June 2007 - Freeradius-Users - lists.freeradius.org

Post
by Randy Evans 12 Jun '07

12 Jun '07

randy(a)vsswireless.net I want to be able to post to the freeradius users list

1 0

Fwd: Help for Jradius and Frreradius
by lisa laam 12 Jun '07

12 Jun '07

---------- Forwarded message ---------- From: lisa laam <laam.lisa(a)gmail.com> Date: 11 juin 2007 12:53 Subject: Help for Jradius and Frreradius To: freeradius-users(a)lists.freeradius.org Hi all, t rried to install jradius patch for freeradius. I can't use the root account so i installed radius in another directory. (note I'm newbie to Freeradius) 1- first i used freeradius-1.1.3.tar.gz with freeradius-1.1.2.patch. i got no error but the installation dosn't succeed. all the directory are empty bin, sbin, etc, .. 2-secondly i used freeradius-1.1.6.tar.gz with freeradius-1.1.5.patch and here are the errors i got here the commands i used for installation : tar xzf freeradius-1.1.6.tar.gz cd freeradius-1.1.6 #I install the the freeradius-1.1.5.patch wget http://jradius.cvs.sourceforge.net/*che ... .1.5.patch<http://jradius.cvs.sourceforge.net/*checkout*/jradius/jradius/freeradius/pa…> patch -p1 < freeradius-1.1.5.patch # whene i patch the files i got this failed : patching file raddb/jradius.conf patching file raddb/Makefile Hunk #1 FAILED at 7. 1 out of 1 hunk FAILED -- saving rejects to file raddb/Makefile.rej patching file raddb/radiusd.conf.in patching file raddb/radiusd.conf.in.rej patching file share/dictionary patching file share/dictionary.chillispot patching file share/dictionary.jradius patching file share/dictionary.lancom patching file share/dictionary.ser patching file src/modules/rlm_jradius/configure patching file src/modules/rlm_jradius/jradius.conf patching file src/modules/rlm_jradius/Makefile patching file src/modules/rlm_jradius/rlm_jradius.c patching file src/modules/stable # I follow the installation instructions ./configure --prefix=/software/freeradius make # whene i execute make I got this errors *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/ouahiba/download/freeradius- 1.1.6/src/lib/.libs -Wl,--rpath -Wl,/software/freeradius/lib /home/ouahiba/download/freeradius-1.1.6/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl- 1.1.6.so -o .libs/rlm_perl- 1.1.6.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6 /src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6 /src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6 /src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/ouahiba/download/freeradius-1.1.6/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6' make: *** [all] Error 2 # when i execute make install i got sudo make install make[6]: *** [install] Error 1 make[6]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6 /src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6 /src/modules' make[4]: *** [install] Error 2 make[4]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6 /src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/ouahiba/download/freeradius- 1.1.6' make: *** [install] Error 2 Please, can somebody tell witch version of freeradius to use with with patch and jradius version. and help me to find out the solution. thanks in advance Lisa.

6 8

Pre built packages
by Liam Farr 12 Jun '07

12 Jun '07

Hi, I'm about to setup FreeRADIUS and use it in conjunction with MikroTik's RouterOS, I was wondering if anyone makes an "off the shelf" package that looks after accounting and administration for FreeRADIUS? Particularly one that allows me to limit user traffic (upload & download)? Cheers Liam

1 0

V2 pre2 Switch blocks ?
by Arran Cudbard-Bell 12 Jun '07

12 Jun '07

Hi Alan, Just wondering whether you had put these in and i'd missed it :) If not, no hastle, they just make the config file look slightly neater.. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 5

error while executing the command radiusd -X
by Mahalakshmi Vijayakumar 12 Jun '07

12 Jun '07

Hi, i downloaded freeradius-1.0.2 and installed it.... when i give the cmd radiusd -X, i get the foll, can anyone tell me where things are going wrong...... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1788] Failed to parse authorize section. WS1A170L:/home/ushustech/rad-downloads/freeradius-1.0.2 # cd ../freeradius-1.1.6/ WS1A170L:/home/ushustech/rad-downloads/freeradius-1.1.6 # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1788] Failed to parse authorize section. thanks.................

