January 2007 - Freeradius-Users - lists.freeradius.org

RE: freeradius and ntlm_auth howto
by King, Michael 25 May '07

25 May '07

Some things I've noticed from your attached files Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes I've never enabled these before, I'm unaware what affect they will have tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" Did you generate your OWN certs... They one's that ship with the server ARE NOT vailid. You have to generate your own. rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 That doesn't look right BUT YOUR FINAL ANSWER: xec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=b9ee04ca891c7b7d --nt-response=79b960c773fa101929d3bf8e738168e8b6d8ae8cd61f64f0 Exec-Program output: Account locked out (0xc0000234) Exec-Program-Wait: plaintext: Account locked out (0xc0000234) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Your account in the domain is not correct. Looks like it's been disabled or something. Fix that first before you change anymore config files. ________________________________ From: Stieven.Struyf(a)komatsu.eu [mailto:Stieven.Struyf@komatsu.eu] Sent: Monday, November 06, 2006 3:16 AM To: King, Michael Subject: Fw: freeradius and ntlm_auth howto Michael, I sent my reply already to the list, but due to the size(larger than 100k) it had to be reviewed by the admin and after a week it was rejected. Below you can find the mail. Thanks for helping me. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 ----- Forwarded by Stieven Struyf/KEISA/BE/KOMEUR on 11/06/2006 09:13 AM ----- Stieven Struyf/KEISA/BE/KOMEUR 11/02/2006 08:55 AM To FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Subject RE: freeradius and ntlm_auth howtoLink <Notes://BENT63KE/C1257011005324FB/DABA975B9FB113EB852564B5001283EA/625A 148B6EA233CDC125721400531414> I added the debuglog as attachment(as it is a little large to paste here). This is the mschap config: mschap { authtype = MS-CHAP use_mppe = yes require_strong = yes with_ntdomain_hack = yes require_encryption = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu(a)lists.freeradius.org wrote on 10/27/2006 04:36:00 PM: > Let's see if we can get this solved... > > > -----Original Message----- > > Here's the full log: > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.104.254.73:1645, > > This is NOT the full log. The full log would have started with the line > /path/to/radiusd -X > > Some important stuff is printed out there, it helps us help you. > > > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > Did you enable Ntdomain Hack in the MSCHAP module? (See below) > > > Including your radius.conf file would help. > > > > > HOWEVER, first you may want to check your mschap module definition: > > > > > > modules { > > > mschap { > > > ntlm_auth = "/usr/bin/ntlm_auth \ > > > --request-nt-key \ > > > --username=%{mschap:User-Name:-None} \ > > > --domain=%{mschap:NT-Domain:-None} \ > > > --challenge=%{mschap:Challenge:-00} \ > > > --nt-response=%{mschap:NT-Response:-00}" > > > > > > ...all on one line of course. Note the use of the > > "mschap:User-Name" > > > and "mschap:NT-Domain" values. > > Mine radiusd.conf file's mschap section looks like this: > NOTE that I do NOT have the :-00 and the :-None statements, and I DO > have with_ntdomain_hack=yes > > > # Microsoft CHAP authentication > # > # This module supports MS-CHAP and MS-CHAPv2 authentication. > # It also enforces the SMB-Account-Ctrl attribute. > # > mschap { > with_ntdomain_hack = yes > ntlm_auth = "/usr/bin/ntlm_auth \ > --request-nt-key \ > --username=%{mschap:User-Name} \ > --challenge=%{mschap:Challenge} \ > --nt-response=%{mschap:NT-Response} > } > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 09 May '07

09 May '07

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" identity = "cn=Directory Manager" password = 1223 basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

pptp + vpn + freeradius Acct-Status-Type Alive
by "Jóhann B. Guðmundsson" 13 Mar '07

13 Mar '07

Is it possible to enable Acct-Status-Type Alive for pptp vpn? If so how.. Best regards Jóhann B.

