July 2007 - Freeradius-Users - lists.freeradius.org

RE: DB_MYSQL.SQL
by Joel Eddy 11 Jul '07

11 Jul '07

For those that need it, like I did you can add this to the end of http://wiki.freeradius.org/MySQL_DDL_script to get your database to create the userinfo table also # # Table structure for table 'userinfo' # CREATE TABLE userinfo ( id int(10) NOT NULL auto_increment, UserName varchar(30), Name varchar(200), Mail varchar(200), Department varchar(200), WorkPhone varchar(200), HomePhone varchar(200), Mobile varchar(200), PRIMARY KEY (id), KEY UserName (UserName), KEY Departmet (Department) );

2 1

R: db_mysql.sql
by Francesco Cristofori 11 Jul '07

11 Jul '07

> Is it possible to use the one from 1.0.1 or some other version? Yes, if you use the mathing sql.conf you can use any db schema (so you don't have to convert old databases to new schemas). > Joel HTH, Francesco.

1 0

RE: db_mysql.sql
by Joel Eddy 11 Jul '07

11 Jul '07

Is version 1.1.6 missing the db_mysql.sql script? Is it possible to use the one from 1.0.1 or some other version? Or is there a link I've missed somewhere to get it? By the way I APPRECIATE all that you programmers are doing. I can only imagine the long hours put in to make this product work. THANK YOU !! Joel

4 3

RE: Logging failed authentications....
by Ackbar Joolia 11 Jul '07

11 Jul '07

Thanks... I've got both working now. File-based logging and mysql too Regards Ackbar -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalplc.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalplc.com@lists.freeradius.org] On Behalf Of tnt(a)kalik.co.yu Sent: 10 July 2007 21:32 To: FreeRadius users mailing list Subject: Re: Logging failed authentications.... radiusd.conf # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = no It will be logged in radius.log file Ivan Kalik Kalik Informatika ISP Dana 10/7/2007, "Ackbar Joolia" <ackbar.joolia(a)bglobalplc.com> piše: >Hi, >I would like to be able to log failed authentications but I don't find >it anywhere. And ideally I would like to put it into a MySQL table. > >Can anyone advice on this please? >Thanks >AJ > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com

1 0

accounting exec when Acct-Status-Type == Stop
by Santiago Balaguer García 11 Jul '07

11 Jul '07

4 5

auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by E A 11 Jul '07

11 Jul '07

Hello I hav one authentificate problem between my Freeradius and NAT(for VOIP) what means that i have : No authenticate method (Auth-Type) so here is my debug : radiusd -X rad_recv: Access-Request packet from host 192.168.100.238:1912, id=2, length=684 User-Name = "192.168.100.180" User-Password = "\371\323\025[" NAS-IP-Address = 192.168.100.238 NAS-Port-Type = Async Service-Type = Login-User Called-Station-Id = "907100" Calling-Station-Id = "4002" Cisco-AVPair = "xpgk-request-type=number" Acct-Session-Id = "47306f08-1-b56089b1" h323-conf-id = "h323-conf-id=02B21F32 1DEB1BAB 26450001 A8045DEC" Cisco-AVPair = "h323-call-id=02B21F32 1DEB1BAB 26440001 A8045DEC" h323-gw-id = "h323-gw-id=192.168.100.180" Cisco-AVPair = "h323-gw-address=192.168.100.180" Cisco-AVPair = "h323-incoming-local-address=192.168.100.238" h323-remote-address = "h323-remote-address=194.6.239.4" Cisco-AVPair = "h323-remote-id=194.6.239.4" Cisco-AVPair = "xpgk-h323-id=4FXS-045dec" Cisco-AVPair = "xpgk-src-number-in=4002" Cisco-AVPair = "xpgk-src-number-out=4002" Cisco-AVPair = "xpgk-dst-number-in=907100" Cisco-AVPair = "xpgk-dst-number-out=907100" h323-setup-time = "h323-setup-time=11:05:05.000 CEST Wed Jul 11 2007" Cisco-AVPair = "xpgk-route-retries=1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "192.168.100.180", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 radius_xlat: '192.168.100.180' rlm_sql (sql): sql_set_user escaped user --> '192.168.100.180' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '192.168.100.180' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '192.168.100.180' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '192.168.100.180' ORDER BY id' query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '192.168.100.180' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '192.168.100.180' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): No matching entry in the database for request from user [192.168.100.180] modcall[authorize]: module "sql" returns notfound for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 2 to 192.168.100.238 port 1912 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 2 with timestamp 46949d41 Nothing to do. Sleeping until we see a request. any help? best regards!!! --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

