January 2008 - Freeradius-Users - lists.freeradius.org

Re: Configuring LDAP for query ONLY...
by Eric Martell 05 Jan '08

05 Jan '08

Hi, Is it possible to altogether avoid authenticate section and just do ldap lookups in the authorize section? authorize { ldap { notfound = reject } } The problem is in the authenticate section, radius gets the userDN from the authorize and tries to "bind" ldap with password which we don't have. I also tried in users file Ldap-UserDN := `cn=Manager,dc=eng,dc=com/answer2` But for some reason it is not working. Please help. Let me know if you need more information or please guide me to any documentation. Thanks and Regards, Eric. --- Eric Martell <workoutexcite(a)yahoo.com> wrote: > I am little bit confused as how to configure > radiusd.conf in the authorize and/or authenticate > section. So password is going to act like ldap > attribute. > > We are going to pass, username and ldap attribute > (home phone #) as input for each user. > > The way it is configured now is in the modules, > > ldap { > server = "10.11.12.2" > identity = "cn=Manager,dc=eng,dc=com" > password = answer2 > basedn = "dc=eng,dc=com" > > filter = > "(&(uid=%{Stripped-User-Name:-%{User-Name}})(phone=1231313128))" > // just for testing > > ldap_connections_number = 5 > > timeout = 4 > > timelimit = 3 > > net_timeout = 1 > > } > > > > > > authorize { > .. > .. > .. > ldap > ... > > } > > authenticate { > Auth-Type LDAP { > ldap > } > } > > > In the logs it says: > > rlm_ldap: - authorize > rlm_ldap: performing user authorization for test1 > radius_xlat: '(&(uid=test1)(phone=1231313128))' > radius_xlat: 'dc=eng,dc=com' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: bind as cn=Manager,dc=eng,dc=com/answer2 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=eng,dc=com, with > filter (&(uid=test1)(phone=1231313128)) > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: user test1 authorized to use remote access > > > this is good.... > But in the authenticate section > > > rlm_ldap: - authenticate > rlm_ldap: login attempt by "test1" with password > "1231313128" > rlm_ldap: user DN: id=1967816, dc=eng,dc=com > rlm_ldap: bind as id=1967816, > dc=eng,dc=com/1231313128 > > rlm_ldap: waiting for bind result ... > rlm_ldap: id=1967816, dc=eng,dc=com bind to > 10.11.12.2:389 failed Inappropriate authentication > rlm_ldap: ldap_connect() failed > > > > Not sure why it is trying to bind as id=1967816, > dc=eng,dc=com/1231313128 > > The only thing I want to do it, just authorize the > ldap and pass the user through. > > > Please let me know if I am missing something. > > Thanks so much. > > Regards, > Erik. > > > > > ____________________________________________________________________________________ > Be a better sports nut! Let your teams follow you > with Yahoo Mobile. Try it now. > http://mobile.yahoo.com/sports;_ylt=At9_qDKvtAbMuh1G1SQtBI7ntAcJ > ____________________________________________________________________________________ Get easy, one-click access to your favorites. Make Yahoo! your homepage. http://www.yahoo.com/r/hs

5 20

latest CVS 2.0 beta hang problem
by A.L.M.Buxey＠lboro.ac.uk 05 Jan '08

05 Jan '08

hi, a 2.0 beta (latest CVS head) install server locked up on us today in its early test deployment case secnario a request was proxied off to another RADIUS server. no response came back. server totally fails to respond to anything else. the only entry in the 'radiusd -X' is the last 2 lines Fri Jan 4 13:40:23 2008 : Error: Rejecting request 12643 due to lack of any response from home server 10.1.2.3 port 1812 Fri Jan 4 13:40:23 2008 : Error: WARNING: Unresponsive child (id 0) for request 12643, in module <server-core> component <server-core> thats all. no further debug i'm afraid. alan

