March 2008 - Freeradius-Users - lists.freeradius.org

Attribute Mangling
by Lemaster, Rob 27 Mar '08

27 Mar '08

Does FR have the ability to modify attributes from proxy servers, eg; a) Apply only local attributes. b) Apply only attributes from remote proxy. c) Merge attributes with local preference. d) Merge attributes with remote preference. Where would I find more documentation on this? Thanks for your time! FreeRADIUS: Now with Dry-weave

2 1

Re: MACAddress silent authentication in LDAP using freeradius2.0.2
by Eric Martell 26 Mar '08

26 Mar '08

Hi Ivan, Sorry to get back to you early as I did not had ldap access :( After adding radiusAuthType on ONE uid it is working fine now. But now the issue is, I have some cases where the MAC address are stored multiple times in Ldap. Thus the ldap query is failing. Please check the log below. Can you please suggest me any workaround? Will really appreciate. Thanks and Regards. Test Case 1 :: 1 UID +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "0014F846C199", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for 0014F846C199 expand: %{Stripped-User-Name} -> expand: %{User-Name} -> 0014F846C199 expand: (&(did=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(did=0014F846C199)) expand: ou=roles,o=entitlement -> ou=roles,o=entitlement rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=roles,o=entitlement, with filter (&(did=0014F846C199)) rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute radiusAuthType as RADIUS attribute Auth-Type == Accept rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute roleid as RADIUS attribute rCidx = "111111" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user 0014F846C199 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [0014F846C199/<via Auth-Type = Accept>] (from client samir port 0) Sending Access-Accept of id 39 to 216.2.193.1 port 38625 Finished request 3. Test Case 2 :: Multiple UIDs rad_recv: Access-Request packet from host 216.2.193.1 port 37788, id=38, length=34 User-Name = "0014F846C199" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "0014F846C199", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for 0014F846C199 expand: %{Stripped-User-Name} -> expand: %{User-Name} -> 0014F846C199 expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(uid=0014F846C199)) expand: ou=roles,o=entitlement -> ou=roles,o=entitlement rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=roles,o=entitlement, with filter (&(uid=0014F846C199)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [0014F846C199/<no User-Password attribute>] (from client samir port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 0014F846C199 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, March 20, 2008 1:01:11 PM Subject: Re: MACAddress silent authentication in LDAP using freeradius2.0.2 > Bit confusing..do you want me to create entries in >ldap as, > No: uid = 001122334455 radiusAuthType = Accept Forget about the device entries. radius authenticates users. Have a look at the filter configured in ldap section of radiusd.conf >If yes, what additional changes I have to do in >freeradius and how I can return devicename along the >freeradius reply? And what would you do with that? Groups? Than create a group entries for them and use memberof in (mac) user entry. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 6

Segmantation Fault on -HUP
by Dmitry A. Sysoev 26 Mar '08

26 Mar '08

Good afternoon! [oracle@tim6a-aaa1 ~]$ uname -a Linux tim6a-aaa1 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686 i386 GNU/Linux [oracle@tim6a-aaa1 freeradius-1.1.7]$ /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 1.1.7, for host i686-pc-linux-gnu, built on Mar 26 2008 at 15:34:16 I have start the radiusd and it's ok, but when i send the signal HUP the radiusd is Segmantation Fault. Any ideas?

3 4

length of data greater than 253
by Cristian Novac 26 Mar '08

26 Mar '08

Hi all, I would like to know what happens with attributes whitch are greater than 253 B. Whether they are still sent or truncated, or... Thank you! Cristian NOVAC

1 0

dhcp+radius
by Kevin Zhang 25 Mar '08

25 Mar '08

Hi, How do I configure Radius server to work with DHCP server, so the client will authenticate with Radius first before DHCP will assign it an IP? Kevin SZ

3 6

802.1x maschine auth with SSL?
by mrhotstandby＠gmail.com 25 Mar '08

25 Mar '08

Heya, i'm a bit stuck. My xp box should auth with ssl cert - works ok so far. But how to assign vlan? When doing this with user, i put my user + pass into users file - works. But for ssl cert? I want my xp box authentificated by ssl cert and after that, my user should logon to "his" vlan. So that i have a "protected" vlan for "my" boxes (to avoid giving access to my auth server to foreign notebooks) and after that, if someone of my users log in, he will be transfered to his vlan... hope you understand... Thanksalot!