Proxying doesn't work!
by Federico Giannici 11 Jul '07

11 Jul '07

We have a working FreeRADIUS 1.1.4 running since a lot of months. Now we have to proxy the requests for a realm (gtenet.it) to a given RADIUS server, but our server seems to ignore the proxy configuration! I have set "proxy_requests = yes" and included the "proxy.conf" file (I'm sure of these, looked at the debug output). Here it is our "proxy.conf" file: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm gtenet.it { type = radius authhost = 195.103.212.53:1645 accthost = 195.103.212.53:1646 secret = XXXXXXXXX } When a request for xxxx(a)gtenet.it is received, it goes through the authorization and then instead of being proxied it goes through authentication and obviously fail! Here it is the output of the server in debug mode: Jul 10 18:55:29 aragorn radiusd[23262]: Going to the next request Jul 10 18:55:29 aragorn radiusd[23262]: Waking up in 6 seconds... Jul 10 18:55:29 aragorn radiusd[23262]: rad_lowerpair: User-Name now 'neomedia(a)gtenet.it' Jul 10 18:55:29 aragorn radiusd[23262]: rad_lowerpair: User-Password now 'XXXXXXXX' Jul 10 18:55:29 aragorn radiusd[23262]: rad_rmspace_pair: User-Name now 'neomedia(a)gtenet.it' Jul 10 18:55:29 aragorn radiusd[23262]: rad_rmspace_pair: User-Password now 'XXXXXXXX' Jul 10 18:55:29 aragorn radiusd[23262]: Processing the authorize section of radiusd.conf Jul 10 18:55:29 aragorn radiusd[23262]: modcall: entering group authorize for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "preprocess" returns ok for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "nm" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "chap" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "mschap" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Jul 10 18:55:29 aragorn radiusd[23262]: modcall[authorize]: module "pap" returns noop for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: modcall: leaving group authorize (returns ok) for request 72 Jul 10 18:55:29 aragorn radiusd[23262]: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Jul 10 18:55:29 aragorn radiusd[23262]: auth: Failed to validate the user. Any hints of what could be the problem? Thanks. -- ___________________________________________________ __ |- giannici(a)neomedia.it |ederico Giannici http://www.neomedia.it ___________________________________________________

