- Freeradius-Devel - lists.freeradius.org

Forward accounting messages from one radius to another
by Nabawia Khalil 09 Nov '10

09 Nov '10

I need an assistance on how to forward accounting messages received on my radius to another radius. Regards, Nabawia On Tue, Nov 9, 2010 at 10:43 AM, zouzou <romaissabox7(a)gmail.com> wrote: > Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to > grant test1 access by this syntax of username ; Username: test1@domaine1 ( > exp: domaine1= DRH) I would like to grant test2 access by this syntax of > username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not > like to grant test1 access by this syntax of username Username: > test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if > FreeRADIUS is capable of handling , if freeradius handle it , please could > you tell me how??? Best Regard. > ------------------------------ > View this message in context: Authentication by domain of company<http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company…> > Sent from the FreeRadius - Dev mailing list archive<http://freeradius.1045715.n5.nabble.com/FreeRadius-Dev-f2789673.html>at Nabble.com. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

2 1

Authentication by domain of company
by zouzou 08 Nov '10

08 Nov '10

Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

Module-Failure-Message creation in rlm_mschap
by Garber, Neal 08 Nov '10

08 Nov '10

The rlm_mschap change to create the Module-Failure-Message attribute creates it on the request chain. I notice that the original commit on 2010-09-10 (35ee205d4e2dcb4fe5e3<http://github.com/alandekok/freeradius-server/commit/35ee205d4e2dcb4fe5e341…>) had it in the reply. Then, a subsequent commit intentionally changed it to the request (401dcce982f9a9972bc7<http://github.com/alandekok/freeradius-server/commit/401dcce982f9a9972bc7bb…>). Would you be opposed to putting it back on the reply chain? I ask because of the pending change to save the reply attributes upon failure to survive the final eap round trip. If it's not in the reply chain, then it gets lost. If you're opposed to this, should the request chain be saved as well (or perhaps just save Module-Failure-Message if it exists)?

2 4

radiusd -d help
by Rashard Roberts 08 Nov '10

08 Nov '10

I have installed freeradius successfully under /etc. I was inform by supervise to install under /opt/freeradius instead. I was informed to use radiusd -d to tell the freeradius server where to look for the configuration files, but I am not familar with the handle -d. I am just doing authentication against an AD server. I know that I am going to need sbm.conf and krb5.conf files in order to run freeradius succesfully, but they are in the /etc directory and freeradius is in the /opt directory. So how do I tell freeradius where to find these files if freeradius is install in a completely different directory using radiusd -d?

2 1

Patch for memory leak in valuepair.c
by James Ballantine 08 Nov '10

08 Nov '10

Hi, We have been experiencing a memory leak in radiusd which the attached patch to valuepair.c appears to fix: When a VALUE_PAIR with the 'Fall-Through' attribute is skipped over in pairxlatmove(), 'tailfrom' is not updated. This means that the pair is orphaned if the subsequent pair is moved. (This is similar to the memory leak in valuepair.c fixed in 2.1.10, but in a different part of the loop. This patch is against the 2.1.x branch from git.) Thanks, James

2 1

[PATCH] check rlm_detail writes
by John Morrissey 03 Nov '10

03 Nov '10

I've modified rlm_detail to check its writes and return RLM_MODULE_FAIL on short writes. I believe this should cause FreeRADIUS to avoid sending an Accounting-Response to the NAS, so the NAS will retry on disk-full/error situations. A while ago, I noticed rlm_detail writes were unchecked[1], causing FreeRADIUS to exit on an assertion in the detail reader due to the partial detail entries. Alan kindly fixed the detail reader's behavior in this situation[2], and I also wanted to have the detail writer check its writes. Truncating the detail file on error to remove the partial detail entry isn't strictly necessary, but it seems like good form and is straightforward. I haven't yet gotten rid of the vp_print() calls (its write is unchecked, too) and this patch is untested (though it compiles), but I wanted to get feedback and see if it's worthwhile for me to finish and test it. john [1] https://lists.freeradius.org/pipermail/freeradius-devel/2010-May/013826.html [2] http://github.com/alandekok/freeradius-server/commit/73fe4311083eb684b3d7f8… -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 2

