October 2008 - Freeradius-Users - lists.freeradius.org

Re: mschap No Cleartext-Password configured
by alois blasbichler 08 Oct '08

08 Oct '08

>> ablasbichler Cleartext-Password == "ablasbichler" >> With no success > > Should be := not ==. Hello Thank you for the the answers. I changed how you suggested but without success. Another thing : we use md5 encrypted passwords in our Ldap-DB for userpasswords - is it right that the line above in users overwrite this ? Here my log (tested with user test password alois) Why pap use CRYPT encryption not it should be cleartext ? by luis -------------------------------------------- server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop request done: ld 0x81a0ba8 msgid 7 ++[unix] returns updated [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test at line 3 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "alois" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CRYPT password check failed): [test] (from client ciscosw port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [test] (from client ciscosw port 29 cli 00-40-96-B4-5B-0F) Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 6 to 10.53.240.10 port 32769 EAP-Message = 0x04100004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.4 seconds.

3 5

Newbie question
by Jair Santos 07 Oct '08

07 Oct '08

Hi all, I just got into this list and I am trying to instal in a RedHat ES 5.2, 64 bits. I ran ./configure and when I ran make I got the following error. cc -o .libs/radmin .libs/radmin.o /usr/lib/libreadline.so /usr/lib/libtermcap.so .libs/util.o .libs/log.o .libs/conffile.o /home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src/lib/.libs /libfreeradius-radius.so -lnsl -lresolv -lpthread -lreadline -ltermcap -Wl,--rpath -Wl,/usr/local/lib /usr/lib/libreadline.so: could not read symbols: File in wrong format collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1' make: *** [all] Error 2 Does anybody know if it works with 64 bits OS. Any help will be very much appreciated. thank you Jair Santos

9 32

How to forward MAC-authentiation-requests over a FreeRADIUS-proxy to a FreeRADIUS-server?
by r.bruengel＠freenet.de 07 Oct '08

07 Oct '08

Hello everyone, I use MAC-authentication and got some problems by using a FreeRADIUS as a proxy to tunnel requests and answers between my switch and my normal FreeRADIUS-server. When I tested MAC-authentication with my switch and FreeRADIUS-server without anything between it worked fine. The MAC-address has been used as username and cleartext-password. Well, when I set up my FreeRADIUS-proxy and want to use it the following message appears in the radius.log of my FreeRADIUS-proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.58 port 1864 - ID 177 : IGNORED The port and the ID vary the port is counted up by every try and the ID well, I dont know. I just want to forward the MAC-address and the cleartext-password to my FreeRADIUS-server. When this data arrives at my FreeRADIUS-server it should be checked and the authentication answer should be sent back to my FreeRADIUS-proxy which forwards it to my switch. I hope that you can help me I just started to work with FreeRADIUS, so Im just a rookie. Heres some data: FreeRADIUS: V 2.0.4 Operating System: Debian Lenny (testing) Kernel: 2.6.25-2-686 Switch: Foundry EdgeIron 2402CF FreeRADIUS-server: 192.168.1.61 FreeRADIUS-proxy: 192.168.1.80 Switch: 192.168.1.58 The following configuration belongs to my FreeRADIUS-server: radiusd.conf listen { type = auth ipaddr = 192.168.1.61 #FreeRADIUS-server IP port = 1812 } [] proxy_requests = no clients.conf client 192.168.1.80 { secret = testing123 } The following configuration belongs to my FreeRADIUS-proxy: radiusd.conf listen { type = proxy ipaddr = 192.168.1.80 #FreeRADIUS-proxy IP port = 1812 } proxy.conf proxy server { default_fallback = no } home_server RADIUS_SERVER { type = auth ipaddr = 192.168.1.61 #FreeRADIUS-server IP port = 1812 secret = testing123 [] } home_server_pool RADIUS_SERVER_POOL { type = fail-over home_server = RADIUS_SERVER } realm RADIUS_REALM { auth_pool = RADIUS_SERVER_POOL } The following configuration belongs to my switch: RADIUS-Server: 192.168.1.80 #FreeRADIUS-proxy Port: 1812 Key: testing123 So, that should be the way: Switch -> FR-proxy -> FR-server 192.168.1.58 192.168.1.80 192.168.1.61 In advance: Thanks a lot for your help! Best regards from Germany, Raphael Brüngel

3 2

Sql-Group value
by donaldbjames＠suddenlinkmail.com 07 Oct '08

07 Oct '08

Hi, In freeradius 2, where is the value of "Sql-Group" set? I am using the mysql database. Is the value of Sql-Group set in one of the tables? Sincerely, Don James

