July 2005 - Freeradius-Users - lists.freeradius.org

No SSL info available. Waiting for more SSL data with Red Hat 7.1
by Dick 13 Jul '05

13 Jul '05

Hi all, At home I've configured a perfectly working freeradius with PEAP/MSCHAPv2, I'd like to transfer it to my work to some really old red hat 7.1 boxes. First I configured and freeradius from source and installed in prefix /usr/local but it crashed on the old ssl, so I grabbed the latest openssl configured it and installed in /usr/local as well, recompiled freeradius with the appropiate ssl directories and it ran! I transferred the configuration from my server at home and converted the appropiate paths. I tried authenticating on but it failed, the only suspicious thing I could find is: rlm_eap_tls: No SSL info available. Waiting for more SSL data. After three of these attempts the supplicant (winxp sp2) seems to bail out, xsupplicant seems to give it some more tries. What am I missing? TIA Dick

2 8

RE: Aruba-Switch_NAS-Problem
by Guy Davies 13 Jul '05

13 Jul '05

Ready to process requests. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown ! client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. [GD] Looks to me like you didn't configure 10.1.2.254 as a valid client of the RADIUS server. Look in clients.conf. Rgds, Guy This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 13 Jul '05

13 Jul '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, July 13, 2005 2:20 PM > To: FreeRadius users mailing list > Subject: Re: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy > > Zawacki Jason D Ctr AFRL/IFOS <Jason.Zawacki.ctr(a)rl.af.mil> wrote: > > I've been trying to get this to work, but it appears, to > me, that the > > redundancy is only used for part of the auth process. > > What "auth" process? Authorize or authenticate? > > > When looking up the > > DN for the user who is trying to authenticate, redundancy works. > > During the "authorize" stage. > > > After that > > though, it appears that only the first module in the > redundant list is > > tried. > > Which redundant list? You listed two. > > > authenticate { > > Auth-Type LDAP { > > redundant { # wasn't sure if this was necessary > > svr1 > > If you want redundancy for authentication, you can list that. > > > I test by simulating a failure of svr1 using: > > Ok. The debug log shows: > > > modcall[authorize]: module "svr1" returns fail for request 0 > ... > > modcall[authorize]: module "svr3" returns fail for request 0 > ... > > modcall[authorize]: module "svr2" returns ok for request 0 > > So the redundancy in the "authorize" section works. > > > rlm_ldap::ldap_groupcmp: Search returned error > > You're using the LDAP-Group attribute, which is set to use svr1, > which is down. There's currently no fail-over for the LDAP-Group > attribute. > I dig, that's kind of what I thought (even if I didn't word it correctly). Thanks for your help! Jason > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

LDAP authentication
by Florin Andrei 13 Jul '05

13 Jul '05

Description of situation first, freeradius question at the end: I am doing plain user/pass authentication against an LDAP server using ldapsearch: $ ldapsearch -H ldap://XXXXXXXX -b 'o=XXXXXXXXXXXXX,c=us' -D 'uid=XXXXX,o=XXXXXXXXXXXXXX,c=us' -x -W uid=XXXXX Enter LDAP Password: [snip] result: 0 Success [snip] The packet trace looks like this: #################################################### No. Time Source Destination Protocol Info 4 0.001468 somecomputer.somedomain.com someserver.somedomain.com LDAP MsgId=1 Bind Request, DN=uid=XXXXX,o=YYYYYYYYYY,c=us Frame 4 (123 bytes on wire, 123 bytes captured) Internet Protocol, Src Addr: somecomputer.somedomain.com (XXX.YYY.ZZZ.38), Dst Addr: someserver.somedomain.com (AAA.BBB.CCC.18) Lightweight Directory Access Protocol LDAP Message, Bind Request Message Id: 1 Message Type: Bind Request (0x00) Message Length: 50 Response In: 6 Version: 3 DN: uid=XXXXX,o=YYYYYYYYYY,c=us Auth Type: Simple (0x00) Password: 1234567890 No. Time Source Destination Protocol Info 6 0.067801 someserver.somedomain.com somecomputer.somedomain.com LDAP MsgId=1 Bind Result Frame 6 (96 bytes on wire, 96 bytes captured) Internet Protocol, Src Addr: someserver.somedomain.com (AAA.BBB.CCC.18), Dst Addr: somecomputer.somedomain.com (XXX.YYY.ZZZ.38) Lightweight Directory Access Protocol LDAP Message, Bind Result Message Id: 1 Message Type: Bind Result (0x01) Message Length: 23 Response To: 4 Time: 0.066333000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: +0gg4KMBV5FZkjyC #################################################### I don't really care about any information that's returned, I only want to authenticate against LDAP. Can I configure freeradius to do the same? I tried a few configurations in radiusd.conf but everything seems to trigger a behaviour that's different from ldapsearch. LDAP is currently used to authenticate various things, and I'd like to point a Radius server to it to use the same user passwords. -- Florin Andrei http://florin.myip.org/

