May 2007 - Freeradius-Users - lists.freeradius.org

Rlm_python - need documentation
by UriCALL Support 28 May '07

28 May '07

Hi All, I am in need of developing my own application using rlm_python. Can anybody inform me about some documentation available? From what I have found on Internet it looks like an isolate project with lack of users ... Anybody able to share the experience with me? Is it stable for production? Thxs in advance, Dan

2 1

howto limit the acces of users
by vik 28 May '07

28 May '07

Hello, I would like to have for each user a time limit, for instance: user1 4 hours user2 2 hours/day user3 illimited etc... Thx in advance. ----- Original Message ---- From: "tnt(a)kalik.co.yu" <tnt(a)kalik.co.yu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 17, 2007 11:08:12 AM Subject: Re: freeradius + pap + md5 (or encrypt) problem Allow only PAP on clients. For Win XP: Go to Network Connections an open Properties for this connection. Select Security tab Click on Advanced radio button, and then on Settings button Leave only PAP ticked Click OK to set it That's what you can do from the clent side. If you have control over NAS, then set it to accept only PAP authentication. If you can do that, all clients will "listen" and use only PAP. In that case there is no need to configure anything on the client. Ivan Kalik Kalik Informatika ISP Dana 17/5/2007, "vik" <vik_viktor(a)yahoo.com> piše: >How do i tell my users not to send CHAP-Password ? > >Is pap allowed in the authorize section in 1.1.6 ? > >Thank you for the fastest answer i've ever expected ! > >----- Original Message ---- >From: Peter Nixon <listuser(a)peternixon.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Thursday, May 17, 2007 10:28:34 AM >Subject: Re: freeradius + pap + md5 (or encrypt) problem > >On Thu 17 May 2007, vik wrote: >> Hello, >> >> I have 1.1.3 server version. > >Please update to 1.1.6 > >> I would like to be able to store encrypted passwords on my computer, but i >> can't. I've read about everything dealing with this problem, but still i >> cannot manage to succeed. >> >> In my users file i have >> >> DEFAULT Auth-Type := PAP >> Fall-Through = Yes > >This bit is not necessary.. > >> gogo User-Password := "my_encrypted_password_using_md5" >> .... >> >> Here i've tried also with Crypt-Password, but it doesn't work either. > >You do need to use Crypt-Password... > >> Still i have in the debugs: >> Auth: rlm_pap: Attribute "Password" is required for authentication. Cannot >> use "CHAP-Password". >> >> Why is rlm_pap receiving an CHAP-Password argument, i don't understand, i >> have disabled all chap options in the radiusd.conf. > >Because your users are sending you CHAP passwords. If you don't support them, >tell your users to send use PAP instead.. > > >-- > >Peter Nixon >http://www.peternixon.net/ >PGP Key: http://www.peternixon.net/public.asc >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > >____________________________________________________________________________________Get the Yahoo! toolbar and be alerted to new email wherever you're surfing. >http://new.toolbar.yahoo.com/toolbar/features/mail/index.php >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545469

2 1

Wiki
by Doug Hardie 28 May '07

28 May '07

On Sun 20 May 2007, Doug Hardie wrote: > I am having problems finding the way to get from the main Wiki page > to the configuration information. The pages are there. When I > search for something they are found. I just can't figure out how you > are supposed to link to them from the main page. For example the > modules page does eventually link back to the main page, but I can't > figure out how to go from the main page to it. It's all a bit ad hoc at present. As it's a wiki, you are welcome to assist with indexing of the information :-) Who do I need to contact on this. The main page (at least) is locked to prevent updates.

