April 2008 - Freeradius-Users - lists.freeradius.org

Accounting logs
by Sergio Belkin 25 Apr '08

25 Apr '08

I see any detail-%Y%m%d log files but only auth-detail-%Y%m%d files. What am I doing wrong? My config files: radiusd.conf: prefix = /usr/local-2.0.2 exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = 190.125.213.5 port = 0 } listen { ipaddr = 190.125.213.5 port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 190 reject_delay = 1 status_server = yes } proxy_requests = no $INCLUDE proxy.conf $INCLUDE clients.conf snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { radwtmp = ${logdir}/radwtmp } $INCLUDE eap.conf mschap { } ldap { server = "ldap.cadorna.biz identity = "cn=freeradius,ou=applications,dc=cadorna,dc=biz" port = 636 password = jejeje0essoleplop basedn = "ou=people,dc=cadorna,dc=biz" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile = /etc/raddb-2.0.2/cacert.pem randfile = /dev/urandom require_cert = "allow" } access_attr = "radiusAllowed" dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } realm IPASS { format = prefix delimiter = "/" } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" } realm ntdomain { format = prefix delimiter = "\\" } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" suppress { User-Password } } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d suppress { User-Password } } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter attr_filter.post-proxy { attrsfile = ${confdir}/attrs } attr_filter attr_filter.pre-proxy { attrsfile = ${confdir}/attrs.pre-proxy } attr_filter attr_filter.access_reject { key = %{User-Name} attrsfile = ${confdir}/attrs.access_reject } attr_filter attr_filter.accounting_response { key = %{User-Name} attrsfile = ${confdir}/attrs.accounting_response } counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } $INCLUDE sql/mysql/counter.conf always fail { rcode = fail } always reject { rcode = reject } always noop { rcode = noop } always handled { rcode = handled } always updated { rcode = updated } always notfound { rcode = notfound } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } expiration { reply-message = "Password Has Expired\r\n" } logintime { reply-message = "You are calling outside your allowed timespan\r\n" minimum-timeout = 60 } exec { wait = yes input_pairs = request shell_escape = yes output = none } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } policy { filename = ${confdir}/policy.txt } } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ EOF acct_users: DEFAULT Ldap-UserDN = `uid=%{User-Name},ou=people,dc=cadorna,dc=biz` EOF sites-enabled/default: authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } EOF thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 2

RE: MAC Authentication and
by Ivan Kalik 25 Apr '08

25 Apr '08

>Another interesting point is: do I right understand that I need to restart >freeradius every time when I correct users file? Is is complicated for me, >what is other way? Maybe store MAC's in LDAP or SQL database? > >Alexey > Yes, if you store details in users file you will need to restart for new entries to take effect. If you store them in sql or ldap you can manage them independantly of freeradius. Ivan Kalik Kalik Informatika ISP

1 0

Re: MAC Authentication and
by Ivan Kalik 25 Apr '08

25 Apr '08

Don't use the password. 00-22-de-4e-8f-1d Auth-Type:= Accept You are lucky that they are all sending mac addresses in same format. One could be using - for delimiter, another : and the third one no delimiter. Then you would need to store usernames (mac addresses) without delimiters and remove delimiters from usernames that are recieved with them. Ivan Kalik Kalik Informatika ISP Dana 25/4/2008, "Alexey Eronko" <alexey.eronko(a)gmail.com> piše: >Hello All, > > I'm setupping my corporate wifi with freeradius as RADIUS >server. I want to implement WEP network with MAC Authentication thought >freeradius. I have three access point and I want to store mac database in >text file. > > Here is an example: > >00-22-de-4e-8f-1d Auth-Type:=Local, User-Password == "secret1" > > Here is my MAC request: > >Packet-Type = Access-Request > >Thu Apr 24 11:42:49 2008 > > User-Name = "00-1c-26-20-9c-00" > > User-Password = "secret1" > > NAS-IP-Address = 192.168.11.1 > > Called-Station-Id = "00-20-a6-87-86-09:WEP" > > Calling-Station-Id = "00-1c-26-20-9c-00;WEP" > > NAS-Port = 2 > > NAS-Port-Type = Wireless-802.11 > > Client-IP-Address = 192.168.11.1 > > > >The user-password field takes from radius clients(ap) configuration of >freeradius. The problem is that I have different radius access password for >three access points. I want to have one list for all AP. > >Is the way to setup _one_ radius password for all AP only one? > >Another interesting point is: do I right understand that I need to restart >freeradius every time when I correct users file? Is is complicated for me, >what is other way? Maybe store MAC's in LDAP or SQL database? > > > >Thanks > > > >Alexey > > >