2 10

Virtual Hosts conflicting
by Nicholas Hall 04 Jan '08

04 Jan '08

Hello all *My Goal*: PAP on legacy port 1645, CHAP on 1812 working simultaneously. *My Environment*: FreeRADIUS 2.0.0-pre2, LDAP user database, MySQL Accounting. *Problem*: I'm running a virtual host for each AUTH port. Each works fine when placed in sites-enabled individually but my CHAP virtualhost fails when both are enabled. The vhost listening on 1812 appears to be referencing an LDAP module that is not listed in it's server{ ... } block. You will see "ou=Dialup" in the debugging output below of a CHAP request to 1812 that is only contained in the legacy PAP vhost. Any ideas are appreciated!! I have 4 LDAP servers configured, two point to a different OU on the same servers for legacy PAP users. Is there maybe a way to change the basedn on the fly with NAS-IP-Address as the condition? This may be easier than sorting out my mess. Right now i'm differentiating requests using clients.conf: # CHAP NAS *client x.x.x.x { secret = test shortname = test nastype = other server = alexssa_dsl } *##################### # Stripped LDAP config # ##################### *ldap ldap01.alexssa.net { <snip> basedn = "ou=users,ou=radius,dc=alexssa,dc=net" ldap ldap02.alexssa.net { <snip> basedn = "ou=users,ou=radius,dc=alexssa,dc=net" ldap ldap01.alexssa.net_dialin { <snip> basedn = "ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net" } ldap ldap02.alexssa.net_dialin { <snip> basedn = "ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net" }* ############################## # Below is my DSL (CHAP) vhost # ############################## *server alexssa_dsl { listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } authorize { if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) { update request { Stripped-User-Name = "%{1}" } } preprocess auth_log files redundant-load-balance { ldap01.alexssa.net ldap02.alexssa.net } daily chap } authenticate { Auth-Type CHAP { chap } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique files } # # Accounting. Log the accounting data. # accounting { # acctdetail sql # daily radutmp attr_filter.accounting_response } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } } # dsl server block* ###################### # Dialin (PAP) vhost # ###################### *server alexssa_dialin { listen { ipaddr = * port = 1645 type = auth } listen { ipaddr = * port = 1646 type = acct } authorize { if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) { update request { Stripped-User-Name = "%{1}" } } preprocess auth_log files redundant-load-balance { ldap01.alexssa.net_dialin ldap02.alexssa.net_dialin } daily pap } authenticate { Auth-Type PAP { pap } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique files } # # Accounting. Log the accounting data. # accounting { # acctdetail sql # daily dialup radutmp attr_filter.accounting_response } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } }* } # dialin server block ####################################### # debugging output of CHAP request to 1812 # ####################################### Listening on authentication address * port 1812 as server alexssa_dsl Listening on accounting address * port 1813 as server alexssa_dsl Listening on authentication address * port 1645 as server alexssa_dialin Listening on accounting address * port 1646 as server alexssa_dialin Ready to process requests. Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 38.119.185.62 port 3563, id=15, length=63 User-Name = "1000copyme(a)alexssa.net" CHAP-Password = 0x0f4e646219d84c7c72d88e920c879d2a01 server alexssa_dsl { +- entering group authorize ++? if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) expand: %{User-Name} -> 1000copyme(a)alexssa.net ? Evaluating ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) -> TRUE ++? if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) -> TRUE ++- entering if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) expand: %{1} -> 1000copyme +++[request] returns notfound ++- if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) returns notfound ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/38.119.185.62/auth-detail-20080103 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/38.119.185.62/auth-detail-20080103 expand: %t -> Thu Jan 3 15:19:46 2008 ++[auth_log] returns ok rlm_ldap: Entering ldap_groupcmp() expand: ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net -> ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net expand: %{Stripped-User-Name} -> 1000copyme expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap02.alexssa.net:389, authentication 0 rlm_ldap: bind as cn=xxxxx,dc=alexssa,dc=net/xxxxxx to ldap02.alexssa.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() expand: ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net -> ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net expand: %{Stripped-User-Name} -> 1000copyme expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 16 ++[files] returns ok ++- entering redundant-load-balance group rlm_ldap: - authorize rlm_ldap: performing user authorization for 1000copyme(a)alexssa.net expand: %{Stripped-User-Name} -> 1000copyme expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme) expand: ou=users,ou=radius,dc=alexssa,dc=net -> ou=users,ou=radius,dc=alexssa,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap02.alexssa.net:389, authentication 0 rlm_ldap: bind as cn=xxxxx,dc=alexssa,dc=net/xxxxxx to ldap02.alexssa.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme) rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "test1234" rlm_ldap: looking for reply items in directory... rlm_ldap: user 1000copyme(a)alexssa.net authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap02.alexssa.net] returns ok ++- redundant-load-balance group returns ok rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP ++[chap] returns noop rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [1000copyme(a)alexssa.net/<CHAP-Password>] (from client test port 0) } # server alexssa_dsl Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 1000copyme(a)alexssa.net attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Sending delayed reject for request 0 Sending Access-Reject of id 15 to 38.119.185.62 port 3563 Reply-Message = "Please call the helpdesk. Alexssa can be reached at 262-338-3742" Waking up in 4 seconds... Cleaning up request 0 ID 15 with timestamp +17 Nothing to do. Sleeping until we see a request. -- Nicholas Hall ngharo(a)gmail.com 262.208.6271