2 2

freeradius 2 problem
by donaldbjames＠suddenlinkmail.com 07 Oct '08

07 Oct '08

Hi, I have a working radius server using freeradius 1.1.7. I am trying to upgrade to freeradius 2. Using radtest, I get a reply, but the radgroup reply data is not included in the reply. I probably have one of the configuration files done wrong. My question is: which configuration files are necessary when using freeradius 2? Sincerely, Don James

2 1

finally its working, but still no authentication againts AD
by luis a 07 Oct '08

07 Oct '08

hello again , finally my freeradius its working following all the steps from http://deployingradius.com/documents/configuration/active_directory.html but i have the same issue check my radius debug , thanks for read Luis. radiusd -X FreeRADIUS Version 2.1.1, for host x86_64-unknown-linux-gnu, built on Sep 27 2008 at 11:05:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/openradius/raddb/radiusd.conf including configuration file /etc/openradius/raddb/proxy.conf including configuration file /etc/openradius/raddb/clients.conf including files in directory /etc/openradius/raddb/modules/ including configuration file /etc/openradius/raddb/modules/exec including configuration file /etc/openradius/raddb/modules/etc_group including configuration file /etc/openradius/raddb/modules/mschap including configuration file /etc/openradius/raddb/modules/files including configuration file /etc/openradius/raddb/modules/logintime including configuration file /etc/openradius/raddb/modules/digest including configuration file /etc/openradius/raddb/modules/pap including configuration file /etc/openradius/raddb/modules/radutmp including configuration file /etc/openradius/raddb/modules/preprocess including configuration file /etc/openradius/raddb/modules/detail.example.com including configuration file /etc/openradius/raddb/modules/attr_filter including configuration file /etc/openradius/raddb/modules/always including configuration file /etc/openradius/raddb/modules/detail including configuration file /etc/openradius/raddb/modules/mac2ip including configuration file /etc/openradius/raddb/modules/smbpasswd including configuration file /etc/openradius/raddb/modules/krb5 including configuration file /etc/openradius/raddb/modules/passwd including configuration file /etc/openradius/raddb/modules/detail.log including configuration file /etc/openradius/raddb/modules/sradutmp including configuration file /etc/openradius/raddb/modules/attr_rewrite including configuration file /etc/openradius/raddb/modules/echo including configuration file /etc/openradius/raddb/modules/ippool including configuration file /etc/openradius/raddb/modules/checkval including configuration file /etc/openradius/raddb/modules/acct_unique including configuration file /etc/openradius/raddb/modules/pam including configuration file /etc/openradius/raddb/modules/expr including configuration file /etc/openradius/raddb/modules/sql_log including configuration file /etc/openradius/raddb/modules/inner-eap including configuration file /etc/openradius/raddb/modules/mac2vlan including configuration file /etc/openradius/raddb/modules/unix including configuration file /etc/openradius/raddb/modules/policy including configuration file /etc/openradius/raddb/modules/realm including configuration file /etc/openradius/raddb/modules/linelog including configuration file /etc/openradius/raddb/modules/wimax including configuration file /etc/openradius/raddb/modules/ldap including configuration file /etc/openradius/raddb/modules/chap including configuration file /etc/openradius/raddb/modules/expiration including configuration file /etc/openradius/raddb/modules/counter including configuration file /etc/openradius/raddb/eap.conf including configuration file /etc/openradius/raddb/sql.conf including configuration file /etc/openradius/raddb/sql/mysql/dialup.conf including configuration file /etc/openradius/raddb/sql/mysql/counter.conf including configuration file /etc/openradius/raddb/policy.conf including files in directory /etc/openradius/raddb/sites-enabled/ including configuration file /etc/openradius/raddb/sites-enabled/default including configuration file /etc/openradius/raddb/sites-enabled/inner-tunnel including dictionary file /etc/openradius/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=MINZ --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MINZ} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/openradius/raddb/certs/server.pem" certificate_file = "/etc/openradius/raddb/certs/server.pem" CA_file = "/etc/openradius/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/openradius/raddb/certs/dh" random_file = "/etc/openradius/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/openradius/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/openradius/raddb/users" acctusersfile = "/etc/openradius/raddb/acct_users" preproxy_usersfile = "/etc/openradius/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/openradius/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/openradius/raddb/huntgroups" hints = "/etc/openradius/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/openradius/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 43374, id=139, length=72 User-Name = "luis" User-Password = "test" NAS-IP-Address = 172.16.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "luis", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> luis attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 43374 Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +3 Ready to process requests.