2 1

Event-Timestamp
by Arran Cudbard-Bell 25 Apr '08

25 Apr '08

Hi, Three questions: * In the default SQL accounting schemas %S is used over the Event-Timestamp attribute included in the accounting packet. I guess this is because of the potential drift between NAS, and it makes correlation easier. Is this the real reason or is it just an omission ? * RFC 2869 Specifies the format of Event-Timestamp to be number of seconds since the Unix Epoch. Yet FR prints it as Event-Timestamp = "Apr 24 2008 20:06:52 BST". Is this FR's interpretation of the integer timestamp as a date string or is the NAS sending the timestamp as a string? * In accounting detail packets, a timestamp attribute is included. But I can't figure out how to access it as an attribute when the detail entries are read back into the server. Any ideas how to ? It would be better to use this in accounting queries than %S and there will be a delay between the packet arriving and the packet being inserted into the SQL db. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 5

MAC Authentication and
by Alexey Eronko 25 Apr '08

25 Apr '08

Hello All, I'm setupping my corporate wifi with freeradius as RADIUS server. I want to implement WEP network with MAC Authentication thought freeradius. I have three access point and I want to store mac database in text file. Here is an example: 00-22-de-4e-8f-1d Auth-Type:=Local, User-Password == "secret1" Here is my MAC request: Packet-Type = Access-Request Thu Apr 24 11:42:49 2008 User-Name = "00-1c-26-20-9c-00" User-Password = "secret1" NAS-IP-Address = 192.168.11.1 Called-Station-Id = "00-20-a6-87-86-09:WEP" Calling-Station-Id = "00-1c-26-20-9c-00;WEP" NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Client-IP-Address = 192.168.11.1 The user-password field takes from radius clients(ap) configuration of freeradius. The problem is that I have different radius access password for three access points. I want to have one list for all AP. Is the way to setup _one_ radius password for all AP only one? Another interesting point is: do I right understand that I need to restart freeradius every time when I correct users file? Is is complicated for me, what is other way? Maybe store MAC's in LDAP or SQL database? Thanks Alexey