5 11

Freeradius-Proxied-To, radrelay and 2.0
by Milan Holub 28 May '07

28 May '07

Hi Alan/others, I wonder whether there is any use for Freeradius-Proxied-To attribute with freeradius 2.0. In freeradius 1.X the attribute was used to stop proxy for relayed packets. Now when I'm relaying some accounting packets to my freeradius server using radrelay binary from 1.1.6 and there is a packet which has already "Freeradius-Proxied-To" attribute set then freeradius 2.0(cvs head) just ignores it and tries to proxy the packet to remote home server. Would it be possible that 2.0 also honors the Freeradius-Proxied-To attribute as in 1.X? I've also observed following related issue regarding the "default_fallback" option of "proxy server {}" in proxy.conf: * I've set default_fallback = yes * home server for realm A was not reachable ==> when sending the packet with realm A(with Freeradius-Proxied-To set to IP of home_server for realm A) to radius then: 1) radius was trying to proxy the packet to home_server(ignoring Freeradius-Proxied-To attribute) 2) radius did not fall back to LOCAL realm 3) radius did not send accounting response back to client(radrelay) - probably consequence of 2??? Final consequence is that radrelay re-sends the packet which was not acknowledged by accounting response and it keeps re-sending forever...(radrelay can't continue in processing detail file) What I'm trying to achieve actually is freeradius 2.0 + radrelay(using binary from 1.1.6) and above is the "show stopper":( Any advise? Here is related debug: ... home_server srv { ipaddr = <PROXY_IP> IP address [<PROXY_IP>] port = 1812 type = "auth+acct" secret = "Atekfuv9" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } server_pool failover { type = failover home_server = srv } server_pool failover { type = failover home_server = srv } realm A { pool = failover } ... Proxying request 0 to realm A, home server <PROXY_IP> port 1813 ... Going to the next request Thread 1 waiting to be assigned a request Waking up in 29 seconds... Received conflicting packet from client <RADRELAY_CLIENT_IP> port 33413 - ID: 0 due to unfinished request 0. Giving up on old request. ... Proxying request 1 to realm A, home server <PROXY_IP> port 1813 ... Proxying request 2 to realm A, home server <PROXY_IP> port 1813 Going to the next request Thread 3 waiting to be assigned a request Waking up in 23 seconds... Received conflicting packet from client <RADRELAY_CLIENT_IP> port 33413 - ID: 0 due to unfinished request 2. Giving up on old request. ... Rejecting request 0 due to lack of any response from home server <PROXY_IP> port 1813 WARNING: Unresponsive child (id 0) for request 0, in module <server-core> component <server-core> WARNING: Marking home server <PROXY_IP> port 1813 as zombie (it looks like it is dead). Thread 1 got semaphore Thread 1 waiting to be assigned a request Received conflicting packet from client <RADRELAY_CLIENT_IP> port 33413 - ID: 0 due to unfinished request 9. Giving up on old request. ... Rejecting request 1 due to lack of any response from home server <PROXY_IP> port 1813 WARNING: Unresponsive child (id 0) for request 1, in module <server-core> component <server-core> Thread 3 got semaphore Thread 3 waiting to be assigned a request Received conflicting packet from client <RADRELAY_CLIENT_IP> port 33413 - ID: 0 due to unfinished request 10. Giving up on old request. ... ERROR: Failed to find live home server for realm A ... Rejecting request 438 due to lack of any response from home server <PROXY_IP> port 1813 FAILURE: Marking home server <PROXY_IP> port 1813 as dead. WARNING: Unresponsive child (id 0) for request 438, in module <server-core> component <server-core> ... ERROR: Failed to find live home server for realm A Finished request 449 state 6 ... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 6

Re: log file for free radius 1.1.6 eap-tls authentication
by anoop_c＠sifycorp.com 28 May '07

