November 2005 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

no DB handles
by Lucas Aimaretto 31 Oct '07

31 Oct '07

Hi all, I've seen many of these messages in the radius.log ... Wed Jun 15 15:10:23 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

11 23

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 25 Feb '06

25 Feb '06

Try changing NS-Admin-Privilege = "Read-Only-Admin" To NS-Admin-Privilege = "1" Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Mark Tunnell Sent: Friday, November 04, 2005 1:23 PM To: freeradius-users(a)lists.freeradius.org Subject: Newbie question re. dictionary files. I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a NetScreen5. I'm able to authenticate accounts just fine. Now I'd like to begin pulling administrative privileges from the Radius server, but I haven't figured out how to do that. I've referenced the dictionary.netscreen file in my clients.conf file, nastype = netscreen, but I'm embarrassed to say I can't figure out the format for including the dictionary attributes for a user in my users file. I've tried various permutations like: markt Auth-Type := Local, User=Password == "testing" NS-Admin-Privilege = "Read-Only-Admin" and: markt Auth-Type := Local, User=Password == "testing" Netscreen-NS-Admin-Privilege = "Read-Only-Admin" Nothing's working. Can some one show me the correct syntax? Thank you, Mark - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 13 Feb '06

13 Feb '06

Yohoo! >> I hope, I could help some people trying to use AD for radius. >there is another way - use the krb module to authenticate against AD Are there any advantages/ disadvantages ldap <-> krb5?

5 13

LDAP, FreeRadius, and Schema
by Matt Juszczak 02 Dec '05

02 Dec '05

Hi all, I was wondering what everyone uses for an account objectClass? Right now I'm using "Person", which makes the dn: cn=<user>,ou=Radius,dc=mydomain,dc=net However, indexing the cn would index the CN of other OU's as well ... . I'm just wondering what people use. I know "Account" could also be used. Regards, Matt

3 3

RE: Freeradius How to integrate Active Directory[ADIntegrationWindowsXP NTLM Tutorial]
by Alhagie Puye 02 Dec '05

02 Dec '05

Thanks Dusty. That's very helpful. I have one little problem. I was hoping someone can shed some light on it. For the Active Directory security, I need to specify the username as "Domain\user" instead of just "user" for the identity in radiusd.conf "user(a)domain.com" doesn't seem to work. Here is the output: rad_recv: Access-Request packet from host 192.168.42.1:50667, id=146, length=57 User-Name = "user" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "apuye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(uid=apuye)' radius_xlat: 'dc=ad,dc=puyenet,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to orion.puyenet.com:389, authentication 0 rlm_ldap: bind as cn=apuye(a)ad.puyenet.com,ou=users,dc=ad,dc=puyenet,dc=com/password to orion.puyenet.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 4 modcall: group authorize returns fail for request 4 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 146 with timestamp 4388ab87 Nothing to do. Sleeping until we see a request. The radiusd.conf file looks like this for the ldap section: ldap { server = "orion.puyenet.com" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=apuye(a)ad.puyenet.com,ou=users,dc=ad,dc=puyenet,dc=com" password = password #basedn = "o=My Org,c=UA" basedn = "dc=ad,dc=puyenet,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" Thanks in advance. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 25, 2005 9:43 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active > >Directory[ADIntegrationWindowsXP NTLM Tutorial] > > > > > >> So, the question again is if the VPN Concentrator is only sending > >> username and password, do I need ntml_auth or ms-chap? FreeRADIUS > >> doesn't have any usernames and password and will query Active > >> Directory for the actual authentication. > >> > >> Thanks, > >> > > > >If the packet is merely containing plaintext username and > >password, then you can probably just use rlm_ldap against AD > >and hit it directly. Just need to setup a user with read > >access to the directory to do the initial bind with and > >search of the user for authorization. Then the user will be > >authenticated by doing a bind against AD with the > >username/password in the packet. > > > >BTW - I use freeradius w/ ldap for cisco VPN concentrators > >as well, although its openldap instead of AD. To pass back > >the class attribute, you must modify ldap.attrmap and > >specify the reply item of Class to match what you call it in > >the directory. > > > >eg: > > > >replyItem Class radiusClass > > > >Then in the directory, you have > > > >dn: cn=someuser,... > >... > >radiusClass: "OU=myvpngroup;" > > > >So, for AD, you'll need to extend the schema and add an > >attribute for this. Or if you already have something that > >you can use, just modify ldap.attrmap to know what it is. > > > >-Dusty Doris > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 4

