July 2007 - Freeradius-Users - lists.freeradius.org

Re : EAP-TLS authentication
by anoop_c＠sifycorp.com 16 Jul '07

16 Jul '07

hi [root@localhost sbin]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" SO my log directory is /usr/local/var/log/radius But in that file i am not getting any logs.Do i need to configure anything other than this. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <50340.98343.qm(a)web26004.mail.ukl.yahoo.com> Content-Type: text/plain; charset=\"iso-8859-1\" There is log file. Check your configure log to find out the path you specified for the log. You can also run in debug mode. radiusd - Regards Anoop Quoting freeradius-users-request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body \'help\' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than \"Re: Contents of Freeradius-Users digest...\" > > > Today\'s Topics: > > 1. FreeRadius and User-Password from Cisco Device > (nicolaskarp(a)free.fr) > 2. How to configure EAP Identity in 1.1.3 (Govardhana K N) > 3. Re: FreeRadius and User-Password from Cisco Device (Stefan > Winter) > 4. Re : EAP-TLS authentication (Eshun Benjamin) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 16 Jul 2007 12:16:22 +0200 > From: nicolaskarp(a)free.fr > Subject: FreeRadius and User-Password from Cisco Device > To: freeradius-users(a)lists.freeradius.org > Message-ID: <1184580982.469b457602cb2(a)imp.free.fr> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello, > > Here a access-request packet from a Cisco Router (2621) : > NAS-IP-Address = \"IP_NAS\" > NAS-Port = 66 > NAS-Port-Type = Virtual > User-Name = \"MyUserLogin\" > Calling-Station-Id = \"IP NAS\" > User-Password = \"ryMyPass/WordHashNotPlainText`\" > > Why is my password not in plain text ? With other cisco devices (Switch > 2960 for > example), the User-Password is in plain text.. If I receive a hashed > password, > the authentication doesn\'t work.. > > > My AAA configuration : > aaa new-model > aaa authentication login default group radius line > aaa authentication login console line > aaa authorization exec default group radius none > aaa authorization network default group radius > aaa accounting exec default start-stop group radius > aaa accounting connection default start-stop group radius > > What can I do ? > > Thanks for your help ! > > Nicos. > > > > > > > > > ------------------------------ > > Message: 2 > Date: Mon, 16 Jul 2007 15:54:09 +0530 > From: \"Govardhana K N\" <govardhan.nagarajaiah(a)gmail.com> > Subject: How to configure EAP Identity in 1.1.3 > To: FreeRadius <freeradius-users(a)lists.freeradius.org> > Message-ID: > <5f382300707160324s57339da5nc72c934408d4c971(a)mail.gmail.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > Hi, > > I was trying to configure FreeRadius server with EAP authentication. AS > mentioned in \"eap.conf\", I didn\'t change the Auth-Type, but I was > sending a > EAP message, and Message-Authenticator attributes in Access-Request. > When i > tried sending an Access-Request with EAP-Message, I got the following > error > \"rlm_eap: Identity Unknown, authentication failed\". > > How to configure the Identity for EAP? > > debug log from server: > --------------------------------- > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/freeradius/proxy.conf > Config: including file: /etc/freeradius/clients.conf > Config: including file: /etc/freeradius/snmp.conf > Config: including file: /etc/freeradius/eap.conf > Config: including file: /etc/freeradius/sql.conf > main: prefix = \"/usr\" > main: localstatedir = \"/var\" > main: logdir = \"/var/log/freeradius\" > main: libdir = \"/usr/lib/freeradius\" > main: radacctdir = \"/var/log/freeradius/radacct\" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 1812 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = \"/var/log/freeradius/radius.log\" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = \"/var/run/freeradius/freeradius.pid\" > main: bind_address = 127.0.0.1 IP address [127.0.0.1] > main: user = \"freerad\" > main: group = \"freerad\" > main: usercollide = no > main: lower_user = \"no\" > main: lower_pass = \"no\" > main: nospace_user = \"no\" > main: nospace_pass = \"no\" > main: checkrad = \"/usr/sbin/checkrad\" > main: proxy_requests = no > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/lib/freeradius > Module: Loaded exec > exec: wait = no > exec: program = \"(null)\" > exec: input_pairs = \"request\" > exec: output_pairs = \"(null)\" > exec: packet_type = \"(null)\" > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = \"crypt\" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = \"(null)\" > mschap: ntlm_auth = \"(null)\" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = \"/etc/passwd\" > unix: shadow = \"/etc/shadow\" > unix: group = \"/etc/group\" > unix: radwtmp = \"/var/log/freeradius/radwtmp\" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = \"md5\" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = \"Password: \" > gtc: auth_type = \"PAP\" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = \"/etc/freeradius/huntgroups\" > preprocess: hints = \"/etc/freeradius/hints\" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = \"suffix\" > realm: delimiter = \"@\" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = \"/etc/freeradius/users\" > files: acctusersfile = \"/etc/freeradius/acct_users\" > files: preproxy_usersfile = \"/etc/freeradius/preproxy_users\" > files: compat = \"no\" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port\" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > \"/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = \"/var/log/freeradius/radutmp\" > radutmp: username = \"%{User-Name}\" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication 127.0.0.1:1812 > Listening on accounting 127.0.0.1:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32813, id=179, > length=95 > User-Name = \"jrc\" > NAS-Identifier = \"jrcnas\" > NAS-Port-Type = Ethernet > CUI = \"0\" > Service-Type = Framed-User > Framed-MTU = 1400 > Calling-Station-Id = \"1:1:1:1:1:1\" > EAP-Message = 0x01100008016a7263 > Message-Authenticator = 0x64c5851b699cd2c027877bbb94fe7f8b > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module \"preprocess\" returns ok for request 0 > modcall[authorize]: module \"chap\" returns noop for request 0 > modcall[authorize]: module \"mschap\" returns noop for request 0 > rlm_realm: No \'@\' in User-Name = \"jrc\", looking up realm NULL > rlm_realm: No such realm \"NULL\" > modcall[authorize]: module \"suffix\" returns noop for request 0 > rlm_eap: EAP packet type request id 16 length 8 > rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation > modcall[authorize]: module \"eap\" returns updated for request 0 > users: Matched entry DEFAULT at line 152 > users: Matched entry jrc at line 178 > modcall[authorize]: module \"files\" returns ok for request 0 > modcall: leaving group authorize (returns updated) for request 0 > rad_check_password: Found Auth-Type EAP > auth: type \"EAP\" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: Identity Unknown, authentication failed > rlm_eap: Failed in handler > modcall[authenticate]: module \"eap\" returns invalid for request 0 > modcall: leaving group authenticate (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 179 to 127.0.0.1 port 32813 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 179 with timestamp 469b9233 > Nothing to do. Sleeping until we see a request. > > > debug log from Client: > ------------------------------------- > > cheux301:/home/govardhana# radeapclient -x localhost auth jrcsecret > <access-request > > +++> About to send encoded packet: > User-Name = \"jrc\" > NAS-Identifier = \"jrcnas\" > NAS-Port-Type = Ethernet > CUI = \"0\" > Service-Type = Framed-User > Framed-MTU = 1400 > Calling-Station-Id = \"1:1:1:1:1:1\" > EAP-Message = 0x01100008016a7263 > Message-Authenticator = 0x00 > Sending Access-Request of id 179 to 127.0.0.1 port 1812 > User-Name = \"jrc\" > NAS-Identifier = \"jrcnas\" > NAS-Port-Type = Ethernet > CUI = \"0\" > Service-Type = Framed-User > Framed-MTU = 1400 > Calling-Station-Id = \"1:1:1:1:1:1\" > EAP-Message = 0x01100008016a7263 > Message-Authenticator = 0x00000000000000000000000000000000 > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=179, > length=20 > rlm_eap: EAP-Message not found > <+++ EAP decoded packet: > > > Thanks & Regards, > Govardhana K N > > > > > -- > With Regards, > Govardhana K N >

