October 2008 - Freeradius-Users - lists.freeradius.org

blocking anonymous outer identity
by Riccardo Veraldi 08 Oct '08

08 Oct '08

Hello, I have some anonymous outer identity in the autentication log of freeradius. I use freeradius version < 2.0 with EAP-TTLS and 802.1x on hte supplicant side. how can I forbid users to use an anonymous identity or to use an outer identity different from the real identity used for authentication/authorization ? I want to force users to use their own real identity based on their real credentials users@domainname without using an outer identity. I want to forbid this because if users use anonymous outer identity in the freeradius log I cannot see who is the user actually autenticating. any hints about this problem of mine ? thank you Rick

2 1

Programming freeradius to react in different way for accepts and rejects
by Diogo Montagner 08 Oct '08

08 Oct '08

Hello all, I'm looking for some tutorial that explain how I can programming the freeradius to work as described below. At my lab environment I have two situations: access-accept (the password is correct) and access-reject (the password is wrong). I would like to programming the freeradius to after the fifth try of an user to authenticate (all five tries was reject), the freeradius authenticate the user within a specific policy for this case. I know how to send different policies to user, but I don't know how to make freeradius answer accept after the fifth try of authentication. Example: user test passwd test123 time: 00:00:00 1st try: test passwd test456 -> radius answer reject 2nd try: test passwd test456 -> radius answer reject 3rd try: test passwd test456 -> radius answer reject 4th try: test passwd test456 -> radius answer reject 5th try: test passwd test456 -> radius answer reject time: 00:05:00 6th try: test passwd test456 -> radius answer accept but athenticate the user in a specific policy to block its access but keep it authenticated. If in five minutes the user has received more than 5 access-reject then I would like to authenticate and block its access with a specific policy. Thanks in advance! ./diogo -montagner

3 6

FreeNIBS
by rsg 08 Oct '08

08 Oct '08

Hi, Is FreeNIBS supported by FreeRADIUS 2.X ? Has anyone deployed this in conjunction with SQLIPPOOL for prepaid data charging ? Thanks for sharing your experiences. Regards, rg

3 2

CA.all and CA.certs in Freeradius 2.x
by Vegard Svanberg 08 Oct '08

08 Oct '08

The CA.all and CA.certs scripts seem to not be included in the Freeradius 2.x tarball anymore. Have they just been forgotten, or have they been replaced by other scripts, or are there other recommended ways of handling/generating certs in 2.x? -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

2 6

How do I tell if accounting module fails?
by Alex French 08 Oct '08

08 Oct '08

Hi all, I'm using an Exec-Program to do some user-specific stuff when a user logs out of our network (i.e. it is invoked with "DEFAULT Acct-Status-Type == Stop"). I'm trying to find a way for it to detect whether the database accounting module has succeedded in updating the user's accounting record or not (it will fail if the STOP packet is a duplicate). I can't find an attribute that I can test to check the status of the request at that stage. Any suggestions? Alex

4 7

Searching for an up to date tutorial for freeRADIUS + Active Directory
by Frederik.Niedernolte＠Bertelsmann.de 08 Oct '08

08 Oct '08

I want to set up a freeRADIUS server to work together with an active directory. The best tutorial I've found is http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO but it seems to be outdated because the part with the "Configuration of radius.conf" is based on an older version of freeRADIUS. I have installed 2.1.1 and there the radius.conf links to other modules / VHosts. What must I change to make it work with version 2.1.1? Thanks in advance. Best regards, F. Niedernolte