3 5

Re: Freeradius-Users Digest, Vol 35, Issue 80
by srdjan mish 25 Mar '08

25 Mar '08

No, it is ClearText-Password... I told, when I test with same attributes, but with RadiusTest software, it works... I think it is something about NAS Type or something like that....... I can post -X, but it only says Wrong password, nothing more... radiusd -X: ************************************************************************************************ FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Mar 10 2008 at 14:15:45 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/dialup1.conf including configuration file /etc/raddb/sql/mysql/dialup2.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 35000 allow_core_dumps = yes pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 0 status_server = yes } } client Router { ipaddr = 192.168.1.1 netmask = 16 require_message_authenticator = no secret = "secrettest" shortname = "LocalRouter" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server_pool my_auth_failover { type = fail-over home_server = localhost } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql_instance1 sql sql_instance1 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "lozinka" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 10 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = "UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "" accounting_start_query_alt = "UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 2 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql_instance1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_instance1): Attempting to connect to radius@localhost:/radius rlm_sql (sql_instance1): starting 0 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_instance1): Connected new DB handle, #0 rlm_sql (sql_instance1): starting 1 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_instance1): Connected new DB handle, #1 rlm_sql (sql_instance1): starting 2 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_instance1): Connected new DB handle, #2 rlm_sql (sql_instance1): starting 3 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_instance1): Connected new DB handle, #3 rlm_sql (sql_instance1): starting 4 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_instance1): Connected new DB handle, #4 rlm_sql (sql_instance1): starting 5 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql_instance1): Connected new DB handle, #5 rlm_sql (sql_instance1): starting 6 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql_instance1): Connected new DB handle, #6 rlm_sql (sql_instance1): starting 7 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql_instance1): Connected new DB handle, #7 rlm_sql (sql_instance1): starting 8 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql_instance1): Connected new DB handle, #8 rlm_sql (sql_instance1): starting 9 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql_instance1): Connected new DB handle, #9 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating sql_instance2 sql sql_instance2 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "lozinka" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT INTO online VALUES('%{User-Name}','%S')" accounting_start_query_alt = "" accounting_stop_query = "DELETE FROM online WHERE username='%{User-Name}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 2 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql_instance2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_instance2): Attempting to connect to radius@localhost:/radius rlm_sql (sql_instance2): starting 0 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_instance2): Connected new DB handle, #0 rlm_sql (sql_instance2): starting 1 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_instance2): Connected new DB handle, #1 rlm_sql (sql_instance2): starting 2 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_instance2): Connected new DB handle, #2 rlm_sql (sql_instance2): starting 3 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_instance2): Connected new DB handle, #3 rlm_sql (sql_instance2): starting 4 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_instance2): Connected new DB handle, #4 Module: Instantiating sql_instance3 sql sql_instance3 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "lozinka" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "UPDATE status SET status=1 where username='%{User-Name}'" accounting_start_query_alt = "" accounting_stop_query = "UPDATE status SET status=0 where username='%{User-Name}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 2 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql_instance3): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_instance3): Attempting to connect to radius@localhost:/radius rlm_sql (sql_instance3): starting 0 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_instance3): Connected new DB handle, #0 rlm_sql (sql_instance3): starting 1 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_instance3): Connected new DB handle, #1 rlm_sql (sql_instance3): starting 2 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_instance3): Connected new DB handle, #2 rlm_sql (sql_instance3): starting 3 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_instance3): Connected new DB handle, #3 rlm_sql (sql_instance3): starting 4 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_instance3): Connected new DB handle, #4 Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_ippool Module: Instantiating main_pool ippool main_pool { session-db = "/etc/raddb/db.ippool" ip-index = "/etc/raddb/db.ipindex" key = "%{NAS-IP-Address} %{NAS-Port}" range-start = 192.168.1.100 range-stop = 192.168.1.254 netmask = 255.255.255.255 cache-size = 154 override = no maximum-timeout = 0 } Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1812, id=76, length=57 User-Name = "testuser" CHAP-Password = 0xc51357f23c896c36ac81e6237b4934c122 NAS-IP-Address = 212.200.103.3 +- entering group authorize ++[preprocess] returns ok rlm_chap: Setting 'Auth-Type := CHAP' ++[chap] returns ok expand: %{User-Name} -> testuser rlm_sql (sql_instance1): sql_set_user escaped user --> 'testuser' rlm_sql (sql_instance1): Reserving sql socket id: 9 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql (sql_instance1): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority expand: SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE groupname = 'VPNUsers' ORDER BY id rlm_sql (sql_instance1): Released sql socket id: 9 ++[sql_instance1] returns ok rad_check_password: Found Auth-Type CHAP auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "testuser" with CHAP password rlm_chap: Using clear text password "nipal28ilula" for user nipalilula authentication. rlm_chap: Password check failed ++[chap] returns reject auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [nipalilula/<CHAP-Password>] (from client LocalRouter port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 76 to 192.168.1.1 port 1812 Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 0 ID 76 with timestamp +78 Ready to process requests. ********************************************************************************************* THX in advance.... > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: FreeRad 2.0.2, l2tp & CHAP problem > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <zHhPuP8b.1206438461.5050800.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Is the password in the database encrypted? If it is: > > http://deployingradius.com/documents/protocols/compatibility.html > > If it isn't - post the radiusd -X debug. > > Ivan Kalik > Kalik Informatika ISP >