WLAN 802.1x FreeRadius with LDAP
by Christian Poessinger 01 Dec '05

01 Dec '05

Hello folks, I want to do a setup with a HP Procurve 520wl Access Point, OpenLDAP and FreeRadius with 802.1x and users in my LDAP backend. LDAP and Radius works fine, when i do a radtest user pass radius.domain.tld 0 secret i get an access accept package back. Now i configured my AP to use the Radius server for 802.1x auth, when i want to logon into the WLAN I enter my user and pass that just worked with radtest but I recieve an acces reject package. This is really strange cause the Radius debug mode tells me LDAP connection successfull. I use clear passwords in the backend, so there should be no problem. Anyone has an idea for my problem? Here is the Radius debug message with the access reject packet: rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 11 to xxx.xxx.164.26:6001 EAP-Message = 0x0105040619407c917840ad1cf254e5ca549ca9b1053de4de1e704dc6eb9cec86a35eafabe5 2f60e8ee1a9697a755a713be14acd2db7f3402acb70864e3139ef470c900d024f2fd0f455b94 028c87d7a170ce86f302e35c4e658d09f17016227f0003cf308203cb30820334a00302010202 0900927540ab5d693004300d06092a864886f70d01010405003081a0310b3009060355040613 0244453110300e06035504081307426176617269613112301006035504071309577565727a62 75726731163014060355040a130d4765466f656b6f4d20652e562e31193017060355040b1310 4765466f656b6f4d20652e562e20434131193017060355040313 EAP-Message = 0x104765466f656b6f4d20652e562e204341311d301b06092a864886f70d010901160e636140 6765666f656b6f6d2e6465301e170d3035303531363137313832335a170d3036303531363137 313832335a3081a0310b30090603550406130244453110300e06035504081307426176617269 613112301006035504071309577565727a6275726731163014060355040a130d4765466f656b 6f4d20652e562e31193017060355040b13104765466f656b6f4d20652e562e20434131193017 060355040313104765466f656b6f4d20652e562e204341311d301b06092a864886f70d010901 160e6361406765666f656b6f6d2e646530819f300d06092a8648 EAP-Message = 0x86f70d010101050003818d0030818902818100c8124b32b761710b8c576a5b8f566a1dd8cc 97c423dfd8901cd58b9e90960328233879b3a09ebda855dbaa4376c00318ebc1767173051ae1 5995a1d41c9a6289707d5f7dd1e608ca5071e2aeb99092204f9386789c9ec8d5f754a26e9940 297ffbe547b5d0cf5ee16566abcc7578e25ac6a3b5e57befee43f2828174d27db19f02030100 01a382010930820105301d0603551d0e04160414ac6e4891d5a749d6548d7eda627ca2d64d12 d2693081d50603551d230481cd3081ca8014ac6e4891d5a749d6548d7eda627ca2d64d12d269 a181a6a481a33081a0310b30090603550406130244453110300e EAP-Message = 0x06035504081307426176617269613112301006035504071309577565727a62757267311630 14060355040a130d4765466f656b6f4d20652e562e31193017060355040b13104765466f656b 6f4d20652e562e20434131193017060355040313104765466f656b6f4d20652e562e20434131 1d301b06092a864886f70d010901160e6361406765666f656b6f6d2e6465820900927540ab5d 693004300c0603551d13040530030101ff300d06092a864886f70d0101040500038181004a36 34f23e46d180ec87122ee39ba0c6757d22a23ec39a38e3f282e82efb7428b83d04f665e28b00 e99a88217803c1abb4a0bc90fe6a51a37eec1c1868853a5436d5 EAP-Message = 0x9035f217c35ab4d53d6f1e3d11cdeabc9f77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc479631c6d6d413371d8af0ebf14ac4f Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=12, length=155 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xc479631c6d6d413371d8af0ebf14ac4f Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xb07e446b64197c49b0ebaca6e799dc53 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 12 to xxx.xxx.164.26:6001 EAP-Message = 0x0106003b1900715e896f163c5ccb279cd28b82295a1bd493ac86f6ffe4733d43f380f4871b 567d14ecb8d5171f15de61995e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xccbffd45885465294711dc5bf8395320 Finished request 3 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=13, length=341 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xccbffd45885465294711dc5bf8395320 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600c01980000000b616030100861000008200801942772db96a99e5e538cb1d5d208967 b1353ea1158512bb1bd050ab7e2aca218fe43e45fbb41a076a2a0dad179b456de8d7afce55b7 c72e125ebe3bb4c42ff4804ded92a10e29c9f021a9dcfe7cac9c60fc41d1be343c7cb74b2889 5a5855e476b79b5db1fea73e1d0615baa9bfcca6004b37f7ebc2ef0f54e6d38ba0c57a631403 010001011603010020340f13326352d4d4b739b0a1d5350db6b211be3d1b16345f3429ce4875 18e879 Message-Authenticator = 0x1379379ef003130e6e5d8bc4ea849160 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 13 to xxx.xxx.164.26:6001 EAP-Message = 0x0107003119001403010001011603010020eb7dbacfe1675927e1f3fcf8e5f61914d375ca69 10fcded8e503adb2dbfccbff Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbe4b1111c47a456a9bbe659aa28a4911 Finished request 4 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=14, length=182 User-Name = "user" NAS-IP-Address = xxx.xxx.1.66 Called-Station-Id = "00-08-88-12-2e-3f" Calling-Station-Id = "00-0d-37-ab-2f-c7" NAS-Identifier = "ORiNOCO-AP-2000-00-02-00" State = 0xbe4b1111c47a456a9bbe659aa28a4911 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700211980000000171503010012a389dbe218dce122f0104ff21769ccb64b2b Message-Authenticator = 0xca07ce402c4e46c7342a2abc05383cab Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for user radius_xlat: '(uid=user)' radius_xlat: 'ou=people,dc=domain,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=de, with filter (uid=user) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 4 seconds... rad_recv: Access-Request packet from host xxx.xxx.164.26:6001, id=14, length=182 Sending Access-Reject of id 14 to xxx.xxx.164.26:6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 9 with timestamp 43886940 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 10 with timestamp 43886941 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 11 with timestamp 43886942 Cleaning up request 3 ID 12 with timestamp 43886942 Cleaning up request 4 ID 13 with timestamp 43886942 Cleaning up request 5 ID 14 with timestamp 43886942 Nothing to do. Sleeping until we see a request.