Building freeradius from source
by Nirmal Guhan 02 Nov '10

02 Nov '10

Hi, Am trying to compile freeradius (freeradius-server-2.1.10) for my own distro (based on 2.6.32 kernel from kernel.org) and running into compilation errors. : libtool: link: `rlm_eap_md5.lo' is not a valid libtool object gmake[9]: *** [rlm_eap_md5.la] Error 1 Please let me know a way to fix this. Also, radiusd seems to be pulling in many shared libraries. Do I need to compile them from source myself or are there any short cuts (if someone has tried this before) ? I know compiling it for Fedora or a similar distro is easier but unfortunately that won't help me. Note that I just need simple password (cleartext) based authentication leaving out the crypto stuff. Thanks, Nirmal

1 0

Segmentation fault on very first accounting request
by Gyanendra Kumar 29 Oct '10

29 Oct '10

Hi All: My authentication requests work fine but just on one accounting request the free-radius (version 2.1.9) gives segmentation fault. Look forward to your near response. The free-radius was running in proxy mode and here are the details: Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/expr Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/digest Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/exec Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/chap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/pam Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/unix Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/files Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/always Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/perl Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/otp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/detail Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/counter Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/echo Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/realm Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/pap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/policy Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/cui Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/eap.conf Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/policy.conf Fri Oct 29 15:49:03 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/default Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Fri Oct 29 15:49:03 2010 : Debug: main { Fri Oct 29 15:49:03 2010 : Debug: user = "freerad" Fri Oct 29 15:49:03 2010 : Debug: group = "freerad" Fri Oct 29 15:49:03 2010 : Debug: allow_core_dumps = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: including dictionary file /etc/freeradius/dictionary Fri Oct 29 15:49:03 2010 : Debug: main { Fri Oct 29 15:49:03 2010 : Debug: prefix = "/usr" Fri Oct 29 15:49:03 2010 : Debug: localstatedir = "/var" Fri Oct 29 15:49:03 2010 : Debug: logdir = "/var/log/freeradius" Fri Oct 29 15:49:03 2010 : Debug: libdir = "/usr/lib/freeradius" Fri Oct 29 15:49:03 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Fri Oct 29 15:49:03 2010 : Debug: hostname_lookups = no Fri Oct 29 15:49:03 2010 : Debug: max_request_time = 30 Fri Oct 29 15:49:03 2010 : Debug: cleanup_delay = 5 Fri Oct 29 15:49:03 2010 : Debug: max_requests = 1024 Fri Oct 29 15:49:03 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Fri Oct 29 15:49:03 2010 : Debug: checkrad = "/usr/sbin/checkrad" Fri Oct 29 15:49:03 2010 : Debug: debug_level = 0 Fri Oct 29 15:49:03 2010 : Debug: proxy_requests = yes Fri Oct 29 15:49:03 2010 : Debug: log { Fri Oct 29 15:49:03 2010 : Debug: stripped_names = no Fri Oct 29 15:49:03 2010 : Debug: auth = no Fri Oct 29 15:49:03 2010 : Debug: auth_badpass = no Fri Oct 29 15:49:03 2010 : Debug: auth_goodpass = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: security { Fri Oct 29 15:49:03 2010 : Debug: max_attributes = 200 Fri Oct 29 15:49:03 2010 : Debug: reject_delay = 1 Fri Oct 29 15:49:03 2010 : Debug: status_server = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Oct 29 15:49:03 2010 : Debug: proxy server { Fri Oct 29 15:49:03 2010 : Debug: retry_delay = 5 Fri Oct 29 15:49:03 2010 : Debug: retry_count = 3 Fri Oct 29 15:49:03 2010 : Debug: default_fallback = no Fri Oct 29 15:49:03 2010 : Debug: dead_time = 120 Fri Oct 29 15:49:03 2010 : Debug: wake_all_if_all_dead = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: home_server localhost2 { Fri Oct 29 15:49:03 2010 : Debug: ipaddr = 127.0.0.1 Fri Oct 29 15:49:03 2010 : Debug: port = 1812 Fri Oct 29 15:49:03 2010 : Debug: type = "auth" Fri Oct 29 15:49:03 2010 : Debug: secret = "testing123" Fri Oct 29 15:49:03 2010 : Debug: response_window = 20 Fri Oct 29 15:49:03 2010 : Debug: max_outstanding = 65536 Fri Oct 29 15:49:03 2010 : Debug: require_message_authenticator = no Fri Oct 29 15:49:03 2010 : Debug: zombie_period = 40 Fri Oct 29 15:49:03 2010 : Debug: status_check = "status-server" Fri Oct 29 15:49:03 2010 : Debug: ping_interval = 30 Fri Oct 29 15:49:03 2010 : Debug: check_interval = 30 Fri Oct 29 15:49:03 2010 : Debug: num_answers_to_alive = 3 Fri Oct 29 15:49:03 2010 : Debug: num_pings_to_alive = 3 Fri Oct 29 15:49:03 2010 : Debug: revive_interval = 120 Fri Oct 29 15:49:03 2010 : Debug: status_check_timeout = 4 Fri Oct 29 15:49:03 2010 : Debug: irt = 2 Fri Oct 29 15:49:03 2010 : Debug: mrt = 16 Fri Oct 29 15:49:03 2010 : Debug: mrc = 5 Fri Oct 29 15:49:03 2010 : Debug: mrd = 30 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: home_server_pool my_auth_failover { Fri Oct 29 15:49:03 2010 : Debug: type = fail-over Fri Oct 29 15:49:03 2010 : Debug: home_server = localhost2 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm example.com { Fri Oct 29 15:49:03 2010 : Debug: auth_pool = my_auth_failover Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm NULL { Fri Oct 29 15:49:03 2010 : Debug: authhost = 192.168.20.83:1812 Fri Oct 29 15:49:03 2010 : Debug: accthost = 192.168.20.83:1813 Fri Oct 29 15:49:03 2010 : Debug: secret = testing123 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm NewRadius { Fri Oct 29 15:49:03 2010 : Debug: authhost = 192.168.20.83:1812 Fri Oct 29 15:49:03 2010 : Debug: accthost = 192.168.20.83:1813 Fri Oct 29 15:49:03 2010 : Debug: secret = testing123 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm ruckuswireless.com { Fri Oct 29 15:49:03 2010 : Debug: authhost = 192.168.20.83:1812 Fri Oct 29 15:49:03 2010 : Debug: accthost = 192.168.20.83:1813 Fri Oct 29 15:49:03 2010 : Debug: secret = testing123 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Loading Clients #### Fri Oct 29 15:49:03 2010 : Debug: client localhost { Fri Oct 29 15:49:03 2010 : Debug: ipaddr = 127.0.0.1 Fri Oct 29 15:49:03 2010 : Debug: require_message_authenticator = no Fri Oct 29 15:49:03 2010 : Debug: secret = "testing123" Fri Oct 29 15:49:03 2010 : Debug: nastype = "other" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: client 192.168.20.0/24 { Fri Oct 29 15:49:03 2010 : Debug: require_message_authenticator = no Fri Oct 29 15:49:03 2010 : Debug: secret = "testing123" Fri Oct 29 15:49:03 2010 : Debug: shortname = "Gyan-test-network-1" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Instantiating modules #### Fri Oct 29 15:49:03 2010 : Debug: instantiate { Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_exec Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating exec Fri Oct 29 15:49:03 2010 : Debug: exec { Fri Oct 29 15:49:03 2010 : Debug: wait = no Fri Oct 29 15:49:03 2010 : Debug: input_pairs = "request" Fri Oct 29 15:49:03 2010 : Debug: shell_escape = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_expr Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating expr Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_expiration Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating expiration Fri Oct 29 15:49:03 2010 : Debug: expiration { Fri Oct 29 