2 3

Re: The EAP Saga begins.
by Evan Vittitow 20 Feb '07

20 Feb '07

[CONFIG] Socket 4 (frame handler) had an event! Network ID from EAP hint : Pukey If this is a wired network, the above ID can be used in the configuration file to identify this network. [CONFIG] Working from config file /etc/xsupplicant.conf. Network ID from EAP hint : Pukey If this is a wired network, the above ID can be used in the configuration file to identify this network. [CONFIG] Working from config file /etc/xsupplicant.conf. [CONFIG] Identity : User [CONFIG] Socket 4 (frame handler) had an event! [CONFIG] Trying to load root certificate /etc/raddb/certs/cert-clt.pem or certificate directory (null) [CONFIG] Loaded root certificate /etc/raddb/certs/cert-clt.pem and directory (null) [CONFIG] Socket 4 (frame handler) had an event! OpenSSL Error -- error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed This is xsupplicant's output. ukey { type = wireless allow_types = eap_peap identity = User eap-peap { random_file = /dev/urandom root_cert = /etc/raddb/certs/cert-clt.pem chunk_size = 1398 allow_types = eap_mschapv2 eap-mschapv2 { username = User password = password } } } I changed the Username and password.

4 20

radwho is not working
by Angel L. Mateo 19 Feb '07

19 Feb '07

Hello, I have a problem with radwho and it is not working, it shows an empty list of users. I have two freeradius servers with the same configuration (running in an active/standby configuration). I have configure unix (radwtmp) and radutmp modules, I have configure accounting to use both unix and radutmp modules and session to use radutmp. I have also configure sql_log module so both servers logs accounting information to a share backend. So my configuration is: modules { ... # Unix /etc/passwd style authentication # unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } # Write a 'utmp' style file, of which users are currently # logged in, and where they've logged in from. # # This file is used mainly for Simultaneous-Use checking, # and also 'radwho', to see who's currently logged in. # radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } # # The rlm_sql_log module appends the SQL queries in a log # file which is read later by the radsqlrelay program. # # This module only performs the dynamic expansion of the # variables found in the SQL statements. No operation is # executed on the database server. (this could be done # later by an external program) That means the module is # useful only with non-"SELECT" statements. # # See rlm_sql_log(5) manpage. # sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}, '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date, ip) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S', '%{Client-IP-Address}' );" } } accounting { # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # Return an address to the IP Pool when we see a stop record. # amateo, 07/07/06: Activamos los pooles que hemos definido pool_vpn pool_vpn_alu pool_ono pool_ono_alu # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log } session { radutmp } The problem I have is that although radumtp and radwmtp are updated every time time radius authenticate an user, radwho shows an empty list, but radlast shows information. For example, at this moment: vulpes2:/etc/freeradius# radlast | more anonymou 765:ap Thu Jan 4 12:06 still logged in skarmeta 810:ap Thu Jan 4 12:05 still logged in anonymou 939:ap Thu Jan 4 12:05 - 12:06 (00:00) anonymou 1648:ap Thu Jan 4 12:05 still logged in anonymou 1211:ap Thu Jan 4 12:03 still logged in anonymou 1647:ap Thu Jan 4 12:02 - 12:05 (00:03) anonymou 764:ap Thu Jan 4 12:02 - 12:05 (00:03) skarmeta 837:ap Thu Jan 4 12:01 - 12:05 (00:03) anonymou 938:ap Thu Jan 4 12:00 - 12:02 (00:01) anonymou 1646:ap Thu Jan 4 11:59 - 12:02 (00:03) anonymou 763:ap Thu Jan 4 11:58 - 12:00 (00:01) skarmeta 809:ap Thu Jan 4 11:57 - 12:01 (00:03) anonymou 1645:ap Thu Jan 4 11:57 - 11:59 (00:02) anonymou 937:ap Thu Jan 4 11:56 - 11:58 (00:01) anonymou 613:ap Thu Jan 4 11:55 - 12:00 (00:04) anonymou 1644:ap Thu Jan 4 11:55 - 11:57 (00:02) anonymou 762:ap Thu Jan 4 11:54 - 11:56 (00:01) skarmeta 835:ap Thu Jan 4 11:53 - 11:57 (00:03) anonymou 1643:ap Thu Jan 4 11:53 - 11:55 (00:02) anonymou 1642:ap Thu Jan 4 11:51 - 11:53 (00:01) anonymou 936:ap Thu Jan 4 11:50 - 11:54 (00:03) anonymou 2668:ap Thu Jan 4 11:50 still logged in skarmeta 808:ap Thu Jan 4 11:49 - 11:53 (00:03) anonymou 1641:ap Thu Jan 4 11:49 - 11:51 (00:02) anonymou 761:ap Thu Jan 4 11:48 - 11:50 (00:01) ... as you can see, radlast shows that there are users logged in to teh system, but vulpes2:/etc/freeradius# radwho Login Name What TTY When From Location any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

5 11

Re: Freeradius(.net) and Oracle
by Brian Atkins 16 Feb '07

16 Feb '07

Sorry for the delay Peter. I overlooked you message. On Tue, 23 Jan 2007 02:34:55, Peter Nixon wrote: > I don't believe that "freeradius.net" contains database support of any > kind. > You will likely have to recompile freeradius yourself if you want to > add Oracle support. You can expect some pain getting it all to build > correctly on windows. So, am I understanding you to say that I would be better off not installing the .net version, but instead download the sources and compile on the server (W2K running Cygwin)?

