April 2008 - Freeradius-Users - lists.freeradius.org

yet ANOTHER EAP-TTLS/PAP with OpenLDAP problem ...
by Sylvain Robitaille 03 Apr '08

03 Apr '08

I've been working on this for a while, and have yet to find a way to configure this correctly, despite lots of reading through the mailing list archives, documentation included with FreeRADIUS, and third-party documentation. In fact, I've been trying to get this working for years with older versions of FreeRADIUS, and have succeeded only with FreeRADIUS<=1.1.6, using configurations that readers of this list are repeatedly told not to use (such as setting Auth-Type in the users file). [ASIDE] With the older versions of FreeRADIUS we're having performance problems with the authentication. Research on this list has uncovered no end of responses that such problems are normally caused by the back-end, not radiusd, but our backend (OpenLDAP) responds to an identical query as that sent by radius in approximately 6ms (7ms when it's slow), yet radiusd is still not responding after 30 seconds. We have thousands of users trying to use our service simultaneously, through hundreds of wireless access points. I would be willing to accept that the configuration I'm using (setting Auth-Type in users) causes radiusd to perform poorly, but that this isn't radiusd's "fault", since it's an un-advised configuration, but I just don't see that the problem we're seeing there is because the backend is slow to respond. Regardless of the cause here, I decided to upgrade to FreeRADIUS-2.0.3, hoping that a) I could get that configured according in a recommended way to accomplish what I want, and b) that this would result in better performance than we're seeing now. Getting TTLS/PAP/OpenLDAP working correctly with FreeRADIUS-2.0.3 is the problem I'd like to solve from this message. [/ASIDE] Converting from a working, though technically incorrect configuration to a "correct" configuration hasn't been particularly easy, but I believe I've accomplished that, with very little change to the default configurations (unified context diffs of my configurations against the defaults are appended below my signature for completeness). What I have seems to pass tests that have been recommended as "get these working before moving on", but I can't seem to figure out how to get from here to being able to unleash my access points on this and have successful authentications. I see (from -X output) that the TTLS tunnel is successfully built (that seems to be several steps), a query against LDAP for authorization (and to retrieve the user's encypted password) succeeds, but when the request finally gets to the authentication, radiusd reports: ... rlm_ldap: performing user authorization for j_doe expand: %{Stripped-User-Name} -> expand: %{User-Name} -> j_doe expand: (&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(search filter trimmed for brevity)) -> (&(cn=j_doe)(search filter trimmed for brevity)) expand: ou=people,dc=concordia,dc=ca -> ou=people,dc=concordia,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=concordia,dc=ca, with filter (&(cn=j_doe)(search filter trimmed for brevity)) rlm_ldap: Added User-Password = {SSHA}*SANITIZED*e2E52K+sO/SC+wvE*SANITIZED*== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user j_doe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [j_doe/*SANITIZED*] (from client wireless-mcconnell port 0) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: RT Modif EAP-Type = 0 EAP-LENGTH = 0 rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [j_doe/<via Auth-Type = EAP>] (from client wireless-mcconnell port 5800234 cli 0019.d290.6e22) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> j_doe attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. ... Now, of the above, beside the fact that the authentication failed when I believe it should have succeeded, I'm concerned about two items. First: WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. Is this caused by the following in raddb/sites-*/inner-tunnel? # If you want the inner tunnel request to be proxied, delete # the next few lines. # update control { Proxy-To-Realm := LOCAL } Do I worry about it, or just accept that radiusd