3 3

FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 13 Jul '05

13 Jul '05

Hey folks, Has anyone gotten redundancy working when using LDAP to perform authentication and authorization? I've been trying to get this to work, but it appears, to me, that the redundancy is only used for part of the auth process. When looking up the DN for the user who is trying to authenticate, redundancy works. After that though, it appears that only the first module in the redundant list is tried. Then it ultimately fails. The LDAP servers are 3 Windows DCs. authorize { redundant { svr1 svr3 svr2 notfound = return } files } authenticate { Auth-Type LDAP { redundant { # wasn't sure if this was necessary svr1 svr3 svr2 } } } I test by simulating a failure of svr1 using: route add -host <svr1 IP> 127.0.0.1 -blackhole Svr3 happens to be down for maintenance at the moment Thanks for any help, Jason Log: rad_recv: Access-Request packet from host x.x.x.x:3104, id=14, length=54 User-Name = "username" User-Password = "XXXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for usersname radius_xlat: 'XXXXXXXX' radius_xlat: 'XXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXX to XXXXXXXXXXXX rlm_ldap: XXXXXXXXXX bind to XXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr1" returns fail for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: 'XXXXXXXXXXXXXXXXXXX' radius_xlat: 'XXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr3 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXX to XXXXXXXXXXXXXX rlm_ldap: XXXXXXXXXXXx bind to XXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr3" returns fail for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: 'XXXXXXXXXXXXXXXxxxxxx' radius_xlat: 'XXXXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr2 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXX to XXXXXXXXXXXXXXXX rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in XXXXXXXXXXXXXXXXXX, with filter (&(XXXXXXXX)(XXXXXXXXXX)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr2" returns ok for request 0 modcall: group redundant returns ok for request 0 radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' radius_xlat: '(&(objectClass=group)(member=XXXXXXXXXXXXXXXXXXXXXXXXXXXX))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXXX to XXXXXXXXXXXXXXXXXXXXXXXx rlm_ldap: XXXXXXXXXXXXXXXXXXXX bind to XXXXXXXXXXXXXXXXXXXXXXXX Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXX' radius_xlat: '(&(objectClass=group)(member=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxx))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXX to XXXXXXXXXXXXXXXXXXXXXXXX rlm_ldap: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX bind to XXXXXXXXXXXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error users: Matched entry DEFAULT at line 224 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [username] (from client client port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 14 to x.x.x.x:3104 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 14 with timestamp 42d548f0 Nothing to do. Sleeping until we see a request.

3 3

FreeRadius for VPN Secondary Authentication
by Eric 13 Jul '05

13 Jul '05

I am attempting to find a radius server which will support secondary authentication for my remote users going through a Checkpoint FW-1 with Securemote. I was hoping to require username/password and a certificate for authentication. Does anyone know if this is possible with FreeRadius and if so, how to go about setting this up. I know how to create certificates, but where do I set up the requirements, add users/passwords? FreeRadius 1.04 Thanks Eric __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Aruba-Switch_NAS-Problem
by alfonso celestino 13 Jul '05

13 Jul '05

Hi, everybody!! I have problems trying to authenticate wireless users, using a Switch Aruba as NAS. I will be grateful much someone could help!!!! Here's debug mode result moctezuma:~# /usr/local/radius/sbin/run-radius -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib:/usr/local/wldap/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/debian.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/debian.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/root.pem" tls: private_key_password = "wireless" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.com.mx/

