June 2005 - Freeradius-Users - lists.freeradius.org

RE: LDAP basedn context
by Zawacki Jason D Contr AFRL/IFOS 14 Jun '05

14 Jun '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Dustin Doris > Sent: Tuesday, June 14, 2005 12:51 PM > To: FreeRadius users mailing list > Subject: Re:LDAP basedn context > > > > Correct, it is unable to find the user. When set at a > higher context I receive the following error: > > > > rlm_ldap: performing search in o=wheaton, with filter (cn=testacct) > > rlm_ldap: object not found or got ambiguous search result > > rlm_ldap: search failed > > > > My ldap config is as follows. If I change the basedn to > where the user is located (ou=cs,ou=srvc,o=wheaton) then it works. > > > > ldap test-ldap{ > > server = "ldapserver.wheaton.edu" > > identity = "cn=admin,o=wheaton" > > password = password > > basedn = "o=wheaton" > > filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" > > start_tls = yes > > > > tls_cacertfile = > /etc/raddb/certs/wheatonCA/wheatonca.b64 > > tls_require_cert = "demand" > > > > access_attr = "cn" > > dictionary_mapping = ${raddbdir}/ldap.attrmap > > ldap_connections_number = 5 > > password_attribute = nspmPassword > > timeout = 4 > > timelimit = 3 > > net_timeout = 1 > > } > > > > matt... > > > > > > >> Is it possible to specify the basedn above where the > users are actually > > >> located and have freeradius find the user in a > subcontext? For instance > > >> if my ldap is setup as ou=users1,ou=loc1,o=org and > > >> ou=users2,ou=loc2,ou=o=org can I specify basedn="o=org" > and find users > > >> in both users1 and users2? > > >> > > > Hmmm, I thought it did a subtree search, maybe not. You could use > configurable_failover to search both trees. FWIW, I am taking advantage of subtree search and it works fine. I don't see anything in his setup that would prevent it from happening. > > in radiusd.conf make two ldap instances with the same config > except the > basedn. > > ldap ldap1 { > config with one basedn > } > > ldap ldap2 { > config with other basedn > } > > in authorize section define them as a group > > authorize { > group { > ldap1 > ldap2 > } > } > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Multiple Authentication REALMS - I hope in Plain Text
by Shepherd, Dave 14 Jun '05

14 Jun '05

Hi, It's been a long time, as the freeRADIUS software I've being using for the last 3 years hasn't needed looking at since installation. So a big thank you to the development team J However, as with most things it's so good I've now got to redesign and re-implement to encompass more of our infrastructure, and I'm having problems. I have a number of settings in the _users_ file that are based on the _Called_Station_ID_ then proxy the requests to a specified REALM. i.e. DEFAULT Called-Station-Id == "<a telephone number>", Proxy-To-Realm := "NULL" Fall-Through = Yes DEFAULT Called-Station-Id == "<another telephone number>", Proxy-To-Realm := "NULL" Fall-Through = Yes DEFAULT Called-Station-Id == "<yet another number>", Proxy-To-Realm := "SPECIAL" Fall-Through = Yes Now, the NULL realm is defined in the proxy.conf file as: realm NULL { type = radius authhost = radiusserver.some.domain:1645 accthost = radiusserver.some.domain:1646 Secret = radiussecret } This works and actually points to a MS IAS server going against an NT4 Domain. Now I need to authenticate a different set of users (who dial a different number) against an LDAP repository, so as you can see from my _users_ file I direct them at the "SPECIAL" realm, which I have set as follows in proxy.conf: realm SPECIAL { type = radius authhost = LOCAL accthost = LOCAL } My plan was for this to then use the local radius server, which has an _ldap_ module configure, which from what I can make out is working: ldap { server = "127.0.0.1" basedn = "dc=some,dc=domain,dc=co,dc=uk" filter = "(uid=%u)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } And then in the authorize and authenticate sections simply include _ldap_ authorize { preprocess chap eap ldap files mschap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type { mschap } unix ldap eap } Now all I see when using NTRadping, and sending the additional _Called_Station_Id_ attribute set to the required number is the following in my _radius.log_ Error: Dropping packet from client Dave_Test:2328 - ID: 2 due to dead request 5018 When I run the radiusd with the -X flag (bearing in mind it's an Production Service) I can make out the call being made to my LDAP server and a "rlm_ldap authorize", but then the request just finishes without giving me and Access-Accept packet, and the relevant settings from the _radreply_ table in the Postgres Database? rad_recv: Access-Request packet from host xx.xx.xx.xx:2796, id=4, length=62 User-Name = "unextest20" User-Password = "nexus" Called-Station-Id = "xxxxxxxxxx" rad_lowerpair: User-Name now 'unextest20' modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "eap" returns noop for request 14 rlm_realm: No '@' in User-Name = "unextest20", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "unextest20" rlm_realm: Proxying request from user unextest20 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 14 radius_xlat: 'unextest20' rlm_sql (sql): sql_set_user escaped user --> 'unextest20' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 8 modcall[authorize]: module "sql" returns ok for request 14 rlm_ldap: - authorize rlm_ldap: performing user authorization for unextest20 radius_xlat: '(uid=unextest20)' radius_xlat: 'dc=some,dc=domain,dc=co,dc=uk' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=some,dc=domain,dc=co,dc=uk, with filter (uid=unextest20) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user unextest20 authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 14 users: Matched DEFAULT at 90 modcall[authorize]: module "files" returns ok for request 14 modcall[authorize]: module "mschap" returns noop for request 14 modcall: group authorize returns updated for request 14 Finished request 14 I'm kinda lost and going round in circles at the minute. If one of you guys has had to do something similar, or can see any glaring omissions in my config (which I seem to think there is) could you please point me in the right direction. TIA Dave Shepherd

