<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
<font class="Apple-style-span" face="Tahoma" size="2"><div><font class="Apple-style-span" face="Tahoma" size="2">Thank you!!!</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div>I put it there but still the same problem:</font><div style="font-family: Tahoma; font-size: 10pt; "><br></div><div><div><font class="Apple-style-span" face="Tahoma" size="2">authorize {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The preprocess module takes care of sanitizing some bizarre</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># attributes in the request, and turning them into attributes</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># which are more standard.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># It takes care of processing the 'raddb/hints' and the</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># 'raddb/huntgroups' files.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>preprocess</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If you want to have a log of authentication requests,</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># un-comment the following line, and the 'detail auth_log'</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># section, above.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>auth_log</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The chap module will set 'Auth-Type := CHAP' if we are</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># handling a CHAP request and Auth-Type has not already been set</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>chap </font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If the users are logging in with an MS-CHAP-Challenge</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># attribute for authentication, the mschap module will find</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># to the request, which will cause the server to then use</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># the mschap module for authentication.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>mschap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If you have a Cisco SIP server authenticating against</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># FreeRADIUS, uncomment the following line, and the 'digest'</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># line in the 'authenticate' section.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>digest</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The WiMAX specification says that the Calling-Station-Id</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># is 6 octets of the MAC. This definition conflicts with</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># RFC 3580, and all common RADIUS practices. Un-commenting</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># the "wimax" module here means that it will fix the</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Calling-Station-Id attribute to the normal format as</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># specified in RFC 3580 Section 3.21</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>wimax</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Look for IPASS style 'realm/', and if not found, look for</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># '@realm', and decide whether or not to proxy, based on</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># that.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>IPASS</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If you are using multiple kinds of realms, you probably</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># want to set "ignore_null = yes" for all of them.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Otherwise, when the first style of realm doesn't match,</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># the other styles won't be checked.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>suffix</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>ntdomain</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># authentication.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># It also sets the EAP-Type attribute in the request</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># attribute list to the EAP type from the packet.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># As of 2.0, the EAP module returns "ok" in the authorize stage</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># for TTLS and PEAP. In 1.x, it never returned "ok" here, so</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># this change is compatible with older configurations.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The example below uses module failover to avoid querying all</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># of the following modules if the EAP module returns "ok".</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Therefore, your LDAP and/or SQL servers will not be queried</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># for the many packets that go back and forth to set up TTLS</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># or PEAP. The load on those servers will therefore be reduced.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>eap {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>ok = return</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Pull crypt'd passwords from /etc/passwd or /etc/shadow,</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># using the system API's to get the password. If you want</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># to read /etc/passwd or /etc/shadow directly, see the</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># passwd module in radiusd.conf.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>unix</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Read the 'users' file</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#files</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Look in an SQL database. The schema of the database</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># is meant to mirror the "users" file.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># See "Authorization Queries" in sql.conf</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#sql</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>pgsql-voip</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If you are using /etc/smbpasswd, and are also doing</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># mschap authentication, the un-comment this line, and</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># configure the 'etc_smbpasswd' module, above.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>etc_smbpasswd</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The ldap module will set Auth-Type to LDAP if it has not</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># already been set</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>ldap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Enforce daily limits on time spent logged in.