cancels the request? Second: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! The text "User-Password" appears in exactly the following places in my raddb directory (not counting comment lines): ./attrs.pre-proxy: User-Password =* ANY, ./sql/mysql/dialup.conf: '%{%{User-Password}:-%{Chap-Password}}', \ ./sql/postgresql/dialup.conf: VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" These files are as shipped with FreeRADIUS-2.0.3. I'm trying to get this done with minimal change to the default configuration, since it appears that's what is expected. Which of the above needs to change? (attrs.pre-proxy?) The above issues of course still don't address what I see as the real problem: Login incorrect: [j_doe/*SANITIZED*] ... Somebody please tell me where I should be looking to make this work correctly. I can run the new server on an alternate port for the preliminary tests, such as using radtest against a user in LDAP (success), and radeapclient against a user in the users file (success using md5 as the default_eap_type, but not ttls), but I can't seem to get a successful test (using ttls; the passwords in LDAP aren't plain-text so md5 won't work for testing that) with radeapclient against a user in LDAP, or successful authentication when running in place of our current in-production RADIUS server. radtest against user in LDAP: radtest j_doe '*SANITIZED*' localhost:1814 1 testing123 User-Name = "syl" User-Password = "*SANITIZED*" NAS-IP-Address = 192.168.7.47 NAS-Port = 1 Older versions of radtest would report receiving "Access-Accept", while this one silently exists. However, radiusd in this case says: Ready to process requests. User-Name = "j_doe" User-Password = "*SANITIZED*" NAS-IP-Address = 192.168.7.47 NAS-Port = 1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "j_doe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for j_doe expand: %{Stripped-User-Name} -> expand: %{User-Name} -> j_doe expand: (&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(search filter trimmed for brevity)) -> (&(cn=j_doe)(search filter trimmed for brevity)) expand: ou=people,dc=concordia,dc=ca -> ou=people,dc=concordia,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost boris:389, authentication 0 rlm_ldap: bind as cn=iits_neg,ou=AdminRoles,dc=concordia,dc=ca/*SANITIZED* to localhost boris:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=concordia,dc=ca, with filter (&(cn=j_doe)(search filter trimmed for brevity)) rlm_ldap: Added User-Password = {SSHA}*SANITIZED*QDmffXBQkU42Wt9x*SANITIZED*== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user j_doe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "*SANITIZED*" rlm_pap: Using SSHA encryption. rlm_pap: Normalizing SSHA1-Password from base64 encoding rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [j_doe/*SANITIZED*] (from client localhost port 1) Finished request 0. Going to the next request Ok, good ... radeapclient against a user listed in the users file still performs the ldap query for authorization (I actually don't want that; I'd like the users file to over-ride the LDAP listing, if an entry is matched in the users file), but then seems to stop short of setting up the TTLS tunnel and performing any authentication: radeapclient says: +++> About to send encoded packet: User-Name = "j_doe" Cleartext-Password = "*SANITIZED*" NAS-IP-Address = 192.168.198.20 NAS-Port-Type = Wireless-802.11 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "j_doe" Message-Authenticator = 0x00 NAS-Port = 0 <+++ EAP decoded packet: Service-Type = Dialout-Framed-User EAP-Message = 0x01d300061520 Message-Authenticator = 0x796172e3b17c8b07c0409d2a811f0996 State = 0x99802cfd9953395efbafe88eb97f8c71 EAP-Id = 211 EAP-Code = Request EAP-Type-LEAP = 0x20 ^^^^ ???? I don't want LEAP! Where did it get this from? Radiusd says: rlm_ldap: performing search in ou=people,dc=concordia,dc=ca, with filter (&(cn=syl)(search filter trimmed for brevity)) rlm_ldap: Added User-Password = {SSHA}*SANITIZED*QDmffXBQkU42Wt9x*SANITIZED*== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user syl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 rlm_eap: RT Modif EAP-Type = 21 EAP-LENGTH = 1 ++[eap] returns