28 May '07

Hi pls find the o/p of radius -X.Also the log file is not coming. [root@localhost sbin]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \"/usr/local/var/log/radius/radius.log\" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: user = \"(null)\" main: group = \"(null)\" main: usercollide = no main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = \"no\" main: nospace_pass = \"no\" main: checkrad = \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = \"(null)\" exec: input_pairs = \"request\" exec: output_pairs = \"(null)\" exec: packet_type = \"(null)\" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \"(null)\" tls: pem_file_type = yes tls: private_key_file = \"/etc/1x/07xwifi.pem\" tls: certificate_file = \"/etc/1x/07xwifi.pem\" tls: CA_file = \"/etc/1x/root.pem\" tls: private_key_password = \"password\" tls: dh_file = \"/etc/1x/DH\" tls: random_file = \"/etc/1x/random\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = \"suffix\" realm: delimiter = \"@\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = \"/etc/raddb/users\" files: acctusersfile = \"/etc/raddb/acct_users\" files: preproxy_usersfile = \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port\" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1026, id=0, length=213 Message-Authenticator = 0x348faa1d22631530332a81f21a480716 Service-Type = Framed-User User-Name = \"saravanakumar07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x02000014017361726176616e616b756d61723037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 rlm_realm: No \'@\' in User-Name = \"saravanakumar07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 20 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 modcall[authorize]: module \"files\" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1026 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc1a1b99ed892aaa874bb2dabd58a9da3 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=1, length=307 Message-Authenticator = 0x4ee10f4214227b83aa487603fc4261db Service-Type = Framed-User User-Name = \"saravanakumar07\" Framed-MTU = 1488 State = 0xc1a1b99ed892aaa874bb2dabd58a9da3 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020100600d800000005616030100510100004d0301465ac684a8794ef0e567e436456ba8869ab7189a3c1ae5716f3fdec38ae182a610193a5d3bf49222fa530aa6094dd80e76001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 rlm_realm: No \'@\' in User-Name = \"saravanakumar07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 modcall[authorize]: module \"files\" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04be], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1026 EAP-Message = 0x0102040a0dc000000563160301004a020000460301465ac5ef2d0abda5b36cc686ccef0d9e8a907e16548ba82817b475b8cef9fe3b20f0328a38d5b438cbb376872879f3f0f89c7343ee8688765c8fc2ad235adbbef500040016030104be0b0004ba0004b700022b3082022730820190a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d3037303131333037353834305a170d3038303131333037353834305a305f310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e06035504031307303778776966693122302006092a864886f70d01090116136a65796b756d61725f7340736966792e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c6f366d39a74d8b66b561628be123f18f9b0a71f09b98d21b990e9a987d9acf3ceabd01df377e13da987a23f244496dfc0609e99ee03a9f44e51033cbb84c814d9d3225aacc7c67786fcd193d57c3f5ac16d7d1b83570152edca9ba9ff99ca4feffcb244551292fad52026afda1f876205e84a26b81cebd89fa03fd97e5f7fdb0203010001a317301530130603551d25040c300a06082b06 EAP-Message = 0x010505070301300d06092a864886f70d010104050003818100a4cbb4e6e8190d840edc9e61637a38ffa423b2a67e8d308c3005b8ec18318e94ddddbac0ccb1a15780c285de01622608f4caded74bab6f0c9d44dfdeb648e46bdd4de3606e4c7f86e5f86472722db409baffdb78eb6c7ad267a623e1155af13de26e83f3ce29b4f82baf551b756d2f49e5691cc1d80f6fb253b11e7a15bf296000028630820282308201eba003020102020100300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d30 EAP-Message = 