February 2006 - Freeradius-Users - lists.freeradius.org

type of lvalue in VALUE_PAIR
by Seferovic Edvin 03 Mar '06

03 Mar '06

Hi, I know this question is probably for the developer list, but I think someone can answer me without any further complications ;) As I "promised", I am patching freeradius ( sqlcounter actually ) so it can do traffic accounting. I have patched it but since I want to have the ability to set the limit by entering the amount of bytes ( in my backend ), I am limited by lvalue of value_pair struct. So values above a (ca) 4 GB are above the limit of uint32 right? What can I do to increase the limit without crashing the freeradius functions. Can I simply change it to uint64_t ( 2 ^64 should be enough ;) ) ??? Regards, Edvin PS: the patched freeradius is working and is able to account traffic, but I think it would not be RFC compliant because I haven't found the needed attributes in the dictionaries

2 4

Radius Features
by mohammad flaifel 02 Mar '06

02 Mar '06

Hi all, I need to install a radius server and i already testes freeradius and seems is really good. i need to know if freeradius supports: - Change of Authorization while the subscriber's PPP session is still connected. - Disconnect users based on download volume limitation regards, Flaifel Regards, ------------------------------------------------------------------- Mohammad Flaifel Senior System Engineer Jordan Telecom Network Operation Center Tel: (+962) 6 5805-214 Mob: (+962) 777 374-933

2 1

Dlink + freeradius + Mysql gives me lots of problem
by Michael Calizo 01 Mar '06

01 Mar '06

Hi, I have a problem in my configuration using the mixed of Dlink + freeradius + Mysql. What i am trying to do is for my dlink hotspot to authenticate using freeradius with mysql module. I do some testing using radtest on both localhost and remote host and my freeradius seems to authenticate and is working fine. Below is the output of Radiusd -x: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded System Module: Instantiated unix (unix) radiusd.conf Auth-Type eap already configured - skipping Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@192.168.1.229:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. OUTPUT of RADTEST FROM REMOTE: rad_recv: Access-Request packet from host 192.168.1.13:56435, id=70, length=60 User-Name = "benjtest" User-Password = "benjtest" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Sending Access-Accept of id 70 to 192.168.1.13 port 56435 Framed-IP-Address := 192.168.0.50 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP OUTPUT when I try to Connect on wifi tru DLINK: rad_recv: Access-Request packet from host 192.168.1.22:65461, id=45, length=81 User-Name = "benjtest" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000d0162656e6a74657374 NAS-IP-Address = 192.168.1.22 Message-Authenticator = 0x6080434b26128348f34dc763d6c89192 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Sending Access-Reject of id 45 to 192.168.1.22 port 65461 My question is why is it that when i use my DLINK wireless access point it failed to authenticate. I use exactly the same login account and password when i use radtest . Anybody please help me. Thank You. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step

3 4

auth-reject with attributes
by freeradius＠list.coretech.ro 01 Mar '06

01 Mar '06

hello, I have tried to upgrade to the latest cvs version and I have noted that reply attributes are no longer sent with auth-reject messages. is this correct ? is there a configuration option to re enable sending of reply attributes with auth-reject messages ? thanks, Razvan Radu

2 2

another sql database
by debik 28 Feb '06

28 Feb '06

I have got onother database on my serwer. I it used by ISP accounting. In this database is the table called users where are logins and passwords. I have tried to put in radiusd.conf another module called sql1 and create file sql1.conf When i start radius it says me that the parameters are in attribute = format. I know what im doing wrong, but is there anyway to correct this. I know the RFC about freeradius and supouse there is not anyway to do this.

