July 2007 - Freeradius-Users - lists.freeradius.org

NAS Reboot
by gaopeng 08 Jul '07

08 Jul '07

Hi,I try to implement the EAP-TLS by Freeradius, but the authentication stoped. From the log, I guess the reason is "NAS Reboot". I wonder if you know why it happend. Thanks a lot in advance! Enclosed please find the part of the log. Paul... ...Finished request 23Going to the next requestWaking up in 6 seconds...rad_recv: Access-Request packet from host 192.168.1.120:32778, id=33, length=219 User-Name = "host/cn1njxac.cn001.siemens.net" NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" NAS-Port = 0 Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Calling-Station-Id = "00-16-6F-58-2D-4B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x022400061900 State = 0xc22b0aa9baefeb0a401d5bfb77355856 Message-Authenticator = 0xcbe38495618ee3a8a7d15dc8d088b68d Processing the authorize section of radiusd.confmodcall: entering group authorize for request 24 modcall[authorize]: module "preprocess" retu! rns ok for request 24 modcall[authorize]: module "chap" returns noop for request 24 modcall[authorize]: module "mschap" returns noop for request 24 rlm_realm: Checking for suffix after "@" rlm_realm: Looking up realm "cn1njxac.cn001.siemens.net" for User-Name = "host/cn1njxac.cn001.siemens.net"XXL:enter realm_find realm =cn1njxac.cn001.siemens.net,accounting =0 Start to compare realm 2:config ream is :LOCAL,sta ream is :cn1njxac.cn001.siemens.net rlm_realm: No such realm "cn1njxac.cn001.siemens.net" modcall[authorize]: module "suffix" returns noop for request 24 rlm_eap: EAP packet type response id 36 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 24 users: Matched entry host/cn1njxac.cn001.siemens.net at line 95 modcall[authorize]: module "files" returns ok for request 24XXL: enter pap_authorize,vp->attribute =1000XXL: vp->lvalue =6XXL: enter pap_authorize,vp->attribu! te =2XXL: enter PW_USER_PASSWORD,found_pw should be truerlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 24modcall: leaving group authorize (returns updated) for request 24 rad_check_password: Found Auth-Type EAPauth: type "EAP" Processing the authenticate section of radiusd.confmodcall: entering group authenticate for request 24 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLSrlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 24modcall: leaving group authenticate (returns handled) for request 24Sending Access-Challenge of id 33 to 192.168.1.120 port 32778 EAP-Message = 0x012500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8810d4afb824cb4c9026f9697c25f35cFinished r! equest 24Going to the next requestWaking up in 6 seconds...--- Walking the entire request list ---Cleaning up request 20 ID 29 with timestamp 468e087eCleaning up request 21 ID 30 with timestamp 468e087eCleaning up request 22 ID 31 with timestamp 468e087eCleaning up request 23 ID 32 with timestamp 468e087eCleaning up request 24 ID 33 with timestamp 468e087eNothing to do. Sleeping until we see a request.rad_recv: Accounting-Request packet from host 192.168.1.120:32779, id=34, length=101 Acct-Status-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.confmodcall: entering group preacct for request 25 modcall[preacct]: module "preprocess" returns noop for request 25rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: W! ARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 25 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 25 modcall[preacct]: module "files" returns noop for request 25modcall: leaving group preacct (returns ok) for request 25 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 25radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" retu! rns ok for request 25 modcall[accounting]: module "unix" returns noop for request 25radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 rebooted (Accounting-Off packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 25modcall: leaving group accounting (returns ok) for request 25Sending Accounting-Response of id 34 to 192.168.1.120 port 32779Finished request 25Going to the next request--- Walking the entire request list ---Cleaning up request 25 ID 34 with timestamp 468e08a3Nothing to do. Sleeping until we see a request.rad_recv: Accounting-Request packet from host 192.168.1.120:32781, id=0, length=101 Acct-Status-Type = Accounting-On Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Rebo! ot Processing the preacct section of radiusd.confmodcall: entering gr oup preacct for request 26 modcall[preacct]: module "preprocess" returns noop for request 26rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 26 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 26 modcall[preacct]: module "files" returns noop for request 26modcall: leaving group preacct (returns ok) for request 26 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 26radius_xlat: '/usr/local/fre! eradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" returns ok for request 26 modcall[accounting]: module "unix" returns noop for request 26radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 restarted (Accounting-On packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 26modcall: leaving group accounting (returns ok) for request 26Sending Accounting-Response of id 0 to 192.168.1.120 port 32781Finished request 26Going to the next request--- Walking the entire request list ---Cleaning up request 26 ID 0 with timestamp 468e08a7Nothing to do. Sleeping until we see a request.rad_recv: Accounting! -Request packet from host 192.168.1.120:32781, id=1, length=101 Acct-S tatus-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.confmodcall: entering group preacct for request 27 modcall[preacct]: module "preprocess" returns noop for request 27rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 27 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suff! ix" returns noop for request 27 modcall[preacct]: module "files" returns noop for request 27modcall: leaving group preacct (returns ok) for request 27 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 27radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" returns ok for request 27 modcall[accounting]: module "unix" returns noop for request 27radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 rebooted (Accounting-Off packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 27modcall: leaving group accounting (returns ok)! for request 27Sending Accounting-Response of id 1 to 192.168.1.120 po rt 32781Finished request 27Going to the next request--- Walking the entire request list ---Cleaning up request 27 ID 1 with timestamp 468e0abeNothing to do. Sleeping until we see a request. _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