3 3

Failed to validate the user!
by E. abdelghani 11 Jul '07

11 Jul '07

2 1

Cisco with Freeradius problem.
by coroy barte 11 Jul '07

11 Jul '07

Hi there, I would like to ask if where in my cisco configuration has a problem. First i used MPD as my LNS and no encountered problem authenticating to the freeradius but when i change my LNS to Cisco it seems i can't log in. What are possible problem in my configuration? Is it in the Cisco or Freeradius has a problem setting. What would be the coz of the problem as stated in the log. I attach the logs for review. Thank you and more power. --coroy Cisco log: *May 22 15:43:51.404: ppp253 PAP: I AUTH-REQ id 186 len 19 from "coroy" *May 22 15:43:51.404: ppp253 PAP: Authenticating peer coroy *May 22 15:43:51.412: AAA/AUTHEN/PPP (00000132): Pick method list 'default' *May 22 15:43:51.412: AAA/ATTR(00000132): copy lists *May 22 15:43:51.412: AAA/ATTR(00000132): new list: 6459A2A8 old list: 645943E4 *May 22 15:43:51.412: AAA/ATTR(00000132): new list: 644B8774 *May 22 15:43: 51.412: AAA/ATTR(00000132): add attr: 644B878C 0 00000002 Framed-Protocol(62) 4 PPP *May 22 15:43:51.412: AAA/ATTR(00000132): add attr: 644B87A0 0 00000009 username(318) 5 coroy *May 22 15:43:51.412: AAA/ATTR(00000132): add attr: 644B87B4 0 00000009 password(226) 8 70 61 73 73 77 6F 72 64 *May 22 15:43:51.412: ppp253 PPP: Sent PAP LOGIN Request *May 22 15:43:51.412: AAA SRV(00000132): process authen req *May 22 15:43:51.412: AAA SRV(00000132): Authen method=SERVER_GROUP IWC *May 22 15:43:51.412 : AAA/ATTR(00000132): cursor init: 63958DC0 644B8774 none unknown *May 22 15:43:51.412: AAA/ATTR(00000132): find :644B87A0 0 00000009 username(318) 5 coroy *May 22 15:43:51.412: AAA/ATTR(00000132): cursor init: 63958E50 644B8774 none unknown *May 22 15:43:51.412: AAA/ATTR(00000132): find :644B87A0 0 00000009 username(318) 5 coroy *May 22 15:43:51.412: AAA/ATTR(00000132): cursor init: 63958D78 644B8774 none none *May 22 15:43:51.412: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.412: AAA/ATTR(00000132): Framed-Protocol ok *May 22 15:43:51.412: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.412: AAA/ATTR(00000132): username ok *May 22 15:43: 51.412: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.412: AAA/ATTR(00000132): password ok *May 22 15:43:51.412: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.416: AAA/ATTR(00000132): not found *May 22 15:43:51.416: AAA/ATTR(00000132): cursor init: 63958D78 6459A2A8 none none *May 22 15:43:51.416: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.416: AAA/ATTR(00000132): port-type ok *May 22 15:43:51.416: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.416: AAA/ATTR(00000132): interface ok *May 22 15:43: 51.416: RADIUS(00000132): Storing nasport 928 in rad_db *May 22 15:43:51.416: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.416: AAA/ATTR(00000132): clid ok *May 22 15:43:51.416 : AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:51.416: AAA/ATTR(00000132): dnis ok *May 22 15:43:51.416: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43: 51.416: AAA/ATTR(00000132): not found *May 22 15:43:51.416: RADIUS(00000132): Config NAS IP: 0.0.0.0 *May 22 15:43:51.416: Getting session id for NET(00000132) : db=64596B3C *May 22 15:43: 51.416: RADIUS/ENCODE(00000132): acct_session_id: 390 *May 22 15:43:51.416: RADIUS(00000132): sending *May 22 15:43:51.416: RADIUS/ENCODE: Best Local IP-Address 10.3.2.130 for Radius-Server 10.3.2.127 *May 22 15:43:51.416: RADIUS(00000132): Send Access-Request to 10.3.2.127:1812 id 21646/45, len 94 *May 22 15:43:51.416: RADIUS: authenticator 95 18 5E 04 20 9F B2 6D - 9C D7 2E F0 66 3F B2 EA *May 22 15:43:51.416: RADIUS: Framed-Protocol [7] 6 PPP [1] *May 22 15:43:51.416: RADIUS: User-Name [1] 7 "coroy" *May 22 15:43:51.416: RADIUS: User-Password [2] 18 * *May 22 15:43:51.416: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *May 22 15:43:51.416: RADIUS: NAS-Port [5] 6 928 *May 22 15:43:51.416: RADIUS: Calling-Station-Id [31] 14 "000c2965075c" *May 22 15:43:51.416: RADIUS: Called-Station-Id [30] 5 "mpd" *May 