2 4

EAP-TLS & computer account(not user)
by Guk Victor 08 Oct '08

08 Oct '08

I use eap-tsl for the registration record of computer. It is necessary to open access to the network to pressure of Ctrl+Alt+Del. I will not understand what is the matter: rad_recv: Access-Request packet from host 10.0.1.2:5007, id=154, length=216 User-Name = "host/cit44" EAP-Message = 0x0202000f01686f73742f6369743434 Message-Authenticator = 0xda5f6a382f76e341ecd76c7fe2eda837 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 154 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x85f944d1ab810baf397561351f4da39d Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=155, length=335 User-Name = "host/cit44" EAP-Message = 0x020300740d800000006a160301006501000061030148eca4801a94d16d54f4d65aa34134bcbd1fb96c22cd0e25ccbbcb4298d76bee000018002f00350005000ac009c00ac013c0140032003800130004010000200000000a00080000056369743434000a00080006001700180019000b00020100 Message-Authenticator = 0x2e81df002f583a191f6f4845ac7caac4 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x85f944d1ab810baf397561351f4da39d Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 116 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0065], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 056e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0074], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 155 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x0104040a0dc00000063b160301004a02000046030148eca6691c134aa5dcae49113ba12777f17184a40c5aa0006278ed9da3dadb3e20ead1859034d686e829341c20201db4c23929ba343e371ace1058d1c5025949f9002f00160301056e0b00056a0005670002503082024c308201b5a003020102020101300d06092a864886f70d01010505003063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72301e170d3038313030313037343430315a EAP-Message = 0x170d3039313030313037343430315a305c310b3009060355040613025541311330110603550408130a5a61706f726f7a736865310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953310f300d0603550403130652414449555330819f300d06092a864886f70d010101050003818d0030818902818100ac35b8809afa0040f3ebc0af9fb56e2a4196f58fe6aee43df306d38e27a8d3da043dfffa300bf8e4b851e88612e6ddce19aaf601912a9a0cb400d736cef53ffdc07950598741653bd839b24e80399c02eaaa48627241d20b20be2df7311ce3b9f7524ffcb03045bcc56d3a0de7d3c382720512 EAP-Message = 0xbfb3d14e7b8418fcdd61f241930203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810037d0d8ed990d72b050cc7c62fb550e65ee8e6115634fa1cd470d344e19c5cf820e0de0c74db9da252d8c2dd9135c32311d9de10d77abe571ceb0c8e8451ba9f06a04aa12b18e917ccd85763f38d7daf3440f4c62c388019f79329d49fb8d2cae40d997db06a8ec8f5b02b92648fc7c9ebd8d75135e4fa4b804e33ec48db919400003113082030d30820276a003020102020900d603ee3f96fc604d300d06092a864886f70d01010505003063310b3009060355040613025541311330110603 EAP-Message = 0x550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72301e170d3038313030313037343330345a170d3130313030313037343330345a3063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f7230819f300d06092a864886f70d010101050003818d00308189028181009b2e0773ff8310e98addfa EAP-Message = 0xb3458c421c935ca651f8f7ca3899d6506d065de4f53f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x475d38bc73179456ecabe627f4c349ab Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=156, length=225 User-Name = "host/cit44" EAP-Message = 0x020400060d00 Message-Authenticator = 0x74221ef1383128241e231013179f3213 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x475d38bc73179456ecabe627f4c349ab Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 156 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x010502450d800000063b4837ac2b653e806f55c44239a6b0fb8de79a837bfe337e34804ee812673f27d00c28fb9735b2e7833b7a4211be3fbb997b2010c63c845b310be1ffd7226f4e9a7a238604f59873c29b47eb3a94fc3255baf8e09bc4580e685d6cef61016acd0203010001a381c83081c5301d0603551d0e041604144883dff930ad8def715cc306a93b716ed1dfa2f03081950603551d2304818d30818a80144883dff930ad8def715cc306a93b716ed1dfa2f0a167a4653063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c30 EAP-Message = 0x0a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72820900d603ee3f96fc604d300c0603551d13040530030101ff300d06092a864886f70d010105050003818100798409d24a31663705ea77a113da2d5283a687cc78561854f7205ff9e565cb2cbd7a133b1361b3bd93f58a0ac03872ca5fefccd451b7e1c7a5827ebe061ec2259436b5c3006895e8c49b356052161f6d3e4b9f7001397ca581bae2b178fc0da21f774a85f1290f71b82ee10bf23604613a0d354556ebf6d1937267a94f3a96ac16030100740d00006c020102006700653063310b3009060355040613025541311330110603550408130a5a61706f EAP-Message = 0x726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f720e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83c05bad6798917fd36b49f983ccfcb8 Finished request 2 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=157, length=1172 User-Name = "host/cit44" EAP-Message = 0x020503b30d80000003a916030103690b0002590002560002533082024f308201b8a003020102020105300d06092a864886f70d01010505003063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72301e170d3038313030383131303833375a170d3039313030383131303833375a305f310b300906035504061302554131123010060355040813094265726b73686972653110300e060355040713074e657762757279310c300a060355040a1303 EAP-Message = 0x7a617a310c300a060355040b13036d6973310e300c06035504031305636974343430819f300d06092a864886f70d010101050003818d0030818902818100b82b614adec29d80e4316eba19ee74db1f2ac3e542f25f193b28af28166a9c4e49321fce20195e01a1fe85977b0e86fa7836226953fff50f42d62d83d16555a0c7b48ab36a2c46edf58c9a1f4427e4a41c3e5e4f6d98cec0626fd0d6e16812ab9e469dd7000e738f037ab7f4c95c74eb627c1cf7adc4d7d42fb3e685ad5783e10203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100610a54b441c6152b00fb776a8833 EAP-Message = 0xfa33aacc278fc6b1f419aecf639a3459edc7450b12285ce1e75053100b955f3012b3f88c7934e0a6016c9c28145b08e0aafb3f581913ee2f24c9c114d470adc9bf591b84e1b9e2d7f1ab04120536145683843cc767aa0589358dec9230469924abe314fa034e47527778eae154b4bdc0fe521000008200800802c992280a9400196f4f6462e392dbb711a5a55d31704ca9492cf35befc97df7d31a9a05de4a01a8c8865125e451412fdabae12a0e94b745535cbb3426f0bbb42961cac7f8952e1a0e847ec175bbfea2f55a419d351a8892cf8290f489df15c478389a1cebcd6a59701fb9fd847a55df834ecf3ed7fdca679becd740db41e60f00008200 EAP-Message = 0x809ff27f75ca3b3daee7c93342cb9535179e2412c5eb27364503da2cc3162abd6ee34e6a6c89c20323c7ed38a52ecb0ec9b48f90078df77a5079b39ac46395bb31fe846f7ad584da3d3cf9d1959e4d70ed4ecbffbcbb22d68f5bb8915fe16de9b2f7899a3d96053f77e586b586af49fab7a378a582f030b3716d5ddcaff33c5ecc14030100010116030100301a884c8358de9a72b0cb658bfe1ffce51786d194e5e2161065e41f350d1fcb6db0f5dcb0e3205984d70521571606f823 Message-Authenticator = 0x0b3ffd5fd267d3e7de9d0ea79faf6edb NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x83c05bad6798917fd36b49f983ccfcb8 Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 025d], Certificate chain-depth=1, error=0 --> User-Name = host/cit44 --> BUF-Name = Administrator --> subject = /C=UA/ST=ZaporozshE/L=ZP/O=ZAZ/OU=MIS/CN=Administrator --> issuer = /C=UA/ST=ZaporozshE/L=ZP/O=ZAZ/OU=MIS/CN=Administrator --> verify return:1 radius_xlat: 'host/cit44' rlm_eap_tls: checking certificate CN (cit44) with xlat'ed value (host/cit44) rlm_eap_tls: Certificate CN (cit44) does not match specified value (host/cit44)! chain-depth=0, error=0 --> User-Name = host/cit44 --> BUF-Name = cit44 --> subject = /C=UA/ST=Berkshire/L=Newbury/O=zaz/OU=mis/CN=cit44 --> issuer = /C=UA/ST=ZaporozshE/L=ZP/O=ZAZ/OU=MIS/CN=Administrator --> verify return:0 rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal certificate_unknown TLS Alert write:fatal:certificate unknown TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 157 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x010600110d80000000071503010002022e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6422c1f11b093d41a5e6dd774b5b1cc8 Finished request 3 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=158, length=225 User-Name = "host/cit44" EAP-Message = 0x020600060d00 Message-Authenticator = 0x6405c8b36bf1e85aa28b4856efba37d7 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x6422c1f11b093d41a5e6dd774b5b1cc8 Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Login incorrect: [host/cit44/<no User-Password attribute>] (from client 10.0.1.2 port 117604353 cli 0013-7737-714e) Delaying request 4 for 1 seconds Finished request 4