2 2

Re:Database connection failure and retry
by Marko Dinic 28 Feb '06

28 Feb '06

>>"Ming-Ching Tiew" <mingching.tiew at redtone.com> wrote: >> >> A little while ago I posted about in my configuration, using unixodbc/freetds, >> we noticed that database/network failure causes permanent disability in >> radius server to stop logging and I was given the reply that it is in the >> feature of radius server to retry upon failure. >> >> So there is a discrepancy between what I noticed verses the "supposed to be" >> behaviour. >> >> Upon further investigation I explored into the code, I found this in sql_mysql.c :- >> >> static int sql_fetch_row(SQLSOCK * sqlsocket, SQL_CONFIG *config) >> { >> rlm_sql_mysql_sock *mysql_sock = sqlsocket->conn; >> >> /* >> * Check pointer before de-referencing it. >> */ >> if (!mysql_sock->result) { >> return SQL_DOWN; >> } >> >> sqlsocket->row = mysql_fetch_row(mysql_sock->result); >> >> if (sqlsocket->row == NULL) { >> return sql_check_error(mysql_errno(mysql_sock->sock)); >> } >> return 0; >> } >> >> >> However the code in sql_unixodbc.c is like this :- >> >> >> static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { >> rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; >> >> sqlsocket->row = NULL; >> >> if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) >> return 0; >> >> /* XXX Check if return suggests we should return error or SQL_DOWN */ >> >> sqlsocket->row = unixodbc_sock->row; >> return 0; >> } >> >> >> There is no checking whatsoever, so unixodbc driver is unable to reconnect >> upon failure. > > Ok... are you willing to supply a patch? > > Alan DeKok. > A while ago Alan suggested I should use odbc instead of native sybase driver, so I set up unixODBC 2.2.11 with freetds 0.63 ODBC driver, but I encountered the same problem as described above. However, I couldn't afford waiting for a patch, so I patched it myself. I've never used ODBC API before, so I cannot be sure if this is a complete solution to the problem, or whether it will work for everyone - the only thing i do know is that it works well for me. Here it is: -------------------------------------PATCH STARTS HERE------------------------------------------ --- freeradius-1.1.0/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c 2005-08-29 19:01:58.000000000 +0200 +++ freeradius-1.1.0-unixodbcfix/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/sql_unixodbc.c 2006-02-28 17:25:27.000000000 +0100 @@ -40,6 +40,7 @@ /* Forward declarations */ static char *sql_error(SQLSOCK *sqlsocket, SQL_CONFIG *config); +static int sql_state(long err_handle, SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_free_result(SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_affected_rows(SQLSOCK *sqlsocket, SQL_CONFIG *config); static int sql_num_fields(SQLSOCK *sqlsocket, SQL_CONFIG *config); @@ -67,23 +68,23 @@ /* 1. Allocate environment handle and register version */ err_handle = SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&unixodbc_sock->env_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate environment handle %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate environment handle\n"); return -1; } err_handle = SQLSetEnvAttr(unixodbc_sock->env_handle, SQL_ATTR_ODBC_VERSION, (void*)SQL_OV_ODBC3, 0); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't register ODBC version %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't register ODBC version\n"); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; } /* 2. Allocate connection handle */ err_handle = SQLAllocHandle(SQL_HANDLE_DBC, unixodbc_sock->env_handle, &unixodbc_sock->dbc_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate connection handle %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate connection handle\n"); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; } @@ -93,9 +94,9 @@ (SQLCHAR*) config->sql_server, strlen(config->sql_server), (SQLCHAR*) config->sql_login, strlen(config->sql_login), (SQLCHAR*) config->sql_password, strlen(config->sql_password)); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Connection failed %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Connection failed\n"); SQLFreeHandle(SQL_HANDLE_DBC, unixodbc_sock->dbc_handle); SQLFreeHandle(SQL_HANDLE_ENV, unixodbc_sock->env_handle); return -1; @@ -103,9 +104,9 @@ /* 4. Allocate the statement */ err_handle = SQLAllocStmt(unixodbc_sock->dbc_handle, &unixodbc_sock->stmt_handle); - if (!SQL_SUCCEEDED(err_handle)) + if (sql_state(err_handle, sqlsocket, config)) { - radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate the statement %s\n", sql_error(sqlsocket, config)); + radlog(L_ERR, "rlm_sql_unixodbc: Can't allocate the statement\n"); return -1; } @@ -139,16 +140,17 @@ static int sql_query(SQLSOCK *sqlsocket, SQL_CONFIG *config, char *querystr) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; long err_handle; + int state; if (config->sqltrace) radlog(L_DBG, "query: %s", querystr); /* Executing query */ err_handle = SQLExecDirect(unixodbc_sock->stmt_handle, (SQLCHAR *)querystr, strlen(querystr)); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); - return -1; + if ((state = sql_state(err_handle, sqlsocket, config))) { + if(state == SQL_DOWN) + radlog(L_ERR, "rlm_sql_unixodbc: rlm_sql should attempt to reconnect\n"); + return state; } return 0; } @@ -165,9 +167,11 @@ rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; SQLINTEGER column, len; int numfields; + int state; - if(sql_query(sqlsocket, config, querystr) < 0) - return -1; + /* Only state = 0 means success */ + if((state = sql_query(sqlsocket, config, querystr))) + return state; numfields=sql_num_fields(sqlsocket, config); if(numfields < 0) @@ -214,11 +218,9 @@ int num_fields = 0; err_handle = SQLNumResultCols(unixodbc_sock->stmt_handle,(SQLSMALLINT *)&num_fields); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); + if (sql_state(err_handle, sqlsocket, config)) return -1; - } + return num_fields; } @@ -247,14 +249,19 @@ *************************************************************************/ static int sql_fetch_row(SQLSOCK *sqlsocket, SQL_CONFIG *config) { rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; + long err_handle; + int state; sqlsocket->row = NULL; - if(SQLFetch(unixodbc_sock->stmt_handle) == SQL_NO_DATA_FOUND) - return 0; - - /* XXX Check if return suggests we should return error or SQL_DOWN */ - + err_handle = SQLFetch(unixodbc_sock->stmt_handle); + if(err_handle == SQL_NO_DATA_FOUND) + return 0; + if ((state = sql_state(err_handle, sqlsocket, config))) { + if(state == SQL_DOWN) + radlog(L_ERR, "rlm_sql_unixodbc: rlm_sql should attempt to reconnect\n"); + return state; + } sqlsocket->row = unixodbc_sock->row; return 0; } @@ -346,6 +353,41 @@ SQLINTEGER errornum = 0; SQLSMALLINT length = 255; static char result[1024]; /* NOT thread-safe! */ + + rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; + + SQLError( + unixodbc_sock->env_handle, + unixodbc_sock->dbc_handle, + unixodbc_sock->stmt_handle, + state, + &errornum, + error, + 256, + &length); + + sprintf(result, "%s %s", state, error); + result[sizeof(result) - 1] = '\0'; /* catch idiot thread issues */ + return result; +} + +/************************************************************************* + * + * Function: sql_state + * + * Purpose: Returns 0 for success, SQL_DOWN if the error was + * connection related or -1 for other errors + * + *************************************************************************/ +static int sql_state(long err_handle, SQLSOCK *sqlsocket, SQL_CONFIG *config) { + SQLCHAR state[256] = ""; + SQLCHAR error[256] = ""; + SQLINTEGER errornum = 0; + SQLSMALLINT length = 255; + int res = -1; + + if(SQL_SUCCEEDED(err_handle)) + return 0; /* on success, just return 0 */ rlm_sql_unixodbc_sock *unixodbc_sock = sqlsocket->conn; @@ -359,9 +401,25 @@ 256, &length); - sprintf(result, "%s %s", state, error); - result[sizeof(result) - 1] = '\0'; /* catch idiot thread issues */ - return result; + if(state[0] == '0') { + switch(state[1]) { + case '1': /* SQLSTATE 01 class contains info and warning messages */ + radlog(L_ERR, "rlm_sql_unixodbc: Warning %s %s\n", state, error); + case '0': /* SQLSTATE 00 class means success */ + res = 0; + break; + case '8': /* SQLSTATE 08 class describes various connection errors */ + radlog(L_ERR, "rlm_sql_unixodbc: SQL down %s %s\n", state, error); + res = SQL_DOWN; + break; + default: /* any other SQLSTATE means error */ + radlog(L_ERR, "rlm_sql_unixodbc: Error %s %s\n", state, error); + res = -1; + break; + } + } + + return res; } /************************************************************************* @@ -378,11 +436,9 @@ int affected_rows; err_handle = SQLRowCount(unixodbc_sock->stmt_handle, (SQLINTEGER *)&affected_rows); - if (!SQL_SUCCEEDED(err_handle)) - { - radlog(L_ERR, "rlm_sql_unixodbc: '%s'\n", sql_error(sqlsocket, config)); + if (sql_state(err_handle, sqlsocket, config)) return -1; - } + return affected_rows; } -------------------------------------PATCH ENDS HERE------------------------------------------ -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. -----