2 1

Password = xpkg ?
by E. abdelghani 16 Jul '07

16 Jul '07

2 1

How to configure EAP Identity in 1.1.3
by Govardhana K N 16 Jul '07

16 Jul '07

Hi, I was trying to configure FreeRadius server with EAP authentication. AS mentioned in "eap.conf", I didn't change the Auth-Type, but I was sending a EAP message, and Message-Authenticator attributes in Access-Request. When i tried sending an Access-Request with EAP-Message, I got the following error "rlm_eap: Identity Unknown, authentication failed". How to configure the Identity for EAP? debug log from server: --------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = no exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32813, id=179, length=95 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x64c5851b699cd2c027877bbb94fe7f8b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jrc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type request id 16 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry jrc at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 179 to 127.0.0.1 port 32813 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 179 with timestamp 469b9233 Nothing to do. Sleeping until we see a request. debug log from Client: ------------------------------------- cheux301:/home/govardhana# radeapclient -x localhost auth jrcsecret <access-request +++> About to send encoded packet: User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00 Sending Access-Request of id 179 to 127.0.0.1 port 1812 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=179, length=20 rlm_eap: EAP-Message not found <+++ EAP decoded packet: Thanks & Regards, Govardhana K N -- With Regards, Govardhana K N

2 1

Re : How to configure EAP Identity in 1.1.3
by Eshun Benjamin 16 Jul '07

16 Jul '07

You have misconfigured the Nas-Identifier > govardhana Nas-Identifier == nas, Nas-Port-Type == 15 You have NAS-Identifier = "jrcnas" ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Govardhana K N <govardhan.nagarajaiah(a)gmail.com> À : FreeRadius <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 16 Juillet 2007, 12h24mn 09s Objet : How to configure EAP Identity in 1.1.3 Hi, I was trying to configure FreeRadius server with EAP authentication. AS mentioned in "eap.conf", I didn't change the Auth-Type, but I was sending a EAP message, and Message-Authenticator attributes in Access-Request. When i tried sending an Access-Request with EAP-Message, I got the following error "rlm_eap: Identity Unknown, authentication failed". How to configure the Identity for EAP? debug log from server: --------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = no exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32813, id=179, length=95 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x64c5851b699cd2c027877bbb94fe7f8b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jrc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type request id 16 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry jrc at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 179 to 127.0.0.1 port 32813 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 179 with timestamp 469b9233 Nothing to do. Sleeping until we see a request. debug log from Client: ------------------------------------- cheux301:/home/govardhana# radeapclient -x localhost auth jrcsecret <access-request +++> About to send encoded packet: User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00 Sending Access-Request of id 179 to 127.0.0.1 port 1812 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=179, length=20 rlm_eap: EAP-Message not found <+++ EAP decoded packet: Thanks & Regards, Govardhana K N -- With Regards, Govardhana K N - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

Re : EAP-TLS authentication
by Eshun Benjamin 16 Jul '07

16 Jul '07

There is log file. Check your configure log to find out the path you specified for the log. You can also run in debug mode. radiusd -X ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : "anoop_c(a)sifycorp.com" <anoop_c(a)sifycorp.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Lundi, 16 Juillet 2007, 11h41mn 05s Objet : Re: EAP-TLS authentication Dear Alan I have been using Navis radius.Now i decided to move to free radius.In the navis radius there is a log file .So it will be shown as \"Username\" login ok or \"user login failed due to..\" So these logs will be very helpful for troubleshooting. In free radius thers is no log file is getting updated. This is not accounting. Regards Anoop Content-Type: text/plain; charset=ISO-8859-1 anoop_c(a)sifycorp.com wrote: > Everything is working fine.But the logs are not coming when user authenticates. What logs? Accounting? If so, see the FAQ. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Re: EAP-TLS authentication
by anoop_c＠sifycorp.com 16 Jul '07

16 Jul '07

Dear Alan I have been using Navis radius.Now i decided to move to free radius.In the navis radius there is a log file .So it will be shown as \"Username\" login ok or \"user login failed due to..\" So these logs will be very helpful for troubleshooting. In free radius thers is no log file is getting updated. This is not accounting. Regards Anoop Content-Type: text/plain; charset=ISO-8859-1 anoop_c(a)sifycorp.com wrote: > Everything is working fine.But the logs are not coming when user authenticates. What logs? Accounting? If so, see the FAQ. Alan DeKok.

2 1

Re: EAP-TLS authentication (Alan DeKok)
by anoop_c＠sifycorp.com 16 Jul '07

16 Jul '07

Message: 6 Date: Fri, 13 Jul 2007 14:25:43 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: EAP-TLS authentication (Alan DeKok) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Hi Everything is working fine.But the logs are not coming when user authenticates. Regards Anoop Message-ID: <46976F47.4030904(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 anoop_c(a)sifycorp.com wrote: > pls find the attached ... > Sending Access-Accept of id 4 to 192.168.0.50 port 1026 The RADIUS server thinks everything is OK. Alan DeKok.

2 1

Reccomended switches for dynamic vlans
by Jacob Jarick 15 Jul '07

15 Jul '07

Can any1 reccomend a brand / model of wireless switches that will support dynamic vlans. I finally have freeradius working very nicely, just need to (hopefully) find an inexpensive solution for the hardware side. I am currently looking into the openwrt distro to see if that will provide dynamic vlans. Thanks for all the help guys, wouldnt have gotten Freeradius setup without this mailing list thats for sure.

7 26

Autoconf SNMP Library checks
by Arran Cudbard-Bell 15 Jul '07

15 Jul '07

Hi, Just wondering if theres any particular reason the configure script still checks for the ucd snmp libraries, is there some legacy code that will only work with ucd snmp functions? or can the snmp include test be updated to look for the net-snmp headers (in acinclude.m4) ? <net-snmp/net-snmp-config.h> <net-snmp/library/asn1.h> <net-snmp/library/snmp.h> <net-snmp/library/snmp_impl.h> ... we could check for both, without too much hastle... Thanks, Arran

2 1

freeradius and mysql
by "jose a. zúñiga" 14 Jul '07

14 Jul '07

Hi: I need a tutorial in order to connect freeradius and mysql thanks jose a.

2 1