2 1

Re:LDAP basedn context
by Matt McFarlane 14 Jun '05

14 Jun '05

Correct, it is unable to find the user. When set at a higher context I receive the following error: rlm_ldap: performing search in o=wheaton, with filter (cn=testacct) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed My ldap config is as follows. If I change the basedn to where the user is located (ou=cs,ou=srvc,o=wheaton) then it works. ldap test-ldap{ server = "ldapserver.wheaton.edu" identity = "cn=admin,o=wheaton" password = password basedn = "o=wheaton" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /etc/raddb/certs/wheatonCA/wheatonca.b64 tls_require_cert = "demand" access_attr = "cn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword timeout = 4 timelimit = 3 net_timeout = 1 } matt... >> Is it possible to specify the basedn above where the users are actually >> located and have freeradius find the user in a subcontext? For instance >> if my ldap is setup as ou=users1,ou=loc1,o=org and >> ou=users2,ou=loc2,ou=o=org can I specify basedn="o=org" and find users >> in both users1 and users2? >> >> Thanks. > >I think so, is it not working for you?

2 1

RE: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

Here is the content of the pam_radius_auth.conf file and yes it does exist in /etc/raddb/server folder. # server[:port] shared_secret timeout (s) #127.0.0.1 secret 1 IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, June 14, 2005 11:16 AM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > I was able to get the vsftpd working, I can > authenticate but when I go check to the /var/log/messages I see the > following message. > > vsftpd[XXXXX]: pam_radius_auth: No RADIUS server found in configuration file > /etc/raddb/server So... what's the content of that file? Does it even exist? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: restricting access for users
by alan walters 14 Jun '05

14 Jun '05

Yes this is my experience as well. Running v 1.0.2 there was nothing in the change log for 1.0.3 to say this was fixed either. Just as a note when I posted these findings nothing came back. I was using an ldap backend as well. It would be great to have a detailed explaination of this one and maybe confirmation that it is not working or wheather is it syntax that causes the problem Alan -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Martial VdB Sent: 13 June 2005 08:22 To: freeradius-users(a)lists.freeradius.org Subject: restricting access for users Hi there, I’m a newby here so forgive if I ask obvious questions. I’m trying to setup, wel actually I did setup FreeRADIUS Version 1.0.2 on a Linux Debian machine and it is working fine :) But I need to achieve the following setup: We have # cisco routers and switches who are locally managed by on site engineers. So these local engineers have to be able to log in to their devices and not be allowed to log in to devices on other sites. Next to these different site engineers there is a group called NOC. The NOC engineers need to access all devices on all sites. I’ve tried several setups by using the huntgroups and using system as authentication method but I can't get the huntgroup validation to work. It looks like the huntgroups are just ignored. Everyone can just enter any device as soon as their usrname and password is matched on the system. Did someone do a similar setup where users where restricted and with a general group that needs access everywhere or can someone tell me how I should take this on. It should be fairly easy I thought… Thanks for your help, it is highly appreciated, Martial _________________________________________________________________ Free blogging with MSN Spaces http://spaces.msn.com/?mkt=nl-be - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005

5 8

Link error (invalid ELF header) in freeradius 1.0.3
by Software Development Group 14 Jun '05

14 Jun '05

Hello, I am getting the following error when running freeradius -X: radiusd.conf[2] Failed to link to module 'rlm_sqlcounter': /usr/lib/freeradius/rlm_sqlcounter.a: invalid ELF header Anyone can help?

