June 2008 - Freeradius-Users - lists.freeradius.org

Free Radius resource
by Do Nguyen Ha 17 Jun '08

17 Jun '08

hi when is this book launch, i am looking for it and think many people are looking for it Ha` > 2008/6/14 Alan DeKok <aland(a)deployingradius.com>: >> Rogelio wrote: >>> Hi all, just started delving into RADIUS and have begun to take the >>> plunge with FreeRADIUS. >>> >>> Any suggested books on the subject? I see quite a few on the subject: >> >> The O'Reilly book is good if you know absolutely nothing about RADIUS. >> But 1/3 is from the RFC's (paraphrased), and another 1/3 is from the >> FreeRADIUS documentation. >> >> The Wiley book has about 30 pages on RADIUS, the rest is about >> technologies that you don't use. And the RADIUS stuff is not that >> useful. >> >> Then, there's my book. It's at about 200 pages, and has been at that >> level for over a year. I'm trying to find time to either finish it, or >> to clean it up, and put it on the web. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html

2 1

Re : Hi
by Joel MBA OYONE 17 Jun '08

17 Jun '08

so the HOW_TO about active diretory/freeradius seem to be enough. I asked cause i noticed that most of the tips on www.freeradius.org point to 1.1x and i use 2.0.x thanx for the answer MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Sambuddho Chakravarty <sc2516(a)columbia.edu> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 16 Juin 2008, 18h39mn 07s Objet : Re: Hi Hello For ldap you need to configure the module/ldap file and not active directory (which I think uses EAP). Thanks Sambuddho On Mon, 2008-06-16 at 20:21 +0200, mbaoyone(a)malmak.com wrote: > Is this this HOW_TO > (http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO) up > to date to make freeradius_conneceted to ldap or there is something > else to do ? > > - thanx! > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

dhcp server launch error
by Haralds Ulmanis 17 Jun '08

17 Jun '08

2.0.6 (just from csv) Tried to launch dhcp server (nothing changed in default dhcp site configuration)... got error: radiusd: #### Loading Virtual Servers #### server dhcp { modules { No DHCP-Message-Type attribute } Errors initializing modules

2 1

Free Radius FreeBSD
by Devinder Singh 16 Jun '08

16 Jun '08

Hi Which version of Free Radius shoud i use for FreeBSD I plan to use Free BSD 7.0. SHoud i use the Free Radius Free BSD version on the web site http://portsmon.freebsd.org/portoverview.py?category=net&portname=freeradius -- Devinder

