February 2007 - Freeradius-Users - lists.freeradius.org

Re: Problems regarding MAC address authentication
by Shobhit Jindal 15 Feb '07

15 Feb '07

yeah upgrading is high on my list :) rlm_passwd says it provides authorization via files but i need it via LDAP. I didnt get much from your reply, here's what am doing presently plz suggest how should i proceed. ********************************************************************************************************* LDAP user: dn: uid=ashimece,cn=Ece08,cn=Students,dc=itweb uid: ashimece userPassword: jindal objectClass: account objectClass: simpleSecurityObject objectClass: top objectClass: radiusprofile cn: Ashim Dutta radiusCallingStationId: 00-90-4B-ED-AB-52 Logs of authentication : ********************************************************************************************************* when MAC ID is correct Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.9.1.2:1088, id=8, length=249 Message-Authenticator = 0x1aefde709d0282b89e74ef5d2df3e4ac Service-Type = Framed-User User-Name = "ashimece" Framed-MTU = 1488 State = 0xefc4f78cf9a0a3f62c93cd748bf36547 Called-Station-Id = "00-15-E9-C9-5F-C0: Dr.CVR24" Calling-Station-Id = "00-90-4B-ED-AB-52" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001bb0362047836069aff6d4a653b9d47e05dcaa105bfa0926b49c0ab2 NAS-IP-Address = 10.9.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "chap" returns noop for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "ashimece", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 18 rlm_ldap: - authorize rlm_ldap: performing user authorization for ashimece radius_xlat: '(uid=ashimece)' radius_xlat: 'dc=itweb' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=itweb, with filter (uid=ashimece) rlm_ldap: checking if remote access for ashimece is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-90-4B-ED-AB-52 & op=21 rlm_ldap: Adding userPassword as User-Password, value jindal & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user ashimece authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 18 modcall: group authorize returns updated for request 18 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 18 modcall: group authenticate returns ok for request 18 Sending Access-Accept of id 8 to 10.9.1.2:1088 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0xfdd87b133b79449727654aa3a681ee48d891ee6ff1685344159acbc3ff02d820 MS-MPPE-Send-Key = 0xdcbb432b81d40d6e1d189527a911932a7b161f8b68ba2ee06e862c455967699e EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ashimece" Finished request 18 Going to the next request Waking up in 6 seconds... ********************************************************************************************************* when MAC ID is *NOT* correct but is authenticated successfully Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.9.1.2:1088, id=17, length=249 Message-Authenticator = 0xaab5be28b7a3198b4432458ae62e1905 Service-Type = Framed-User User-Name = "ashimece" Framed-MTU = 1488 State = 0xdfdb9e22d8d2452e0a4c3daf52e757f6 Called-Station-Id = "00-15-E9-C9-5F-C0:Dr.CVR24" Calling-Station-Id = " 00-90-4B-ED-AB-52" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x021100261900170301001ba1bc4bf393dc67e00b5d456b4eda44e73fdef7b14ba0558ecbe493 NAS-IP-Address = 10.9.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 27 modcall[authorize]: module "preprocess" returns ok for request 27 modcall[authorize]: module "chap" returns noop for request 27 modcall[authorize]: module "mschap" returns noop for request 27 rlm_realm: No '@' in User-Name = "ashimece", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 27 rlm_eap: EAP packet type response id 17 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 27 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 27 rlm_ldap: - authorize rlm_ldap: performing user authorization for ashimece radius_xlat: '(uid=ashimece)' radius_xlat: 'dc=itweb' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=itweb, with filter (uid=ashimece) rlm_ldap: checking if remote access for ashimece is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-90-4B-ED-AB-00 & op=21 rlm_ldap: Adding userPassword as User-Password, value jindal & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user ashimece authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 27 modcall: group authorize returns updated for request 27 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 27 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 27 modcall: group authenticate returns ok for request 27 Sending Access-Accept of id 17 to 10.9.1.2:1088 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x777bb3e1d089ab4d06e5d17cc4e75e1ce71c8a31f7ac06cf193ac2aca893eca9 MS-MPPE-Send-Key = 0x485bd639e4f35fb4fe39fe954d6a1959f3d25f149b53d22c180716bac82abac9 EAP-Message = 0x03110004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ashimece" Finished request 27 Going to the next request Waking up in 5 seconds... ********************************************************************************************************* when MAC ID is correct BUT ldap *filter* is changed from uid to radiusCallingStationId but is *NOT* authenticated Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.9.1.2:1089, id=7, length=249 Message-Authenticator = 0xef805c6611b81ccd4e57f0a01b5a56b2 Service-Type = Framed-User User-Name = "ashimece" Framed-MTU = 1488 State = 0xaf77bba9c6823b2507d129594c59a524 Called-Station-Id = "00-15-E9-C9-5F-C0: Dr.CVR24" Calling-Station-Id = "00-90-4B-ED-AB-52" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001bd7bb65c7f80981315f61ec2779f602c81f4ec09c0c92babb82aacb NAS-IP-Address = 10.9.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "ashimece", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 15 rlm_ldap: - authorize rlm_ldap: performing user authorization for ashimece radius_xlat: '(radiusCallingStationId=00-90-4B-ED-AB-52)' radius_xlat: 'dc=itweb' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=itweb, with filter (radiusCallingStationId=00-90-4B-ED-AB-52) rlm_ldap: checking if remote access for ashimece is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-90-4B-ED-AB-52 & op=21 rlm_ldap: Adding userPassword as User-Password, value jindal & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user ashimece authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 15 modcall: group authenticate returns invalid for request 15 auth: Failed to validate the user. Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 6 seconds... -- Registerd Linux User #426561 - Shobhit Jindal B.Tech. Part-III, Department Of Electronics Engineering, ITBHU INDIA

