May 2008 - Freeradius-Users - lists.freeradius.org

Authentication with Sonicwall and FreeRadius not quite working...
by aprotector 30 May '08

30 May '08

I have a free radius working and says it's accepting requests. I have put in the ldap server information into the radiusd.conf file and put in a user that's capable of looking up password within the directory. I have also added the Sonicwall to the clients.conf file and the radius server is recognizing it. However, when I go to the sonicwall and test the radius server it comes up on the radius server but says: Ready to process requests. User-Name = "testuser" User-Password = "password" NAS-IP-Address = 192.168.1.251 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [testuser/password] (from client sonicwall port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> landymow attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. Can anyone tell me what configuration I'm missing that is needed to get the radius to pass the request on to the ldap server and then back to the sonicwall so the authentication is successful?? I'm totally stumped here. -- View this message in context: http://www.nabble.com/Authentication-with-Sonicwall-and-FreeRadius-not-quit… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

FreeRadius 2.0.4 - problems with LDAP and Sonicwall...
by aprotector 30 May '08

30 May '08

I've been trying to get my freeradius server to work with an Netscape LDAP server and authenticate users when they connect via VPN to our Sonicwall gateway. I have set the Sonicwall as a client so the radius recognizes it and then adjusted the radiusd.conf. However, when I try to authenticate an LDAP user from the sonicwall it will say the authentication failed and the radius shows the following messages: ---------- (running in radiusd -X) User-Name = "testuser" User-Password = "testing" NAS-IP-Address = sonicwallIP NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [testuser/testing] (from client sonicwall port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. ---------- If I uncomment a local user account on the Radius box and then try authenticating from the Sonicwall with this it will succeed. It just doesn't seem to want to go to the LDAP server and then back to the Sonicwall. Has anyone had any experience with this sort of setup, and might be able to shed some light on how I can set it up to use LDAP for the authentication? -- View this message in context: http://www.nabble.com/FreeRadius-2.0.4---problems-with-LDAP-and-Sonicwall..… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

XP Extensions for PEAP/MSCHAPv2
by Casartello, Thomas 30 May '08

30 May '08

I have everything working, but I believe I've hit the problem with the OIDs windows needs for the SSL cert. I generated a key with openssl and a req and I actually have a real cert assigned for the server. How do I go about modifying my key and cert so that XP users will be able to connect? I can connect with other OSes. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

4 11

rlm_ldap: no dialupAccess attribute - access denied by default
by youness hsina 30 May '08

30 May '08

Hi Lists, sorry for my english and thank you very much in advance for your help. I'm trying to make a test in radius server with a user who is locate in ldap server with this commande : *# radtest yhsina yhsina localhost 0 test *and i'm getting this message : Sending Access-Request of id 36 to 127.0.0.1 port 1812 User-Name = "yhsina" User-Password = "yhsina" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 *rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=36, length=20 *in debugging mode i have this error : * **rlm_ldap: no dialupAccess attribute - access denied by default* * *Have you any ideas please why it doen't work ? here's my debugging message : radius# radiusd -X -A & [1] 4889 radius# Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = yes proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "192.168.33.33" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=iut-velizy,dc=uvsq,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secret" ldap: basedn = "dc=iut-velizy,dc=uvsq,dc=fr" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x2840f290 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) radiusd.conf Auth-Type eap already configured - skipping Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:54433, id=36, length=58 User-Name = "yhsina" User-Password = "yhsina" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "yhsina", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for yhsina radius_xlat: '(uid=yhsina)' radius_xlat: 'dc=iut-velizy,dc=uvsq,dc=fr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.33.33:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=iut-velizy,dc=uvsq,dc=fr/secret to 192.168.33.33:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=iut-velizy,dc=uvsq,dc=fr, with filter (uid=yhsina) *rlm_ldap: no dialupAccess attribute - access denied by default* rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 0 modcall: leaving group authorize (returns userlock) for request 0 Delaying request 0 for 1 seconds Finished request 0 > > > >