2 1

Fw: Help needed with MS-CHAP
by Charles Blake 28 Feb '06

28 Feb '06

I am sorry. I just want to know what happens when Radius receives a request with a MS-CHAP password, how it authenticates the user? Thank you, Charles ----- Original Message ----- From: "Alan DeKok" <aland(a)ox.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, February 24, 2006 10:52 AM Subject: Re: Help needed with MS-CHAP > "Charles Blake" <charles(a)neutel.com> wrote: >> I just want to authenticate MS-CHAPv2 passwords. My question is: >> >> Where do I have those passwords in my Linux server? > > I've been trying to say you don't. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 3

freeBSD and freeRADIUS with mySQL
by eric＠gozippy.com 28 Feb '06

28 Feb '06

We've been trying to get freeradius, freebsd and mysql to all work together now for a week... If anyone has figured out how to do this - please let me know. There are literally hundreds of posts on various forums I found by googleing the errors and all are having the same issues... the ports for freeradius don't seem to install correctly, and when we build from lates binaries there is errors when trying to load mysql... In the mandrake 10.2 system I had - all I did was install mysqlxx-dev development extensions, and all was good... I can't find any support for freebsd. -grateful for any links or how-to's...

5 4

Help with log file format
by Walter Reynolds 28 Feb '06

28 Feb '06

For some reason my replies are not getting to the list. > Walter Reynolds <waltr(a)umich.edu> wrote: > > We have some tools that currently run some statistics on the radius > > accounting file. Well, we currently use a different radius server. With > > that in mind the log format is different. Is there a way to modify the > > format of the accounting log format? > > Which accounting log? The detail file? That's pretty much > unchanged since the original Livingston format 13 years ago. > > Could you be more specific, and say what should be changed, and to > what it should be changed? > > Alan DeKok. I apologize for not giving all the info, I am new to radius and am still learning. Yes I am refering to the detail file. Currently we have implemented a version of MERIT Radius. I know less about that than Freeradius, so forgive me if I do not give you what you need. Currently we have two files that appear to be accounting data to me. Following are what we get (I have removed IP info for safty sake) These two lines are from logfile.20060220 Mon Feb 20 13:07:12 2006: Received-Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP Mon Feb 20 13:07:12 2006: Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP - OK -- total 0, holding 0 No, what is more important to me os from the session.20060220.las file (mainly the first line) This is strange though as because Pre-Auth the accounting data is sent to the merit radius then forwarded to a freeradius and back. Either way this is the format of the merit radius and our scripts. NA NA 1140458855 20 20 waltr@ NA 'PROFILE' NA NA XXX.XXX.XXX.XXX/9126 NA NA Framed/PPP/XXX.XXX.XXX.XXX ## User-Name:0='waltr' Calling-Station-Id:0='XXX.XXX.XXX.XXX' Acct-Status-Type:1=Stop ## Acct-Input-Octets:1=1208 Acct-Output-Octets:1=1648 Acct-Session-Id:0='0B901E52' ## Acct-Input-Packets:1=11 Acct-Output-Packets:1=9 Acct-Terminate-Cause:1=User-Request ## Tunnel-Client-Endpoint:10=:49:'XXX.XXX.XXX.XXX' Acct-Authentic:1=RADIUS Acct-Delay-Time:1=0 ## NAS-IP-Address:2=XXX.XXX.XXX.XXX NAS-Port-Type:1=Virtual I hope this helps clear up my question. -- Walter Reynolds University of Michigan