4 5

2nd instance of freeradius 1.1.7 fails to run
by Jack Murgia 04 Jan '08

04 Jan '08

I'm trying to run 2 separate instances of freeradius for testing another .sql authorization database. I've created a second .conf file location- /etc/raddb2 and similarly created locations for the run and log files (/var/log/radiusd2, /var/run/radiusd2) and edited the 2nd radiusd.conf file appropirately, so I thought- binding it to an IP not used by my other instance of the freeradius server and specifying port 1820 in my second radiusd.conf file. But when I try to run in debug mode, I get this: [root@srv run]# /usr/sbin/radiusd2 -d /etc/raddb2 -XX Fri Jan 4 18:38:47 2008 : Info: Starting - reading configuration files ... Fri Jan 4 18:38:47 2008 : Debug: reread_config: reading radiusd.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/proxy.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/clients.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/snmp.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/eap.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/sql.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/sqlcounter.conf Fri Jan 4 18:38:47 2008 : Debug: main: prefix = "/usr" Fri Jan 4 18:38:47 2008 : Debug: main: localstatedir = "/var" Fri Jan 4 18:38:47 2008 : Debug: main: logdir = "/var/log/radius2" Fri Jan 4 18:38:47 2008 : Debug: main: libdir = "/usr/lib" Fri Jan 4 18:38:47 2008 : Debug: main: radacctdir = "/var/log/radius2/radacct" Fri Jan 4 18:38:47 2008 : Debug: main: hostname_lookups = no Fri Jan 4 18:38:47 2008 : Debug: main: snmp = no Fri Jan 4 18:38:47 2008 : Debug: main: max_request_time = 30 Fri Jan 4 18:38:47 2008 : Debug: main: cleanup_delay = 5 Fri Jan 4 18:38:47 2008 : Debug: main: max_requests = 1024 Fri Jan 4 18:38:47 2008 : Debug: main: delete_blocked_requests = 0 Fri Jan 4 18:38:47 2008 : Debug: main: port = 1820 Fri Jan 4 18:38:47 2008 : Debug: main: allow_core_dumps = no Fri Jan 4 18:38:47 2008 : Debug: main: log_stripped_names = no Fri Jan 4 18:38:47 2008 : Debug: main: log_file = "/var/log/radius2/radius.log" Fri Jan 4 18:38:47 2008 : Debug: main: log_auth = no Fri Jan 4 18:38:47 2008 : Debug: main: log_auth_badpass = no Fri Jan 4 18:38:47 2008 : Debug: main: log_auth_goodpass = no Fri Jan 4 18:38:47 2008 : Debug: main: pidfile = "/var/run/radiusd2/radiusd2.pid" Fri Jan 4 18:38:47 2008 : Debug: main: bind_address = 6X.XX.XXX.XXX IP address [69.59.117.122] Fri Jan 4 18:38:47 2008 : Debug: main: user = "(null)" Fri Jan 4 18:38:47 2008 : Debug: main: group = "(null)" Fri Jan 4 18:38:47 2008 : Debug: main: usercollide = no Fri Jan 4 18:38:47 2008 : Debug: main: lower_user = "no" Fri Jan 4 18:38:47 2008 : Debug: main: lower_pass = "no" Fri Jan 4 18:38:47 2008 : Debug: main: nospace_user = "no" Fri Jan 4 18:38:47 2008 : Debug: main: nospace_pass = "no" Fri Jan 4 18:38:47 2008 : Debug: main: checkrad = "/usr/sbin/checkrad" Fri Jan 4 18:38:47 2008 : Debug: main: proxy_requests = yes Fri Jan 4 18:38:47 2008 : Debug: proxy: retry_delay = 5 Fri Jan 4 18:38:47 2008 : Debug: proxy: retry_count = 3 Fri Jan 4 18:38:47 2008 : Debug: proxy: synchronous = no Fri Jan 4 18:38:47 2008 : Debug: proxy: default_fallback = yes Fri Jan 4 18:38:47 2008 : Debug: proxy: dead_time = 120 Fri Jan 4 18:38:47 2008 : Debug: proxy: post_proxy_authorize = no Fri Jan 4 18:38:47 2008 : Debug: proxy: wake_all_if_all_dead = no Fri Jan 4 18:38:47 2008 : Debug: security: max_attributes = 200 Fri Jan 4 18:38:47 2008 : Debug: security: reject_delay = 1 Fri Jan 4 18:38:47 2008 : Debug: security: status_server = no Fri Jan 4 18:38:47 2008 : Debug: main: debug_level = 0 Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading dictionary Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading naslist Fri Jan 4 18:38:47 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading clients Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading realms Fri Jan 4 18:38:47 2008 : Error: There appears to be another RADIUS server running on the authentication port 1820 netstat -tunelup shows only this for radiusd: udp 0 0 69.59.138.117:1812 0.0.0.0:* 0 22764540 16572/radiusd udp 0 0 69.59.138.117:1813 0.0.0.0:* 0 22764541 16572/radiusd -- Jack Murgia General Manager HubbaDubba Internet Services http://www.hubbadubba.com