22 15:43:51.416: RADIUS: Service-Type [6] 6 Framed [2] *May 22 15:43:51.416: RADIUS: NAS-IP-Address [4] 6 10.3.2.130 *May 22 15:43:52.084: RADIUS: Received from id 21646/45 10.3.2.127:1812, Access-Accept, len 71 *May 22 15:43:52.084: RADIUS: authenticator A4 72 E4 2B 33 5E B8 AF - AB 4A 21 26 69 66 EB E3 *May 22 15:43:52.084: RADIUS: Service-Type [6] 6 Administrative [6] *May 22 15:43:52.084: RADIUS: Framed-Protocol [7] 6 PPP [1] *May 22 15:43:52.084: RADIUS: Framed-IP-Address [8] 6 10.10.10.45 *May 22 15:43:52.084: RADIUS: Framed-IP-Netmask [9] 6 255.240.0.0 *May 22 15:43:52.084: RADIUS: Framed-Routing [10] 6 3 *May 22 15:43:52.088: RADIUS: Filter-Id [11] 9 *May 22 15:43:52.088: RADIUS: 73 74 64 2E 70 70 70 [std.ppp] *May 22 15:43:52.088: RADIUS: Framed-MTU [12] 6 1500 *May 22 15:43:52.088: RADIUS: Framed-Compression [13] 6 VJ TCP/IP Header Compressi[1] *May 22 15:43:52.088: AAA/ATTR(00000132): free all lists: 644B8774 *May 22 15:43:52.088: AAA/ATTR(00000132): del attr: 644B878C 0 00000002 Framed-Protocol(62) 4 PPP *May 22 15:43:52.088: AAA/ATTR(00000132): del attr: 644B87A0 0 00000009 username(318) 5 coroy *May 22 15:43:52.088: AAA/ATTR(00000132): del attr: 644B87B4 0 00000009 password(226) 8 70 61 73 73 77 6F 72 64 *May 22 15:43: 52.088: AAA/ATTR(00000132): new list: 64596DB4 *May 22 15:43:52.088: RADIUS(00000132): Received from id 21646/45 *May 22 15:43:52.088: AAA/ATTR(00000132): cursor init: 64588A50 64596DB4 none none *May 22 15:43:52.088 : AAA/ATTR(00000000): add attr: 64596DCC 0 00000001 service-type(245) 4 Administrative *May 22 15:43:52.088: AAA/ATTR(00000000): add attr: 64596DE0 0 00000001 Framed-Protocol(62) 4 PPP *May 22 15:43:52.088: AAA/ATTR(00000000): add attr: 64596DF4 0 00000001 addr(5) 4 10.10.10.45 *May 22 15:43:52.088: AAA/ATTR(00000000): add attr: 64596E08 0 00000009 route(272) 20 10.0.0.0 255.240.0.0 *May 22 15:43:52.088: AAA/ATTR(00000000): add attr: 64596E1C 0 00000001 netmask(215) 4 255.240.0.0 *May 22 15:43:52.088: AAA/ATTR(00000000): add attr: 64596E30 0 00000001 routing(281) 4 TRUE *May 22 15:43:52.088: RADIUS/DECODE: invalid ACL type; FAIL *May 22 15:43:52.088: RADIUS/DECODE: decoder; FAIL *May 22 15:43:52.088: RADIUS/DECODE: attribute Filter-Id; FAIL *May 22 15:43:52.088: RADIUS/DECODE: parse response op decode; FAIL *May 22 15:43:52.088: RADIUS/DECODE: parse response; FAIL *May 22 15:43:52.088: AAA/ID(00000132): Setting connection progress = 101 *May 22 15:43:52.088: AAA SRV(00000132): protocol reply FAIL for Authentication *May 22 15:43:52.088: AAA SRV(00000132): Authen method=NOT_SET - No methods left to try *May 22 15:43:52.088: AAA SRV(00000132): Return Authentication status=FAIL *May 22 15:43:52.088: ppp253 PPP: Received LOGIN Response FAIL *May 22 15:43:52.088: AAA/ATTR(00000132): copy lists *May 22 15:43:52.088: AAA/ATTR(00000132): new list: 644B8774 old list: 64596DB4 *May 22 15:43:52.088: AAA/ATTR(00000132): cursor init: 6436F110 644B8774 none none *May 22 15:43:52.088: AAA/ATTR(00000132): find :timeout(303): not found *May 22 15:43:52.088: AAA/ATTR(00000132): cursor init: 6436F100 644B8774 none unknown *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): service-type ok *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): Framed-Protocol ok *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): addr ok *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): route protocol:ip ok *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): netmask ok *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): routing ok *May 22 15:43:52.088: AAA/ATTR(00000132): find next matching service=none, protocol=unknown *May 22 15:43:52.088: AAA/ATTR(00000132): not found *May 22 15:43:52.088: AAA/ATTR(00000132): cursor init: 6436F058 644B8774 none unknown *May 22 15:43:52.088: AAA/ATTR(00000132): find :reply-message(194): not found *May 22 15:43:52.088: ppp253 PAP: O AUTH-NAK id 186 len 26 msg is "Authentication failed" *May 22 15:43:52.088: L2X: UDP socket write 66 bytes, 10.3.2.130(1701) to 10.3.2.126(54959) *May 22 15:43:52.092 : AAA/ID(00000132): Setting disconnect: abort = 25/PPP PAP Fail, terminate = 17/user-error *May 22 15:43:52.092: AAA/ATTR(00000132): new list: 64584098 *May 22 15:43:52.092: AAA/ATTR(00000132): add attr: 645840B0 0 00000009 username(318) 5 coroy *May 22 15:43:52.092: AAA/ACCT/EVENT/(00000132): NET DOWN *May 22 15:43:52.092: AAA/ATTR(00000132): cursor init: 6436EC38 64584098 none none *May 22 15:43:52.092: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:52.092: AAA/ATTR(00000132): username ok *May 22 15:43:52.092: AAA/ATTR(00000132): find next matching service=none, protocol=none *May 22 15:43:52.092: AAA/ATTR(00000132): not found *May 22 15:43: 52.092: AAA/ACCT/NET(00000132): Method list not found *May 22 15:43:52.092: AAA/ATTR(00000132): free all lists: 64599260 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64599278 0 00000001 session-id(293) 4 390(186) *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 6459928C 0 00000009 tunnel-server-endpoint(311) 10 10.3.2.130 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 645992A0 0 00000009 tunnel-client-endpoint(305) 10 10.3.2.126 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 645992B4 0 00000009 vpdn-group(324) 3 mpd *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 645992C8 0 00000001 tunnel-type(316) 4 l2tp *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 645992DC 0 00000009 tunnel-connection-id(312) 7 1890042 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 645992F0 0 00000009 tunnel-id(306) 21 host-lac.kamisaki.net *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64599304 0 00000009 gw-name(307) 6 Router *May 22 15:43:52.092: AAA/ACCT(00000132): del node, session 390 *May 22 15:43:52.092: AAA/ACCT/NET(00000132): free_rec, count 0 *May 22 15:43:52.092: AAA/ACCT/NET(00000132) reccnt 0, csr FALSE, osr 0 *May 22 15:43:52.092: AAA/ATTR(00000132): free all lists: 64584098 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 645840B0 0 00000009 username(318) 5 coroy *May 22 15:43:52.092: AAA/ATTR(00000132): free all lists: 644B8774 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 644B878C 0 00000001 service-type(245) 4 Administrative *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 644B87A0 0 00000001 Framed-Protocol(62) 4 PPP *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 644B87B4 0 00000001 addr(5) 4 10.10.10.45 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 644B87C8 0 00000009 route(272) 20 10.0.0.0 255.240.0.0 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 644B87DC 0 00000001 netmask(215) 4 255.240.0.0 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 644B87F0 0 00000001 routing(281) 4 TRUE *May 22 15:43:52.092: ppp253 PPP: aaa-id := 0x0 reset *May 22 15:43:52.092: ppp253 PPP: mlp-aaa-id := 0x0 reset *May 22 15:43:52.092: ppp253 PPP: aaa-id := 0x0 reset *May 22 15:43:52.092: ppp253 PPP: mlp-aaa-id := 0x0 reset *May 22 15:43:52.092: AAA/ATTR(00000132): free all lists: 64596DB4 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64596DCC 0 00000001 service-type(245) 4 Administrative *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64596DE0 0 00000001 Framed-Protocol(62) 4 PPP *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64596DF4 0 00000001 addr(5) 4 10.10.10.45 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64596E08 0 00000009 route(272) 20 10.0.0.0 255.240.0.0 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64596E1C 0 00000001 netmask(215) 4 255.240.0.0 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 64596E30 0 00000001 routing(281) 4 TRUE *May 22 15:43:52.092: AAA/ATTR(00000132): free all lists: 6459A2A8 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 6459A2C0 0 00000001 port-type(156) 4 Virtual Terminal *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 6459A2D4 0 00000009 interface(152) 15 Uniq-Sess-ID253 *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 6459A2E8 0 00000009 clid(25) 12 000c2965075c *May 22 15:43:52.092: AAA/ATTR(00000132): del attr: 6459A2FC 0 00000009 dnis(36) 3 mpd ----------------------- Freeradius log: rad_recv: Access-Request packet from host 