1 0

PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

HI, I am trying to setup pam_radius_auth on my RHEL WS v4. I followed the direction from the pam_radius_app pkg which I downloaded from freeradius.org. I copy the appropriate files in the right location. I configured the pam_radius_auth.conf in /etc/raddb/server folder to talk to radius server which is running on a MS Windows environment. The next problem is that I am not able to configure the PAM modules appropriately to work with pam_radius_auth.so. I was able to get the vsftpd working, I can authenticate but when I go check to the /var/log/messages I see the following message. vsftpd[XXXXX]: pam_radius_auth: No RADIUS server found in configuration file /etc/raddb/server If someone has had a similar problem and know a fix around this, please help me. Thanks,

2 1

Logging SQL queries to logfile
by Lucas Aimaretto 14 Jun '05

14 Jun '05

Hi all, Is there any way of logging the MSSQL queries ( with values ) to the radius.log file ? I can see the following in the radius.log file ... Tue Jun 14 00:53:53 2005 : Error: rlm_sql (sql): Couldn't update SQL accounting STOP record - HY019 [unixODBC][FreeTDS][SQL Se rver]Arithmetic overflow error converting numeric to data type numeric. ... but I do not know which values in the accounting_stop_query made this happen. I know I can run radiusd with the -X, but I'd like to run it at background. Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.1 - Release Date: 13/06/2005