handled Service-Type = Dialout-Framed-User EAP-Message = 0x01d300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x99802cfd9953395efbafe88eb97f8c71 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 243 with timestamp +465 Ready to process requests. I'm certainly prepared to be told that I'm doing it wrong, but in that case, I'd sure like to know WHAT I'm doing wrong, because I believe I've followed documented instructions completely, and haven't strayed any further than necessary from the default configuration as shipped with FreeRADIUS-2.0.3. Can someone please tell me where I should be looking? As promised, the unified context diff of my configuration against the default is appended below my signature. -- ---------------------------------------------------------------------- Sylvain Robitaille syl(a)alcor.concordia.ca Systems and Network analyst Concordia University Instructional & Information Technology Montreal, Quebec, Canada ---------------------------------------------------------------------- diff -ur raddb/clients.conf ../root-freeradius-2.0.3/etc/raddb/clients.conf --- raddb/clients.conf 2008-02-13 04:41:14.000000000 -0500 +++ ../root-freeradius-2.0.3/etc/raddb/clients.conf 2008-03-28 11:11:49.000000000 -0500 @@ -227,3 +227,96 @@ # secret = testing123 # } #} + +client hostname.concordia.ca { + secret = *SANITIZED* + shortname = LOCAL/LOCALTEST +} ### more entries in the same format, for other RADIUS clients ### diff -ur raddb/eap.conf ../root-freeradius-2.0.3/etc/raddb/eap.conf --- raddb/eap.conf 2008-02-26 04:32:29.000000000 -0500 +++ ../root-freeradius-2.0.3/etc/raddb/eap.conf 2008-03-28 12:15:53.000000000 -0500 @@ -27,7 +27,7 @@ # then that EAP type takes precedence over the # default type configured here. # - default_eap_type = md5 + default_eap_type = ttls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a @@ -145,7 +145,7 @@ cadir = ${confdir}/certs private_key_password = whatever - private_key_file = ${certdir}/server.pem + private_key_file = /public/apache/ssl/netnames-1_private.pem # If Private key & Certificate are located in # the same file, then private_key_file & @@ -157,7 +157,7 @@ # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. - certificate_file = ${certdir}/server.pem + certificate_file = /public/apache/ssl/netnames-1.pem # Trusted Root CA list # @@ -174,7 +174,7 @@ # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. - CA_file = ${cadir}/ca.pem + CA_file = /public/apache/ssl/cacert.pem # # For DH cipher suites to work, you have to --- raddb/radiusd.conf 2008-03-27 12:42:15.000000000 -0500 +++ ../root-freeradius-2.0.3/etc/raddb/radiusd.conf 2008-03-28 13:27:03.000000000 -0500 @@ -56,13 +56,13 @@ sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = /local/pkg/freeradius/root-freeradius-2.0.3/bin -logdir = ${localstatedir}/log/radius +logdir = ${localstatedir}/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} -run_dir = ${localstatedir}/run/radiusd +run_dir = ${localstatedir}/run # Should likely be ${localstatedir}/lib/radiusd db_dir = $(raddbdir) @@ -134,8 +134,8 @@ # that the debugging mode server is running as a user that can read the # shadow info, and the user listed below can not. # -#user = nobody -#group = nobody +user = nul-rad +group = nul-rad # max_request_time: The maximum time (in seconds) to handle a request. # @@ -191,7 +191,7 @@ # # Useful range of values: 256 to infinity # -max_requests = 1024 +max_requests = 262144 # listen: Make the server listen on a particular IP address, and send # replies out from that address. This directive is most useful for @@ -239,7 +239,8 @@ # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" - port = 0 + #port = 0 + port = 1814 # Some systems support binding to an interface, in addition # to the IP address. This feature isn't strictly necessary, @@ -274,7 +275,8 @@ listen { ipaddr = * # ipv6addr = :: - port = 0 + #port = 0 + port = 1815 type = acct # interface = eth0 # clients = per_socket_clients @@ -361,7 +363,7 @@ # # allowed values: {no, yes} # - auth = no + auth = yes # Log passwords with the authentication requests. # auth_badpass - logs password if it's rejected @@ -592,7 +594,7 @@ # with the correct value. It will