1 0

eap-ttls pap proxy problem
by Tim Tyler 13 Jul '05

13 Jul '05

Alan, others, Ok, we are trying to get wireless clients configured for 802.1x authentication by using wpa configured with pap authentication. This works fine on the Freeradius server if we authenticate against system. However, when we try to proxy to other non eap supported radius servers, it fails and we have tried a lot of permutations. We know that proxy works if we simply use NTradPing test utility. However, our XP clients using SecureW2 or Mac OS X ver3 simply wont work. Below are our critical configuration lines as well as output from Debug. If anyone might tell us what we might be doing wrong, we would very much appreciate it! users: DEFAULT Auth-Type := PAP, Proxy-To-Realm = stu Fall-Through = 1 proxy.conf: realm stu { type = radius authhost = stu.beloit.edu:1645 accthost = stu.beloit.edu:1646 secret = testpass } eap.conf: eap { default_eap_type = ttls ignore_unknown_eap_types = yes } tls { private_key_password = tempprivate private_key_file = ${raddbdir}/certs/server_keycert.pem certificate_file = ${raddbdir}/certs/server_keycert.pem CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { # default_eap_type = md5 # copy_request_to_tunnel = yes # use_tunneled_reply = yes } Debug: rad_recv: Access-Request packet from host 144.89.40.251:1451, id=254, length=144 NAS-IP-Address = 144.89.40.251 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 User-Name = "leadacid@stu" Calling-Station-Id = "00119551d683" Called-Station-Id = "0001e6ffc493" NAS-Identifier = "ISR Test -don't use" EAP-Message = 0x020b0011016c6561646163696440737475 Message-Authenticator = 0x3a44d6f0ad7b1f8b6b550b65142e2b60 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: Looking up realm "stu" for User-Name = "leadacid@stu" rlm_realm: Found realm "stu" rlm_realm: Adding Stripped-User-Name = "leadacid" rlm_realm: Proxying request from user leadacid to realm stu rlm_realm: Adding Realm = "stu" rlm_realm: Preparing to proxy authentication request to realm "stu" modcall[authorize]: module "suffix" returns updated for request 5 rlm_eap: Request is supposed to be proxied to Realm stu. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall: group authorize returns updated for request 5 Sending Access-Request of id 0 to 144.89.40.6:1645 NAS-IP-Address = 144.89.40.251 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 User-Name = "leadacid" Calling-Station-Id = "00119551d683" Called-Station-Id = "0001e6ffc493" NAS-Identifier = "ISR Test -don't use" EAP-Message = 0x020b0011016c6561646163696440737475 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323534 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Reject packet from host 144.89.40.6:1645, id=0, length=25 Proxy-State = 0x323534 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 5 modcall[post-proxy]: module "eap" returns noop for request 5 modcall: group post-proxy returns noop for request 5 Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 144.89.40.251:1451, id=254, length=144 Sending Access-Reject of id 254 to 144.89.40.251:1451 Tim Tyler Network Engineer

2 1

Active Directory and FreeRadius
by Talwar, Puneet (NIH/NIAID) 13 Jul '05

13 Jul '05

HI, I was able to auth against AD by setting up KRB5 on RHEL. Now I would like to setup freeradius where I will have bunch of UNIX workstation that will point to the freeradius server using pam_radius_auth module and will auth against radius server using their AD credentials. So would anyone have an example of radiusd.conf file that I can see and get an idea how I might be able to setup freeradius server to point to the AD for auth purposes. Thanks,

2 1

Postauth_query semi-duplicates records...
by Mario Alberto Cruz Gartner 13 Jul '05

13 Jul '05

Hi! I've changed the postauth_query from the sql.conf to insert there some extra info (and changed the BD table to reflect this). postauth_query = "INSERT into ${postauth_table} (id, user, date, clt_mac, ap_mac, ap_ip, ap_id) values ('', '%{User-Name}', NOW(), '%{Calling-Station-Id}', '%{Called-Station-Id}', '%{NAS-IP-Address}', '%{NAS-Identifier}')" The wierd thing is that when a EAP/TLS client joins, the record on the BD keeps their info well. BUT, when a EAP/PEAP client authenticates, the record it's almost duplicated: +----+----------+----------------+-------------------+-------------------+--------------+-----------------------+ | id | user | date | clt_mac | ap_mac | ap_ip | ap_id | +----+----------+----------------+-------------------+-------------------+--------------+-----------------------+ | 49 | john | 20050713132540 | 00-0b-7d-0f-f7-35 | 00-0c-41-b1-37-07 | 192.168.20.7 | Linksys BEFW11S4-V4.X | | 50 | jairo | 20050713132629 | | | | | | 51 | jairo | 20050713132629 | 00-0b-7d-0f-f7-35 | 00-0c-41-b1-37-07 | 192.168.20.7 | Linksys BEFW11S4-V4.X | +----+----------+----------------+-------------------+-------------------+--------------+-----------------------+ Here, "john" it's a EAP/TLS auth. and "jairo" is the EAP/PEAP auth. On the server debug i see: modcall: entering group post-auth for request 47 rlm_sql (sql): Processing sql_postauth radius_xlat: 'jairo' rlm_sql (sql): sql_set_user escaped user --> 'jairo' radius_xlat: 'INSERT into radpostauth (id, user, date, clt_mac, ap_mac, ap_ip, ap_id) values ('', ' jairo', NOW(), '00-0b-7d-0f-f7-35', '00-0c-41-b1-37-07', '192.168.20.7', 'Linksys BEFW11S4-V4.X')' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, date, clt_mac, ap_mac, ap _ip, ap_id) values ('', 'jairo', NOW(), '00-0b-7d-0f-f7-35', '00-0c-41-b1-37-07', '192.168.20.7', 'L inksys BEFW11S4-V4.X') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 modcall[post-auth]: module "sql" returns ok for request 47 modcall: group post-auth returns ok for request 47 and that "SEEMS" ok, but, on the DB appears 2 records for that query. Do you know why is happening this? Thks!

2 1