2 2

freeradius 2.0.4, rlm_passwd and dhcp
by Evgeniy Kozhuhovskiy 30 May '08

30 May '08

Hi! I've installed freeradius 2.0.4, configured dhcp. In fact, i leave all sample configuration. from modules{} : passwd mac2ip { filename = /usr/local/freeradius204/etc/raddb/dhcppasswd format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," } deb30# cat /usr/local/freeradius204/etc/raddb/dhcppasswd 2a:00:3e:50:32:d2,93.84.246.130 From debug output: server dhcp { modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating mac2ip passwd mac2ip { filename = "/usr/local/freeradius204/etc/raddb/dhcppasswd" format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no Module: Checking dhcp (null) {...} for more modules to load /usr/local/freeradius204/etc/raddb/sites-enabled/dhcp[202]: No name specified for Post-Auth-Type block } } But when packet arrived, rlm_passwd says NOTFOUND: Received DHCP-Discover of id 22424 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 22424 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 2a:00:3e:50:32:d2 DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = 2a:00:3e:50:32:d2 DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Time-Server DHCP-Parameter-Request-List = DHCP-IEN-116-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Log-Server DHCP-Parameter-Request-List = DHCP-Quotes-Server DHCP-Parameter-Request-List = DHCP-LPR-Server DHCP-Parameter-Request-List = DHCP-Impress-Server DHCP-Parameter-Request-List = DHCP-RLP-Server DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Swap-Server DHCP-Parameter-Request-List = DHCP-NIS-Domain-Name DHCP-Parameter-Request-List = DHCP-NIS-Servers DHCP-Parameter-Request-List = DHCP-NTP-Servers DHCP-Parameter-Request-List = DHCP-X-Window-Font-Server DHCP-Parameter-Request-List = DHCP-X-Window-Display-Mgr server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover ++[reply] returns noop ++[reply] returns noop ++[reply] returns noop ++[mac2ip] returns notfound ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id 22424 from 0.0.0.0:67 to 0.0.0.0:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 22424 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 0x2a003e5032d2 DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 93.84.246.129 DHCP-Domain-Name-Server = 82.209.240.241 DHCP-Domain-Name-Server = 82.209.243.241 DHCP-IP-Address-Lease-Time = 60 DHCP-DHCP-Server-Identifier = 93.84.246.129 Finished request 0. Cleaning up request 0 ID 22424 with timestamp +8 Going to the next request Ready to process requests. Also i've tried to add such update section: dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 82.209.240.241 DHCP-Domain-Name-Server = 82.209.243.241 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 93.84.246.129 DHCP-IP-Address-Lease-Time = 60 DHCP-DHCP-Server-Identifier = 93.84.246.129 } # This part ---> update reply { DHCP-Your-IP-Address = 93.84.246.130 DHCP-Client-IP-Address = 93.84.246.130 } # <--- but it updates only DHCP-Your-IP-Address, not DHCP-Client-IP-Address: Sending DHCP-Offer of id 10898 from 0.0.0.0:67 to 0.0.0.0:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 10898 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 93.84.246.130 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 0x2a003e5032d2 DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 93.84.246.129 DHCP-Domain-Name-Server = 82.209.240.241 DHCP-Domain-Name-Server = 82.209.243.241 DHCP-IP-Address-Lease-Time = 60 DHCP-DHCP-Server-Identifier = 93.84.246.129 Finished request 13. Cleaning up request 13 ID 10898 with timestamp +212 What am i doing wrong? -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

3 9

Fw: Invalid user (rlm_ldap: Access Attribute denies access) - Digest Authentication With FreeRADIUS and OpenLDAP
by Hoa But 30 May '08