8 26

CPU - FR1.0.5
by Breuer Nicolas 01 Dec '05

01 Dec '05

Hello all, I've a problem with FR 1.0.5. I've installed it on an old server Pentium Intel 3 (no multi-threading) i've installed FR1.0.5 and radiusd take all CPU !! after a while, requests aren't more served.. kernel : Linux 2.6.9-1.667 #1 When i launch radiusd with -s option there is no problem.. Do you have an explication ? kernel is compiled with no multi-threading. I've an other radiusd on a pentium 4 with multi-threading and i have no problems on this server.. Thanks

3 3

Re: Fall-through and different NAS IP Settings
by Curt LeCaptain 30 Nov '05

30 Nov '05

As always, run it in debugging mode. You would see the answer. In this case, NAS-IP-Address is an attribute in the RADIUS packet. So if the NAS doesn't send it, it doesn't match that entry. Okay, so I'm looking at my radiusd -X output and here's what I get on a access-request: rad_recv: Access-Request packet from host ip.add.re.ss:21737, id=82, length=84 Framed-Protocol = PPP User-Name = "user(a)domain.com" User-Password = "drb2859" NAS-Port-Type = Virtual NAS-Port = 81185 Service-Type = Framed-User NAS-IP-Address = ip.add.re.ss I'm just asking this for my understanding, am I still going to want to use Client-IP-Address even though from what I can see here, the NAS-IP-Address attribute is appearing within the output of debugging? Thanks, Curt LeCaptain

2 1

error in configurable failover?
by Norbert Wegener 30 Nov '05

30 Nov '05

I am trying to get configurable failover working.(ok, this example is not yet that far) With authenticate { #ldap1 group { ldap1 { notfound = return } } } in radiusd.conf I get: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8117ff8 Module: Instantiated ldap (ldap1) radiusd.conf[1862] Unknown Auth-Type "_UnNamedGroup" in authenticate section. Errors setting up modules changing this to authenticate { ldap1 #group { #ldap1 { #notfound = return #} #} # } freeradius starts without problems. radiusd -v radiusd: FreeRADIUS Version 1.1.0-pre0, for host i686-pc-linux-gnu, built on Nov 22 2005 at 22:02:26 Norbert Wegener

3 3