0x37303131333037353830305a170d3038303131333037353830305a303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003818d0030818902818100ec232cf24bd548a586d614994a3f3b9ee699eb64a3bf9a0c90d7bc8afb39842c767c3613757b8d38a78ceaa6a499be55dcf997abb9963b3ef406b39f766054d8e37d35859e6bd5ce686c01eb63a25684afb79cd6796193355bd3ae67eae642701a34d1bc93426ade87434dadfbc8a8b0cae8137d97d2a267973f2213ebeefcfd0203010001a38195 EAP-Message = 0x308192301d0603551d0e04160414095ab44cec0cb80f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x43e98998191c1122bfd72ba20764320b Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=2, length=217 Message-Authenticator = 0xe8a5d1b7a5f9a89d7e42afc6244ffff5 Service-Type = Framed-User User-Name = \"saravanakumar07\" Framed-MTU = 1488 State = 0x43e98998191c1122bfd72ba20764320b Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 rlm_realm: No \'@\' in User-Name = \"saravanakumar07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 modcall[authorize]: module \"files\" returns notfound for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1026 EAP-Message = 0x0103016d0d80000005638c150861ea8bc609ed3cfbc030630603551d23045c305a8014095ab44cec0cb80f8c150861ea8bc609ed3cfbc0a13fa43d303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810019a69104ce7b395ddbb7a05ae632f71c590ba34e71b9a57cbe952eabed153fdacb07eb1c8d6db397f1f47a687103025a91b0431e73beac6e788de0af02e7d49e35808652dc4b2db60ccbcef9245239c47c785fb5c78c79ed7dd22d60ab6c19727e EAP-Message = 0xaa68ec38e3fc5b6e7716741e1f56eba981970face974b560ba07450ecdf817160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8670b977c646e91adfd91786496c45ef Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=3, length=1117 Message-Authenticator = 0xa370f2b08e6e383872205a370026c41c Service-Type = Framed-User User-Name = \"saravanakumar07\" Framed-MTU = 1488 State = 0x8670b977c646e91adfd91786496c45ef Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020303840d800000037a160301034a0b00023a0002370002343082023030820199a0030201020202011f300d06092a864886f70d0101040500303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669301e170d3037303131393033343135305a170d3038303131393033343135305a3067310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453696679311830160603550403130f7361726176616e616b756d617230373122302006092a864886f70d01090116136a65796b756d61725f7340736966792e63 EAP-Message = 0x6f6d30819f300d06092a864886f70d010101050003818d0030818902818100b6413143a14d8666369a759ccad7ab221e73ec0cc73ad7346a6060b34e8571d1838d97cc4aa7a2f99a4be83b9bb5af5daeb3307909d5a44c9338a43b19b6c1f3ec6232eae8508103741d5eeb9b4e7f99b3c2b4b283fcef13cc1b34a087e240e2ab94fee8fce66687dd95690b23d20e84551cd24f385afb5cdb086f851f9900070203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003818100ca0e708d266de50c32dc92d523eed3b11d4e678e2d7bdfeffca92e91b3be256b1533f53180c670c7e224671bbc EAP-Message = 0x1b1245c125bd2f3c252da361542f7d43e5b18db9d6904d92d1300a9e333d7ac7d8a8ec00aa3bed5d0c9f07028b62f004e6bcfbdee18f80740820065ea68c48cca932d6e3388b9837c944c42ddc92eed2eb66851000008200800e8d0f8c2bbe84a6c2a1dec24b1301126c5014bc64bb60aa57053af71ce790709036034dfd85c2cde680388e410bf11cf623f0469c605f058313088a50be37ef633cf901ce8613c4968ef8d1f369bb38903fbda7c4a197b8357706c2abb0358c558e3f8d1306d11043d7762749e5133b7d7eb2cd2a226888a14bbc626cd3dcd80f0000820080448775660120cb094f6cf29dce77ccc080f202df2e3e5a5e0dcc6f8308e6 EAP-Message = 0xc08f0e79440eec49c7b7fcb820bcecc8a3d02b8bffe75f901b9a1627479ae616e86d8a49ad93fb313b939cb73f5219b9230786cb348bed214a33e0499b638c3a3fffaa5b668d8d5324a0955f33bdf76524eff59a087c6fc15afd44bd75aa417546ee14030100010116030100205855ce98017c7c5ca87c91534c2fd241039ccad9a19ff4465cd7c040e9d540b7 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 rlm_realm: No \'@\' in User-Name = \"saravanakumar07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 modcall[authorize]: module \"files\" returns notfound for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 023e], Certificate chain-depth=1, error=0 --> User-Name = saravanakumar07 --> BUF-Name = 07xwifi --> subject = /C=IN/ST=TN/O=Sify/CN=07xwifi --> issuer = /C=IN/ST=TN/O=Sify/CN=07xwifi --> verify return:1 chain-depth=0, error=0 --> User-Name = saravanakumar07 --> BUF-Name = saravanakumar07 --> subject = /C=IN/ST=TN/O=Sify/CN=saravanakumar07/emailAddress=jeykumar_s(a)sify.com --> issuer = /C=IN/ST=TN/O=Sify/CN=07xwifi --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], CertificateVerify TLS_accept: SSLv3 read certificate verify A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1026 EAP-Message = 0x010400350d800000002b14030100010116030100204162186f236f12a6774a934742937f8d6653973dbce3f01ee4c223e78617f9d4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5edb6911600c27ccf2a62bd801e114ab Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1026, id=4, length=217 Message-Authenticator = 0x885b78f58d62d0eec96b2535b1e9bfb1 Service-Type = Framed-User User-Name = \"saravanakumar07\" Framed-MTU = 1488 State = 0x5edb6911600c27ccf2a62bd801e114ab Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020400060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module \"preprocess\" returns ok for request 4 rlm_realm: No \'@\' in User-Name = \"saravanakumar07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 4 modcall[authorize]: module \"files\" returns notfound for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module \"eap\" returns ok for request 4 modcall: leaving group authenticate (returns ok) for request 4 Login OK: [saravanakumar07] (from client private-network-1 port 1 cli 00-0E-35-F3-A1-67) Sending Access-Accept of id 4 to 192.168.0.50 port 1026 MS-MPPE-Recv-Key = 0xb6e9159f33592da50de909d1f12d8cdfa9b866be2d2b12f90f7edefa4c7af054 MS-MPPE-Send-Key = 0xca94e3cdf69257d148b01ccb582dbb3e45b06dbc4450b07850fb47288111daf0 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = \"saravanakumar07\" Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 465ac5ef Cleaning up request 1 ID 1 with timestamp 465ac5ef Cleaning up request 2 ID 2 with timestamp 465ac5ef Cleaning up request 3 ID 3 with timestamp 465ac5ef Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 4 with timestamp 465ac5f0 Nothing to do. Sleeping until we see a request. [root@localhost sbin]# > Message: 5 > Date: Mon, 28 May 2007 12:08:21 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: log file for free radius 1.1.6 eap-tls authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <Bslo14cn.1180350501.8176480.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Post the radiusd -X output of user not in users file being accepted. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 28/5/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >Hi all > > I have two quieres > >1 > > I have changed the log_auth= yes > >Still i am not able to get logs.Pls find my configs > > prefix = /usr/local > >exec_prefix = ${prefix} > >sysconfdir = /etc > >localstatedir = ${prefix}/var > >sbindir = ${exec_prefix}/sbin > >logdir = /usr/local/var/log/radius > >raddbdir = ${sysconfdir}/raddb > >radacctdir = ${logdir}/radacct > > > ># Location of config and logfiles. > >confdir = ${raddbdir} > >run_dir = ${localstatedir}/run/radiusd > > > ># > ># The logging messages for the server are appended to the > ># tail of this file. > ># > >log_file = /usr/local/var/log/radius/radius.log > > > > > > > > > >log_stripped_names = no > > > ># Log authentication requests to the log file. > ># > ># allowed values: {no, yes} > ># > >log_auth = yes > > > ># Log passwords with the authentication requests. > ># log_auth_badpass - logs password if it\'s rejected > ># log_auth_goodpass - logs password if it\'s correct > > > > > >2 While i am using Navis radius, ther will be one user file where you > have to add all usernames.In free radius without adding the username > also the authentication is working.I would like to have users file so > that only the users specified in that will authenticate. Wat config > change i should make for the same

