August 2005 - Freeradius-Users - lists.freeradius.org

Authentication problem-FreeRadius Output
by Hamid Salim 03 Aug '05

03 Aug '05

[root@radiusd sbin]# /opt/radiusd/sbin/runradiusd -X + LD_LIBRARY_PATH=/opt/openssl/lib + LD_PRELOAD=/opt/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH + export LD_PRELOAD + /opt/radiusd/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/radiusd/etc/raddb/proxy.conf Config: including file: /opt/radiusd/etc/raddb/clients.conf Config: including file: /opt/radiusd/etc/raddb/snmp.conf Config: including file: /opt/radiusd/etc/raddb/eap.conf Config: including file: /opt/radiusd/etc/raddb/sql.conf main: prefix = "/opt/radiusd" main: localstatedir = "/opt/radiusd/var" main: logdir = "/opt/radiusd/var/log/radius" main: libdir = "/opt/radiusd/lib" main: radacctdir = "/opt/radiusd/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/radiusd/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/radiusd/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/radiusd/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/radiusd/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/opt/radiusd/etc/1x/radiusd.ece.neu.edu.pem" tls: certificate_file = "/opt/radiusd/etc/1x/radiusd.ece.neu.edu.pem" tls: CA_file = "/opt/radiusd/etc/1x/root.pem" tls: private_key_password = "serverpwd" tls: dh_file = "/opt/radiusd/etc/1x/dh" tls: random_file = "/opt/radiusd/etc/1x/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/opt/radiusd/etc/raddb/huntgroups" preprocess: hints = "/opt/radiusd/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/radiusd/etc/raddb/users" files: acctusersfile = "/opt/radiusd/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/radiusd/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addr" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/opt/radiusd/var/log/radius/radacct/%{Client-IP-Address}" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/radiusd/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/opt/radiusd/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Hamid Salim wrote: >Hi all, >i was wondering if anyone has successfully implemented the following >setup and/or had any issues. this is my second post. your help will be >greatly appreciated. > > >I have a setup as follows: > >Fedora core 3 >FreeRadius 1.0.4 >openssl .098 >Dell TrueMobile 1170 Access Pointv2.3.3 >802.11b/g cards for AP and supplicant >Windows XP SP2 > >FreeRadius is not authenticating, there are no messages on the screen >or the logfile. The AP does not see the FreeRadius server! > >I think this is a configuration issue outside of FreeRadius. > >Has anyone had similar problem. > >Any help will be greatly appreciated as i have hit a wall here and i am >on a deadline! > >thanks >Hamid.

2 1

Simple flat file passwords?
by Martin.Ward＠uk.neceur.com 03 Aug '05

03 Aug '05

I am trying to use the passwd module to configure a simple flat file with two fields, a user name and a password. I believe I have the module configured right: passwd text_file { filename = /var/text_file format = "*User-Name:*User-Password" authtype = PAP } The contents of this file are: mward:feeble However I can't figure out which authtype to use. If I use PAP (above) I get the following errors: rlm_pap: login attempt by "mward" with password feeble rlm_pap: No password (or empty password) to check against for for user mward If I use CHAP or MSCHAP I get errors like: rlm_chap: Attribute "CHAP-Password" is required for authentication. Cannot use "User-Password". and if I change the format=line to suit, my passwd module fails with: modcall[authorize]: module "text_file" returns notfound for request 0 Can anyone point out the undoubtedly siple thing I am missing? Thanks. |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

2 2

Limiting the number of connections
by Jose Divino de Lima 03 Aug '05

03 Aug '05

Hi people, I need your help. We´ve a solution that use SER athenticating, athotizing and accounting in a freeRadius+mySQL. I´ve a challenge now to limit thu number of simultaneous connections (i.e: we can permit only ten connections at the same time). Does anybody has any idea to implement this in freeRadius+mySQL ? I imagine that i need to change the sql queries in sql.conf, but i´m not sure.. Any ideas ? Tks, Lima

2 1

Authentication problem
by Hamid Salim 03 Aug '05

03 Aug '05

Hi all, i was wondering if anyone has successfully implemented the following setup and/or had any issues. this is my second post. your help will be greatly appreciated. I have a setup as follows: Fedora core 3 FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 802.11b/g cards for AP and supplicant Windows XP SP2 FreeRadius is not authenticating, there are no messages on the screen or the logfile. The AP does not see the FreeRadius server! I think this is a configuration issue outside of FreeRadius. Has anyone had similar problem. Any help will be greatly appreciated as i have hit a wall here and i am on a deadline! thanks Hamid.

