June 2005 - Freeradius-Users - lists.freeradius.org

Which module to use talk to Microsoft SQL Server 2000 ?
by Aime 15 Jun '05

15 Jun '05

All, Which module can one use to accounting or authenticating with Microsoft SQl Server ? Thanks in advance --Aimé __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 3

Problem TTLS-LDAP
by alfonso celestino 15 Jun '05

15 Jun '05

Hi, everybody! I have a problem on having tried to use TTLS with LDAP. I have seen solutions to this problem in this mailing list, but I have not had success. In the following line it seems that ldap realizes correctly the comparison: .... rlm_ldap: user prueba authorized to use remote access .... but after that error comes: .... rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. .... Please, if someone have an idea to solve it, I will be grateful very much. I attach my configuration files and the complete result of the execution. Thanks Alfonso Celestino DGSCA, UNAM ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx Radius.conf File: authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } unix eap } authorize { preprocess chap mschap suffix eap files ldap } ldap { server = "xxx.xxx.xxx.xxx" identity = "cn=redes,ou=admins,ou=radius,dc=mydomain,dc=com" password = secret basedn = "ou=users,ou=radius,dc=mydomain,dc=com" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" password_attribute = "userPassword" ssword_attribute = "userPassword" authtype = ldap start_tls = no tls_cacertfile = /usr/local/radius/etc/raddb/certs/demoCA/cacert.pem tls_cacertdir = /usr/local/radius/etc/raddb/certs tls_certfile = /usr/local/radius/etc/raddb/certs/server.pem tls_keyfile = /usr/local/radius/etc/raddb/certs/demoCA/private/cakey.pem tls_randfile = /usr/local/radius/etc/raddb/certs/random tls_require_cert = "demand" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } eap.conf file eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no tls { private_key_password = secretpasswd private_key_file = ${raddbdir}/certs/server.pem certificate_file = ${raddbdir}/certs/server.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } users file: DEFAULT Auth-Type := LDAP Fall-Through = No ....And I add to ldap.attrmap file the next: checkItem User-Password userPassword checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "132.247.1.33" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=redes,ou=admins,ou=radius,dc=mydomain,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "/usr/local/radius/etc/raddb/certs/demoCA/cacert.pem" ldap: tls_cacertdir = "/usr/local/radius/etc/raddb/certs" ldap: tls_certfile = "/usr/local/radius/etc/raddb/certs/debian.pem" ldap: tls_keyfile = "/usr/local/radius/etc/raddb/certs/demoCA/private/cakey.pem" ldap: tls_randfile = "/usr/local/radius/etc/raddb/certs/random" ldap: tls_require_cert = "demand" ldap: password = "freeradius" ldap: basedn = "ou=users,ou=radius,dc=mydomain,dc=com" ldap: filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/radius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/radius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8151628 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/debian.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/debian.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/root.pem" tls: private_key_password = "wireless" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 132.248.120.178:6001, id=15, length=144 User-Name = "prueba" NAS-IP-Address = 132.248.120.178 Called-Station-Id = "00-20-A6-49-74-B8:wlanseg" Calling-Station-Id = "00-50-FC-BE-29-C0" NAS-Identifier = "Avaya-AP-8-49-74-b8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000b01707275656261 Message-Authenticator = 0x19e8a29cdf0de6710fc3019af28b5f7c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "prueba", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 145 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba radius_xlat: '(&(uid=prueba)(objectclass=radiusprofile))' radius_xlat: 'ou=users,ou=radius,dc=mydomain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 132.247.1.33:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radius/etc/raddb/certs/demoCA/cacert.pem rlm_ldap: setting TLS CACert File to /usr/local/radius/etc/raddb/certs rlm_ldap: setting TLS Require Cert to demand rlm_ldap: setting TLS Cert File to /usr/local/radius/etc/raddb/certs/debian.pem rlm_ldap: setting TLS Key File to /usr/local/radius/etc/raddb/certs/demoCA/private/cakey.pem rlm_ldap: setting TLS Key File to /usr/local/radius/etc/raddb/certs/random rlm_ldap: bind as cn=redes,ou=admins,ou=radius,dc=mydomain,dc=com/freeradius to 132.247.1.33:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=radius,dc=mydomain,dc=com, with filter (&(uid=prueba)(objectclass=radiusprofile)) rlm_ldap: Added password redeswire in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0

3 4

Timer...
by synackrst 15 Jun '05

15 Jun '05

Hello erveryone :-) Anyone can help-me setting freeradius to count(continuous time) and disable wireless access for users? For example: User1 - just allowed for 1hour, and then account disabled User2 - just allowed for 1hour, and then account disabled Thank you.