2 1

rlm_eap: Handler failed in EAP/peap
by Agus Supriyadi 28 Feb '06

28 Feb '06

Dear All, I've got a problem with my freeradius. I've installed freeradius 1.1.0. I'm gonna using EAP/PEAP and MSCHAPv2. The radius returned Access-Reject message when I try to authenicate user. This is the debug message from freeradius: ------------------- BEGIN DEBUG ----------------------- rad_recv: Access-Request packet from host 128.16.100.2:21645, id=112, length=219 User-Name = "agus" Framed-MTU = 1400 Called-Station-Id = "0012.43f9.07f0" Calling-Station-Id = "0040.96a6.0915" Service-Type = Login-User Message-Authenticator = 0x035385584153738e930ae5647bba4e77 EAP-Message = 0x020900561900170301004bbeba44dea711ccc50b11d2b66d81c5ee2f2254128135c4bfbc0c8f56c11d93419377cb9061b873416e21389346112ea96d1078b7ad8db16c64b70d812a071923b02819bd681a5902ead889 NAS-Port-Type = Wireless-802.11 NAS-Port = 208 State = 0xbe8af775ecd2998b486819e32c8c5eb3 NAS-IP-Address = 128.16.100.2 NAS-Identifier = "iSpot" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to agus PEAP: Adding old state with e5 7c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for agus with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 60 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=agus --challenge=b7bc51d8fa48dfc5 --nt-response=09d697e7c477017b27c969c52b93deb49200295bda22bf6b' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=agus --challenge=b7bc51d8fa48dfc5 --nt-response=09d697e7c477017b27c969c52b93deb49200295bda22bf6b [2006/02/28 05:41:41, 0] utils/ntlm_auth.c:get_winbind_domain(140) could not obtain winbind domain name! Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 112 to 128.16.100.2 port 21645 EAP-Message = 0x010a00261900170301001bce70eaa23461d24fc4ce2a1d288dd015b9c4c3640a8a4edb8bae92 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x475bad5b4f387d108835cc1a2cf108f0 Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 128.16.100.2:21645, id=113, length=171 User-Name = "agus" Framed-MTU = 1400 Called-Station-Id = "0012.43f9.07f0" Calling-Station-Id = "0040.96a6.0915" Service-Type = Login-User Message-Authenticator = 0xc2617d78095ef05b9cac0310eb5d1793 EAP-Message = 0x020a00261900170301001bd67b9a87e9d765a68d39d4c7315696e06a111f82effe74aca9e9c0 NAS-Port-Type = Wireless-802.11 NAS-Port = 208 State = 0x475bad5b4f387d108835cc1a2cf108f0 NAS-IP-Address = 128.16.100.2 NAS-Identifier = "iSpot" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "agus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 8 rlm_passwd: Added LM-Password: 'B736D7A84FBDE543AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: 'AA4348E74FCFE5BB2061F2FF5C085304' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. ------------------- END DEBUG ----------------------- Can anybody tell me what happen with my freeradius? -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS d(-) s:- a--- C++(+++)$>++++$ UL$>++++$ P+? L++$>$ !E--- W++ !N !o !K-- w !O M !V PS PE !Y PGP t 5 X R tv b DI D G e h r y ------END GEEK CODE BLOCK------

2 3