1 0

Nübie
by Javier Basisty 04 Jan '08

04 Jan '08

Hi list, i realy need help. Im trying to use pppoe-server + Freeradius + OpenLDAP. My problem is Freeradius + LDAP. I followed the manual, step by step, but it doesnt work. My radius.conf is: ldap { server = "127.0.0.1" basedn = "dc=PPP,dc=cicomsa" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no #access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 #password_header = "{clear}" password_attribute = "userPassword" edir_account_policy_check=no # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # set_auth_type = yes } authorize { ldap } authenticate { Auth-Type LDAP { ldap } } and my ldif schema is: dn: uid=pepe,ou=People,dc=PPP,dc=cicomsa structuralObjectClass: account objectClass: top objectClass: account objectClass: posixAccount cn: pepe uid: pepe userPassword: 123 uidNumber: 1001 gidNumber: 1024 homeDirectory: /home/pepe1 loginShell: /bin/bash When i try to test the radius server i got this problem: [root@tna-080 javier.basisty]# radtest pepe 123 127.0.0.1:0 1 testing123 Sending Access-Request of id 131 to 127.0.0.1 port 1812 User-Name = "pepe" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Re-sending Access-Request of id 131 to 127.0.0.1 port 1812 User-Name = "pepe" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=131, length=20 [root@tna-080 javier.basisty]# and the log is: Fri Jan 4 15:11:53 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Jan 4 15:11:53 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Jan 4 15:11:54 2008 : Info: Ready to process requests. Fri Jan 4 15:11:59 2008 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Fri Jan 4 15:11:59 2008 : Auth: Login incorrect: [pepe/123] (from client localhost port 2) Is there something missing? Where is my error? is the ldif wrong or the config file? Please, if somebody can send me a tutorial will be glad! Regards

2 1

Freeradius and eDirectory
by Generic Generic 04 Jan '08

04 Jan '08

Hi, I'm setting up Freeradius 1.1.4 on a SUSE 10 server for our wireless users with XP SP2 using PEAP. Because we use eDirectory I strip the computer name from the username, not every users uses the Novell client. The user get authorize but I can't get the authentication to work. For some reason the first character of the users password is change for a "a", if the first character is a "a" then it is change for something else. ??? I installed the 885453 and 917021 patches for Windows XP SP2 and changed the supplicant mode to 3, didn't help. This problem does not occur with users using the Novell client SP4. I included a few lines from the debug, the password should be mypassw instead of aypassw. Robert rlm_ldap: bind as cn=User1,ou=Techs,o=ORG/aypassw to rep01.mydomain.ca:389 <http://rep01.mydomain.ca:389/> ... res_errno: 49, res_error: <NDS error: failed authentication (-669)>, res_matched: <>

3 2

Radius Load-Balancing concept
by Sebastian Ganschow 04 Jan '08

04 Jan '08

Hi, we're planing to reinstall our Radius servers. Currently we have two servers running, each with an own mysql server for the accounting records. If server 1 fails server 2 takes over. The accounting data is exchange with radrelay, I'm thinking to switch from this fail-over concept to a load-balancing concept and I would like to ask, if this concept would work. I want to install 2 radius servers and a postgres database cluster. Both radius servers will write their accounting data into the same database. Some of our NASes will use the first, the others the second server as primary radius server. If one of the server fails the other server will take over all NASes. Does it work, if both servers will write into the same database? Do I need to set up radrelay to exchange the accounting data between the two servers? Will this concept work in general? Thanks in advance Regards Sebastian

5 8

Authentication type (ldap, users, etc) per client or user?
by falz 04 Jan '08

04 Jan '08

Hello, I have a FreeRADIUS server working properly with an LDAP backend. I've brought some user config into the 'users' file for a legacy system we're migrating to this server. However, I cannot seem to find the appropriate way to have FreeRADIUS map clients to a specific authentication type. In my example I want everything to use LDAP, except one client to use the legacy 'users' file syntax. The closest example to this that I can find is here: https://lists.freeradius.org/pipermail/freeradius-users/2005-April/043218.h… However, this deals with multple LDAP instances, and it does not like syntax of my chaning: files { } to: files foo {} and the other steps that seem logical when looking at the above. Is there any way to do this off of a single FreeRADIUS install? Any suggestions appreciated! Thanks, --falz