2 4

Re: a problem about radius and ldap [SOLVED]
by Ramazan Ulker 15 Feb '07

15 Feb '07

Hi Sorry for too many mails. Problem solved by setting identity and password in radius.conf with proper user in ldap. I managed to get User-Password from ldap at the end as shown below. rlm_ldap: Added password ramazan in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userpassword as User-Password, value ramazan & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusClass as Class, value employee & op=11 rlm_ldap: user ramazan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Login OK: [ramazan/<no User-Password attribute>] (from client ldapsrv port 50001 cli 00-12-79-AE-D2-4D) On 1/29/07, Ramazan Ulker <ulkerra(a)gmail.com> wrote: > > > > Hi > > I'm working on 802.1x implementation(cisco 2950, freeradius, ldap), i face a problem. First of all, defining users and passwords in users file in raddb works well with md5 authentication. Then i tried to use ldap, then with radtest i get accept-accept packet. But while authenticating from xp client with md5-challenge, I got > > Auth:rlm_ldap:Attribute "User-Password" is required for authentication > > error. In one of the e-mail you said don't authenticate from ldap, but with radtest function i get success!!! The passwords are kept clear text. I'm looking forward to getting your help. I also send radius debug log. > > Best Regards > > Ramazan > > > > > > Starting - reading configuration files ... > > reread_config: reading radiusd.conf > > Config: including file: /etc/raddb/proxy.conf > > Config: including file: /etc/raddb/clients.conf > > Config: including file: /etc/raddb/snmp.conf > > Config: including file: /etc/raddb/sql.conf > > main: prefix = "/usr" > > main: localstatedir = "/var" > > main: logdir = "/var/log/radius" > > main: libdir = "/usr/lib/freeradius" > > main: radacctdir = "/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = yes > > main: log_file = "/var/log/radius/radius.log" > > main: log_auth = yes > > main: log_auth_badpass = yes > > main: log_auth_goodpass = yes > > main: pidfile = "/var/run/radiusd/radiusd.pid" > > main: user = "radiusd" > > main: group = "radiusd" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/sbin/checkrad" > > main: proxy_requests = yes > > proxy: retry_delay = 5 > > proxy: retry_count = 3 > > proxy: synchronous = no > > proxy: default_fallback = yes > > proxy: dead_time = 120 > > proxy: post_proxy_authorize = yes > > proxy: wake_all_if_all_dead = no > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > > read_config_files: reading dictionary > > read_config_files: reading naslist > > read_config_files: reading clients > > read_config_files: reading realms > > radiusd: entering modules setup > > Module: Library search path is /usr/lib/freeradius > > Module: Loaded expr > > Module: Instantiated expr (expr) > > Module: Loaded PAP > > pap: encryption_scheme = "crypt" > > Module: Instantiated pap (pap) > > Module: Loaded CHAP > > Module: Instantiated chap (chap) > > Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: passwd = "(null)" > > mschap: authtype = "MS-CHAP" > > Module: Instantiated mschap (mschap) > > Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > > Module: Instantiated unix (unix) > > Module: Loaded LDAP > > ldap: server = "192.168.100.18" > > ldap: port = 389 > > ldap: net_timeout = 1 > > ldap: timeout = 4 > > ldap: timelimit = 3 > > ldap: identity = "" > > ldap: start_tls = no > > ldap: password = "" > > ldap: basedn = "dc=dot1x.com" > > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > > ldap: default_profile = "(null)" > > ldap: profile_attribute = "(null)" > > ldap: password_header = "(null)" > > ldap: password_attribute = "userPassword" > > ldap: access_attr = "radiusgroupname" > > ldap: groupname_attribute = "cn" > > ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > ldap: groupmembership_attribute = "radiusGroupName" > > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > > ldap: ldap_debug = 0 > > ldap: ldap_connections_number = 5 > > ldap: compare_check_items = no > > ldap: access_attr_used_for_allow = yes > > conns: (nil) > > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link > > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network > > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone > > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > > rlm_ldap: LDAP userPassword mapped to RADIUS User-Password > > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type > > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id > > conns: 0x8101f58 > > Module: Instantiated ldap (ldap) > > Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > rlm_eap: Loaded and initialized the type md5 > > rlm_eap: Loaded and initialized the type leap > > Module: Instantiated eap (eap) > > Module: Loaded preprocess > > preprocess: huntgroups = "/etc/raddb/huntgroups" > > preprocess: hints = "/etc/raddb/hints" > > preprocess: with_ascend_hack = no > > preprocess: ascend_channels_per_line = 23 > > preprocess: with_ntdomain_hack = no > > preprocess: with_specialix_jetstream_hack = no > > preprocess: with_cisco_vsa_hack = no > > Module: Instantiated preprocess (preprocess) > > Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > Module: Instantiated realm (suffix) > > Module: Loaded files > > files: usersfile = "/etc/raddb/users" > > files: acctusersfile = "/etc/raddb/acct_users" > > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > > files: compat = "no" > > Module: Instantiated files (files) > > Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" > > Module: Instantiated acct_unique (acct_unique) > > Module: Loaded detail > > detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > > Module: Instantiated detail (detail) > > Module: Loaded radutmp > > radutmp: filename = "/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > > Module: Instantiated radutmp (radutmp) > > Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp. > > Ready to process requests. > > rad_recv: Access-Request packet from host 192.168.100.17:1812, id=11, length=129 > > NAS-IP-Address = 192.168.100.17 > > NAS-Port = 50001 > > NAS-Port-Type = Ethernet > > User-Name = "ramazan" > > Called-Station-Id = "00-0F-8F-77-DB-81" > > Calling-Station-Id = "00-12-79-AE-D2-4D" > > Service-Type = Framed-User > > Framed-MTU = 1500 > > EAP-Message = 0x0200000c0172616d617a616e > > Message-Authenticator = 0x68c41631d4feb2234d900b37a9845348 > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > rlm_eap: EAP packet type notification id 0 length 12 > > rlm_eap: EAP Start not found > > modcall[authorize]: module "eap" returns updated for request 0 > > rlm_realm: No '@' in User-Name = "ramazan", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > users: Matched DEFAULT at 152 > > rlm_ldap: Entering ldap_groupcmp() > > radius_xlat: 'dc=dot1x.com' > > radius_xlat: '(uid=ramazan)' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: attempting LDAP reconnection > > rlm_ldap: (re)connect to 192.168.100.18:389, authentication 0 > > rlm_ldap: bind as / to 192.168.100.18:389 > > rlm_ldap: waiting for bind result ... > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > ldap_release_conn: Release Id: 0 > > radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in dc=dot1x.com, with filter (&(cn=VPN)(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))) > > rlm_ldap: object not found or got ambiguous search result > > ldap_release_conn: Release Id: 0 > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in uid=ramazan,cn=users,cn=idc,dc=dot1x.com, with filter (objectclass=*) > > rlm_ldap::ldap_groupcmp: User found in group VPN > > ldap_release_conn: Release Id: 0 > > users: Matched DEFAULT at 171 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_ldap: - authorize > > rlm_ldap: performing user authorization for ramazan > > radius_xlat: '(uid=ramazan)' > > radius_xlat: 'dc=dot1x.com' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > rlm_ldap: checking if remote access for ramazan is allowed by radiusgroupname > > rlm_ldap: looking for check items in directory... > > rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 > > rlm_ldap: looking for reply items in directory... > > rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 > > rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 > > rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 > > rlm_ldap: Adding radiusClass as Class, value group-net & op=11 > > rlm_ldap: user ramazan authorized to use remote access > > ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns ok for request 0 > > modcall: group authorize returns updated for request 0 > > rad_check_password: Found Auth-Type ldap > > auth: type "LDAP" > > modcall: entering group Auth-Type for request 0 > > rlm_ldap: - authenticate > > rlm_ldap: Attribute "User-Password" is required for authentication. > > modcall[authenticate]: module "ldap" returns invalid for request 0 > > modcall: group Auth-Type returns invalid for request 0 > > auth: Failed to validate the user. > > Login incorrect: [ramazan/<no User-Password attribute>] (from client radius port 50001 cli 00-12-79-AE-D2-4D) > > Delaying request 0 for 1 seconds > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Sending Access-Reject of id 11 to 192.168.100.17:1812 > > Waking up in 4 seconds... >