2 1

Error when testing FreeRadius
by Moses Ndala 25 Mar '08

25 Mar '08

Dear all, I have installed FreeRadius in Windows XP Professional but I keep getting this error ehen testing: radclient:dict_init:couldn't open dictionary "freeradisu/etct/raddb/dictionary":No such file or directory. Is there anyone who has an idea about this error? Thanks in advance. Kind regards Moise Ndala _________________________________________________________________ Express yourself with free Messenger emoticons. Get them today! http://g.msn.ca/ca55/207

2 1

ldap+radius authentication problem
by amir shrestha 25 Mar '08

25 Mar '08

Dear all, I have configured freeradius with ldap backed as given in http://freeradius.org/radiusd/doc/ldap_howto.txt. The user get authorized but the authentication failed. The detail output is here: Ready to process requests. rad_recv: Access-Request packet from host a.b.c.d:3272, id=0, length=47 User-Name = "abc" User-Password = "12345" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for abc radius_xlat: '(uid=abc)' radius_xlat: 'ou=users,ou=radius,dc=whitehouse,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to x.x.x.x:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=Manager,dc=whitehouse,dc=edu/password to x.x.x.x:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=radius,dc=whitehouse,dc=edu, with filter (uid=abc) rlm_ldap: Added password 12345 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user abc authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "abc" with password "12345" rlm_ldap: user DN: uid=abc,ou=users,ou=radius,dc=whitehouse,dc=edu rlm_ldap: (re)connect to x.x.x.x:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=abc,ou=users,ou=radius,dc=whitehouse,dc=edu/12345 to x.x.x.x:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group LDAP (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Can anyone help me??

2 1

NTLM in MSCHAP
by David Hláčik 25 Mar '08

25 Mar '08

Hi, I have working configuration of PPTPD (Windows VPN) trought Radius to LDAP stored users. The think is ,that it accepts only plain text stored passwords in ldap becouse of very well known NT-Password for MSCHAPv2 I figure out there is an option to make it work with ntlm_auth in mschap configuration in radius. But when I enable it : #with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # Be VERY careful when editing the following line! # ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-Use r-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT- Response:-00}" } I am getting following error : rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 1 rlm_mschap: Told to do MS-CHAPv2 for boss with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 6b radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=boss --challenge=09c34801a6bafab3 --nt-response=e9aa9365702850c20847566b84c4c729efbac9d014ff1301' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=boss --challenge=09c34801a6bafab3 --nt-response=e9aa9365702850c20847566b84c4c729efbac9d014ff1301 Exec-Program output: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) Exec-Program-Wait: plaintext: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 1 But I am not sending a domain trought VPN connection (I have it clear). I have also tried #with_ntdomain_hack = yes But without result. Please help me, David

3 4