September 2007 - Freeradius-Users - lists.freeradius.org

rlm_sql error in pre2
by Norbert Wegener 12 Sep '07

12 Sep '07

In some cases I do not have the need to query for groupmembership. When I undefine group_membership_query, I get the following error: rlm_sql (voipsipsql): Error retrieving group list^M rlm_sql (voipsipsql): Error processing groups; rejecting user Maybe an information about the non availability of groupmembership would be more helpful than an error ? Norbert Wegener

2 2

sometimes double records in radacct
by Nelson Serafica 12 Sep '07

12 Sep '07

I notice in my radacct that there are double records. See sample below: +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | RadAcctId | AcctSessionId | AcctUniqueId | UserName | AcctStartTime | AcctStopTime | ConnectInfo_start | AcctStartDelay | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | 531828 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:32 | 2007-09-12 11:20:14 | | 0 | | 531826 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:33 | 2007-09-12 11:19:14 | 33333 LAPM/V42BIS | 0 | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ I noticed that the difference (AcctStartTime,AcctStartDelay,ConnectInfo_start) are indicated in the accounting_start_query_alt parameters. If you will noticed, there are identical AcctSessionId which was supposed to be none and the difference between them is the one that is updated by accounting_start_query_alt. It must not be identical. The problem is there are identical AcctSessionId. Would it be possible that the culprit is in the accounting_start_query_alt parameters? Is the accounting_start_query failing that's why accounting_start_query_alt take over? accounting_start_query is not broken and one line only. Is there a way to increase time before accounting_start_query_alt takes over? ____________________________________________________ Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com

1 0

Fw: Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type
by Rohaizam Abu Bakar 11 Sep '07

11 Sep '07

Resent... --haizam ----- Original Message ----- From: "Rohaizam Abu Bakar" <haizam(a)myjaring.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, September 11, 2007 5:09 PM Subject: Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type > > I've tried as recommended not to set Auth-Type but trying below will works > in 1.1.2 but not on my recently upgraded to 1.1.7 > > Configs:- > > ############################ > a) radiusd.conf > > authorize { > Autz-Type LDAP { > ldap1 > } > > Autz-Type ADSL { > ldapadsl1 > } > > } > authenticate { > > Auth-Type ldap1 { > ldap1 > Auth-Type ldapadsl1 { > ldapadsl1 > } > } > > b) users > > DEFAULT Huntgroup-Name == "adsl", ldapadsl1-Ldap-Group == > "ADSL", Autz-Type := ADSL > DEFAULT Autz-Type := LDAP > ################################## > > > > Results:- > > > In 1.1.2 - (Auth-Type ldap1 => working!!) > > ############################################ > > modcall: leaving group authorize (returns ok) for request 18 > Found Autz-Type LDAP > Processing the authorize section of radiusd.conf > modcall: entering group LDAP for request 18 > modcall: entering group redundant for request 18 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for test > radius_xlat: '(uid=test)' > radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with > filter (uid=test) > rlm_ldap: checking if remote access for test is allowed by dialupAccess > rlm_ldap: Added password {CRYPT}XXXXXXXX in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value > Van-Jacobson-TCP-IP & op=11 > rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 > rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & > op=11 > rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & > op=11 > rlm_ldap: Setting Auth-Type = ldap1 > rlm_ldap: user test authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap1" returns ok for request 18 > modcall: leaving group redundant (returns ok) for request 18 > modcall: leaving group LDAP (returns ok) for request 18 > rad_check_password: Found Auth-Type ldap1 > auth: type "ldap1" > > ###################################### > > > > In 1.1.7 (Auth-Type = Local => not working!!) > > ########################################## > modcall: leaving group authorize (returns ok) for request 1 > Found Autz-Type LDAP > Processing the authorize section of radiusd.conf > modcall: entering group LDAP for request 1 > modcall: entering group redundant for request 1 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for test > radius_xlat: '(uid=test)' > radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with > filter (uid=test) > rlm_ldap: checking if remote access for test is allowed by dialupAccess > rlm_ldap: Added password {CRYPT}XXXXXXXXXXXXX in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding radiusFramedCompression as Framed-Compression = > Van-Jacobson-TCP-IP > rlm_ldap: Adding radiusFramedMTU as Framed-MTU = 1500 > rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol = PPP > rlm_ldap: Adding radiusServiceType as Service-Type = Framed-User > rlm_ldap: user test authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap1" returns ok for request 1 > modcall: leaving group redundant (returns ok) for request 1 > modcall: leaving group LDAP (returns ok) for request 1 > auth: type Local > auth: user supplied User-Password does NOT match local User-Password > > ###################################3 > >

1 0

How do I Instruct Freeradius to connect to postgreSQL Database on a port other than 5432?
by justice obrey 11 Sep '07

11 Sep '07

I finally managed to figure it out. In the postgresql.conf file, I put in: port = '5490' and that worked. --------------------------------- Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search.