2 1

LDAP NT-Password vs. Cleartext-Password
by Florian Prester 14 Jun '05

14 Jun '05

Hi, How can I controll if the radius should take the nt-Password or the cleartext-Password? I mapped an cleartext-Entry in ldap to the User-Password radius entry in ldap.attrmap. The request is looking in the directory for the checkItem: User-Password --> found! But for authentication it wants to do MS-CHAPv2 with the NT-Password!!??!! modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: Told to do MS-CHAPv2 for unrz148 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 7 modcall: group Auth-Type returns ok for request 7 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 64 to 131.188.4.191:20001 but later: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 rlm_eap: EAP packet type response id 7 length 89 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 modcall[authorize]: module "files" returns notfound for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 ---------------------------------------- ---> What means this????? rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. --------------------------------------- Login incorrect: [unrz148/<no User-Password attribute>] (from client airbrush port 0 cli 00-90-4B-8F-B7-3B) Delaying request 8 for 1 seconds Finished request 8 I am sorry I do not get it, here is my complete log-Output: see attachment Thanks Florian -- -------------------------------------------------------------- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Germany Tel.: +499131 8527813 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 600 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded LDAP ldap: server = "131.188.3.53" ldap: port = 400 ldap: net_timeout = 1 ldap: timeout = 24 ldap: timelimit = 23 ldap: identity = "cn=florian,ou=allro,ou=AAAdsadm,o=Universitaet Erlangen-Nuernberg,c=DE" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "XXX" ldap: basedn = "ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE" ldap: filter = "(Userid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "User-Password" ldap: access_attr = "uid" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP fauUserid mapped to RADIUS User-Password conns: 0x817a680 Module: Instantiated ldap (ldap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=58, length=143 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User EAP-Message = 0x0201000c01756e727a313438 User-Name = "unrz148" NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0xc06d9475f4e1734074fa5f7a47c242c8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 131.188.3.53:400, authentication 0 rlm_ldap: bind as cn=florian,ou=allro,ou=AAAdsadm,o=Universitaet Erlangen-Nuernberg,c=DE/xxxx to 131.188.3.53:400 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 58 to 131.188.4.191:20001 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x270ffa52f6cd54af512613f5dc5a0163 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=58, length=143 Sending duplicate reply to client airbrush:20001 - ID: 58 Re-sending Access-Challenge of id 58 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 0 ID 58 with timestamp 42ae9a7b Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=59, length=261 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x270ffa52f6cd54af512613f5dc5a0163 EAP-Message = 0x0202007019800000006616030100610100005d030142ae9a8c9ab37cb5e0be2d40b17ee3a0c9dc7eb42c91aac9a17fe703487bd50920ad7715fb0a7a0ca9afd61ffd9578c2a03915324eb5435068e6922188812d47d5001600040005000a000900640062000300060013001200630100 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0x9bf7576f94ad6fbb49ea90935b20a0cd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_eap: EAP packet type response id 2 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 59 to 131.188.4.191:20001 EAP-Message = 0x0103040a19c0000006f1160301004a02000046030142ae9a871f96b5b1966ed13ea050ff6fcdb3bc53914fe1a7b87f7d76938bdbe920b7f93176dba8e7bbb9774500ba73127da6d19912d57c239b593d89007090fcf600040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2adab79082d449df9b7da77f4bcd00f9 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=59, length=261 Sending duplicate reply to client airbrush:20001 - ID: 59 Re-sending Access-Challenge of id 59 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 1 ID 59 with timestamp 42ae9a81 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=60, length=155 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x2adab79082d449df9b7da77f4bcd00f9 EAP-Message = 0x020300061900 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0x83e5596497bddbf7ee210c4e7d4d509b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 modcall[authorize]: module "files" returns notfound for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 60 to 131.188.4.191:20001 EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdba2ec94e26cdc9029662c91d5de7c75 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=60, length=155 Sending duplicate reply to client airbrush:20001 - ID: 60 Re-sending Access-Challenge of id 60 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 2 ID 60 with timestamp 42ae9a87 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=61, length=341 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0xdba2ec94e26cdc9029662c91d5de7c75 EAP-Message = 0x020400c01980000000b61603010086100000820080cfbb1dd41d0df0c6e0e1cb6462b7e81823085da901070fa40f7eb12b9e895c67d008c3da58b0129404054041302516c5a0ba714764f85dc3032ade87073c0574c4707bf75310dfbf09bbb82af75459f5c3dd0a17fe78bc4d0ec4310bf63633d55c192cf5c0709bd79db371c2690572c20bb88fcbf605e60b3d07e46186cf2f6a14030100010116030100208a09577f64446134031d8e1369db91db3ee537e2e43bf06b9e28843c6cab325f NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0xa10d965b399e7ed9781f6af3b5b69486 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 61 to 131.188.4.191:20001 EAP-Message = 0x0105003119001403010001011603010020737ff100536fae4f010e5a5dc6d837e397c7f85ffc5dfdd4672a97191ce55a62 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d81b76d29d5bb96464d985ea5a72a71 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=61, length=341 Sending duplicate reply to client airbrush:20001 - ID: 61 Re-sending Access-Challenge of id 61 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 3 ID 61 with timestamp 42ae9a8d Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=62, length=155 