10.3.2.130:21645, id=228, length=94 Framed-Protocol = PPP User-Name = "coroy" User-Password = "password" NAS-Port-Type = Virtual NAS-Port = 160 Calling-Station-Id = "000c2965075c" Called-Station-Id = "mpd" Service-Type = Framed-User NAS-IP-Address = 10.3.2.130 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: No '@' in User-Name = "coroy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 users: Matched entry coroy at line 90 modcall[authorize]: module "files" returns ok for request 12 modcall: leaving group authorize (returns ok) for request 12 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 228 to 10.3.2.130 port 21645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 10.10.10.45 Framed-IP-Netmask = 255.240.0.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = " std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 12 ---------------------------- Cisco configuration: Using 2475 out of 129016 bytes ! version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot system flash slot0:c7200-js-mz.123-1.bin enable secret 5 $1$..Q4$R03cMosO4XOmURBY6wQWo/ ! username admin privilege 15 password 0 xxxpass username test password 0 test username LAC-1 password 0 secret username multihop password 0 secret username Tunnel-Switch-In password 0 Secret2 username Tunnel-Switch-Out password 0 secret3 username coroy password 0 password aaa new-model ! aaa group server radius user-radius server 10.3.2.127 auth-port 1812 acct-port 1813 ! aaa authentication login default local-case aaa authentication enable default enable aaa authentication ppp default group user-radius aaa authorization config-commands aaa authorization exec default local aaa authorization network default group user-radius aaa accounting exec default start-stop group user-radius aaa session-id common ip subnet-zero ! ! ip name-server 10.1.0.5 ip name-server 10.1.0.11 ! ip cef vpdn enable vpdn source-ip 10.3.2.130 vpdn logging vpdn logging local vpdn logging remote vpdn logging user vpdn logging tunnel-drop vpdn search-order domain ! vpdn-group mpd accept-dialin protocol l2tp virtual-template 1 terminate-from hostname host-lac.kamisaki.net lcp renegotiation on-mismatch l2tp tunnel password 7 071C2E40470D1E040317 ! mpls ldp logging neighbor-changes ! ! ! ! ! ! ! ! ! no voice hpi capture buffer no voice hpi capture destination ! ! ! ! ! ! interface Loopback0 no ip address ! interface FastEthernet0/0 ip address 10.3.2.130 255.240.0.0 duplex half ! interface Virtual-Template1 ip unnumbered FastEthernet0/0 peer default ip address pool ip_pool no keepalive ppp authentication pap user-radius ppp authorization user-radius ! ip local pool ip_pool 10.10.10.2 10.10.10.6 ip classless ip route 0.0.0.0 0.0.0.0 10.0.0.10 no ip http server ! ! ! ! ! radius-server attribute nas-port format c radius-server host 10.3.2.127 auth-port 1812 acct-port 1813 radius-server key radpass radius-server authorization permit missing Service-Type ! ! dial-peer cor custom ! ! ! ! gatekeeper shutdown ! ! line con 0 line aux 0 transport output lat pad v120 mop telnet rlogin udptn stopbits 1 line vty 0 4 session-timeout 20 transport input lat pad v120 mop telnet rlogin udptn transport output lat pad v120 mop telnet rlogin udptn ! ! ! end

2 2

setup question : mschap + perl authentication
by Johan 11 Jul '07

11 Jul '07

Hi community I have a question for you guys. I'm wondering if it's possible to authenticate a user who is using mschap authentication with perl. I already made a perl script, which I use with rlm_perl to authenticate users to an ftp backend. I use that script to authenticate users from the authentication proxy of a Cisco PIX. My next setup is to authenticate user requests from a Wireless Access Point with EAP-TTLS. Is it possible to do that with the radiusd.conf ? I already tried to setup like this in the authenticate section : mschap { perl } But problem is, the perl script doens't seems to receive the same information as a PIX request. Do I need to modify my script to talk mschap ? Is there a perl module to understand the mschap protocol ? Thanks in advance, Johan

8 13