1 0

Nas Prompt User
by Sofia Silva 11 Sep '07

11 Sep '07

I have an user configured as Nas Prompt User, when i make a login in the graphic interface i get this: login: testuser Password: RADIUS: Authentication OK Starting. RADIUS_SERVICE_TYPE = NAS-Prompt-User RADIUS_USER_NAME = testuser after that, the process finishes and returns me the original prompt. When i try to do a radius login on a tty i get the same message and then it asks me to login again. So i'm pretty sure i'm not logging in. I think i should specificate the home directory and the shell of the user, but idon't know where to do it. could you please help me?? Thanks a lot, Sofia _________________________________________________________________ ¿Cuánto vale tu auto? Tips para mantener tu carro. ¡De todo en MSN Latino Autos! http://latino.msn.com/autos/

1 0

Multiple Huntgroups for one User?
by Alexander Papenburg 11 Sep '07

11 Sep '07

Hi Freeradius-List, is it possible to give/deny access to multiple huntgroups for a single user/group? E.g.: User/group is denied to access hosts 10.0.0.1, 10.0.0.2 and 10.0.0.3 but is allowed to access all the other hosts in 10.0.0.0/24. Something like hostpools would be nice (e.g.: user/group1 can access pool1, pool2 and pool3. user2 can access pools 1+2 but is denied to access pool3). Thanks in advance, Alexander

1 0

RE : LOGs of eap-tls authentication (inelec communication)
by anoop_c＠sifycorp.com 11 Sep '07