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x9d81b76d29d5bb96464d985ea5a72a71 EAP-Message = 0x020500061900 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0xa79c981dce7c71f29bc87fdf2d8d3e80 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 modcall[authorize]: module "files" returns notfound for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 62 to 131.188.4.191:20001 EAP-Message = 0x010600201900170301001566e4b4b405bc2c12b176e3557a29c3c03815f4ddd2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5550b1e72047a6159121b463f0f2760a Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=62, length=155 Sending duplicate reply to client airbrush:20001 - ID: 62 Re-sending Access-Challenge of id 62 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 4 ID 62 with timestamp 42ae9a93 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=63, length=184 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x5550b1e72047a6159121b463f0f2760a EAP-Message = 0x020600231900170301001888367f88b8b7708556ab4886d9c94dde43f6bafe2532d994 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0x8ea347ff548c28722c8172e46158a763 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 rlm_eap: EAP packet type response id 6 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - unrz148 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of unrz148 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to unrz148 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 rlm_eap: EAP packet type response id 6 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 63 to 131.188.4.191:20001 EAP-Message = 0x010700381900170301002d7c2c8e60506d6f294dcb35bd3b21b7b49bf411c538c25f6371e7879f4e0b98753a967c6119158063715e62041b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x608c84a6c7bdebe161a378bf2712bbdb Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=63, length=184 Sending duplicate reply to client airbrush:20001 - ID: 63 Re-sending Access-Challenge of id 63 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 5 ID 63 with timestamp 42ae9a99 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=63, length=184 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x5550b1e72047a6159121b463f0f2760a EAP-Message = 0x020600231900170301001888367f88b8b7708556ab4886d9c94dde43f6bafe2532d994 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0x8ea347ff548c28722c8172e46158a763 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 rlm_eap: EAP packet type response id 6 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 modcall[authorize]: module "files" returns notfound for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 6 modcall: group authenticate returns invalid for request 6 auth: Failed to validate the user. Login incorrect: [unrz148/<no User-Password attribute>] (from client airbrush port 0 cli 00-90-4B-8F-B7-3B) Delaying request 6 for 1 seconds Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=64, length=238 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x608c84a6c7bdebe161a378bf2712bbdb EAP-Message = 0x020700591900170301004e7e90b7c54598cc8f991d8641e6b01aaaeb889df18ef70a87a66f19687d685b759e0e27c406a9ff52a71ee0421866391250b4dcf6c017ca748ed4dced7211db8e09b2e395a308a4cc166730ad3de6 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0xc220272d9a037f0d9b77726394ccc47c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 rlm_eap: EAP packet type response id 7 length 89 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to unrz148 PEAP: Adding old state with 4b e4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 rlm_eap: EAP packet type response id 7 length 66 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: Told to do MS-CHAPv2 for unrz148 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 7 modcall: group Auth-Type returns ok for request 7 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 64 to 131.188.4.191:20001 EAP-Message = 0x0108004a1900170301003f218f117d77a76da70c19bb284b51eb603360dc21f3a00f2c7dbc1d0c22da1235981479012b052b73ad68eaf1537881a61a34d52d046862f4b6de4cd5016510 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7f60a4cbd632e692be15a7144b117590 Finished request 7 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 63 to 131.188.4.191:20001 Cleaning up request 6 ID 63 with timestamp 42ae9aa5 Waking up in 6 seconds... rad_recv: Access-Request packet from host 131.188.4.191:20001, id=64, length=238 Sending duplicate reply to client airbrush:20001 - ID: 64 Re-sending Access-Challenge of id 64 to 131.188.4.191:20001 --- Walking the entire request list --- Cleaning up request 7 ID 64 with timestamp 42ae9aab Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 131.188.4.191:20001, id=64, length=238 NAS-Port-Id = "2049/2" Calling-Station-Id = "00-90-4B-8F-B7-3B" Called-Station-Id = "00-0B-0E-03-00-42:FAU-SEC" Service-Type = Framed-User User-Name = "unrz148" State = 0x608c84a6c7bdebe161a378bf2712bbdb EAP-Message = 0x020700591900170301004e7e90b7c54598cc8f991d8641e6b01aaaeb889df18ef70a87a66f19687d685b759e0e27c406a9ff52a71ee0421866391250b4dcf6c017ca748ed4dced7211db8e09b2e395a308a4cc166730ad3de6 NAS-Identifier = "Trapeze" NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 131.188.4.191 Message-Authenticator = 0xc220272d9a037f0d9b77726394ccc47c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 rlm_ldap: - authorize rlm_ldap: performing user authorization for unrz148 radius_xlat: '(Userid=unrz148)' radius_xlat: 'ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE, with filter (Userid=unrz148) rlm_ldap: checking if remote access for unrz148 is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding fauUserid as User-Password, value unrz148 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user unrz148 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 rlm_eap: EAP packet type response id 7 length 89 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 rlm_realm: No '@' in User-Name = "unrz148", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 modcall[authorize]: module "files" returns notfound for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Login incorrect: [unrz148/<no User-Password attribute>] (from client airbrush port 0 cli 00-90-4B-8F-B7-3B) Delaying request 8 for 1 seconds Finished request 8 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 64 to 131.188.4.191:20001 Cleaning up request 8 ID 64 with timestamp 42ae9ab7 Nothing to do. Sleeping until we see a request.