15:49:03 2010 : Debug: reply-message = "Password Has Expired " Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_logintime Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating logintime Fri Oct 29 15:49:03 2010 : Debug: logintime { Fri Oct 29 15:49:03 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Oct 29 15:49:03 2010 : Debug: minimum-timeout = 60 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Loading Virtual Servers #### Fri Oct 29 15:49:03 2010 : Debug: server inner-tunnel { Fri Oct 29 15:49:03 2010 : Debug: modules { Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_pap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating pap Fri Oct 29 15:49:03 2010 : Debug: pap { Fri Oct 29 15:49:03 2010 : Debug: encryption_scheme = "auto" Fri Oct 29 15:49:03 2010 : Debug: auto_header = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_chap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating chap Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_mschap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating mschap Fri Oct 29 15:49:03 2010 : Debug: mschap { Fri Oct 29 15:49:03 2010 : Debug: use_mppe = yes Fri Oct 29 15:49:03 2010 : Debug: require_encryption = no Fri Oct 29 15:49:03 2010 : Debug: require_strong = no Fri Oct 29 15:49:03 2010 : Debug: with_ntdomain_hack = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_unix Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating unix Fri Oct 29 15:49:03 2010 : Debug: unix { Fri Oct 29 15:49:03 2010 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_eap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap Fri Oct 29 15:49:03 2010 : Debug: eap { Fri Oct 29 15:49:03 2010 : Debug: default_eap_type = "md5" Fri Oct 29 15:49:03 2010 : Debug: timer_expire = 60 Fri Oct 29 15:49:03 2010 : Debug: ignore_unknown_eap_types = no Fri Oct 29 15:49:03 2010 : Debug: cisco_accounting_username_bug = no Fri Oct 29 15:49:03 2010 : Debug: max_sessions = 4096 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-md5 Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-leap Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-gtc Fri Oct 29 15:49:03 2010 : Debug: gtc { Fri Oct 29 15:49:03 2010 : Debug: challenge = "Password: " Fri Oct 29 15:49:03 2010 : Debug: auth_type = "PAP" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-tls Fri Oct 29 15:49:03 2010 : Debug: tls { Fri Oct 29 15:49:03 2010 : Debug: rsa_key_exchange = no Fri Oct 29 15:49:03 2010 : Debug: dh_key_exchange = yes Fri Oct 29 15:49:03 2010 : Debug: rsa_key_length = 512 Fri Oct 29 15:49:03 2010 : Debug: dh_key_length = 512 Fri Oct 29 15:49:03 2010 : Debug: verify_depth = 0 Fri Oct 29 15:49:03 2010 : Debug: pem_file_type = yes Fri Oct 29 15:49:03 2010 : Debug: private_key_file = "/etc/freeradius/certs/server.key" Fri Oct 29 15:49:03 2010 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Fri Oct 29 15:49:03 2010 : Debug: CA_file = "/etc/freeradius/certs/ca.pem" Fri Oct 29 15:49:03 2010 : Debug: private_key_password = "whatever" Fri Oct 29 15:49:03 2010 : Debug: dh_file = "/etc/freeradius/certs/dh" Fri Oct 29 15:49:03 2010 : Debug: random_file = "/etc/freeradius/certs/random" Fri Oct 29 15:49:03 2010 : Debug: fragment_size = 1024 Fri Oct 29 15:49:03 2010 : Debug: include_length = yes Fri Oct 29 15:49:03 2010 : Debug: check_crl = no Fri Oct 29 15:49:03 2010 : Debug: cipher_list = "DEFAULT" Fri Oct 29 15:49:03 2010 : Debug: make_cert_command = "/etc/freeradius/certs/bootstrap" Fri Oct 29 15:49:03 2010 : Debug: cache { Fri Oct 29 15:49:03 2010 : Debug: enable = no Fri Oct 29 15:49:03 2010 : Debug: lifetime = 24 Fri Oct 29 15:49:03 2010 : Debug: max_entries = 255 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-ttls Fri Oct 29 15:49:03 2010 : Debug: ttls { Fri Oct 29 15:49:03 2010 : Debug: default_eap_type = "md5" Fri Oct 29 15:49:03 2010 : Debug: copy_request_to_tunnel = no Fri Oct 29 15:49:03 2010 : Debug: use_tunneled_reply = no Fri Oct 29 15:49:03 2010 : Debug: virtual_server = "inner-tunnel" Fri Oct 29 15:49:03 2010 : Debug: include_length = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-peap Fri Oct 29 15:49:03 2010 : Debug: peap { Fri Oct 29 15:49:03 2010 : Debug: default_eap_type = "mschapv2" Fri Oct 29 15:49:03 2010 : Debug: copy_request_to_tunnel = no Fri Oct 29 15:49:03 2010 : Debug: use_tunneled_reply = no Fri Oct 29 15:49:03 2010 : Debug: proxy_tunneled_request_as_eap = yes Fri Oct 29 15:49:03 2010 : Debug: virtual_server = "inner-tunnel" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-mschapv2 Fri Oct 29 15:49:03 2010 : Debug: mschapv2 { Fri Oct 29 15:49:03 2010 : Debug: with_ntdomain_hack = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_realm Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating suffix Fri Oct 29 15:49:03 2010 : Debug: realm suffix { Fri Oct 29 15:49:03 2010 : Debug: format = "suffix" Fri Oct 29 15:49:03 2010 : Debug: delimiter = "@" Fri Oct 29 15:49:03 2010 : Debug: ignore_default = no Fri Oct 29 15:49:03 2010 : Debug: ignore_null = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_files, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_files Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating files Fri Oct 29 15:49:03 2010 : Debug: files { Fri Oct 29 15:49:03 2010 : Debug: usersfile = "/etc/freeradius/users" Fri Oct 29 15:49:03 2010 : Debug: acctusersfile = "/etc/freeradius/acct_users" Fri Oct 29 15:49:03 2010 : Debug: preproxy_usersfile = "/etc/freeradius/preproxy_users" Fri Oct 29 15:49:03 2010 : Debug: compat = "no" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking session {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_radutmp Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating radutmp Fri Oct 29 15:49:03 2010 : Debug: radutmp { Fri Oct 29 15:49:03 2010 : Debug: filename = "/var/log/freeradius/radutmp" Fri Oct 29 15:49:03 2010 : Debug: username = "%{User-Name}" Fri Oct 29 15:49:03 2010 : Debug: case_sensitive = yes Fri Oct 29 15:49:03 2010 : Debug: check_with_nas = yes Fri Oct 29 15:49:03 2010 : Debug: perm = 384 Fri Oct 29 15:49:03 2010 : Debug: callerid = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_attr_filter Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating attr_filter.access_reject Fri Oct 29 15:49:03 2010 : Debug: attr_filter attr_filter.access_reject { Fri Oct 29 15:49:03 2010 : Debug: attrsfile = "/etc/freeradius/attrs.access_reject" Fri Oct 29 15:49:03 2010 : Debug: key = "%{User-Name}" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } # modules Fri Oct 29 15:49:03 2010 : Debug: } # server Fri Oct 29 15:49:03 2010 : Debug: server { Fri Oct 29 15:49:03 2010 : Debug: modules { Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_preprocess Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating preprocess Fri Oct 29 15:49:03 2010 : Debug: preprocess { Fri Oct 29 15:49:03 2010 : Debug: huntgroups = "/etc/freeradius/huntgroups" Fri Oct 29 15:49:03 2010 : Debug: hints = "/etc/freeradius/hints" Fri Oct 29 15:49:03 2010 : Debug: with_ascend_hack = no Fri Oct 29 15:49:03 2010 : Debug: ascend_channels_per_line = 23 Fri Oct 29 15:49:03 2010 : Debug: with_ntdomain_hack = no Fri Oct 29 15:49:03 2010 : Debug: with_specialix_jetstream_hack = no Fri Oct 29 15:49:03 2010 : Debug: with_cisco_vsa_hack = no Fri Oct 29 15:49:03 2010 : Debug: with_alvarion_vsa_hack = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking preacct {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_acct_unique Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating acct_unique Fri Oct 29 15:49:03 2010 : Debug: acct_unique { Fri Oct 29 15:49:03 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking accounting {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_always, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_always Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating ok Fri Oct 29 15:49:03 2010 : Debug: always ok { Fri Oct 29 15:49:03 2010 : Debug: rcode = "ok" Fri Oct 29 15:49:03 2010 : Debug: simulcount = 0 Fri Oct 29 15:49:03 2010 : Debug: mpp = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_detail Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating detail Fri Oct 29 15:49:03 2010 : Debug: 12. In Detail Accounting Fri Oct 29 15:49:03 2010 : Debug: detail { Fri Oct 29 15:49:03 2010 : Debug: detailfile = "%A/%{Client-IP-Address}/detail" Fri Oct 29 15:49:03 2010 : Debug: header = "%t" Fri Oct 29 15:49:03 2010 : Debug: detailperm = 384 Fri Oct 29 15:49:03 2010 : Debug: dirperm = 493 Fri Oct 29 15:49:03 2010 : Debug: locking = no Fri Oct 29 15:49:03 2010 : Debug: log_packet_header = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking session {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: } # modules Fri Oct 29 15:49:03 2010 : Debug: } # server Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Oct 29 15:49:03 2010 : Debug: listen { Fri Oct 29 15:49:03 2010 : Debug: type = "acct" Fri Oct 29 15:49:03 2010 : Debug: ipaddr = 192.168.20.113 Fri Oct 29 15:49:03 2010 : Debug: port = 0 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: listen { Fri Oct 29 15:49:03 2010 : Debug: type = "auth" Fri Oct 29 15:49:03 2010 : Debug: ipaddr = * Fri Oct 29 15:49:03 2010 : Debug: port = 0 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Listening on accounting address 192.168.20.113 port 1813 Fri Oct 29 15:49:03 2010 : Debug: Listening on authentication address * port 1812 Fri Oct 29 15:49:03 2010 : Debug: Listening on proxy address * port 1814 Fri Oct 29 15:49:03 2010 : Info: Ready to process requests. In Rad Recv CALLING ATTRDB FROM RAD_RECV rad_recv: Accounting-Request packet from host 192.168.20.135 port 2775, id=164, length=101 User-Name = "testing2" Acct-Session-Id = "1288392617O99rsg" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "Localhost" NAS-Port = 0 Calling-Station-Id = "1115551212" Acct-Status-Type = Stop Acct-Session-Time = 180 Acct-Delay-Time = 2 2. In rad decode CALLING ATTRDB from RADRECV End of radius decode Fri Oct 29 15:49:07 2010 : Info: +- entering group preacct {...} Fri Oct 29 15:49:07 2010 : Info: [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.20.135,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "1288392617O99rsg",User-Name = "testing2"' Fri Oct 29 15:49:07 2010 : Info: [acct_unique] Acct-Unique-Session-ID = "d7b6690b26a345b1". Fri Oct 29 15:49:07 2010 : Info: ++[acct_unique] returns ok Fri Oct 29 15:49:07 2010 : Info: [suffix] No '@' in User-Name = "testing2", looking up realm NULL Fri Oct 29 15:49:07 2010 : Info: [suffix] Found realm "NULL" Fri Oct 29 15:49:07 2010 : Info: [suffix] Adding Stripped-User-Name = "testing2" Fri Oct 29 15:49:07 2010 : Info: [suffix] Adding Realm = "NULL" Fri Oct 29 15:49:07 2010 : Info: [suffix] Proxying request from user testing2 to realm NULL Fri Oct 29 15:49:07 2010 : Info: [suffix] Preparing to proxy accounting request to realm "NULL" Fri Oct 29 15:49:07 2010 : Info: ++[suffix] returns updated Fri Oct 29 15:49:07 2010 : Info: ++[files] returns noop Fri Oct 29 15:49:07 2010 : Info: +- entering group accounting {...} Fri Oct 29 15:49:07 2010 : Info: ++[ok] returns ok Fri Oct 29 15:49:07 2010 : Debug: 1. In Detail Accounting Fri Oct 29 15:49:07 2010 : Debug: 14. In Detail Accounting Fri Oct 29 15:49:07 2010 : Info: [detail] expand: %A/%{Client-IP-Address}/detail -> /var/log/freeradius/radacct/ 192.168.20.135/detail Fri Oct 29 15:49:07 2010 : Info: [detail] %A/%{Client-IP-Address}/detail expands to /var/log/freeradius/radacct/192.168.20.135/detail Fri Oct 29 15:49:07 2010 : Debug: 20 In rlm_detail Fri Oct 29 15:49:07 2010 : Info: [detail] expand: %t -> Fri Oct 29 15:49:07 2010 Fri Oct 29 15:49:07 2010 : Debug: 21 In rlm_detail Fri Oct 29 15:49:07 2010 : Info: ++[detail] returns ok Segmentation fault Best Regards -GK