3 5

Freeradius support
by Andreas Moroder 04 Jan '08

04 Jan '08

Hello, I asked Kostas Kalevras for paid support. I got support from him in November but since then I get no answer to my mails. Maybe he reads this mailing list and answers to my mails or anyone that is in contact with him can ask him to answer. Happy New Year Andreas

1 0

Problem with pptp and freeradius
by Danny Milshtein 03 Jan '08

03 Jan '08

Hi, When trying to connect from VPN client with chap method I get the following error messages from VPN server - GRE: Bad checksum from pppd - rc_avpair_new: unknown attribute When testing without radius plug-in (chap-secret file) work fine I'm using pptp version 1.3 freeradius 1.1.3 Attached my configuration files Thanks Danny # /var/log/messages # Jan 3 14:42:32 host-8-220 pptpd[31170]: CTRL: Client 192.168.8.244 control connection started Jan 3 14:42:32 host-8-220 pptpd[31170]: CTRL: Starting call (launching pppd, opening GRE) Jan 3 14:42:32 host-8-220 pppd[31171]: Plugin radius.so loaded. Jan 3 14:42:32 host-8-220 pppd[31171]: RADIUS plugin initialized. Jan 3 14:42:32 host-8-220 pppd[31171]: Plugin radattr.so loaded. Jan 3 14:42:32 host-8-220 pppd[31171]: RADATTR plugin initialized. Jan 3 14:42:32 host-8-220 pppd[31171]: pppd options in effect: Jan 3 14:42:32 host-8-220 pppd[31171]: debug # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: idle 30 # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: dump # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: plugin radius.so # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: plugin radattr.so # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: auth # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: name pptp # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: 115200 # (from command line) Jan 3 14:42:32 host-8-220 pppd[31171]: lock # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: local # (from command line) Jan 3 14:42:32 host-8-220 pppd[31171]: asyncmap 0 # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: mru 1000 # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: mtu 1000 # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: lcp-echo-failure 3 # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: lcp-echo-interval 10 # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: ipparam 192.168.8.244 # (from command line) Jan 3 14:42:32 host-8-220 pppd[31171]: proxyarp # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: 192.168.1.107:192.168.2.1 # (from command line) Jan 3 14:42:32 host-8-220 pppd[31171]: nobsdcomp # (from /etc/ppp/options.pptpd) Jan 3 14:42:32 host-8-220 pppd[31171]: pppd 2.4.4 started by root, uid 0 Jan 3 14:42:32 host-8-220 pppd[31171]: Using interface ppp0 Jan 3 14:42:32 host-8-220 pppd[31171]: Connect: ppp0 <--> /dev/pts/2 Jan 3 14:42:32 host-8-220 pptpd[31170]: GRE: Bad checksum from pppd. Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 6 Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 7 Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 1 Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 60 Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 3 Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 31 Jan 3 14:42:32 host-8-220 pppd[31171]: rc_avpair_new: unknown attribute 32 Jan 3 14:42:32 host-8-220 pppd[31171]: Peer username failed CHAP authentication Jan 3 14:42:32 host-8-220 pppd[31171]: Connection terminated. Jan 3 14:42:32 host-8-220 pppd[31171]: Exit. Jan 3 14:42:32 host-8-220 pptpd[31170]: GRE: read(fd=6,buffer=804e560,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Jan 3 14:42:32 host-8-220 pptpd[31170]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) Jan 3 14:42:32 host-8-220 pptpd[31170]: CTRL: Client 192.168.8.244 control connection finished # /etc/ppp/options.pptpd # name pptp debug dump lock nobsdcomp auth mtu 1000 mru 1000 lcp-echo-failure 3 lcp-echo-interval 10 idle 30 plugin radius.so plugin radattr.so # /etc/radiusclient/radiusclient.conf # auth_order radius login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver localhost:1812 acctserver localhost:1813 servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 nas_identifier surdemo login_local /bin/login # /etc/radiusclient/servers # localhost test123 Danny Milshtein VideoCells Ltd. Tel +972-3-9291516 Fax +972-3-9291513 Mobile +972-52-8388561 HYPERLINK "mailto:danny@videocells.com"danny(a)videocells.com No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1207 - Release Date: 1/2/2008 11:29 AM

3 2