2 2

Using Oracle AND MySQL
by Tim Rich, Jr. 15 Jun '05

15 Jun '05

freeRADIUS is part of our solution - the majority of our solution, including users resides in an Oracle database; however, we have been using MySQL for authenticate, authorize, and accounting. Of course, there is an overhead here where we programmatically keep the Oracle users and MySQL tables in synchronization. There have been issues where users were not kept current - hence the following question: Can we authenticate and authorize in Oracle and account in MySQL? Could not find anything in the FAQ or archives, so I assume that either it is not possible or nobody else has had the need/desire to do so. Thanks in advance for any responses. Tim Rich, Jr. Unique Solutions, Inc.

2 1

Re: freeradius no longer accepts Crypt-Password after upgrade
by shadur＠systemec.nl 15 Jun '05

15 Jun '05

In other news for Wed, Jun 15, 2005 at 10:08:05AM +0200, Rens Houben has been seen typing: > Argh. Disregard, I'm an idiot. The "No Auth-Type Found" was because I'd forgotten to restore the huntgroups file. Now it's "merely" repeating the original error: "auth: user supplied User-Password does NOT match local User-Password" and rejects. I've pasted a full trace log on http://hiryuu.systemec.nl/~shadur/freeradissues.txt -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://swordbreaker.systemec.nl/~shadur/shadur.key.asc

2 1

FR eap-ttls , winxp client configuration
by Bruno Quintas 15 Jun '05

15 Jun '05

Hi, i want to change my current setup (eap-tls) to eap-ttls so that i don't need the client certificates. I really not understanding how to use the options and if should i use them: copy_request_to_tunnel = no use_tunneled_reply = no Can somebody give some hints on configuring Win XP with SecureW2 in this scenario? thanks, B

2 3

RE: FR eap-ttls , winxp client configuration
by King, Michael 15 Jun '05

15 Jun '05

Do not comment TLS. TLS is required to Make TTLS work. (TTLS uses the TLS section) > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Bruno Quintas > Sent: Wednesday, June 15, 2005 2:24 PM > To: FreeRadius users mailing list > Subject: Re: FR eap-ttls , winxp client configuration > > Thanks for your feedback Alan, i'll try to be clearer: > > What changes should i do in the server to change the current > setup EAP-TLS to EAP-TTLS? > Based on the documents eap.conf: > > default_eap_type = ttls in eap section > comment tls and uncomment ttls? > > > The purpose of using ttls is to eliminate the need for client > certificates. I have read in several articles (which > considered this to be the main advantage over eap-tls), but > all the howtos i've seen - including secure2w ttls client > assume the existence of client certificates. > > TIA > > BQ > > > > > > > >>Can somebody give some hints on configuring Win XP with > SecureW2 in this scenario? > > >These options have nothing to do with configuring XP. > >See the various HOWTO's for that. > > Alan DEKok. > > > > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Accounting question
by Joseph Abadi 15 Jun '05

15 Jun '05

Hello, I have a question regarding the way accounting is done. I configured freeradius 1.0.1 with openssl and mysql support on a Fedora Core 3 system. I'm using it with PEAP and TLS for wireless authentication. The authentication works fine, but the accounting packets are always missing the username and the IPs of client and NAS seem to be interchanged. Here is a sample packet extracted from running radiusd with debugging: rad_recv: Accounting-Request packet from host 192.168.30.11:1223, id=211, length=182 Acct-Status-Type = Alive Acct-Session-Id = "0002e3412adf-000e6ad5debc-b0e1" NAS-IP-Address = 192.168.30.34 Acct-Input-Octets = 10179 Acct-Output-Octets = 11165 Acct-Input-Packets = 47 Acct-Output-Packets = 97 Vendor-Specific = 0x45415020557365726e616d652069733a204a4f53455048 Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x4553534944203d2055746570736120486f742053706f74 Vendor-Specific = 0x45415020547970652069733a204541502d50454150 Acct-Session-Time = 63418 My question is.... Isn the NAS suppossed to be the wireless access point? (in our case 192.168.30.11, not 192.168.30.34). Isn't the client suppossed to be the computer from which the user authenticated? (192.168.30.34 instead of .11). Is this just access point related? or can I configure it in clients.conf? The relevant portion of clients.conf looks like this: client 192.168.30.0/24 { secret = XXXXXX shortname = wifiAP } Thanks for any help,