3 2

1.1.4 slow to respond
by Andrew Long 12 Jun '07

12 Jun '07

I am getting slow response time from the server for authentication requests (chap/mschap) that eventually fail (users submitting wrong password). The problem is that the NAS is sending about 3 requests before getting a response. By the time the deny arrives, it is out of order and the NAS logs an unexpected packet (though it correctly denies the user). I am wondering if disabling all authentication/authorization methods except chap/mschap would solve this by speeding the response time. The server is not the speediest machine... 1 GHZ processor/1GB ram, but is dedicated for freeradius except for serving some static web pages. I have never seen system usage stats above nominal levels. Regards, Andrew

3 2

Behaviour of freeradius when receiving a response from a proxy server
by Nicolas Castel 12 Jun '07

12 Jun '07

Hi all, I wonder about the freeradius server behaviour after receiving a response from a proxy. Is it normal that the request passes through the post-auth section once the request has been received ? Below, the behaviour i observed Note: this is only a test in order to undersand the freeradius server behaviour in that case. rad_recv: Access-Request packet from host 127.0.0.1:16395, id=235, length=109 User-Name = "D00000" User-Password = "password" NAS-IP-Address = 172.26.233.2 NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "Testing:FR,localhost" NAS-Identifier = "FRAF1" Event-Timestamp = "Jun 12 2007 09:26:34 GMT" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall: entering group request_processing for request 0 radius_xlat: 'test.fr' rlm_attr_rewrite: Added attribute Proxy-To-Realm with value 'test.fr' modcall[authorize]: module "add_proxy_to_realm" returns ok for request 0 modcall: leaving group request_processing (returns ok) for request 0 modcall: leaving group authorize (returns ok) for request 0 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 0 modcall: entering group request_processing for request 0 radius_xlat: '/var/log/freeradius/radacct//RADIUS-Trace-20070612' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/RADIUS-Trace-%Y%m%d expands to /var/log/freeradius/radacct//RADIUS-Trace-20070612 modcall[pre-proxy]: module "radius_trace" returns ok for request 0 modcall: leaving group request_processing (returns ok) for request 0 modcall: leaving group pre-proxy (returns ok) for request 0 Sending Access-Request of id 0 to 172.26.233.2 port 1812 User-Name = "D000001" User-Password = "password" NAS-IP-Address = 172.26.233.2 NAS-Port-Type = Wireless-802.11 WISPr-Location-Name = "Testing:FR,localhost" NAS-Identifier = "FRAF1" Event-Timestamp = "Jun 12 2007 09:26:34 GMT" Proxy-State = 0x323335 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 172.26.233.2:1812, id=0, length=67 Reply-Message = "User authenticated on remote platform." Proxy-State = 0x323335 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 radius_xlat: '/var/log/freeradius/radacct//RADIUS-Trace-20070612' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/RADIUS-Trace-%Y%m%d expands to /var/log/freeradius/radacct//RADIUS-Trace-20070612 modcall[post-proxy]: module "radius_trace" returns ok for request 0 modcall: leaving group post-proxy (returns ok) for request 0 authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'User authenticated on remote platform.' Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 modcall: entering group request_processing for request 0 modcall[post-auth]: module "local_voucher_account_info" returns ok for request 0 radius_xlat: '/var/log/freeradius/radacct//RADIUS-Trace-20070612' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/RADIUS-Trace-%Y%m%d expands to /var/log/freeradius/radacct//RADIUS-Trace-20070612 modcall[post-auth]: module "radius_trace" returns ok for request 0 modcall: leaving group request_processing (returns ok) for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 91 to 127.0.0.1 port 16395 Reply-Message = "User authenticated on remote platform." Finished request 0 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 91 with timestamp 466e71d8 Nothing to do. Sleeping until we see a request. The example above shows that the request passes through authorize, pre-proxy, post-proxy and then though post-auth. Is there any way that the request does not pass through the post-auth section ? Thanks in advance.