2 2

TLS Error with Freeradius 2: unkown_ca
by Julian Stöver 16 Jun '08

16 Jun '08

Hi I'm running Freeradius2 with EAP-TLS. I've created new certificates and putted them into my certs-dir. Radius starts with no errors. But if I try to login, I get this TLS Error: > rlm_sql (sql): Released sql socket id: 3 > ++[sql] returns ok > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > +- entering group authenticate > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0467], Certificate > --> verify error:num=18:self signed certificate > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > TLS Alert write:fatal:unknown CA > TLS_accept:error in SSLv3 read client certificate B > rlm_eap: SSL error error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. > eaptls_process returned 13 > rlm_eap: Freeing handler > ++[eap] returns reject > auth: Failed to validate the user. > Login incorrect: [julian/<via Auth-Type = EAP>] (from client > GFS-03-01 port 286 cli 001e.5280.15c6) > Delaying reject of request 11 for 1 seconds > Going to the next request But I don't know why freeradius has a problem with the ca cert. thanks for helping me Here's the startup log and the hole request: startup.log > Starting - reading configuration files ... > including configuration file /etc/freeradius/radiusd.conf > including configuration file /etc/freeradius/proxy.conf > including configuration file /etc/freeradius/clients.conf > including configuration file /etc/freeradius/snmp.conf > including configuration file /etc/freeradius/eap.conf > including configuration file /etc/freeradius/sql.conf > including dictionary file /etc/freeradius/dictionary > main { > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/freeradius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/freeradius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > allow_core_dumps = no > pidfile = "/var/run/freeradius/freeradius.pid" > user = "freerad" > group = "freerad" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = no > security { > max_attributes = 200 > reject_delay = 1 > status_server = no > } > } > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client 172.17.255.1 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.2 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-02" > } > client 172.17.255.3 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-03" > } > client 172.17.255.4 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.5 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.6 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.11 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.12 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.13 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.14 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.15 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.16 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.21 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-03-01" > } > client 172.17.255.22 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > zombie_period = 40 > status_check = "status-server" > ping_check = "none" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = yes > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > } > radiusd: #### Loading Virtual Servers #### > server { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "crypt" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = yes > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/var/log/freeradius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "tls" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/etc/freeradius/certs2/server.key" > certificate_file = "/etc/freeradius/certs2/server.pem" > CA_file = "/etc/freeradius/certs2/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/freeradius/certs2/dh" > random_file = "/etc/freeradius/certs2/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating preprocess > preprocess { > huntgroups = "/etc/freeradius/huntgroups" > hints = "/etc/freeradius/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Linked to module rlm_realm > Module: Instantiating suffix > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_sql > Module: Instantiating sql > sql { > driver = "rlm_sql_mysql" > server = "172.19.1.2" > port = "" > login = "user" > password = "9L2xWq" > radius_db = "user" > read_groups = yes > sqltrace = no > sqltracefile = "/var/log/freeradius/sqltrace.sql" > readclients = no > deletestalesessions = yes > num_sql_socks = 5 > sql_user_name = "%{User-Name}" > default_user_profile = "" > nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" > authorize_check_query = "SELECT id, UserName, Attribute, Value, > op FROM radcheck WHERE Username = '%{SQL-User- > Name}' ORDER BY id" > authorize_reply_query = "SELECT id, UserName, Attribute, Value, > op FROM radreply WHERE Username = '%{SQL-User- > Name}' ORDER BY id" > authorize_group_check_query = "SELECT > radgroupcheck > .id > ,radgroupcheck > .GroupName > ,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM > radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User- > Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY > radgroupcheck.id" > authorize_group_reply_query = "SELECT > radgroupreply > .id > ,radgroupreply > .GroupName > ,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM > radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User- > Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY > radgroupreply.id" > accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', > AcctSessionTime=unix_timestamp('%S') - > unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate- > Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE > AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP- > Address}' AND AcctStartTime <= '%S'" > accounting_update_query = "UPDATE radacct SET > FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime > = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input- > Octets}', AcctOutputOctets = '%{Acct-Output- > Octets}' WHERE AcctSessionId = '%{Acct-Session- > Id}' AND UserName = '%{SQL-User-Name}' AND > NASIPAddress= '%{NAS-IP-Address}'" > accounting_update_query_alt = "INSERT into radacct (AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, > AcctInputOctets, AcctOutputOctets, CalledStationId, > CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session- > Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- > Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session- > Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '% > {Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output- > Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '% > {Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" > accounting_start_query = "INSERT into radacct (AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, > ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, > AcctOutputOctets, CalledStationId, CallingStationId, > AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct- > Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP- > Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '% > {Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called- > Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '% > {Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', > '0')" > accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = > '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '% > {Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND > UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" > accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', > AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct- > Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', > AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '% > {Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE > AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User- > Name}' AND NASIPAddress = '%{NAS-IP-Address}'" > accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, > ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, > AcctOutputOctets, CalledStationId, CallingStationId, > AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct- > Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP- > Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', > INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), > '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect- > Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called- > Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '% > {Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', > '%{Acct-Delay-Time}')" > group_membership_query = "SELECT GroupName FROM usergroup WHERE > UserName='%{SQL-User-Name}'" > connect_failure_retry_delay = 60 > simul_count_query = "" > simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, > NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, > FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND > AcctStopTime = 0" > postauth_query = "INSERT into radpostauth (id, user, pass, reply, > date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', > '%{reply:Packet-Type}', NOW())" > safe-characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- > _: /" > } > rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded > and linked > rlm_sql (sql): Attempting to connect to user@172.19.1.2:/user > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 > rlm_sql_mysql: Starting connect to MySQL server for #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 > rlm_sql_mysql: Starting connect to MySQL server for #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 > rlm_sql_mysql: Starting connect to MySQL server for #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 > rlm_sql_mysql: Starting connect to MySQL server for #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 > rlm_sql_mysql: Starting connect to MySQL server for #4 > rlm_sql (sql): Connected new DB handle, #4 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- > Address, NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating detail > detail { > detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/ > detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Linked to module rlm_radutmp > Module: Instantiating radutmp > radutmp { > filename = "/var/log/freeradius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } > } > radiusd: #### Opening IP addresses and Ports #### > bind_address = * > WARNING: The directive 'bind_adress' is deprecated, and will be > removed in future versions of FreeRADIUS. Please edit the > configuration files to use the directive 'listen'. > main { > snmp = no > smux_password = "" > snmp_write_access = no > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Ready to process requests. request.log > rad_recv: Access-Request packet from host 172.17.255.21 port 1645, > id=68, length=364 > User-Name = "julian" > Framed-MTU = 1400 > Called-Station-Id = "0016.9cbf.bc40" > Calling-Station-Id = "001e.5280.15c6" > Service-Type = Login-User > Message-Authenticator = 0xb8af69f5c41127d504fdbc11340ef77e > EAP-Message = > 0x020600d90d006ad75a8c33f431e52eb13d606916030100860f0000820080568392759081ec75c2e4ee2a000dbb18333895a786a217118fafd1e5c951c5845875cf1b37c9d271ef74447c5794ce6c49ddc0b93a7f70f6da7f4b92c388dc70dccb81cf00e0ef86be7b41ac0c3e06371d85def74b99c2b74e4ff45f39a8c2f3ae755b4cfc6ca2324a79ec2bbd9ba117d1fb4ca6a6f316eb99a07685ac4ad78114030100010116030100308f3fbc37134291724f1f6981dd100ad3c9fe8b77a57e94e11e59b89f738ed960768395779b6176a4443f1b98815e85b4 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 290 > NAS-Port-Id = "290" > State = 0x81153e8b851333f6401c7fc382b600a0 > NAS-IP-Address = 172.17.255.21 > NAS-Identifier = "gfs-wl-03-01" > +- entering group authorize > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > rlm_realm: No '@' in User-Name = "julian", looking up realm NULL > rlm_realm: No such realm "NULL" > ++[suffix] returns noop > rlm_eap: EAP packet type response id 6 length 217 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > expand: %{User-Name} -> julian > rlm_sql (sql): sql_set_user escaped user --> 'julian' > rlm_sql (sql): Reserving sql socket id: 4 > expand: SELECT id, UserName, Attribute, Value, op FROM > radcheck WHERE Username = '%{SQL-User-Name}' > ORDER BY id -> SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'julian' ORDER BY > id > rlm_sql (sql): User found in radcheck table > expand: SELECT id, UserName, Attribute, Value, op FROM > radreply WHERE Username = '%{SQL-User-Name}' > ORDER BY id -> SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'julian' ORDER BY > id > expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User- > Name}' -> SELECT GroupName FROM usergroup WHERE UserName='julian' > rlm_sql (sql): Released sql socket id: 4 > ++[sql] returns ok > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > +- entering group authenticate > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0467], Certificate > --> verify error:num=18:self signed certificate > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > TLS Alert write:fatal:unknown CA > TLS_accept:error in SSLv3 read client certificate B > rlm_eap: SSL error error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. > eaptls_process returned 13 > rlm_eap: Freeing handler > ++[eap] returns reject > auth: Failed to validate the user. > Login incorrect: [julian/<via Auth-Type = EAP>] (from client > GFS-03-01 port 290 cli 001e.5280.15c6) > Delaying reject of request 10 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 10 > Sending Access-Reject of id 68 to 172.17.255.21 port 1645 > Framed-IP-Address = 172.17.8.165 > EAP-Message = 0x04060004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 3.9 seconds. > Cleaning up request 9 ID 67 with timestamp +45 > Waking up in 1.0 seconds. > Cleaning up request 10 ID 68 with timestamp +45 > Ready to process requests.