30 May '08

-----Forwarded Message----- >From: Hoa But <hoabut(a)earthlink.net> >Sent: May 29, 2008 12:13 PM >To: freeradius-users(a)lists.freeradius.org >Cc: hoabut(a)earthlink.net >Subject: Invalid user (rlm_ldap: Access Attribute denies access) - Digest Authentication With FreeRADIUS and OpenLDAP > >Hello, > >Thank you for your support. > >I am getting "Invalid user (rlm_ldap: Access Attribute denies access)" when authenticating against >OpenLDAP. I can pull up the authentication credentials with OpenLDAP clients against the OpenLDAP server separately fine. >The cleartext User-Password is in OpenLDAP. > >Any assistance is greatly appreciated. The debugging messages are below. > >Thank you and best regards, > >Hoa > > >------------------------------------------------------ > >[root@pops-ldap ~]# radiusd -X >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file: /etc/raddb/proxy.conf >Config: including file: /etc/raddb/clients.conf >Config: including file: /etc/raddb/snmp.conf >Config: including file: /etc/raddb/eap.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/lib" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: snmp = no > main: max_request_time = 5 > main: cleanup_delay = 5 > main: max_requests = 10240 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = "/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = no > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library search path is /usr/lib >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" > pap: auto_header = yes >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded DIGEST >Module: Instantiated digest (digest) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "/etc/shadow" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded LDAP > ldap: server = "ldap://localhost" > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 4 > ldap: timelimit = 3 > ldap: identity = "cn=manager,dc=test,dc=com" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "qchat123" > ldap: basedn = "dc=test,dc=com" > ldap: filter = "(uid=%u)" > ldap: base_filter = "(objectclass=radiusprofile)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "radiusProfileDn" > ldap: password_header = "(null)" > ldap: password_attribute = "userPassword" > ldap: access_attr = "dialupAccess" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 40 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > ldap: set_auth_type = yes >rlm_ldap: Registering ldap_groupcmp for Ldap-Group >rlm_ldap: Registering ldap_xlat with xlat_name ldap >rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap >rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ >rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ >rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type >rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use >rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id >rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id >rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password >rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password >rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT >rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration >rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address >rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type >rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol >rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address >rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask >rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route >rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing >rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id >rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU >rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression >rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host >rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service >rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port >rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number >rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id >rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network >rlm_ldap: LDAP radiusClass mapped to RADIUS Class >rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout >rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout >rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action >rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service >rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node >rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group >rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link >rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network >rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone >rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit >rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port >rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message >conns: 0x99eef30 >Module: Instantiated ldap (ldap) >Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/raddb/huntgroups" > preprocess: hints = "/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no >Module: Instantiated realm (suffix) >Module: Loaded files > files: usersfile = "/etc/raddb/users" > files: acctusersfile = "/etc/raddb/acct_users" > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. >rad_recv: Access-Request packet from host 10.8.140.21:7251, id=201, length=306 > User-Name = "popsffa64(a)test.com" > NAS-Identifier = "qcs-qchat-ops-2-3.qln.test.com.(none)" > NAS-Port-Type = Virtual > Service-Type = 200 > Digest-Response = "b7b36bac8060d1688fdb3a4e7d4bceb9" > Digest-Attributes = 0x010e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x02226632396366616434303130323732653337333162393237626266373665333462 > Digest-Attributes = 0x031051434841542d5245474953544552 > Digest-Attributes = 0x040e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x050661757468 > Digest-Attributes = 0x060a4d44352d73657373 > Digest-Attributes = 0x08226665386661626333396437613030616230626335616130373963393635633530 > Digest-Attributes = 0x090331 > Digest-Attributes = 0x0a18706f70736666613634407175616c636f6d6d2e636f6d > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 >rlm_digest: Adding Auth-Type = DIGEST > modcall[authorize]: module "digest" returns ok for request 0 > rlm_realm: Looking up realm "test.com" for User-Name = "popsffa64(a)test.com" > rlm_realm: No such realm "test.com" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry popsffa64(a)test.com at line 103 > modcall[authorize]: module "files" returns ok for request 0 >rlm_ldap: - authorize >rlm_ldap: performing user authorization for popsffa64(a)test.com >radius_xlat: '(uid=popsffa64(a)test.com)' >radius_xlat: 'dc=test,dc=com' >rlm_ldap: ldap_get_conn: Checking Id: 0 >rlm_ldap: ldap_get_conn: Got Id: 0 >rlm_ldap: attempting LDAP reconnection >rlm_ldap: (re)connect to ldap://localhost, authentication 0 >rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow >rlm_ldap: bind as cn=manager,dc=test,dc=com/qchat123 to ldap://localhost >rlm_ldap: waiting for bind result ... >request 1 done >rlm_ldap: Bind was successful >rlm_ldap: performing search in dc=test,dc=com, with filter (uid=popsffa64(a)test.com) >request 2 done >rlm_ldap: no dialupAccess attribute - access denied by default >rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns userlock for request 0 >modcall: leaving group authorize (returns userlock) for request 0 >Invalid user (rlm_ldap: Access Attribute denies access): [popsffa64(a)test.com/<no User-Password attribute>] (from client qcs-qchat-ops-2-3 port 0) >Delaying request 0 for 1 seconds >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Sending Access-Reject of id 201 to 10.8.140.21 port 7251 >Waking up in 4 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 201 with timestamp 483cb7b5 >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.8.140.21:7252, id=195, length=306 > User-Name = "popsffa64(a)test.com" > NAS-Identifier = "qcs-qchat-ops-2-3.qln.test.com.(none)" > NAS-Port-Type = Virtual > Service-Type = 200 > Digest-Response = "a4ebf865f9abea9d590bdd95f5d81f5e" > Digest-Attributes = 0x010e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x02223464303339383763636661353637393938326461323237313735656638663930 > Digest-Attributes = 0x031051434841542d5245474953544552 > Digest-Attributes = 0x040e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x050661757468 > Digest-Attributes = 0x060a4d44352d73657373 > Digest-Attributes = 0x08226530653061383666616133656238643532313161376636326133653662303937 > Digest-Attributes = 0x090331 > Digest-Attributes = 0x0a18706f70736666613634407175616c636f6d6d2e636f6d > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 >rlm_digest: Adding Auth-Type = DIGEST > modcall[authorize]: module "digest" returns ok for request 1 > rlm_realm: Looking up realm "test.com" for User-Name = "popsffa64(a)test.com" > rlm_realm: No such realm "test.com" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 1 > users: Matched entry popsffa64(a)test.com at line 103 > modcall[authorize]: module "files" returns ok for request 1 >rlm_ldap: - authorize >rlm_ldap: performing user authorization for popsffa64(a)test.com >radius_xlat: '(uid=popsffa64(a)test.com)' >radius_xlat: 'dc=test,dc=com' >rlm_ldap: ldap_get_conn: Checking Id: 0 >rlm_ldap: ldap_get_conn: Got Id: 0 >rlm_ldap: performing search in dc=test,dc=com, with filter (uid=popsffa64(a)test.com) >request 3 done >rlm_ldap: no dialupAccess attribute - access denied by default >rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns userlock for request 1 >modcall: leaving group authorize (returns userlock) for request 1 >Invalid user (rlm_ldap: Access Attribute denies access): [popsffa64(a)test.com/<no User-Password attribute>] (from client qcs-qchat-ops-2-3 port 0) >Delaying request 1 for 1 seconds >Finished request 1 >Going to the next request >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Sending Access-Reject of id 195 to 10.8.140.21 port 7252 >Waking up in 4 seconds... >--- Walking the entire request list --- >Cleaning up request 1 ID 195 with timestamp 483cb7c0 >Nothing to do. Sleeping until we see a request. > >---------------------------------------------------------------------------