2 1

User not found using LDAP
by Amr el-Saeed 08 Jul '07

08 Jul '07

Dear all, i'm using freeradius-1.1.0-1 i need to make a default action if a user is not found . i need to make this action ( allow) for a while, i mean if the radius searched the LDAP and didn't find the user reply to the router with OK. i didn't find anything in the docs. any ideas ?? Regards Amr Ali

3 7

sql auth problems with 2.0.0-pre
by Alexander Serkin 07 Jul '07

07 Jul '07

Gurus, may be i'm pulling some common mistake with my configuration being tested against cvs snapshot, but no idea which one. I've an sql profile telling: some.dotted.user Cleartext-Password = cisco NAS-IP-Address =~ "xxx.xxx.97.(85|86)" authentication request: User-Name = "some.dotted.user" User-Password = "cisco" Calling-Station-Id = "000000000000000" Framed-Protocol = PPP Service-Type = Framed-User NAS-IP-Address = xxx.xxx.97.85 gives the access-reject for unknown (for me) reason: rlm_sql (sqlauth): sql_set_user escaped user --> 'some.dotted.user' rlm_sql (sqlauth): Reserving sql socket id: 3 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id' SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id ... rlm_sql (sqlauth): Released sql socket id: 3 modcall[authorize]: module "sqlauth" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [some.dotted.user/cisco] (from client localhost port 0 cli 00000000000000) auth: Failed to validate the user. I've checked the authorization sql query shown in debug - it properly returns the profile configured -- Sincerely Yours, Alexander

5 21

Re: pool-key issue in rlm_sqlippool
by Hugh Messenger 07 Jul '07

07 Jul '07

[Changed the subject back again. I have a bad habit of forgetting to change it from the digest subject when I respond. Time to switch lists, I guess.] Peter Nixon <listuser(a)peternixon.net> said: > > if ("%{control:Pool-Name}") { > > if ("%{control:Huntgroup-Name" == "dialup") { > > sqlippool_dialup > > } > > elsif ("%{control:Huntgroup-Name" == "wireless") { > > sqlippool_wireless > > } > > } > > Nope. Accounting does not know which Pool-Name was used, or even IF a pool > was used or not.... Doh! And I'd just finished explaining how I set the Pool-Name up in the authorize section. Slaps forehead. Does the Huntgroup-Name get set during accounting? I may not know the pool name, but if I know the Huntgroup, I know which instance of sqlippool I'll need. > Just list them both. Yup. That's how I've been testing it so far. I was just trying to find a way that would avoid unnecessary db queries. > Even just fixing existing pages that you feel are unclear is helpfull as > you > are a new comer and have found by trial and error which bits are difficult > to understand. That was years ago for many of the wiki authors :-) Okie Dokie. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 1

using EAP instead of chilli
by Carl aniams 07 Jul '07

07 Jul '07

hi all i'm using freeradius with a mysql database to authenticate users through chillispot, and it's working fine. i would like to authenticate my user using EAP instead of using chilli that already grant them access through dhcp to the network i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. thanks a lot -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

1 0

files module
by Diana Robert 07 Jul '07

07 Jul '07

hi, My server is using the files module to authenticate a client, but the module is present only in the authorize section and not in the authenticate section in radiusd.conf file, so can anyone comment on this. Wat is my doubt is , Is it enough to have the files [or anyother] module to be present only in authorize section. thank u. Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php

2 1

Freeradius + LDAP + EAP-TTLS with PAP cannot login
by cktan＠ocesb.com.my 07 Jul '07

07 Jul '07

7 24

Add $ to end of machine account uid
by Cody Jarrett 07 Jul '07

07 Jul '07

I need machines to be able to authenticate so that when a user who has never logged onto a computer can, by the machine have an active network connection and pulling the credentials from the samba-ldap domain. I have a realm setup to strip the domain/ part of the username which works fine, but I need to figure out how to add a $ at the end of anything that tries to connect as uid=host/computername. I'm sure I can figure out how to strip the host prefix, but can't quit figure out how to add the $ to the end. Thanks. -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

3 6

Configuration for EAP-SIM
by Garvin Haslett 06 Jul '07

06 Jul '07

Can anyone direct me to an example eap.conf entry to use EAP-SIM? I have looked but I don't see an example. Cheers, Garvin.

2 1

Adding an attribute to an incoming Access-Request
by Roy Walker 06 Jul '07

06 Jul '07

I have played with this a bit and can't seem to get it working... I need to add the "NAS-Port = 0" attribute to an incoming request if it is not set. This is currently breaking my sqlippool config and the upstream partner making the requests is not giving me a NAS-Port attribute. It looks like this should be done in the preprocess section, however the hints looks like it only works with a username and huntgroups doesn't really do what I need... Anyone got an idea? Thanks, Roy

2 2