3 2

freeRADIUS with PEAP doesn't authenticate WinXp supplicant
by Apangshu Saha 12 Jun '07

12 Jun '07

Dear All, I am using winxp as supplicant and configured every possible configuration files of freeRADIUS to support PEAP. But still the log file in server shows like following: and the client doesnot authenticated. whatshould i do in Winxp supplicant....at the time of connection it shows to enter Username/Password/Logon Domain......what is that Logon Domain? What should i enter here?what configuration setting i should make in xpsupplicant? plz see the following log file and help me what should i do? / /************log file**************************8 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=214 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xd316349afcfe1dc084768fa39e502497 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d0301466ef55151e34499d4e0e15c72bb20474e547f6ca8156439c527ad5ac76c0a0700001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf71f7a4777cdd86d08877ab3de3ec762 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05f6], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0102040a19c000000653160301004a020000460301466e470fa9c7109a172aed739dfa7cc7f5a64a8e4281076ebcc58c4a7676bee920a8c128e283cab0f2a26570674f1984771c0818971f23474e5db5a2bf5c77392100040016030105f60b0005f20005ef00028930820285308201eea003020102020102300d06092a864886f70d0101050500307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e4953473111300f060355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b74 EAP-Message = 0x6140636461632e696e301e170d3037303532393035303635315a170d3038303532383035303635315a307b310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450554e45310d300b060355040a130443444143310d300b060355040b13044e495347310f300d060355040313065052414a414b311f301d06092a864886f70d01090116105072616a616b746140636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100c4682bbf78964108c4b94d5976695394751375febb82827ad98069865b6e8e8d5d151e4c22cb8b1b96d300972bc5b2905316b1b485d54c060eb3 EAP-Message = 0x19fe4f7248c37e493aa7a0459f6e8f6c50400f4e22e3bdd804ed998e9f9bfeab26e7d2c2ae2f99c7453670daf7cea13f891febc690c9be4ada506eba501d31fa49daf7fa8b130203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100159024193168e51423e2d73826a6e2bb07937a3de03bd4fe61eef65a0c00b6e0da6d08e51ae89f8bc12b312e29306466e53caae1f4ef4cb1cb0174c250621b520a265296de3c53df587a3a3c3f922b6949a95fbda7d149503d53361270cbb4043fcdb99a44011b1042efe168c70fd493123fb3a6f997671ef304f287cbc842ab000360308203 EAP-Message = 0x5c308202c5a0030201020209009271838f2a65231f300d06092a864886f70d0101050500307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e4953473111300f060355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b746140636461632e696e301e170d3037303532393035303530385a170d3039303532383035303530385a307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a13044344 EAP-Message = 0x4143310d300b060355040b13044e4953473111300f06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x66261f68c0a988471b7dbd1406aa25a9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=140 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0x66261f68c0a988471b7dbd1406aa25a9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0x715b22052c0a834c8ab26540be3c7ee1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 2 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0103025919000355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b746140636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100b4695f7f4ac6d738e8f1ba01d9ba31b7a55ec069aa18e5323fafd646b55a2c5fcf8777d20a34ebe6e6b3c7210f75cd3c0b9a1298565c6f4408fcb71fd95906402256723fe9c98d4d5ce6d6d47e2e705f2acf120d40ec9df1f05f376e9e61702409c1ab1df14225f2592720037abb529527f0140f266dda722bc85ee638e0927d0203010001a381e33081e0301d0603551d0e041604146e8a698195a518d1efe841869bc3b87746e660e430 EAP-Message = 0x81b00603551d230481a83081a580146e8a698195a518d1efe841869bc3b87746e660e4a18181a47f307d310b300906035504061302494e310d300b060355040813044d414841310d300b0603550407130450756e65310d300b060355040a130443444143310d300b060355040b13044e4953473111300f060355040313087072616a616b7461311f301d06092a864886f70d01090116107072616a616b746140636461632e696e8209009271838f2a65231f300c0603551d13040530030101ff300d06092a864886f70d010105050003818100876aaf9ca0aebb3f6331d22edc4d8a8fb3828e6db868fc65f40f2ab80dfba2a06bdedb167a348a1bdc59 EAP-Message = 0xb14cb59fb92bce6dac1822379ecb469faba3a4dd0efd449f7dd3ae13dd0cce3ed2a59f2c83f88a75585a94e269b51ce27008bc2dbd4e3493e7657b09f1f07eaed60ab55c9ef636d587e3aa7c530c0b3ef8c01b875a4316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xeeffea22eecd70571b93074167e1f9d9 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=326 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xeeffea22eecd70571b93074167e1f9d9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300c01980000000b6160301008610000082008057a095505e914a7b5abe8025749ed79d441c0253ffc67fca83b899e2f086449bb015e9389edc1e440c81e28aa97382183f45cc7ce253fb95218c43cafde60441baa54bb5fb50a7b44e9ae8ab6b4c83028e015e96fe32f4f66aa315cf6d61bb1f73767316d4a238ea9a5601ab94c31fc149d571858362ca64d87222891897bcbe1403010001011603010020e6f71473f403b2d477ad3db5019876b535c1f3d63622c01e65ce12f09f82f056 Message-Authenticator = 0x1adf37f766e60a62b2a64ea969e12a2e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 3 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0104003119001403010001011603010020ac7b7eae7df6a094a06aac986552e097a71e014578dcdac2d0aa555ac0e82762 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe09ac59efcfd79cdce50681ada73421e Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=140 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xe09ac59efcfd79cdce50681ada73421e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xc678535af140a79e91368303e815f863 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0105002019001703010015ebc8d24acae130428ed6d6893d7ce9eabb27a803bb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcffd82ce7722fb003680179d65ba88e3 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=170 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xcffd82ce7722fb003680179d65ba88e3 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0205002419001703010019c215488e5af95d08053d8add389cf76bec07c3b8a752467f63 Message-Authenticator = 0xf659306a361f36453617aadc3172c0c5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testuser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testuser Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: No such EAP type mschapv2 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x010600261900170301001b070ae9621b3a0172525b8ec994d48f8ba1eaa1993e5bad037fbc82 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xced664250055f6ce7932cae33490350b Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=172 User-Name = "testuser" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0xced664250055f6ce7932cae33490350b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001bbdd92f192251db8ca1d0badadf2540be9d4e58ac52a5b914f2a17d Message-Authenticator = 0xb04c98dd979b625880b0b41a63bd758d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 users: Matched entry testuser at line 215 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 6 ID 0 with timestamp 466e4711 Nothing to do. Sleeping until we see a request. /*************end of log file*******/ with thanks... apangshu