3 4

a problem about radius and ldap
by Ramazan Ulker 08 Feb '07

08 Feb '07

Hi I'm working on 802.1x implementation(cisco 2950, freeradius, ldap), i face a problem. First of all, defining users and passwords in users file in raddb works well with md5 authentication. Then i tried to use ldap, then with radtest i get accept-accept packet. But while authenticating from xp client with md5-challenge, I got Auth:rlm_ldap:Attribute "User-Password" is required for authentication error. In one of the e-mail you said don't authenticate from ldap, but with radtest function i get success!!! The passwords are kept clear text. I'm looking forward to getting your help. I also send radius debug log. Best Regards Ramazan Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "192.168.100.18" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: start_tls = no ldap: password = "" ldap: basedn = "dc=dot1x.com" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "radiusgroupname" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes conns: (nil) rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8101f58 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 rlm_eap: Loaded and initialized the type md5 rlm_eap: Loaded and initialized the type leap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp. Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.17:1812, id=11, length=129 NAS-IP-Address = 192.168.100.17 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "ramazan" Called-Station-Id = "00-0F-8F-77-DB-81" Calling-Station-Id = "00-12-79-AE-D2-4D" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000c0172616d617a616e Message-Authenticator = 0x68c41631d4feb2234d900b37a9845348 modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_eap: EAP packet type notification id 0 length 12 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated for request 0 rlm_realm: No '@' in User-Name = "ramazan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched DEFAULT at 152 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=dot1x.com' radius_xlat: '(uid=ramazan)' ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.100.18:389, authentication 0 rlm_ldap: bind as / to 192.168.100.18:389 rlm_ldap: waiting for bind result ... rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com ))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc=dot1x.com )))' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=dot1x.com, with filter (&(cn=VPN)(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))) rlm_ldap: object not found or got ambiguous search result ldap_release_conn: Release Id: 0 ldap_get_conn: Got Id: 0 rlm_ldap: performing search in uid=ramazan,cn=users,cn=idc,dc=dot1x.com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group VPN ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ramazan radius_xlat: '(uid=ramazan)' radius_xlat: 'dc=dot1x.com' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) rlm_ldap: checking if remote access for ramazan is allowed by radiusgroupname rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusClass as Class, value group-net & op=11 rlm_ldap: user ramazan authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [ramazan/<no User-Password attribute>] (from client radius port 50001 cli 00-12-79-AE-D2-4D) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 192.168.100.17:1812 Waking up in 4 seconds...

6 12

Disconnect user in radius
by satish patel 04 Feb '07

04 Feb '07

Dear ALL I have useing freeradius with microsoft mssql now my question is how do i disconnect user from freeradius means example:- user xyz is online and i want to disconnect user from radius so what is the option for this task ?? is there any script or any option to integrate with webpage of dialupadmin ??? Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

5 7

Questions about latest CVS
by 高嵩 02 Feb '07

02 Feb '07

Hi,all I just installed the radiusd on CVS successfully. There are two questions: Does the radiusd server listen on IPv6 address by default?How to use the radclient in Ipv6 ? Regards

3 2

redundant LDAP server with free-radius
by sumi thra 02 Feb '07

02 Feb '07

Hi All, 1. When i configure the free-radius to use redundant ldap, the radius server contacts the secondary ldap server first. My config file options are: authorize { ... .... redundant{ ldap_primary ldap_secondary } .. } authenticate { .. .. Auth-Type LDAP { redundant { ldap_primary ldap_secondary } } } #unix eap } ldap ldap_primary { ;; .. } ldap ldap_secondary { .... ... } 2. My users file has : DEFAULT LDAP-Group := "groupname1" some vendor specific attributes follows.. DEFAULT LDAP-Group := "groupname2" ..... Do i need to specify it as ldap_primary-LDAP-Group := "groupname1" ldap_secondary-LDAP-Group := "groupname1" ?? or the previous define itself will work ?? Its very urgent. Please reply me if you have any idea. Thanks in advance. Regards, Sumi.

4 12