2 2

Re: Freeradius + OpenLDAP
by youness hsina 30 May '08

30 May '08

thank you for your response! when i run my server in debugging mode , it seems to work very well! radius# *radiusd -X -A & *** Starting - reading configuration files ... reread_config: reading radiusd.conf [...] Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 *Ready to process requests.* ** but i want to make a test with a user who is located in openldap server. and i don't know how i can do this. Regards, uness

4 5

Thank you and Diameter question
by Raj Patel 30 May '08

30 May '08

Hi People First thank you, I been reading this mailing list for some time and I found it great source of help I want to share some info with you and than ask a question We are slowly moving here into Java and starting to have Diameter requirements I found OpenBloX Java Diameter a great source of help (i think its GPL)and it seems to meet our requirements (* http://sourceforge.net/projects/openblox/**) * as anyone else been using it, I will be happy for some feedback I guess this is the right place for a feedback with so many AAA gurus around J so sorry again for my post Thanks In advance RP

4 4

Need help with Radiusclient-ng
by Pete Kay 30 May '08

30 May '08

Hi, I am trying to write a client using Radiusclient-ng to authenticate with Freeradius. I understand this question may be related to radiusclient-ng speficially, but I can't find any radiusclient-ng specific mailing list, so I just hope someone may be able to help me out here. I am modifiying radiusclient-ng's radexample.c and there are two questions I have: 1. How to change the radiusclient setting so it is sending in password in Digest format? Since my freeradius is configured to use Digest as Auth-Type, I need to use the Digest Auth-type but radiusclient is sending in password in Cleartext out-of-box. 2. How to send additinal attribute or user-defined attribute from radclient.c? I need to use that additional attribute to tell freeradius what table to use for authentication. Any help and suggestion will be greatly appreciated. Regards, Pete

2 1

can't initiate SIM , no RAND1 attribute
by Kalyani Garigipati (kagarigi) 30 May '08

30 May '08

Hi I have tried the eap-sim test by putting the triplets in the eapsim-in.txt also. But I am still getting the same errors... Please let me know in which file I should be keeping those triplets. It would be of great help in someone attach the configuration file. Regards, Kalyani [preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "cisco.com" for User-Name = "1234567892(a)cisco.com" rlm_realm: No such realm "cisco.com" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 25 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim can not initiate sim, no RAND1 attribute rlm_eap: Default EAP type sim failed in initiate rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [1234567892(a)cisco.com/<via Auth-Type = EAP>] (from client cisco port 0 cli 1234567892(a)cisco.com) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 1234567892(a)cisco.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 0 ID 189 with timestamp +16

1 0