2 1

problem connecting from windows xp to pptp server
by Danny Milshtein 28 May '07

28 May '07

Hi, I'm trying to connect to pptp server (with freeradius + mysql) with no success. when trying with radtest or NTradping from remote server it's work fine (the server return me Access-Acept) here is my radiusd dump : rad_recv: Access-Request packet from host 127.0.0.1:32787, id=39, length=69 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "danielmi" Calling-Station-Id = "192.168.8.244" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "danielmi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'danielmi' rlm_sql (sql): sql_set_user escaped user --> 'danielmi' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'danielmi' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'danielmi' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'danielmi' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'danielmi' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Any idea why I keep getting failed message. thanks Danny :-) No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.0/819 - Release Date: 5/26/2007 10:47 AM No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.0/819 - Release Date: 5/26/2007 10:47 AM

3 5

Newbie-quiz: Can't get authentication to work.
by Giobbi Piero 28 May '07

28 May '07

Hello all. Just started out with Freeradius and got it installed and working (Debian Etch, FR 1.1.4). Im hooked up our firewall to authenticate to FR-server and the "link" works, so i guess the basics are ok. Now i have added a user in the system and in the Users-file: test-system Auth-Type := System, User-Password == "test-system" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.0.5.7, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Fall-Through = yes, Framed-Compression = Van-Jacobsen-TCP-IP When i connect to my FR-server i get this: rad_recv: Access-Request packet from host 10.0.5.1:56509, id=132, length=182 NAS-Identifier = "halon" NAS-IP-Address = 10.0.5.1 Message-Authenticator = 0x3f0dd3b6a7a3fd31e874e22721f5073d NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "10.0.8.184" User-Name = "test-system" MS-CHAP-Challenge = 0xbb1e68a886add6f65e6e9af66c709bfd MS-CHAP2-Response = 0x01000a3194599cecfe61460a4942c9671fe70000000000000000a5f8bab30f7bdf4664 07edd2d7be2e97969a1a918def8d2c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "test-system", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test-system at line 101 users: Matched entry DEFAULT at line 185 users: Matched entry DEFAULT at line 204 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "unix" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [test-system/<no User-Password attribute>] (from client halon port 0 cli 10.0.8.184) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 132 to 10.0.5.1 port 56509 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 132 with timestamp 465ab8d7 So, my firewall talks MS_CHAP, i haven't touched the radiusd.conf and its in there under authenticate {.. Now im stuck, i really don't know where else to look for, tried google but everything pointed to this wonderful list! I tried to change auth-type = Local but same problem. Maybe the problem lies here: rlm_realm: No '@' in User-Name = "test-system", looking up realm NULL rlm_realm: No such realm "NULL" But i can't tell. Any thoughts, solutions, pointers to right directions are greatly appreciated! Many thanks. p

2 1

Re: log file for free radius 1.1.6 eap-tls authentication
by anoop_c＠sifycorp.com 28 May '07

28 May '07

Hi all I have two quieres 1 I have changed the log_auth= yes Still i am not able to get logs.Pls find my configs prefix = /usr/local exec_prefix = ${prefix} sysconfdir = /etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = /usr/local/var/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = /usr/local/var/log/radius/radius.log log_stripped_names = no # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it\'s rejected # log_auth_goodpass - logs password if it\'s correct 2 While i am using Navis radius, ther will be one user file where you have to add all usernames.In free radius without adding the username also the authentication is working.I would like to have users file so that only the users specified in that will authenticate. Wat config change i should make for the same

2 1

Free Radius
by Bob Irwin 28 May '07

28 May '07

Hi, I'm a serious Newb with Radius, and I have a question regarding support for "Pool Hint". This is supported under "Radiator" (a radius server we use elsewhere on our network), and we need to replicate it in FreeRADIUS for a much smaller application. I'm wondering if FreeRADIUS supports it at all. We are running FreeRADIUS version 1.0.1 on Redhat. Google doesn't show me much at all, so I'm thinking if "Pool Hint" is supported, it might be under a different name. Any help/advice is appreciated. Thanks, Bob

2 1

Proxy home server failover
by Tomas Hoger 27 May '07

27 May '07

Hi! I have a question regarding proxy failover in FreeRadius 1.x. Proxy code chooses first active home server for realm and send packet to that one. If no reply is received after configured number of retries, request is rejected, other servers are *not* tried. Does version 2.0 have the same behavior? According to comments in sample proxy.conf it seems new version will also try only one server and reject request if no reply is received. I have made a quick modification of request_list.c, so that request_reject is not called when try_count drops to 0. After that, when NAS retries, different home server is selected. Can not calling request_reject have any negative impact (memory leak, internal structures inconsistency, ...)? Wouldn't it make sense to make configuration parameter, which will instruct radiusd whether it should reject or silently drop request, for which it has not received reply from home server? For realms with single home server, it won't make much difference, as request will be rejected on next NAS retry (all home servers are marked dead), but for realms with multiple home servers, reject will not be sent just because one of the home servers is not responding. Ideas? th.

2 2