2 1

RE: Multiple Authentication REALMS - I hope in Plain Text
by Shawn K. O'Shea 14 Jun '05

14 Jun '05

>From what you've provided, I believe what is happening is that your requests that you *want* to go to local LDAP are still being proxied to your IAS server, and for some reason IAS isn't sending an Access-Reject so you get that error about a "dead request". Realm "NULL" is a special realm that means "there is no realm as part of the username as per any definitions of the realm module in radiusd.conf". It appears from your debug output that you have the realm for @ defined (suffix realm, anything after an @ symbol is the realm). Since your new Called-Station-Id still has a user with no realm, it's proxied to NULL as your debug shows: rlm_realm: No '@' in User-Name = "unextest20", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "unextest20" rlm_realm: Proxying request from user unextest20 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" I *believe* the behaviour you truly want is something more like this: DEFAULT Called-Station-Id == "<a telephone number>",Proxy-To-Realm := "msias" Fall-Through = Yes DEFAULT Called-Station-Id == "<another telephone number>",Proxy-To-Realm := "msias" Fall-Through = Yes DEFAULT Called-Station-Id == "<yet another number>",Proxy-To-Realm := "localldap" Fall-Through = Yes And in proxy.conf: realm msias { type = radius authhost = radiusserver.some.domain:1645 accthost = radiusserver.some.domain:1646 Secret = radiussecret } realm localldap { type = radius authhost = LOCAL accthost = LOCAL } Also, I'd just make sure what line in your users file is being matched. Your debug output says a DEFAULT entry at line 90. Check your IAS event log to see if it's getting proxied requests. I usually run radiusd with -Xxx for extra debuging when a request gets proxied, you should see something like this: Fri Jun 10 15:02:47 2005 : Debug: proxy: creating 0d02a8c0:1812 Fri Jun 10 15:02:47 2005 : Debug: proxy: allocating 0d02a8c0:1812 0 Sending Access-Request of id 0 to a.b.c.d:1812 And a list of attributes. Hope this helps. -Shawn ~~~~~~~~~~~~~~~~~~~~~~~~~ Shawn O'Shea Network Engineer Airpath Wireless, Inc. "Clearing the Way" 781-250-3500-office 781-250-3535-direct 781-250-3503-fax shawno(a)airpath.com http://www.airpath.com ~~~~~~~~~~~~~~~~~~~~~~~~~ CONFIDENTIALITY STATEMENT This electronic message contains information from Airpath Wireless, Inc., and may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify the sender immediately by reply e-mail shawno(a)airpath.com or telephone at (781) 250-3500. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Shepherd, Dave > Sent: Tuesday, June 14, 2005 9:49 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Multiple Authentication REALMS - I hope in Plain Text > > Hi, > > It's been a long time, as the freeRADIUS software I've > being using for the last 3 years hasn't needed looking at > since installation. > > So a big thank you to the development team J > > However, as with most things it's so good I've now got to > redesign and re-implement to encompass more of our > infrastructure, and I'm having problems. > > I have a number of settings in the _users_ file that are > based on the _Called_Station_ID_ then proxy the requests to a > specified REALM. > > i.e. > > DEFAULT Called-Station-Id == "<a telephone number>", > Proxy-To-Realm := "NULL" > Fall-Through = Yes > > DEFAULT Called-Station-Id == "<another telephone number>", > Proxy-To-Realm := "NULL" > Fall-Through = Yes > > DEFAULT Called-Station-Id == "<yet another number>", > Proxy-To-Realm := "SPECIAL" > Fall-Through = Yes > > Now, the NULL realm is defined in the proxy.conf file as: > > realm NULL { > type = radius > authhost = radiusserver.some.domain:1645 > accthost = radiusserver.some.domain:1646 > Secret = radiussecret > } > > This works and actually points to a MS IAS server going > against an NT4 Domain. > > Now I need to authenticate a different set of users (who dial > a different number) against an LDAP repository, so as you can > see from my _users_ file I direct them at the "SPECIAL" > realm, which I have set as follows in proxy.conf: > > realm SPECIAL { > type = radius > authhost = LOCAL > accthost = LOCAL > } > > My plan was for this to then use the local radius server, > which has an _ldap_ module configure, which from what I can > make out is working: > > ldap { > server = "127.0.0.1" > basedn = "dc=some,dc=domain,dc=co,dc=uk" > filter = "(uid=%u)" > start_tls = no > dictionary_mapping = ${raddbdir}/ldap.attrmap > ldap_connections_number = 5 > timeout = 4 > timelimit = 3 > net_timeout = 1 > } > > And then in the authorize and authenticate sections simply > include _ldap_ > > authorize { > preprocess > chap > eap > ldap > files > mschap > } > authenticate { > Auth-Type PAP { > pap > } > Auth-Type CHAP { > chap > } > Auth-Type { > mschap > } > unix > ldap > eap > } > > Now all I see when using NTRadping, and sending the > additional _Called_Station_Id_ attribute set to the required > number is the following in my _radius.log_ > > Error: Dropping packet from client Dave_Test:2328 - ID: 2 > due to dead request 5018 > > When I run the radiusd with the -X flag (bearing in mind it's > an Production Service) I can make out the call being made to > my LDAP server and a "rlm_ldap authorize", but then the > request just finishes without giving me and Access-Accept > packet, and the relevant settings from the _radreply_ table > in the Postgres Database? > > rad_recv: Access-Request packet from host xx.xx.xx.xx:2796, id=4, > length=62 > User-Name = "unextest20" > User-Password = "nexus" > Called-Station-Id = "xxxxxxxxxx" > rad_lowerpair: User-Name now 'unextest20' > modcall: entering group authorize for request 14 > modcall[authorize]: module "preprocess" returns ok for request 14 > modcall[authorize]: module "chap" returns noop for request 14 > modcall[authorize]: module "eap" returns noop for request 14 > rlm_realm: No '@' in User-Name = "unextest20", looking up > realm NULL > rlm_realm: Found realm "NULL" > rlm_realm: Adding Stripped-User-Name = "unextest20" > rlm_realm: Proxying request from user unextest20 to realm NULL > rlm_realm: Adding Realm = "NULL" > rlm_realm: Preparing to proxy authentication request to > realm "NULL" > > modcall[authorize]: module "suffix" returns updated for request 14 > radius_xlat: 'unextest20' > rlm_sql (sql): sql_set_user escaped user --> 'unextest20' > radius_xlat: 'SELECT id, UserName, Attribute, Value, Op > ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 8 > rlm_sql_postgresql: query: SELECT id, UserName, Attribute, > Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' > ??ORDER BY id > rlm_sql_postgresql: Status: PGRES_TUPLES_OK > rlm_sql_postgresql: affected rows = > radius_xlat: 'SELECT radgroupcheck.id, > radgroupcheck.GroupName, ??radgroupcheck.Attribute, > radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, > usergroup ??WHERE usergroup.Username = 'unextest20' AND > usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY > radgroupcheck.id' > rlm_sql_postgresql: query: SELECT radgroupcheck.id, > radgroupcheck.GroupName, ??radgroupcheck.Attribute, > radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, > usergroup ??WHERE usergroup.Username = 'unextest20' AND > usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY > radgroupcheck.id > rlm_sql_postgresql: Status: PGRES_TUPLES_OK > rlm_sql_postgresql: affected rows = > radius_xlat: 'SELECT id, UserName, Attribute, Value, Op > ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id' > rlm_sql_postgresql: query: SELECT id, UserName, Attribute, > Value, Op ??FROM radreply ??WHERE Username = 'unextest20' > ??ORDER BY id > rlm_sql_postgresql: Status: PGRES_TUPLES_OK > rlm_sql_postgresql: affected rows = > radius_xlat: 'SELECT radgroupreply.id, > radgroupreply.GroupName, radgroupreply.Attribute, > ??radgroupreply.Value, radgroupreply.Op ??FROM > radgroupreply,usergroup ??WHERE usergroup.Username = > 'unextest20' AND usergroup.GroupName = > radgroupreply.GroupName ??ORDER BY radgroupreply.id' > rlm_sql_postgresql: query: SELECT radgroupreply.id, > radgroupreply.GroupName, radgroupreply.Attribute, > ??radgroupreply.Value, radgroupreply.Op ??FROM > radgroupreply,usergroup ??WHERE usergroup.Username = > 'unextest20' AND usergroup.GroupName = > radgroupreply.GroupName ??ORDER BY radgroupreply.id > rlm_sql_postgresql: Status: PGRES_TUPLES_OK > rlm_sql_postgresql: affected rows = > rlm_sql (sql): Released sql socket id: 8 > modcall[authorize]: module "sql" returns ok for request 14 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for unextest20 > radius_xlat: '(uid=unextest20)' > radius_xlat: 'dc=some,dc=domain,dc=co,dc=uk' > ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in dc=some,dc=domain,dc=co,dc=uk, > with filter (uid=unextest20) > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: user unextest20 authorized to use remote access > ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 14 > users: Matched DEFAULT at 90 > modcall[authorize]: module "files" returns ok for request 14 > modcall[authorize]: module "mschap" returns noop for request 14 > modcall: group authorize returns updated for request 14 > Finished request 14 > > I'm kinda lost and going round in circles at the minute. > > If one of you guys has had to do something similar, or can > see any glaring omissions in my config (which I seem to think > there is) could you please point me in the right direction. > > TIA > > Dave Shepherd > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0