3 2

Hints file can't match on prefix with back slash, forward slash works
by Matt Cobb 15 Jun '05

15 Jun '05

In the hints file I want to look for one of two domains to pick which ldap server to auth to. Users are used to the DOMAIN\user syntax, so I put in hint prefix checks for DOMAIN1\ and DOMAIN2\. What I found was that trying to match on the back slash doesn't work, despite trying several checks with escaping. A prefix check using a forward slash or a postfix check using @ (user@realm) works fine. Here is the configuration of hints and users along with the output (1.0.2 radiusd -X) of a login with TESTLAB\tester, which fails to set Auth-Type, followed by a user TESTLAB/test which matches and sets the Auth-Type successfully. hints file... DEFAULT Prefix == "TESTLAB\", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Prefix == "TESTLAB\\", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Prefix == "TESTLAB\\\\", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Prefix == "TESTLAB/", Strip-User-Name = Yes Hint = "LDAP2" DEFAULT Suffix == "@TESTLAB", Strip-User-Name = Yes Hint == "LDAP2" DEFAULT Prefix == "CORP\", Strip-User-Name = Yes Hint = "LDAP1" DEFAULT Prefix == "CORP\\", Strip-User-Name = Yes Hint = "LDAP1" Users file... DEFAULT Hint == "LDAP1", Auth-Type := LDAP1, Autz-Type := LDAP1 DEFAULT Hint == "LDAP2", Auth-Type := LDAP2, Autz-Type := LDAP2 radiusd -X ... qid = 0 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "braka.lockdownnetworks.com" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=LDAP_USER,cn=Users,dc=lockdownnetworks,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "xyz" ldap: basedn = "dc=lockdownnetworks,dc=com" ldap: filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: ldap_referrals = 0 rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute LOCKDOWN-Ldap-Group rlm_ldap: Registering ldap_groupcmp for LOCKDOWN-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name LOCKDOWN rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8153570 Module: Instantiated ldap (LOCKDOWN) ldap: server = "192.168.11.3" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "administrator(a)testlab.lockdownnetworks.com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "xyz" ldap: basedn = "dc=testlab,dc=lockdownnetworks,dc=com" ldap: filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: ldap_referrals = 0 rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute testlab-Ldap-Group rlm_ldap: Registering ldap_groupcmp for testlab-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name testlab rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8154620 Module: Instantiated ldap (testlab) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1026, id=189, length=105 User-Name = "TESTLAB\\tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 189 to 127.0.0.1:1026 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 189 with timestamp 42b054b6 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1026, id=239, length=105 User-Name = "TESTLAB/tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 47 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for tester radius_xlat: '(sAMAccountName=tester)' radius_xlat: 'dc=testlab,dc=lockdownnetworks,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.11.3:389, authentication 0 rlm_ldap: bind as administrator(a)testlab.lockdownnetworks.com/xyz to 192.168.11.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=testlab,dc=lockdownnetworks,dc=com, with filter (sAMAccountName=tester) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "testlab" returns ok for request 1 modcall: group Autz-Type returns ok for request 1 rad_check_password: Found Auth-Type LDAP2 auth: type "LDAP2" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "tester" with password "xyz" rlm_ldap: user DN: CN=Tester,CN=Users,DC=testlab,DC=lockdownnetworks,DC=com rlm_ldap: (re)connect to 192.168.11.3:389, authentication 1 rlm_ldap: bind as CN=Tester,CN=Users,DC=testlab,DC=lockdownnetworks,DC=com/testing to 192.168.11.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user tester authenticated succesfully modcall[authenticate]: module "testlab" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 239 to 127.0.0.1:1026 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 239 with timestamp 42b054c9 Nothing to do. Sleeping until we see a request.

1 0

Accounting ReceiveQueue
by Edgars Klavinskis 15 Jun '05

15 Jun '05

In which case the accounting queue is getting so big (see below) while a authorization works perfect? Proto Recv-Q Send-Q Local Address Foreign Address State moon:~# netstat -l |grep radius udp 0 0 *:radius *:* udp 100608 0 *:radius-acct *:* Thanks in advance. Edgars

1 0