access-Request packet from host 127.0.0.1 port 52902, id=43, length=20</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>[ldap] Attribute "User-Name" is required for authorization. </div>
<div>++[ldap] returns noop</div><div>++[expiration] returns noop</div><div>++[logintime] returns noop</div><div>No authenticate method (Auth-Type) configuration found for the request: Rejecting the user</div><div>Failed to authenticate the user.</div>
<div>Login incorrect: [<no User-Name attribute>] (from client localhost port 0)</div><div>Using Post-Auth-Type Reject</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject] expand: %{User-Name} -> </div>
<div>++[attr_filter.access_reject] returns noop</div><div>Delaying reject of request 0 for 2 seconds</div><div>Going to the next request</div><div>Waking up in 0.9 seconds.</div><div>Waking up in 0.9 seconds.</div><div>Sending delayed reject for request 0</div>
<div>Sending Access-Reject of id 43 to 127.0.0.1 port 52902</div><div>Waking up in 4.9 seconds.</div><div>Cleaning up request 0 ID 43 with timestamp +758</div><div>Ready to process requests.</div><div><br></div></div><div>
<br></div><div>I don`t know where are the problem, if you can help please, your my last hope </div><div>Thnx for everything </div><div><br></div></div><br>-- <br>Se despide atentamente <br>Sergio Ormeño Reyes<br>Ingeniería en Informática<br>
UFRO<br>