2 1

Error: rlm_radutmp
by Neil Jones 16 Jun '08

16 Jun '08

Hello. We keep getting the following error in the radius log but do not appear to have any issues. I have Googled it and see many, many references to it but none explain what causes the error or what the impact is. Thank you for your input, Neil Error: rlm_radutmp: Logout entry for NAS 7206VXR_2A port 1090519040 has wrong ID

2 1

Hi
by mbaoyone＠malmak.com 16 Jun '08

16 Jun '08

Is this this HOW_TO (http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO) up to date to make freeradius_conneceted to ldap or there is something else to do ? - thanx!

2 1

TLS Error: unkown_CA
by Julian Stöver 16 Jun '08

16 Jun '08

Hi I'm running Freeradius2 with EAP-TLS. I've created new certificates and putted them into my certs-dir. Radius starts with no errors. But if I try to login, I get this TLS Error: > rlm_sql (sql): Released sql socket id: 3 > ++[sql] returns ok > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > +- entering group authenticate > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0467], Certificate > --> verify error:num=18:self signed certificate > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > TLS Alert write:fatal:unknown CA > TLS_accept:error in SSLv3 read client certificate B > rlm_eap: SSL error error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. > eaptls_process returned 13 > rlm_eap: Freeing handler > ++[eap] returns reject > auth: Failed to validate the user. > Login incorrect: [julian/<via Auth-Type = EAP>] (from client > GFS-03-01 port 286 cli 001e.5280.15c6) > Delaying reject of request 11 for 1 seconds > Going to the next request But I don't know why freeradius has a problem with the ca cert. thanks for helping me Here's the startup log and the hole request: startup.log > Starting - reading configuration files ... > including configuration file /etc/freeradius/radiusd.conf > including configuration file /etc/freeradius/proxy.conf > including configuration file /etc/freeradius/clients.conf > including configuration file /etc/freeradius/snmp.conf > including configuration file /etc/freeradius/eap.conf > including configuration file /etc/freeradius/sql.conf > including dictionary file /etc/freeradius/dictionary > main { > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/freeradius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/freeradius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > allow_core_dumps = no > pidfile = "/var/run/freeradius/freeradius.pid" > user = "freerad" > group = "freerad" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = no > security { > max_attributes = 200 > reject_delay = 1 > status_server = no > } > } > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client 172.17.255.1 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.2 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-02" > } > client 172.17.255.3 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-03" > } > client 172.17.255.4 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.5 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.6 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.11 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.12 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.13 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.14 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.15 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.16 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > client 172.17.255.21 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-03-01" > } > client 172.17.255.22 { > require_message_authenticator = no > secret = "4n3kc092ldnS3mfL2ndL" > shortname = "GFS-01-01" > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > zombie_period = 40 > status_check = "status-server" > ping_check = "none" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = yes > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > } > radiusd: #### Loading Virtual Servers #### > server { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "crypt" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = yes > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/var/log/freeradius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "tls" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/etc/freeradius/certs2/server.key" > certificate_file = "/etc/freeradius/certs2/server.pem" > CA_file = "/etc/freeradius/certs2/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/freeradius/certs2/dh" > random_file = "/etc/freeradius/certs2/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating preprocess > preprocess { > huntgroups = "/etc/freeradius/huntgroups" > hints = "/etc/freeradius/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Linked to module rlm_realm > Module: Instantiating suffix > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_sql > Module: Instantiating sql > sql { > driver = "rlm_sql_mysql" > server = "172.19.1.2" > port = "" > login = "user" > password = "9L2xWq" > radius_db = "user" > read_groups = yes > sqltrace = no > sqltracefile = "/var/log/freeradius/sqltrace.sql" > readclients = no > deletestalesessions = yes > num_sql_socks = 5 > sql_user_name = "%{User-Name}" > default_user_profile = "" > nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" > authorize_check_query = "SELECT id, UserName, Attribute, Value, > op FROM radcheck WHERE Username = '%{SQL-User- > Name}' ORDER BY id" > authorize_reply_query = "SELECT id, UserName, Attribute, Value, > op FROM radreply WHERE Username = '%{SQL-User- > Name}' ORDER BY id" > authorize_group_check_query = "SELECT > radgroupcheck > .id > ,radgroupcheck > .GroupName > ,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM > radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User- > Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY > radgroupcheck.id" > authorize_group_reply_query = "SELECT > radgroupreply > .id > ,radgroupreply > .GroupName > ,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM > radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User- > Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY > radgroupreply.id" > accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', > AcctSessionTime=unix_timestamp('%S') - > unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate- > Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE > AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP- > Address}' AND AcctStartTime <= '%S'" > accounting_update_query = "UPDATE radacct SET > FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime > = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input- > Octets}', AcctOutputOctets = '%{Acct-Output- > Octets}' WHERE AcctSessionId = '%{Acct-Session- > Id}' AND UserName = '%{SQL-User-Name}' AND > NASIPAddress= '%{NAS-IP-Address}'" > accounting_update_query_alt = "INSERT into radacct (AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, > AcctInputOctets, AcctOutputOctets, CalledStationId, > CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session- > Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- > Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session- > Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '% > {Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output- > Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '% > {Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" > accounting_start_query = "INSERT into radacct (AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, > ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, > AcctOutputOctets, CalledStationId, CallingStationId, > AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct- > Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP- > Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '% > {Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called- > Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '% > {Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', > '0')" > accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = > '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '% > {Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND > UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" > accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', > AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct- > Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', > AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '% > {Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE > AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User- > Name}' AND NASIPAddress = '%{NAS-IP-Address}'" > accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, > AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, > AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, > ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, > AcctOutputOctets, CalledStationId, CallingStationId, > AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, > AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct- > Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP- > Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', > INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), > '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect- > Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called- > Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '% > {Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', > '%{Acct-Delay-Time}')" > group_membership_query = "SELECT GroupName FROM usergroup WHERE > UserName='%{SQL-User-Name}'" > connect_failure_retry_delay = 60 > simul_count_query = "" > simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, > NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, > FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND > AcctStopTime = 0" > postauth_query = "INSERT into radpostauth (id, user, pass, reply, > date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', > '%{reply:Packet-Type}', NOW())" > safe-characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- > _: /" > } > rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded > and linked > rlm_sql (sql): Attempting to connect to user@172.19.1.2:/user > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 > rlm_sql_mysql: Starting connect to MySQL server for #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 > rlm_sql_mysql: Starting connect to MySQL server for #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 > rlm_sql_mysql: Starting connect to MySQL server for #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 > rlm_sql_mysql: Starting connect to MySQL server for #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 > rlm_sql_mysql: Starting connect to MySQL server for #4 > rlm_sql (sql): Connected new DB handle, #4 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- > Address, NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating detail > detail { > detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/ > detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Linked to module rlm_radutmp > Module: Instantiating radutmp > radutmp { > filename = "/var/log/freeradius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } > } > radiusd: #### Opening IP addresses and Ports #### > bind_address = * > WARNING: The directive 'bind_adress' is deprecated, and will be > removed in future versions of FreeRADIUS. Please edit the > configuration files to use the directive 'listen'. > main { > snmp = no > smux_password = "" > snmp_write_access = no > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Ready to process requests. request.log > rad_recv: Access-Request packet from host 172.17.255.21 port 1645, > id=68, length=364 > User-Name = "julian" > Framed-MTU = 1400 > Called-Station-Id = "0016.9cbf.bc40" > Calling-Station-Id = "001e.5280.15c6" > Service-Type = Login-User > Message-Authenticator = 0xb8af69f5c41127d504fdbc11340ef77e > EAP-Message = > 0x020600d90d006ad75a8c33f431e52eb13d606916030100860f0000820080568392759081ec75c2e4ee2a000dbb18333895a786a217118fafd1e5c951c5845875cf1b37c9d271ef74447c5794ce6c49ddc0b93a7f70f6da7f4b92c388dc70dccb81cf00e0ef86be7b41ac0c3e06371d85def74b99c2b74e4ff45f39a8c2f3ae755b4cfc6ca2324a79ec2bbd9ba117d1fb4ca6a6f316eb99a07685ac4ad78114030100010116030100308f3fbc37134291724f1f6981dd100ad3c9fe8b77a57e94e11e59b89f738ed960768395779b6176a4443f1b98815e85b4 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 290 > NAS-Port-Id = "290" > State = 0x81153e8b851333f6401c7fc382b600a0 > NAS-IP-Address = 172.17.255.21 > NAS-Identifier = "gfs-wl-03-01" > +- entering group authorize > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > rlm_realm: No '@' in User-Name = "julian", looking up realm NULL > rlm_realm: No such realm "NULL" > ++[suffix] returns noop > rlm_eap: EAP packet type response id 6 length 217 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > expand: %{User-Name} -> julian > rlm_sql (sql): sql_set_user escaped user --> 'julian' > rlm_sql (sql): Reserving sql socket id: 4 > expand: SELECT id, UserName, Attribute, Value, op FROM > radcheck WHERE Username = '%{SQL-User-Name}' > ORDER BY id -> SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'julian' ORDER BY > id > rlm_sql (sql): User found in radcheck table > expand: SELECT id, UserName, Attribute, Value, op FROM > radreply WHERE Username = '%{SQL-User-Name}' > ORDER BY id -> SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'julian' ORDER BY > id > expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User- > Name}' -> SELECT GroupName FROM usergroup WHERE UserName='julian' > rlm_sql (sql): Released sql socket id: 4 > ++[sql] returns ok > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > +- entering group authenticate > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0467], Certificate > --> verify error:num=18:self signed certificate > rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > TLS Alert write:fatal:unknown CA > TLS_accept:error in SSLv3 read client certificate B > rlm_eap: SSL error error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. > eaptls_process returned 13 > rlm_eap: Freeing handler > ++[eap] returns reject > auth: Failed to validate the user. > Login incorrect: [julian/<via Auth-Type = EAP>] (from client > GFS-03-01 port 290 cli 001e.5280.15c6) > Delaying reject of request 10 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 10 > Sending Access-Reject of id 68 to 172.17.255.21 port 1645 > Framed-IP-Address = 172.17.8.165 > EAP-Message = 0x04060004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 3.9 seconds. > Cleaning up request 9 ID 67 with timestamp +45 > Waking up in 1.0 seconds. > Cleaning up request 10 ID 68 with timestamp +45 > Ready to process requests.