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>daily</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Use the checkval module</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>checkval</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>expiration</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>logintime</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>pap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>Autz-Type Status-Server {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">authenticate {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># PAP authentication, when a back-end database listed</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># in the 'authorize' section supplies a password. The</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># password can be clear-text, or encrypted.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#Auth-Type PAP {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="white-space:pre"> </span>pap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Most people want CHAP authentication</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># A back-end database listed in the 'authorize' section</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># MUST supply a CLEAR TEXT password. Encrypted passwords</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># won't work.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type CHAP {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>chap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># MSCHAP authentication.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type MS-CHAP {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>mschap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If you have a Cisco SIP server authenticating against</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># FreeRADIUS, uncomment the following line, and the 'digest'</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># line in the 'authorize' section.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>digest</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Pluggable Authentication Modules.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>pam</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># See 'man getpwent' for information on how the 'unix'</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># module checks the users password. Note that packets</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># containing CHAP-Password attributes CANNOT be authenticated</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># against /etc/passwd! See the FAQ for details.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># For normal "crypt" authentication, the "pap" module should</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># be used instead of the "unix" module. The "unix" module should</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># be used for authentication ONLY for compatibility with legacy</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># FreeRADIUS configurations.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>unix</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Uncomment it if you want to use ldap for authentication</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Note that this means "check plain-text password against</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># the ldap database", which means that EAP won't work,</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># as it does not supply a plain-text password.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type LDAP {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>ldap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Allow EAP authentication.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>eap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The older configurations sent a number of attributes in</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Access-Challenge packets, which wasn't strictly correct.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># If you want to filter out these attributes, uncomment</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># the following lines.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type eap {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>eap {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>handled = 1 </font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>if (handled && (Response-Packet-Type == Access-Challenge)) {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.access_challenge.post-auth</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>handled # override the "updated" code from attr_filter</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"># Pre-accounting. Decide which accounting type to use.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">preacct {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>preprocess</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Session start times are *implied* in RADIUS.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The NAS never sends a "start time". Instead, it sends</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># a start packet, *possibly* with an Acct-Delay-Time.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The server is supposed to conclude that the start time</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># was "Acct-Delay-Time" seconds in the past.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The code below creates an explicit start time, which can</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># then be used in other modules.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># The start time is: NOW - delay - session_length</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span> update request {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span> <span class="Apple-tab-span" style="white-space:pre"> </span>FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Ensure that we have a semi-unique identifier for every</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># request, and many NAS boxes are broken.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>acct_unique</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Look for IPASS-style 'realm/', and if not found, look for</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># '@realm', and decide whether or not to proxy, based on</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># that.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Accounting requests are generally proxied to the same</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># home server as authentication requests.