11 Sep '07

> Message: 3 > Date: Mon, 10 Sep 2007 10:23:19 +0200 (CEST) > From: inelec communication <inelec_communication(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication > To: FreeRadius users mailing list Hi Please find my result.The authentication is working well.The problem is logs are not in radius.log file. [root@anoop fr1.1.7]# cat successlog Message-Authenticator = 0x96080298cf8084c0a353d72c9e82a3aa Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ab131c9d151752c61f18ffb09aa2c55 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1033, id=1, length=299 Message-Authenticator = 0xe6d7ba1e4458e637c60740bc57383f9e Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x8ab131c9d151752c61f18ffb09aa2c55 Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020100600d800000005616030100510100004d030146e4c9b422a11c 6b0c2a9c5e74b8a0de5e3eb0e1d8a15f49cb7cbf83ad04116a105892c006371829ccf94f1dcdc6d8 3e3d001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04be], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a0dc000000563160301004a02000046030146e4c9b59eb2f0 eb1e4eff23a4604203f5da0d54bd36842f27464dc2af678d07203e33b80dee1b655fafab80ece953 ac778f9d578cced14cc8f23c7e0e2c4335b800040016030104be0b0004ba0004b700022b30820227 30820190a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131333037353834305a170d3038303131333037353834305a 305f310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693122302006092a864886f70d01090116136a65796b756d61725f734073696679 2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c6f366d39a74d8 b66b561628be123f18f9b0a71f09b98d21b990e9a987d9acf3ceabd01df377e13da987a23f244496 dfc0609e99ee03a9f44e51033cbb84c814d9d3225aacc7c67786fcd193d57c3f5ac16d7d1b835701 52edca9ba9ff99ca4feffcb244551292fad52026afda1f876205e84a26b81cebd89fa03fd97e5f7f db0203010001a317301530130603551d25040c300a06082b06 EAP-Message = 0x010505070301300d06092a864886f70d010104050003818100a4cbb4 e6e8190d840edc9e61637a38ffa423b2a67e8d308c3005b8ec18318e94ddddbac0ccb1a15780c285 de01622608f4caded74bab6f0c9d44dfdeb648e46bdd4de3606e4c7f86e5f86472722db409baffdb 78eb6c7ad267a623e1155af13de26e83f3ce29b4f82baf551b756d2f49e5691cc1d80f6fb253b11e 7a15bf296000028630820282308201eba003020102020100300d06092a864886f70d010104050030 3b310b300906035504061302494e310b300906035504081302544e310d300b060355040a13045369 66793110300e0603550403130730377877696669301e170d30 EAP-Message = 0x37303131333037353830305a170d3038303131333037353830305a30 3b310b300906035504061302494e310b300906035504081302544e310d300b060355040a13045369 66793110300e060355040313073037787769666930819f300d06092a864886f70d01010105000381 8d0030818902818100ec232cf24bd548a586d614994a3f3b9ee699eb64a3bf9a0c90d7bc8afb3984 2c767c3613757b8d38a78ceaa6a499be55dcf997abb9963b3ef406b39f766054d8e37d35859e6bd5 ce686c01eb63a25684afb79cd6796193355bd3ae67eae642701a34d1bc93426ade87434dadfbc8a8 b0cae8137d97d2a267973f2213ebeefcfd0203010001a38195 EAP-Message = 0x308192301d0603551d0e04160414095ab44cec0cb80f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf4654b6a22307d938c91831ef0396b8e Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1033, id=2, length=209 Message-Authenticator = 0x5dc14e6f1f5361ad60a06d2bffa9e4a9 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0xf4654b6a22307d938c91831ef0396b8e Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103016d0d80000005638c150861ea8bc609ed3cfbc030630603551d 23045c305a8014095ab44cec0cb80f8c150861ea8bc609ed3cfbc0a13fa43d303b310b3009060355 04061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603 550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d01 010405000381810019a69104ce7b395ddbb7a05ae632f71c590ba34e71b9a57cbe952eabed153fda cb07eb1c8d6db397f1f47a687103025a91b0431e73beac6e788de0af02e7d49e35808652dc4b2db6 0ccbcef9245239c47c785fb5c78c79ed7dd22d60ab6c19727e EAP-Message = 0xaa68ec38e3fc5b6e7716741e1f56eba981970face974b560ba07450e cdf817160301004c0d000044020102003f003d303b310b300906035504061302494e310b30090603 5504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669 0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x378a0c3727565af6c193024a8be476bc Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1033, id=3, length=1100 Message-Authenticator = 0x2261a2046965f5b6c67629831b5ef1f5 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x378a0c3727565af6c193024a8be476bc Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0203037b0d800000037116030103410b00023100022e00022b308202 2730820190a003020102020106300d06092a864886f70d0101040500303b310b3009060355040613 02494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403 130730377877696669301e170d3037303131373033303230385a170d303830313137303330323038 5a305f310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304 536966793110300e06035504031307616e6f6f7030373122302006092a864886f70d01090116136a 65796b756d61725f7340736966792e636f6d30819f300d0609 EAP-Message = 0x2a864886f70d010101050003818d0030818902818100c530f10ae7bd 0f0fbd6bbafbcd48532c054b9afd474b7cd7ce6aa0291d664476bb1d9d143cfb4c713f5b47b5e636 3f6ceed4c3bc51ef1a35c84a100bb17b262f38923947a12f1e288ffe57fccfa92e6d12da42d9016a 8da5c07c7705c2156da206d76fd569ca589fdca309fd1703fec4b5fa77ee1257b5b9514e39b4d79d 601f0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886 f70d01010405000381810089c51110b91d0135f1a99f29ea922ff1a7738195963017d2d9dd32c81d 2782210b1329644559fc746cb77ce6f707f50efe3aa155b3d9 EAP-Message = 0x36f15183865793097ff4207baac2d26153f81f177377493db3d2a52d b063b7668b57bc0e575401a6da093e5abd9a0f147810eaf1ee2967bc2252afe0bf8b7b678914895c c3190f22eb7a1000008200803ea26a8f1b684b4c6f76f7ca07e3b3d0dd71dd459cd90f96868faf38 253fc9970fbc3e19efb321e353e982314b42e8bb66aa5b1ee540a4810d8a48a1615b8af8657a9b38 cc1caf7da1966813de8f59f372c63c4cbac4dd3ad7877bcc8fba80ca799f52efcdee1b541461ef7e 65948840305e0dbcc845d069765955affbf8b41e0f0000820080588771eb658b2403ce711f921da6 27e0b633993385a5dc7d249503ecc0c84f7bdefc5bf34c20a9 EAP-Message = 0x4b18930f40b19d87ea7d1819aa00d2e42ea7fed5f4ad7d327a0a6eee 2b2c5915e86f5c4399e75af08982a3462b8b65478ef1c88592679fd3de147e0b1153e54c4e97c8e5 3119db0b0c62b47ec818386db914820c02f63071781403010001011603010020761ad2fae86d1219 94064ff99a0de5bc0eb15df5bafe1a75fcfa20f285db803a NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0235], Certificate chain-depth=1, error=0 --> User-Name = anoop07 --> BUF-Name = 07xwifi --> subject = /C=IN/ST=TN/O=Sify/CN=07xwifi --> issuer = /C=IN/ST=TN/O=Sify/CN=07xwifi --> verify return:1 chain-depth=0, error=0 --> User-Name = anoop07 --> BUF-Name = anoop07 --> subject = /C=IN/ST=TN/O=Sify/CN=anoop07/emailAddress=jeykumar_s(a)sify.com --> issuer = /C=IN/ST=TN/O=Sify/CN=07xwifi --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], CertificateVerify TLS_accept: SSLv3 read certificate verify A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010400350d800000002b1403010001011603010020324ac90185d18d e8ead736d798e140ed642aeb31ff52849b3aa5b6f021c5aec0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5ffef94eee0c0123922689d2e6c2fe8e Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 46e4c9b5 Cleaning up request 1 ID 1 with timestamp 46e4c9b5 Cleaning up request 2 ID 2 with timestamp 46e4c9b5 Cleaning up request 3 ID 3 with timestamp 46e4c9b5 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.0.50:1033, id=4, length=209 Message-Authenticator = 0x221fc85bf9fb820395d9c8484a3fdabc Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x5ffef94eee0c0123922689d2e6c2fe8e Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020400060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module \"preprocess\" returns ok for request 4 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 4 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module \"eap\" returns ok for request 4 modcall: leaving group authenticate (returns ok) for request 4 Sending Access-Accept of id 4 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x428d07c24a61cd12f49c7b51f54e36b19dce6fa5e42d393221d 043784abdc995 MS-MPPE-Send-Key = 0x55f256119e8b41171ac594ea1a871d302fff183d06365a3505b 6a6786eee1fc5 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = \"anoop07\" Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 4 with timestamp 46e4c9bc Nothing to do. Sleeping until we see a request. [root@anoop fr1.1.7]# > <freeradius-users(a)lists.freeradius.org> > Message-ID: <60722.76768.qm(a)web26011.mail.ukl.yahoo.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > hello, > running radius in debug mode doesn\'t give any log file ,i meen it > doesn\'t give logs in radiusd.log ; if you give me your result when you > have rubn radiusd -X -A perhaps i can help > > regards > >