2 3

dhcp server (already in use lease verify)
by EvilEzh 16 Jun '08

16 Jun '08

Does DHCP server verify is lease already in use or not ? And another question is about multiple interfaces. As i understand i need to run several dhcp instances for each interface, or maybe it is possible to add attribute on which interface dhcp packet was received if i run on multiple interfaces.

2 1

freeradius and client ip
by King, Adam 16 Jun '08

16 Jun '08

Hi, I am building a radius server for an ADSL platform, the test server is built on version 1.1.3 and the radius set up works nicely, thanks to the detailed documentation! However, one extra necessity is the ability to accept/reject a user based on where they are connecting from, I have spent several hours looking around the internet and looking at the freeradius files trying to see how this can be implemented but am stuck. I wonder if you could help? Many thanks Adam Adam King Network Engineer adam.king(a)intechnology.com InTechnology plc Support 0845 120 7070 Telephone 01423 850000 Facsimile 01423 858866 www.intechnology.com * Harrogate, Reading, London * 200 people, ?50m p.a. turnover * Over 500 corporate clients * Specialist Business Solutions & Services Provider This is an email from InTechnology plc, Central House, Beckwith Knowle, Harrogate, UK, HG3 1UG. Registered in England 3916586. The contents of this message may be privileged and confidential. If you have received this message in error, you may not use, disclose, copy or distribute its content in anyway. Please notify the sender immediately. All messages are scanned for all viruses.

2 3