2 1

Different configuration upon realm
by Dejan Markic 08 Oct '08

08 Oct '08

Hello all! I have a quick question. I have SQL based setup, little bit modified to suit our needs. Everything works well! We have username scheme like that: USER(a)OURDOMAIN.com<mailto:USER@OURDOMAIN.com> which goes through our SQL based authentication. Now, I would like to configure radius, to return different attributes for different domains (without SQL). So if user comes in with: Service-Type: Framed-User User-Name: USER(a)OTHERDOMAIN.com<mailto:USER@OTHERDOMAIN.com> ... I would like to reply with some AVPairs, without any password checks ... So, OURDOMAIN.com should go through normal process, but other domains, should go through this process. How is that possible to implement?! I was looking for examples, but didn't find any - or maybe I don't know what I'm looking for. Thanks for your help! Kind regards, Dejan Markic

2 1

Unresponsive Child in component authorize
by kesm0724 08 Oct '08

08 Oct '08

Does the "Unresponsive Child in module files component authorize" allude to something I have misconfigured in the virtual server or a process that is hung? I can certainly post the debug if it is necessary to troubleshoot this issue... Tue Oct 7 12:14:26 2008 : Error: Discarding duplicate request from client PCS port 1645 - ID: 4 due to unfinished request 8 Tue Oct 7 12:14:43 2008 : Error: WARNING: Unresponsive child (id 3054615440) for request 8, in module files component authorize Tue Oct 7 12:15:13 2008 : Error: Discarding duplicate request from client Chambersburg-Switch port 1645 - ID: 3 due to unfinished request 9 Tue Oct 7 12:15:19 2008 : Error: Discarding duplicate request from client Chambersburg-Switch port 1645 - ID: 3 due to unfinished request 9 Tue Oct 7 12:15:24 2008 : Error: Discarding duplicate request from client Chambersburg-Switch port 1645 - ID: 3 due to unfinished request 9 Tue Oct 7 12:15:40 2008 : Error: WARNING: Unresponsive child (id 3044125584) for request 9, in module files component authorize -- View this message in context: http://www.nabble.com/Unresponsive-Child-in-component-authorize-tp19864007p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Primary key in radacct table
by Santiago Balaguer García 08 Oct '08

08 Oct '08

Hi, I am using a freeradius 1.1.7 + postgres since 3 years ago. The AAA service works fine, however my radacct table has sonetimes duplicate registers. I realize that it happens when a NAS does not have a realiable Internet conection, so NAS send the accounting packets several times. My radacct table has 'radacctid' as primary key. I realize that two (or more) duplicate registers share 'acctsessionid' and 'acctuniqueid' fields amog others. I know 'acctsessionid' field can be the same in diferent NASes. Would be a good idea change the primery key by 'acctuniqueid' ? Santiago _________________________________________________________________ Llega la nueva temporada. Consulta las nuevas tendencias en MSN Estilo http://estilo.es.msn.com/moda/

6 8