1 0

Failed Auth using users file (sometimes)
by Mike O'Connor 25 Apr '08

25 Apr '08

Hi Guys I have an account which I want to auth locally on our 2 proxy radius machine. The problem is that sometimes the connection authenticates and other times it does not, there are warning in the log's below so I'm sure I have something wrong. But I can not work out what I should be doing instead. Also how would I create a feature which would temporally authenticate all users for a realm as allowed ? The user file entry is nyp2inter Realm == 'xxx.com', User-Password == 'xxx', Proxy-To-Realm := "LOCAL" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = xxx.xx.216.40, Framed-IP-Netmask = 255.255.255.255, Framed-Route = "xxx.xx.10.128/25 0.0.0.0 1", Framed-MTU = 1492, Framed-Compression = Van-Jacobsen-TCP-IP Failed Auth: rad_recv: Access-Request packet from host xxx.xx.208.165:1645, id=155, length=106 Framed-Protocol = PPP User-Name = "nyp2inter(a)xxx.com" User-Password = "xxx" NAS-Port-Type = Virtual NAS-Port = 328 Calling-Station-Id = "sfy713300200187" Service-Type = Framed-User NAS-IP-Address = xxx.xx.208.165 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1647 modcall[authorize]: module "preprocess" returns ok for request 1647 radius_xlat: '/var/log/radius/radacct/xxx.xx.208.165/auth-detail-20080424' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/xxx.xx.208.165/auth -detail-20080424 modcall[authorize]: module "auth_log" returns ok for request 1647 modcall[authorize]: module "attr_filter" returns noop for request 1647 modcall[authorize]: module "chap" returns noop for request 1647 modcall[authorize]: module "mschap" returns noop for request 1647 rlm_realm: Looking up realm "xxx.com" for User-Name = "nyp2inter(a)xxx.com" rlm_realm: Found realm "xxx.com" rlm_realm: Proxying request from user nyp2inter to realm xxx.com rlm_realm: Adding Realm = "xxx.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1647 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1647 modcall[authorize]: module "files" returns notfound for request 1647 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1647 2008-04-24T11:29:37.613507: Verbose: RLM_PYTHON: handling Authorize request... modcall[authorize]: module "python" returns ok for request 1647 modcall: leaving group authorize (returns ok) for request 1647 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [nyp2inter(a)xxx.com/nyp4inter] (from client lns1.ade port 328 cli sfy713300200187) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 1647 rlm_sql_log (sql_log): Processing sql_log_postauth radius_xlat: 'INSERT INTO radpostauth (user, password, reply, date, reply_message) VALUES ('nyp2inter(a)xxx.com', 'xxx', ' Access-Reject', '2008-04-24 11:29:37', '');' radius_xlat: '/var/log/radius/radacct/sql-relay' modcall[post-auth]: module "sql_log" returns ok for request 1647 modcall: leaving group REJECT (returns ok) for request 1647 Delaying request 1647 for 1 seconds Finished request 1647 With no Changes this Connected: rad_recv: Access-Request packet from host xxx.xx.208.165:1645, id=167, length=106 Framed-Protocol = PPP User-Name = "nyp2inter(a)xxx.com" User-Password = "xxx" NAS-Port-Type = Virtual NAS-Port = 315 Calling-Station-Id = "sfy713300200187" Service-Type = Framed-User NAS-IP-Address = xxx.xx.208.165 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1675 modcall[authorize]: module "preprocess" returns ok for request 1675 radius_xlat: '/var/log/radius/radacct/xxx.xx208.165/auth-detail-20080424' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/xxx.xx208.165/auth -detail-20080424 modcall[authorize]: module "auth_log" returns ok for request 1675 modcall[authorize]: module "attr_filter" returns noop for request 1675 modcall[authorize]: module "chap" returns noop for request 1675 modcall[authorize]: module "mschap" returns noop for request 1675 rlm_realm: Looking up realm "xxx.com" for User-Name = "nyp2inter(a)xxx.com" rlm_realm: Found realm "xxx.com" rlm_realm: Adding Stripped-User-Name = "nyp2inter" rlm_realm: Proxying request from user nyp2inter to realm xxx.com rlm_realm: Adding Realm = "xxx.com" rlm_realm: Preparing to proxy authentication request to realm "xxx.com" modcall[authorize]: module "suffix" returns updated for request 1675 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1675 users: Matched entry nyp2inter at line 18 modcall[authorize]: module "files" returns ok for request 1675 modcall[authorize]: module "pap" returns updated for request 1675 2008-04-24T11:29:48.109597: Verbose: RLM_PYTHON: handling Authorize request... modcall[authorize]: module "python" returns ok for request 1675 modcall: leaving group authorize (returns updated) for request 1675 WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1675 rlm_pap: login attempt with password nyp4inter rlm_pap: Using clear text password "nyp4inter". rlm_pap: User authenticated successfully modcall[authenticate]: module "pap" returns ok for request 1675 modcall: leaving group PAP (returns ok) for request 1675 Login OK: [nyp2inter(a)xxx.com] (from client lns1.ade port 315 cli sfy713300200187) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1675 radius_xlat: '/var/log/radius/radacct/xxx.xx.208.165/reply-detail-20080424' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/xxx.xx.208.165/rep ly-detail-20080424 modcall[post-auth]: module "reply_log" returns ok for request 1675 modcall: leaving group post-auth (returns ok) for request 1675 WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. Sending Access-Accept of id 167 to xxx.xx.208.165 port 1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = xxx.xx.216.40 Framed-IP-Netmask = 255.255.255.255 Framed-Route = "xxx.xx.10.128/25 0.0.0.0 1" Framed-MTU = 1492 Framed-Compression = Van-Jacobson-TCP-IP Finished request 1675