3 2

can't start radius
by ann kok 10 Sep '07

10 Sep '07

Hi all When starting the radius, the error is showing "the file size is exceeding" check /var/log/freeradius/radwtmp is 2G 1/ how can I avoid it but we still keep the log file? 2/ ls the limitation in linux or in freeradius program? if it is in linux, can I increase the file size limit? I am using debian thank you ____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/

2 2

LOGs of eap-tls authentication
by anoop_c＠sifycorp.com 10 Sep '07

10 Sep '07

Hi 1 I am using eap-tls authentication.My setup is working well with certificates. I am unable to get logs of user login ok or denied in the radius.log file [root@anoop sbin]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = \"/usr/local/var/log/radius/radius.log\" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: user = \"(null)\" main: group = \"(null)\" main: usercollide = no main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = \"no\" main: nospace_pass = \"no\" main: checkrad = \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = \"(null)\" exec: input_pairs = \"request\" exec: output_pairs = \"(null)\" exec: packet_type = \"(null)\" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = \"Password: \" gtc: auth_type = \"PAP\" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \"(null)\" tls: pem_file_type = yes tls: private_key_file = \"/etc/1x/07xwifi.pem\" tls: certificate_file = \"/etc/1x/07xwifi.pem\" tls: CA_file = \"/etc/1x/root.pem\" tls: private_key_password = \"password\" tls: dh_file = \"/etc/1x/DH\" tls: random_file = \"/etc/1x/random\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = \"suffix\" realm: delimiter = \"@\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = \"/etc/raddb/users\" files: acctusersfile = \"/etc/raddb/acct_users\" files: preproxy_usersfile = \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port\" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. 2 I am using certificate based authentication so do i need to edit anything in the users file/ Thanks and regards Anoop

2 1

Freeradius+Active directory - router login authentciation
by Rakesh Jha 10 Sep '07

10 Sep '07

For Cisco router login /enable authentication I want to use active directory authentication. I have installed Red Hat Linux 4 (2.6.9-5.EL #1) with Samba. I have also installed OpenSSL 0.9.8e 23 Feb 2007 and FreeRadius 1.1.7. I see RHL OS installation also put openssl (some old version of 2003) in /usr/bin directory. After following FreeRADIUS Tutorial for AD integration I am not able to start radius daemon as it complains - radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. Please advise what am I missing? While compiling openssl and freeradius I am using default option. Somewhere I read - "you want to use TLS or TTLS or PEAP, but have compiled the server without TLS support. Install openssl and the corresponding development libraries (often called openssl-devel) and recompile the server." Also one link advises to configure freeradius as following - ./configure --with-rlm-eap-tls-include-dir=/usr/kerberos/include/ Here problem is that I donot see /usr/kerberos/include path. Please suggest the right option for compiling openssl, freeradius and advisory. Thanks & regards, Rakesh Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

2 1