1 0

strip unwanted characters from reply message
by Cory Robson 15 Feb '07

15 Feb '07

I have failed logins being dumped into a table in myslq and am getting a lot of unwanted characters. IE: Password Has Expired=5Cr=5Cn Is there a way I can tell it to only supply the textual content Thanks Cory

1 0

Multiple SSL CA Files
by Michael Courtney 14 Feb '07

14 Feb '07

Freeradius List, I have Freeradius 1.1.3 running on a Fedora Core 6 box, and it works great in the current setup. My question has to do with a configuration change that I'm having trouble implementing. Right now, I have an in-house CA Cert that was generated for our servers that sit behind a firewall. The Radius server connects to our LDAP box via a hole in the firewall over an SSL connection that was generated with our internal CA Cert. I would like to have two SSL certs on the Radius box: one, for the internal connections to our servers, and two, an SSL cert that one can verify as a trusted Root Authority for the TTLS connections. This is causing an issue right now on the server. I have the following LDAP fields in radiusd.conf: tls_cacertfile = /etc/lfncerts/cacert.pem tls_certfile = /etc/lfncerts/ldap2_public_cert.pem tls_keyfile = /etc/lfncerts/ldap2_private_key.pem I have the following fields in the eap.conf: private_key_file = /etc/lfnnewcerts/radius.lawrencefreenet.org.key certificate_file = /etc/lfnnewcerts/radius.lawrencefreenet.org.crt CA_file = /etc/lfnnewcerts/rapidssl_01.cer Here's the output in the logs: Feb 14 12:47:26 radius kernel: audit(1171478846.538:8): avc: denied { read } for pid=10837 comm="radiusd" name="radius.lawrencefreenet.org.crt" dev=dm-0 ino=1310741 scontext=root:system_r:radiusd_t:s0 tcontext=root:object_r:user_home_t:s0 tclass=file As you can see, the CA_files are different, since they are signed by different certificate authorities. I have tried this configuration and 777'ed each of the files to no avail. Is the configuration I'm trying to implement possible? Any help that you can offer would be greatly appreciated! Thanks for your time! -Mike

2 1

Freeradius dies if it cant resolve clients...
by "Jóhann B. Guðmundsson" 14 Feb '07

14 Feb '07

I had the unfortunate experience for my radius daemon to die when it couldn't resolve one client in clients.conf Is there any particular reason for radius not to spew out error message to the logs and declare the client "dead" or "unresolvable " and continue to function or is this just bad programming.... Best regards Johann B. -- Jóhann B. Guðmundsson. RHCE,CCSA Unix Kerfistjóri. Kerfistjórn. Reiknistofnun Háskóla Íslands. Tæknigarði, Dunhaga 5. Rafpóstur: johannbg(a)hi.is 107 Reykjavík. Sími: 525-4267 Ísland. Bréfasími: 552-8801 Johann B. Gudmundsson. RHCE,CCSA Unix System Engineer. IT Management. Reiknistofnun University of Iceland. Taeknigardi, Dunhaga 5. Email: johannbg(a)hi.is IS-107 Reykjavik. Phone: +354-525-4267 Iceland. Fax: +354-552-8801