3 2

Coa and Disconnect Message
by gennaro amelio 03 Aug '05

03 Aug '05

hi all, i' am an italian student and i' m a newbie with freeradius. So sorry if i ask stupid things... Can i use Freeradius to do a prepaid-billing system?? Freeradius supports CoA and Disconnect Mesage? Thanks

2 1

ldap basedn assignment
by ggreen＠olemiss.edu 03 Aug '05

03 Aug '05

I have freeradius setup to use 2 ldap servers as backend authentication. One is openldap and the other is windows active directory. They have different basedn structures and these are laid out separately in the conf file. I have it setup to authenticate off of active directory first and openldap second. Everything is working fine except for the case of a user who's openldap username is the same as someone in active directory. In the authorize stage it looks in both AD and ldap. In the authenticate stage it queries both AD and ldap. The problem is that in the authenticate stage it uses the basedn of the server that returns the first ok in the authorize stage. So if the username is in both AD and ldap, openldap rejects the user because it is using the AD basedn to query the openldap server. Is there a way for me to force the basedn for the ldap server regardless of which server returned the first ok? Thanks in advance g

2 1

rlm_sql post-auth variable bug?
by Fernando Schapachnik 03 Aug '05

03 Aug '05

Hi, In my AAA chain I have a module that *sometimes* adds a custom attribute (defined in my dictionary as ipaddr) called Auth-NAS. This module is called in the authorize section. Later on, in the post-auth session I have a SQL-module that has: postauth_query = "INSERT INTO ${postauth_table} (...) \ VALUES (.... \ '%{check:Auth-NAS:-0.0.0.0}', ...)" When run, and Auth-NAS is not present, it outputs: rlm_sql (sql-xxx) in sql_postauth: query is INSERT INTO table (...) ??VALUES (..., '=01', ...); Sometimes the '=01' is replaced by '255.255.255.255'. Is this a bug in some place or am I doing something wrong? Any ideas? Thanks in advance. Fernando.

1 1

FreeRadius Authentication-Please help
by Hamid Salim 03 Aug '05

03 Aug '05

I have a setup as follows: FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 802.11b/g cards for AP and supplicant Windows XP SP2 FreeRadius is not authenticating, there are no messages on the screen or the logfile. The AP does not see the FreeRadius server! I think this is a configuration issue outside of FreeRadius. Has anyone had similar problem. Any help will be greatly appreciated as i have hit a wall here and i am on a deadline! thanks Hamid.

2 1

dialadmin question
by Carlo Paris 03 Aug '05

03 Aug '05

hi all, can I use dialadmin for create users and autenticate this in a lan and exit out the router?? LAN (many users) -> router/fw ---> internet | | freeradius server thanks in advance. damon

2 1

accounting - respose from freeradius, and forward
by Tariq Rashid 03 Aug '05

03 Aug '05

hi - is it possible for freeradius to do the following? we'd like freeradius to reply to accounting requests (start, stop, interim) with acknowledgements, but also to forward the accounting request to a backend radius server but to ignore the response from this prozy behaviour. this means that the querying NAS equipment doesn't spend time and resources waiting for a backend reply to an accounting request. however, the backend radius (possibly belionging to a 3rd party organisation) will need to see the accounting packets - we just ignore/drop their repsonse. diagramatically: 1. [NAS] ------ accounting -----> [freeradius] 2. [NAS] <----- accounting ------ [freeradius] -----------> [radius server] 3. [NAS] [freeradius] <----------- [radius server] is this possible? tariq

2 1