3 2

Multiple shared secrets?
by Mark J Elkins 12 Jun '07

12 Jun '07

Can one have multiple shared secrets for the same client(NAS) ? ie - in clients.conf - something like... client 192.168.10.20{ secret = secret1 secret = secret2 shortname = mynas nastype = other } ... so that if the first secret does not work - the second secret is tried? (or how else could I solve the problem) I'm merging two Radius Servers - and authenticating packets from my Incumberant Telcom Provider - who is using proxies (a handful) from (hundreds of) multiple NAS's... from different services (Dialup - is one system, aDSL is another system). I currently have two different shared secrets - and these seem to be bleeding together... I'm looking for a stop-gap until I can get the right people to do the right thing. -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

3 2

Server dies
by Hugh Messenger 12 Jun '07

12 Jun '07

Having been running freeradius in debug mode (with no problems at all) for a month or so while testing and provisioning, it's time to put it in production. Unfortunately, when I run it as a service, it dies after a few hours. No clues, no errors, no nothing . it just silently dies off. Load is not a factor - we're migrating our wireless networks to PPPOE, and right now just have a handful of test users. So freeradius isn't handling more than a handful of requests per hour. I'm running RHEL4, fully up2date. Freeradius 1.1.6, using sqlippool and sql accounting. MySql 5.1 is on another machine. If it makes any difference, the init.d integration seems to be working fine, it correctly starts on boot, and I can control it with 'service'. Are there any logs or stats I could post to help give a clue? I'm basically looking at a blank wall, I have no idea how to even start trying to track this one down. As usual, TIA for any suggestions. -- hugh

2 1