2 3

Dynamic Clients with FreeRADIUS
by jasoneswan 07 Oct '08

07 Oct '08

Has anyone gotten dynamic-clients working with freeradius yet? I'm trying to accept clients from ANY IP, then looks up the IP in sql 'nas' table to see if it exists -- View this message in context: http://www.nabble.com/Dynamic-Clients-with-FreeRADIUS-tp19384912p19384912.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 11

NTLM_auth active directory - what is wrong?
by Santiago Matiz V 07 Oct '08

07 Oct '08

Hi all I follow the instructions of Alan : <http://deployingradius.com/documents/configuration/active_directory.html> to authenticate ntlm_auth with radius but appers the following message: " WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user." what is wrong? Please help. Santiago FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Sep 3 2008 at 15:55:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log_auth = yes log_auth_badpass = no log_auth_goodpass = no log_stripped_names = no } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.100.16.11 { require_message_authenticator = no secret = "123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DOMAIN.LOC { authhost = LOCAL accthost = LOCAL } realm DOMAIN { authhost = LOCAL accthost = LOCAL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-DOMAIN} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating realmslash realm realmslash { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.100.16.11 port 1308, id=0, length=217 Message-Authenticator = 0x92d1b860b93a1c6d28f08eaa37697101 Service-Type = Framed-User User-Name = "DOMAIN\\user\000" Framed-MTU = 1488 Called-Station-Id = "00-16-E0-04-FE-44:pcountry" Calling-Station-Id = "00-1B-77-4D-1A-74" NAS-Identifier = "PISO 7 UG SISTEMAS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001601434c49434f554e5452595c736d6174697a NAS-IP-Address = 192.100.16.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\user" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. ++[realmslash] returns ok rlm_realm: Request already proxied. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry user at line 178 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [DOMAIN\\user\000] (from client 192.100.16.11 port 1 cli 00-1B-77-4D-1A-74) Sending Access-Reject of id 0 to 192.100.16.11 port 1308 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.100.16.11 port 1310, id=0, length=217 Message-Authenticator = 0xf829fc414e9407ab04ede033d5a60941 Service-Type = Framed-User User-Name = "DOMAIN\\user\000" Framed-MTU = 1488 Called-Station-Id = "00-16-E0-04-FE-44:pcountry" Calling-Station-Id = "00-1B-77-4D-1A-74" NAS-Identifier = "PISO 7 UG SISTEMAS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001601434c49434f554e5452595c736d6174697a NAS-IP-Address = 192.100.16.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\user" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. ++[realmslash] returns ok rlm_realm: Request already proxied. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry user at line 178 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [DOMAIN\\user\000] (from client 192.100.16.11 port 1 cli 00-1B-77-4D-1A-74) Sending Access-Reject of id 0 to 192.100.16.11 port 1310 Finished request 1. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.100.16.11 port 1312, id=0, length=217 Message-Authenticator = 0xef8314925f34ccf891d91ca6fa18857d Service-Type = Framed-User User-Name = "DOMAIN\\user\000" Framed-MTU = 1488 Called-Station-Id = "00-16-E0-04-FE-44:pcountry" Calling-Station-Id = "00-1B-77-4D-1A-74" NAS-Identifier = "PISO 7 UG SISTEMAS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001601434c49434f554e5452595c736d6174697a NAS-IP-Address = 192.100.16.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\user" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. ++[realmslash] returns ok rlm_realm: Request already proxied. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry user at line 178 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [DOMAIN\\user\000] (from client 192.100.16.11 port 1 cli 00-1B-77-4D-1A-74) Sending Access-Reject of id 0 to 192.100.16.11 port 1312 Finished request 2. Going to the next request Waking up in 4.4 seconds. Cleaning up request 0 ID 0 with timestamp +113 Waking up in 0.2 seconds. Cleaning up request 1 ID 0 with timestamp +113 Waking up in 0.2 seconds. Cleaning up request 2 ID 0 with timestamp +114 Ready to process requests. Santiago Matiz (santimatiz(a)yahoo.com) Systems Engineer Bogotá, Colombia (South America)

4 8

$ORIGIN run-time path & libtool problem
by John Center 07 Oct '08

07 Oct '08

Hi, I'm having a problem compiling FreeRADIUS 2.1.1 on Solaris 10 using the Sun Studio 12 compiler. I'm trying to specify the run-time library path like: -R'$ORIGIN/../lib' But I'm getting the following error: libtool: link: only absolute run-paths are allowed If I remove the $ORIGIN run-time option, it compiles. Is there a setting for libtool I can make to fix this? Thanks. -John -- John Center Villanova University

2 2

How to implement Disconnect Request on Freeradius.
by Piero Santi 07 Oct '08

07 Oct '08

Hi, Could some body help me to know whether Radius disconnect and Ack messages are supported in freeradius as defined in RFC 2822 ? If it's supported how can i implement it on my freeradius ? Thanks, piero

3 6