4 5

pap/peap confusion
by Matt Ashfield 14 Feb '07

14 Feb '07

I'm pouring through the alphabet soup of all of this and have a few questions that keep popping up. During a pap conversation, the radius server ends up with the username/password passed to it from the client. It then encrypts the password to match the encryption of the stored password in ldap (or other directory) and tries a bind. Correct? During a PEAP conversation, the radius server also would end-up with a username/password received from the client (either via clear-text or via the mschap conversation). Why can it not then encrypt the password just like PAP did? Does it do the comparison to LDAP stored passwords via MSCHAP as well? Thanks for any info. Matt mda(a)unb.ca

4 3

Group reply parameter
by tzieleniewski 14 Feb '07

14 Feb '07

Hi!! I'd like to ask You If it is possible to set up radius in such way that whenever there will be an Access Request send from the NAS for a user which in a member of the particular group in database the reply will be attached with the reply parameter of thed value equal to the User-Name parameter. So generally there will be for instance the Cleartext-password attribute in the radchek table for that user and a reply parameter in the radgroupreply table, will it work? Is it possible to specify the parameter as it is done in the users file %{User-Name} will it be translated to the correct value? Thanks in advance Cheers -tomasz

1 0

FreeRadius + OpenLDAP + VLAN assignation
by Romain Mercier 14 Feb '07

14 Feb '07

Hi, I want to assign users to a certain VLAN depending on an attribute stocked in LDAP. At the time, I use files module to do that and it works in a first test but don't take care about the attribute. How can I use the attribute I create? In the ldap.attrmap file I add this line: checkItem Ldap-Group auaStatut In the users file I add these lines: DEFAULT Ldap-Group == "xxxx" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 1, Fall-Through = 0 Does anybody have an idea? Romain Mercier

2 2

counter and limiter in freeradius
by brad brock 14 Feb '07

14 Feb '07

Hi, I want to use counter module in free radius. Where can I find the reference to use it? What is the difference between counter and sqlcounter? Is there a kind of bandwidth limiter in freeradius? For example, I want to limit each client connection transfer rate about 300 Kbps. How can I do it? Thank you.

1 0

rlm_postgresql , accounting and Framed-IP-Address
by Francisco Gimeno 14 Feb '07

14 Feb '07

Hello I'm having some problems when accounting with postgreSQL. I'm using FreeRadius 1.1.3 with sqlippool and postgresql. Authentication is done via PAM to a LDAP server. Some authorization is done with LDAP (pool assignment, profiles...). I would like to use accounting and simultaneous use check with postgreSQL. It seems that everything is working well.. But for some reason I don't get the assigned IP in my accounting tables whenever the user is logged. I just get it whenever the user is disconnected. I would like to have that info in real-time for debugging purposes. This is my postgresql.sql related config: ---- sql_user_name = "%{Stripped-User-Name:-%{User-Name}}" accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, \ ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', \ NULLIF('%{reply:Framed-IP-Address}', '')::inet, '%{Acct-Delay-Time:-0}')" ---- The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at all... SQL module is executed after sqlippool, so, that variable should be available. The logs: --- rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' rlm_sql_postgresql: query: BEGIN rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = radius_xlat: 'UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = '10.15.208.103' AND pool_name = 'Pool-VODA-IPdina'' rlm_sql_postgresql: query: UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = ' 10.15.208.103' AND pool_name = 'Pool-VODA-IPdina' rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 2 radius_xlat: 'COMMIT' rlm_sql_postgresql: query: COMMIT rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sqlippool" returns ok for request 6 radius_xlat: 'vodafone.dinamica@junta' rlm_sql (sql): sql_set_user escaped user --> 'vodafone.dinamica@junta' radius_xlat: 'INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', 'vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', ' vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0') rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 1 rlm_sql (sql): Released sql socket id: 1 modcall[accounting]: module "sql" returns ok for request 6 --- The assigned IP is 10.247.254.3 (or 10.247.254.5)... The relevant part in radiusd.conf ---- accounting { sqlippool sql } ------------- By the way.. The username is not stripped, and @junta appears in the logs after the xlat call :/ what am I doing wrong? Thanks

2 3