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>IPASS</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>suffix</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>ntdomain</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># Read the 'acct_users' file</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#files</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"># Accounting. Log the accounting data.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">accounting {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>if (noop) {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>ok</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">session {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>radutmp</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">post-auth {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>ldap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>exec</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span></font><span class="Apple-style-span" style="font-size: small; font-family: Tahoma; ">edir_account_policy_check = yes' in the ldap module configuration</span></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>Post-Auth-Type REJECT {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span># log failed authentications in SQL, too.</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>sql</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.access_reject</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">pre-proxy {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">post-proxy {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>post_proxy_log</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_rewrite</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.post-proxy</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>#</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><span class="Apple-tab-span" style="white-space:pre"> </span>eap</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>Post-Proxy-Type Fail {</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>detail</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">#<span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2">}</font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><div>}</div><div>Listening on authentication address * port 1812</div><div>Listening on accounting address * port 1813</div><div>Listening on command file /var/run/radiusd/radiusd.sock</div><div>Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel</div><div>Listening on proxy address * port 1814</div><div>Ready to process requests.</div><div>rad_recv: Access-Request packet from host 212.13.228.58 port 49883, id=136, length=206</div><div> Acct-Multi-Session-Id = "1291732743095"</div><div> Cisco-Attr-130 = 0x683332332d63616c6c696e672d656e74657270726973652d69643d656e74504258</div><div> Calling-Station-Id = "81609000"</div><div> NAS-Identifier = "intraswitch"</div><div> NAS-IP-Address = 212.13.228.58</div><div> 3GPP2-Prepaid-acct-Capability = 0x010600000002</div><div> 3GPP2-Session-Termination-Capability = 1</div><div> h323-conf-id = "h323-conf-id=1291732743095"</div><div> Vendor-Specific = 0x00000009</div><div> Event-Timestamp = "Dec 7 2010 15:39:03 CET"</div><div> User-Name = "081609000"</div><div> User-Password = "12345"</div><div># Executing section authorize from file /etc/raddb/sites-enabled/default</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>++[mschap] returns noop</div><div>++[digest] returns noop</div><div>[suffix] No '@' in User-Name = "081609000", looking up realm NULL</div><div>[suffix] No such realm "NULL"</div><div>++[suffix] returns noop</div><div>[eap] No EAP-Message, not doing EAP</div><div>++[eap] returns noop</div><div>[pgsql-voip] expand: %{User-Name} -> 081609000</div><div>[pgsql-voip] sql_set_user escaped user --> '081609000'</div><div>rlm_sql (pgsql-voip): Reserving sql socket id: 24</div><div>[pgsql-voip] expand: -> </div><div>[pgsql-voip] Error generating query; rejecting user</div><div>rlm_sql (pgsql-voip): Released sql socket id: 24</div><div>++[pgsql-voip] returns fail</div><div>Using Post-Auth-Type Reject</div><div># Executing group from file /etc/raddb/sites-enabled/default</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject] expand: %{User-Name} -> 081609000</div><div> attr_filter: Matched entry DEFAULT at line 11</div><div>++[attr_filter.access_reject] returns updated</div><div>Delaying reject of request 0 for 1 seconds</div><div>Going to the next request</div><div>Waking up in 0.9 seconds.</div></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><div><font class="Apple-style-span" face="Tahoma" size="2"><br></font></div><br><div id="SkyDrivePlaceholder" style="font-family: Tahoma; font-size: 10pt; "></div><font class="Apple-style-span" face="Tahoma" size="2">> Date: Tue, 7 Dec 2010 21:26:18 +0700</font><br><font class="Apple-style-span" face="Tahoma" size="2">> Subject: Re: Voip database</font><br><font class="Apple-style-span" face="Tahoma" size="2">> From: work@fajar.net</font><br><font class="Apple-style-span" face="Tahoma" size="2">> To: freeradius-users@lists.freeradius.org</font><br><font class="Apple-style-span" face="Tahoma" size="2">> </font><br><font class="Apple-style-span" face="Tahoma" size="2">> On Tue, Dec 7, 2010 at 9:24 PM, Fajar A. Nugraha <work@fajar.net> wrote:</font><br><font class="Apple-style-span" face="Tahoma" size="2">> > On Tue, Dec 7, 2010 at 9:17 PM, miha- <miha_zoubek@hotmail.com> wrote:</font><br><font class="Apple-style-span" face="Tahoma" size="2">> >></font><br><font class="Apple-style-span" face="Tahoma" size="2">> >> I have uncomment only this # Cisco VoIP specific bulk accounting</font><br><font class="Apple-style-span" face="Tahoma" size="2">> >> pgsql-voip under accounting section.</font><br><font class="Apple-style-span" face="Tahoma" size="2">> >> I have not found it under authorize and authenticate.</font><br><font class="Apple-style-span" face="Tahoma" size="2">> >></font><br><font class="Apple-style-span" face="Tahoma" size="2">> >> Must I put it there?</font><br><font class="Apple-style-span" face="Tahoma" size="2">> ></font><br><font class="Apple-style-span" face="Tahoma" size="2">> > On second thought, you might not need it in authenticate. You'd need</font><br><font class="Apple-style-span" face="Tahoma" size="2">> > it in authorize and authenticate.</font><br><font class="Apple-style-span" face="Tahoma" size="2">> </font><br><font class="Apple-style-span" face="Tahoma" size="2">> I meant to say "authorize and accounting".</font><br><font class="Apple-style-span" face="Tahoma" size="2">> </font><br><font class="Apple-style-span" face="Tahoma" size="2">> -- </font><br><font class="Apple-style-span" face="Tahoma" size="2">> Fajar</font><br><font class="Apple-style-span" face="Tahoma" size="2">> </font><br><font class="Apple-style-span" face="Tahoma" size="2">> -</font><br><font class="Apple-style-span" face="Tahoma" size="2">> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html</font><br></div> </body>
</html>