2 3

60% Off All Luxury Designer Shoes & Boots Men & Women Gucci Prada Chanel
by freeradius-users＠lists.freeradius.org 25 Apr '08

25 Apr '08

Thought I would let you know about the Fashion Footwear SPRING Sale! Men and Women Designer Shoes, Heels, Sandals and Boots, All Half-OFF, Buy Direct, Forget Department Store Prices, Get Exclusive 2008 Gucci Prada Chanel, Christian Dior, Dsquared, Versace D&G, Uggs and More! They Ship International for FREE on all Orders! http://stowetangofest.com/images/menu/gif/

2 1

Dot1x on cisco 3560
by Omar Lopez Limonta 25 Apr '08

25 Apr '08

Hi i have problems again with authentication , i trying to use freeradius and cisco 802.1x. Windows said authentication error. This is my users file: xxxx Cleartext-Password := "PPPPPl" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" yyy User-Password == "KKKK" DEFAULT Auth-Type := Reject I´m fallowing this doc http://security.fi.infn.it/TRIP/802.1x-wired/802.1x-wired.html This is my freeradius -X -A -d /etc/freeradius Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=60, length=123 User-Name = "omar" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-17-94-97-D9-07" Calling-Station-Id = "00-1A-92-70-A0-59" EAP-Message = 0x02020009016f6d6172 Message-Authenticator = 0x549dffe0deb75cea25112692b8e6091e NAS-Port = 50005 NAS-Port-Type = Ethernet NAS-IP-Address = 172.29.11.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "omar", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry omar at line 219 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 60 to 172.29.11.1:21645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010300160410245db5b7205b11398ead15f567f6ed77 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb307e1b51eedc6cc895b65e64bcd34a3 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.29.11.1:21645, id=60, length=123 Sending duplicate reply to client authenticator-short-name:21645 - ID: 60 Re-sending Access-Challenge of id 60 to 172.29.11.1:21645 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 60 with timestamp 481178e6 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=60, length=123 User-Name = "omar" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-17-94-97-D9-07" Calling-Station-Id = "00-1A-92-70-A0-59" EAP-Message = 0x02020009016f6d6172 Message-Authenticator = 0x549dffe0deb75cea25112692b8e6091e NAS-Port = 50005 NAS-Port-Type = Ethernet NAS-IP-Address = 172.29.11.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "omar", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry omar at line 219 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 60 to 172.29.11.1:21645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103001604100d0ce983971e4ed535cc6e85aa3bfb03 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x823bfbd94e10855a70a8868a41ee4805 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.29.11.1:21645, id=60, length=123 Sending duplicate reply to client authenticator-short-name:21645 - ID: 60 Re-sending Access-Challenge of id 60 to 172.29.11.1:21645 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 60 with timestamp 481178ed Nothing to do. Sleeping until we see a request. -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

3 11

Need to check Freeradius V1.1.4
by Breuer Nicolas 25 Apr '08

25 Apr '08

Dear all, I need to perform some changes in our post-auth process. We need to check a value in a sql database. If value = XX , i need to add a reply item. We already have links to the radius database for ip-pool but we need to connect to an other database to achieve this. Do you have an idea ? I didn't find any modules to achieve this. Maybe i can modify the sqlippool module, but i need some help I can create a sql query in the sqlippool.conf and connect in the sqlippool.c like this. > sqlippool_command(data->stop_begin, sqlsocket, instance, request, (char *) NULL, 0); > but is it possible to directly connect to the database and the table in this sqlippool_command ? adding the sql_db after the sqlsocket ? Any others ideas? Thanks

2 1

EAP-TTLS and accounting
by Will Booth 25 Apr '08

25 Apr '08

Is is possible to use TTLS with accounting messages after authentication? Will

2 1