August 2006 - Freeradius-Users - lists.freeradius.org

EAP PEAP, unable to load certificate
by Nick Larsen 28 Aug '06

28 Aug '06

Hi Subscribers, I'm currently setting up a wireless hotspot for a cafe, and am currently stuck with the EAP part in FreeRADIUS. I'm running "FreeRADIUS Version 1.1.1" on FreeBSD `uname -a` output: FreeBSD radius02.01.net.nz 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Wed Nov 2 22:33:15 UTC 2005 root@s-dallas.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC sparc64 I'm trying to connect my i-mate PDA2k (PDA) to the Linksys WAG54g access point. The access point is set up to use WPA-RADIUS, but when I attempt to connect to it from the PDA, It say's the Linksys isn't sending a User-Password or CHAP-Password attribute, so this is where I thought I needed EAP. We want to make is as easy as possible for people with mobile devices to connect to the AP, so I decided to use the PEAP method, which requires tls{} to be enabled. I have created an SSL certificate (CA) and private key file, and put them in /etc/raddb/certs and referenced them correctly in eap.conf under tls{} but when I enable peap{} I get the following output from radiusd -XA: (On the 8th to last line, you'll see fopen, and it has nothing between the quotes in the 1st argument.) Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 5120 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.10.1.18 IP address [10.10.1.18] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter sqlcounter: counter-name = "Daily-Session-Time" sqlcounter: check-name = "Max-Daily-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "daily" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1830 rlm_sqlcounter: Check attribute Max-Daily-Session is number 1831 rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Next reset 1156507200 [2006-08-26 00:00:00] rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Prev reset 1156420800 [2006-08-25 00:00:00] Module: Instantiated sqlcounter (dailycounter) sqlcounter: counter-name = "Monthly-Session-Time" sqlcounter: check-name = "Max-Monthly-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sql" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "monthly" sqlcounter: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sqlcounter: Counter attribute Monthly-Session-Time is number 1832 rlm_sqlcounter: Check attribute Max-Monthly-Session is number 1833 rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Next reset 1157025600 [2006-09-01 00:00:00] rlm_sqlcounter: Current Time: 1156477612 [2006-08-25 15:46:52], Prev reset 1154347200 [2006-08-01 00:00:00] Module: Instantiated sqlcounter (monthlycounter) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/private/cakey.pem" tls: certificate_file = "(null)" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "*******" tls: dh_file = "(null)" tls: random_file = "(null)" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 1062:error:0200100E:system library:fopen:Bad address:bss_file.c:352:fopen('','r') 1062:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: 1062:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:720: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1906] Unknown module "eap". radiusd.conf[1853] Failed to parse authenticate section. Does anyone know what could cause this, or is there a better method to get ease of use for wireless clients? Please let me know if there's other info you need which may help, as I'm sure I would have forgotten something. Thanks in advance, -- Regards, Nick Larsen Wellington NEW ZEALAND

3 5

Please help !!!
by Kartthik 28 Aug '06

28 Aug '06

3 2

RE: Report Generator
by Edward.Shih＠rcc.edu 28 Aug '06

28 Aug '06

Thank you, Sean. Have a great day. Edward -----Original Message----- From: freeradius-users-bounces+edward.shih=rcc.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+edward.shih=rcc.edu@lists.freeradius.or g] On Behalf Of Sean Sent: Monday, August 28, 2006 10:45 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: Report Generator Hi Andre, You can download the work to date here http://swarmhotspots.com/phpreports.tar.gz I'm integrating phpMyPrepaid and Dialup Admin into it at the moment, so there are a lot of redundant files included in the tar file. You can have a look at how it works at http://topup.ie/reports username testuser, password testuser. Some reports ask for a client user name use seanb52, some reports ask for a NAS ID use palm1 and some reports request the NAS IP use 82.153.112.235 Please give me some feedback. I'd like to know if any of this would be useful or worth putting onto Sourceforge when it's ready for release. There is no documentation ready yet but if you need help send me an email. Don't tie up the FreeRadius list with private correspondence. Regards, Sean Bracken http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Suggestions about captive portal
by Giuseppina Venezia 28 Aug '06

28 Aug '06

Hi all, I would like to know what Captive Portal you advise to use and in particular what supports better Freeradius. For the moment I'am using Chillispot. My problem is always the same: set the NAS to accept the IP address, assigned by IP pool, from FreeRADIUS. I have searched documentation related to my NAS (Doc, forum, mailing list, ecc.ecc.) but I haven't find nothing of useful for my problem. Fort this reason i would to use another captive portal (that support freeradius) that can solve my problem. Thanks in advance for every advice or help. Best regards. Giusy

1 0

RE: Report Generator
by Sean 28 Aug '06

28 Aug '06

Hi Andre, You can download the work to date here http://swarmhotspots.com/phpreports.tar.gz I'm integrating phpMyPrepaid and Dialup Admin into it at the moment, so there are a lot of redundant files included in the tar file. You can have a look at how it works at http://topup.ie/reports username testuser, password testuser. Some reports ask for a client user name use seanb52, some reports ask for a NAS ID use palm1 and some reports request the NAS IP use 82.153.112.235 Please give me some feedback. I'd like to know if any of this would be useful or worth putting onto Sourceforge when it's ready for release. There is no documentation ready yet but if you need help send me an email. Don't tie up the FreeRadius list with private correspondence. Regards, Sean Bracken http://swarmhotspots.com