also automatically handle # Base-64 encoded data, hex strings, and binary data. pap { - auto_header = no + auto_header = yes } # CHAP module @@ -737,12 +739,14 @@ # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. - server = "ldap.your.domain" - #identity = "cn=admin,o=My Org,c=UA" - #password = mypass - basedn = "o=My Org,c=UA" - filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" - #base_filter = "(objectclass=radiusprofile)" + server = "localhost another_host" + identity = "cn=iits_neg,ou=AdminRoles,dc=concordia,dc=ca" + password = "*SANITIZED*" + basedn = "ou=people,dc=concordia,dc=ca" + #filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" + filter = "(&(cn=%{%{Stripped-User-Name}:-%{User-Name}})(search filter trimmed for brevity))" + + base_filter = "(objectclass=ConcordiaPerson)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for @@ -820,7 +825,8 @@ # Novell may require TLS encrypted sessions before returning # the user's password. # - # password_attribute = userPassword + password_attribute = userPassword + password_radius_attribute = "SSHA-Password" # Un-comment the following to disable Novell # eDirectory account policy check and intruder diff -ur raddb/sites-available/default ../root-freeradius-2.0.3/etc/raddb/sites-available/default --- raddb/sites-available/default 2008-01-17 01:42:07.000000000 -0500 +++ ../root-freeradius-2.0.3/etc/raddb/sites-available/default 2008-03-28 10:14:12.000000000 -0500 @@ -132,7 +132,7 @@ # # The ldap module will set Auth-Type to LDAP if it has not # already been set -# ldap + ldap # # Enforce daily limits on time spent logged in. @@ -243,9 +243,9 @@ # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. -# Auth-Type LDAP { -# ldap -# } + Auth-Type LDAP { + ldap + } # # Allow EAP authentication. diff -ur raddb/sites-available/inner-tunnel ../root-freeradius-2.0.3/etc/raddb/sites-available/inner-tunnel --- raddb/sites-available/inner-tunnel 2008-02-26 04:32:29.000000000 -0500 +++ ../root-freeradius-2.0.3/etc/raddb/sites-available/inner-tunnel 2008-03-28 11:05:55.000000000 -0500 @@ -113,7 +113,7 @@ # # The ldap module will set Auth-Type to LDAP if it has not # already been set -# ldap + ldap # # Enforce daily limits on time spent logged in. @@ -201,9 +201,9 @@ # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. -# Auth-Type LDAP { -# ldap -# } + Auth-Type LDAP { + ldap + } # # Allow EAP authentication. diff -ur raddb/sites-enabled/default ../root-freeradius-2.0.3/etc/raddb/sites-enabled/default --- raddb/sites-enabled/default 2008-01-17 01:42:07.000000000 -0500 +++ ../root-freeradius-2.0.3/etc/raddb/sites-enabled/default 2008-03-28 10:14:12.000000000 -0500 @@ -132,7 +132,7 @@ # # The ldap module will set Auth-Type to LDAP if it has not # already been set -# ldap + ldap # # Enforce daily limits on time spent logged in. @@ -243,9 +243,9 @@ # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. -# Auth-Type LDAP { -# ldap -# } + Auth-Type LDAP { + ldap + } # # Allow EAP authentication. diff -ur raddb/users ../root-freeradius-2.0.3/etc/raddb/users --- raddb/users 2007-10-23 09:41:23.000000000 -0400 +++ ../root-freeradius-2.0.3/etc/raddb/users 2008-03-28 12:04:13.000000000 -0500 @@ -201,3 +201,343 @@ # Service-Type = Administrative-User # On no match, the user is denied access. + +# Wireless WDS: +username1 Auth-Type := EAP, Cleartext-Password := "*SANITIZED*" + Service-Type = Outbound-User + +# 2008/03/12 Sylvain Robitaille: for testing: +j_doe Cleartext-Password := "*SANITIZED*" + Service-Type = Outbound-User + #### Lots more in the same format, plus some of this type: + +# 2008/03/19 Sylvain Robitaille: copyright violation +blocked_user Calling-Station-ID == "0019.7e70.cdf9", Auth-Type := Reject + Reply-Message = "This system is blocked from our network ...." + +# Wireless (expect to need to list each access point) +DEFAULT NAS-Port-Type == Wireless-802.11 + Service-Type = Outbound-User +# Autz-Type := wireless +# Autz-Type := wireless, +# Fall-Through = Yes +# +#DEFAULT NAS-Port-Type == Wireless-802.11, EAP-Message !* "Matches if not EAP" +# Auth-Type := wireless + +#DEFAULT EAP-Type == EAP-TTLS, Proxy-To-Realm := LOCAL + +# On no match, the user is denied access.