2 1

Freeradius + Active Directory
by Rashard Roberts 20 Oct '10

20 Oct '10

Hello I am trying to get Freeradius to authenticate end-user using Active Directory. The end-user will be using be there AD username and password to login to network devices. Would some please help me? I have embedded a copy of the debug log from the radius server. rad_recv: Access-Request packet from host 192.168.168.252:1645, id=94, length=92 User-Name = "svc-ldap-01@corp-test" User-Password = "WindowsXP!" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.168.252 NAS-Port = 10 Calling-Station-Id = "192.168.168.194" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "corp-test" for User-Name = "svc-ldap-01@corp-test" rlm_realm: No such realm "corp-test" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 94 to 192.168.168.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 94 with timestamp 4cbf5aee Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.168.252:1645, id=95, length=104 User-Name = "svc-ldap-01(a)corp-test.weather.com" User-Password = "WindowsXP!" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.168.252 NAS-Port = 10 Calling-Station-Id = "192.168.168.194" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "corp-test.weather.com" for User-Name = " svc-ldap-01(a)corp-test.weather.com" rlm_realm: No such realm "corp-test.weather.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 95 to 192.168.168.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 95 with timestamp 4cbf5b25 Nothing to do. Sleeping until we see a request.

2 1

Re: Freeradius-Devel Digest, Vol 66, Issue 6
by Gyanendra Kumar 18 Oct '10

18 Oct '10

Hi Neal: Thanks for the response. authorize { if ("%{NAS-Port-Type}" =~ /^Wireless/){ if ("%{NAS-Identifier}" =~ /^gktest-nas-id/){ if ("%{Called-Station-Id}" =~ /(.*):(.*)/){ update control { %{Called-Station-SSId} = "%{2}" If I do anything like above try and use any new variable for example here, %{Called-Station-SSId} I get this error when starting radius deamon. Sun Oct 17 18:19:02 2010 : Error: /etc/freeradius/sites-enabled/default[71]: Invalid expansion: "%{2}" Look forward to your comments. Best Regards -Gyan It happens both in update request and update control On Fri, Oct 15, 2010 at 3:00 AM, < freeradius-devel-request(a)lists.freeradius.org> wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. RE: Upgrading Free Radius Proxy functionality (Garber, Neal) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 14 Oct 2010 09:42:59 -0400 > From: "Garber, Neal" <Neal.Garber(a)iberdrolausa.com> > Subject: RE: Upgrading Free Radius Proxy functionality > To: "'FreeRadius developers mailing list'" > <freeradius-devel(a)lists.freeradius.org> > Message-ID: > < > 3FF48394E621F14F97A9117CF92D138E5863CDAE1D(a)EEROCH1CMS1.Energyeast.net> > > Content-Type: text/plain; charset="us-ascii" > > > SSID based forwarding takes precedence over realm and default forwarding. > > > Please give comments or pointers about how to include this functionality > to enhance forwarding and to change order. > > Use unlang. We use Cisco APs which pass the SSID in a Cisco-AVPair > attribute. So, perhaps you could use something similar to the following in > the authorize section of sites-enabled/default: > > # Adjust below to capture the SSID from the request > # If you're not sure what attr. has SSID, look at your debug output > # If it's not in any request attr, consult your NAS documentation on > how to make it pass it > if (Cisco-AVPair =~ /ssid=(.*)/) { > update request { > SSID-Name = "%{1}" > } > } > > # Adjust SSID and Realm names below > # Ensure you create the realms in proxy.conf > if (SSID-Name) { > if (SSID-Name == "SSID1") { > update control { > Proxy-To-Realm = "Realm1" > } > } > elseif (SSID-Name == "SSID2") { > update control { > Proxy-To-Realm = "Realm2" > } > } > } > > Also, you'll need to add SSID-Name to the dictionary file as a local > attribute. Something like the following: > > ATTRIBUTE SSID-Name 3012 string >

1 0