1 0

Local groups in FreeRadius ?
by Ami Schieber 28 Aug '06

28 Aug '06

Hi, I've seen several Q&A about local groups of users but they all refer to system groups (i.e. - /etc/group configuration). I'd like to have a Group definition that will include attributes that are common to all users that belong in this group. For example : Group Finance, Pool-Name := finance_pool, Reply-Message = "Hello Finance User, %u" Group Engineering, Pool-Name := eng_pool, Reply-Message = "Hello Eng %u" Is it possible to achieve in freeradius , how ? Thanks, Ami

3 12

Regarding memory leaks
by Ravi S M 28 Aug '06

28 Aug '06

Hi I am integrating my rlm_otp module with freeradius code . if I run radiusd server with the purify it is giving leaks As MLK :95 bytes Finished radiusd ( 278 errors, 95 leaked bytes) Purify instrumented /home/ravis/kshitij/freeradius-1.1.2/src/main/.libs/radiusd (pid 8830 at Fri Aug 25 12:54:30 2006) Command-line: radiusd UMR: Uninitialized memory read (18 times) UMR: Uninitialized memory read (19 times) UMR: Uninitialized memory read (6 times) UMR: Uninitialized memory read (79 times) UMR: Uninitialized memory read (96 times) UMR: Uninitialized memory read (3 times) UMR: Uninitialized memory read (2 times) UMR: Uninitialized memory read ABR: Array bounds read (7 times) ABR: Array bounds read (7 times) ABR: Array bounds read (7 times) ABR: Array bounds read (3 times) ABR: Array bounds read (3 times) ABR: Array bounds read (3 times) UMR: Uninitialized memory read (8 times) UMR: Uninitialized memory read (3 times) UMR: Uninitialized memory read (3 times) PAR: Bad function parameter (7 times) ABR: Array bounds read ABR: Array bounds read ABR: Array bounds read Current file descriptors in use: 7 Memory leaked: 95 bytes (0.0142%); potentially leaked: 0 bytes (0%) MLK: 95 bytes leaked in 7 blocks This memory was allocated from: malloc [rtlib.o] lt_emalloc [ltdl.c:863] lt_emalloc (size) size_t size; { => lt_ptr mem = lt_dlmalloc (size); if (size && !mem) LT_DLMUTEX_SETERROR (LT_DLSTRERROR (NO_MEMORY)); return mem; canonicalize_path [ltdl.c:2044] assert (path && *path); assert (pcanonical); => canonical = LT_EMALLOC (char, 1+ LT_STRLEN (path)); if (!canonical) return 1; try_dlopen [ltdl.c:2562] lt_dlopenext [ltdl.c:2959] linkto_module [modules.c:207] Block of 19 bytes at 0x32ed90 Block of 15 bytes at 0x231728 Block of 14 bytes at 0x22c9e0 Block of 12 bytes (3 times); last block at 0x2122b8 Block of 11 bytes at 0x32e480 Purify Heap Analysis (combining suppressed and unsuppressed blocks) Thread Summary : 1 thread(s) in existence Program exited with status code 0. So please provide some usefull inputs to solve this problem Thanks & regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

Account lockout enforcement and min lengh reqs
by Ellis, Scott 1 (N-Comptel Inc.) 28 Aug '06

28 Aug '06

Hello everyone, I am running freeradius v1.0.1 in a Redhat linux environment. Does there exist a mechanism to enforce account lockout after 3 tries and strong passwords? The environment is Cisco routers and switches. If there exists some kind of post-auth script, that would be nice. Thanks, Scott

2 1

A few clarifications on EAP-TTLS
by luigi natalino 28 Aug '06

28 Aug '06

Hello, I'am using freeradius 1.1.2 with eap-ttls. I have read that I can use Eap-Ttls in trasparent way for the Client, that is without using Client side certificates and without installing other software since that eap-ttls support legacy authentication system (I'am using a wall garden and I'can't install nothing on the clients). So i've configured eap.conf (I've just decommented this few lines in default configuration) tls { private_key_password = whatever private_key_file = /etc/mycerts/cert-srv.pem certificate_file = /etc/mycerts/cert-srv.pem CA_file = /etc/mycerts/root.pem dh_file = /etc/mycerts/dh random_file = /etc/mycerts/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } And this is the output of "radiusd -X" Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=valug,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypass" ldap: basedn = "ou=homewifi,dc=valug,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139948 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1041, id=0, length=219 User-Name = "utente" CHAP-Challenge = 0xb8e461988db3fcb15283eae64c342d1b CHAP-Password = 0x0090a807a589b4864d7900bee913da1710 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "XX-XX-XX-XX-XX-XX" Called-Station-Id = "YY-YY-YY-YY-YY-YY" NAS-Identifier = "localhost" Acct-Session-Id = "44f1bf3c00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x81223a8de1013cb55976c322793533a2 WISPr-Logoff-URL = "http://192.168.182.5:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "utente", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 This is the error rlm_eap: No EAP-Message, not doing EAP what's wrong? I must install specific software on the clients (like Xsupplicant) or I can solve in other way (trasparent for the clients)? Many Thanks Luigi Natalino _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

3 3

how to send to a switch Port Priority ?
by George Comanescu 28 Aug '06

28 Aug '06

hello I have the following users file and I wold like to send to the switch on authentification PortPriority ... a auth-Type := Local, User-Password == "a" Service-Type = Administrative-User, Reply-Message = "Salut user:A!" b Auth-Type := EAP, User-Password == "b" Service-Type = Administrative-User, Reply-Message = "Hi :B!", ???? Port-Priority = Platinum, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "256", Vendor-Specific = "562" ... -- Cu respect, George Comanescu

2 1