8 30

copy-acct-to-home-server example. need help
by Mikhail Novikov 03 Apr '08

03 Apr '08

Hi, I use copy-acct-to-home-server example but the virtual server doesn't sends requests to the home server. I tried to proxy requests by Proxy-To-Realm attribute but it doesn't works. my configuration files: sites-available/copy-acct-to-home-server: server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail load_factor = 10 } preacct { update control { Proxy-To-Realm := "CLD" } } accounting { ok } pre-proxy { } post-proxy { } } proxy.conf: realm CLD { type = radius accthost = 10.6.1.91:1813 secret = testing123 } I'm newbie and have no experience with freeradius. Maybe I forgot to add something in configuration files... Log: Polling for detail file /usr/local/var/log/radius/radacct/detail Waking up in 0.9 seconds. User-Name = "test" User-Password = "pass" Framed-Protocol = PPP NAS-Port-Id = "11123" +- entering group accounting expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/detail-20080403 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20080403 expand: %t -> Thu Apr 3 20:01:53 2008 ++[detail] returns ok Finished request 0. Cleaning up request 0 ID 83 with timestamp +61 Going to the next request Waking up in 0.6 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail Thank you.

2 5

Re: Users cant connect Freeradius 2.0.2
by Gustavo Chavelas 03 Apr '08

03 Apr '08

Hi. I have the same problem and it's very strange. In other server I have CentOS 5 with freeradius-1.1.3-1.2.el5 (rpm) and its working without problem. My WindowsXP and WindowsCE clients connect fine. But I need to upgrade my version why my Windows VISTA clients can't connect. I'm installing the 2.0.3 version of freeradius but with a TARBALL file. I'm configuring the freeradius as old version, I don't copy the configurations files, I configure again the files. But when I to run radiusd -X my clients not connect. Sends an error of authentification. Someone know why? ------------------------------ Message: 8 Date: Wed, 2 Apr 2008 19:05:47 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Users cant connect Freeradius 2.0.2 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080402180547.GB2566(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Firstly, i have to install a new server and my freeradius 2.0.2 it's running > now. > Bur I have a new problem. > > With last version, my freeradius work fine, but with this new version, the > users can't connect. > > I'm attaching the raddiusd -X so, you've just installed 2.0.2 (why not 2.0.3???) - and your old version was working. what was your old version? did you just use the same config files? alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 36, Issue 15 ************************************************

2 1

Re: radius server cannot handle external request
by xia sihua 03 Apr '08

03 Apr '08

> Hi, > > > I have installed the latest freeradius server (version: 2.0.3) on my > > Fedora Core 5 i386 PC. Now it can work ok when I use "radtest test test > > localhost 0 testing123" to test local user from local. And under debug mode > > "radiusd -X" the server can print out relevant handle info. However, > > Configure another machine as a RADIUS client and send out request, and the > > server is silent, and stop "Ready to process requests.". That means the > > server cannot handle external radius request. > > default FC5 install? edit /etc/sysconfig/iptables then > 'service iptables restart' you'll need to allow UDP 1812 and 1813 > from the client address. not a freeradius problem. Yes, I use default configuration. The firewall discard the radius packet. After adding the rule allowing radius udp packet coming in, the server can handle the message. Thanks for you and Ivan Kalik. > > alan > -- Best regards！ walter *************************************** Nothing is impossible! ***************************************

1 0

RE: Hints & Huntgroups [SEC=UNCLASSIFIED] (Ranner, Frank MR)
by Dean Smith 03 Apr '08

03 Apr '08

Thanks Frank I'd tried two instances of preprocess but couldn't get it to work. I'll do some reading and try again. I have got the huntgroup now set in the Hints file though so immediate problem solved Thanks again Dean ------------------------------ Message: 4 Date: Thu, 3 Apr 2008 11:06:17 +1100 From: "Ranner, Frank MR" <Frank.Ranner(a)defence.gov.au> Subject: RE: Hints & Huntgroups [SEC=UNCLASSIFIED] To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Hints is processed first, then Huntgroups. You can set up 2 instances of preprocess, process huntgroups in the first instance and hints in the second. You can also set the Huntgroup item in hints as the result of an sql or ldap lookup. Once the huntgroup variable exists, further huntgroup sections exit immediately. Regards, Frank Ranner

1 0

Module-Success-Message / Module-Failure-Message
by Arran Cudbard-Bell 03 Apr '08

03 Apr '08

Hi, I noticed Module-Success-Message / Module-Failure-Message were listed in the internal dictionary .... Are they legacy attributes ? They don't seem to be being populated. Be really nice if they were populate with the nice new shiny Login OK / Login Fail messages... Login OK: [ac221/***** (from client hp-e-engg1-1-dev-8021x-sw1.net.susx.ac.uk port 1 cli 0080c8396796) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

I'm using chillispot + freeradius_2.0.3 + mysql ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 3, 2008 15:03:14 Subject: Re: freeradius_2.0.3+mysql SANDY KALUGDAN wrote: > why is my config always using Auth-type := CHAP???? Are you alway sending it CHAP requests? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

I don't know. It just says that my authentication is being done thru CHAP ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 3, 2008 15:03:14 Subject: Re: freeradius_2.0.3+mysql SANDY KALUGDAN wrote: > why is my config always using Auth-type := CHAP???? Are you alway sending it CHAP requests? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

why is my config always using Auth-type := CHAP???? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 3, 2008 13:17:36 Subject: Re: freeradius_2.0.3+mysql SANDY KALUGDAN wrote: > thanks for replying. > for testing purposes, i've use 's' as the password. > SQL password for user sandy is really 's' (a) you didn't type "s" as the user's password on the client (b) the client is broken, and does not do CHAP properly (c) the code in FreeRADIUS is broken, and does not do CHAP properly. There are few other options. Perhaps try a longer password. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Failed to insert event, freeradius 2.0.3
by Mikhail Novikov 03 Apr '08

03 Apr '08

Hi, I got this message and freeradius stoped work: Rejecting request 0 due to lack of any response from home server 192.168.0.10 port 1812 There was no response configured: rejecting request 0 Finished request 0. [event.c:969] Failed to insert event How can I fix that?

3 2