June 2008 - Freeradius-Users - lists.freeradius.org

/etc/smbpasswd issue
by vijayakumar 06 Jun '08

06 Jun '08

Dear All, I was trying to authenticate MSCHAPV2 with /etc/smbpasswd & am getting following error while doing radiusd -X .Can any body help me out . [root@test rlm_smb]# radiusd -X FreeRADIUS Version 2.0.4, for host i686-pc-linux-gnu, built on May 25 2008 at 02:35:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.7.0/24 { require_message_authenticator = no secret = "testing123" shortname = "corp" } client 196.1.109.0/16 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. User-Name = "ajay" User-Password = "ajay" NAS-IP-Address = 127.0.0.1 NAS-Port = 7 +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080605 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080605 expand: %t -> Thu Jun 5 05:24:03 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ajay", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "ajay" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [ajay/ajay] (from client localhost port 7) Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. Cleaning up request 0 ID 197 with timestamp +19 Ready to process requests. Regards. VIJAY

2 3

compiler Error at "radsniff.h"
by Thomas Cornelsen 05 Jun '08

05 Jun '08

Hi all! i can`t compile Freeradius with the "Radius Sniffer Module". If i compile without the "libpcap"-Library the Compiler throws NO Error! Everything seems to be fine. If i install the libpcap Library the Compiler throws Errors at "radsniff.h" I really hope that someone has a suggestion! thanks a lot! -Tom OS: Solaris 9 Freeradius-Version: 2.0.4 libpcap-libaries: Tested Versions: 0.9.8 and 0.9.7 and 0.9.6 (tested as binaries and also tested with source code) compiler: gcc 3.3.1 and also tested with gcc 3.4.6 (binary package) Linker: gnu ld: Version: binutils-2.11.2 0/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.9\" -DRADIUSD_VERSION=\"2.0.4\" -I/soft/ssl/include -DOPENSSL_NO_KRB5 -c radsniff.c -fPIC -DPIC -o .libs/radsniff.o In file included from radsniff.c:34: /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:39: error: parse error before "u_int8_t" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:39: warning: no semicolon at end of struct or union /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:40: warning: type defaults to `int' in declaration of `ethernet_shost' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:40: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:41: error: parse error before "ethernet_type" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:41: warning: type defaults to `int' in declaration of `ethernet_type' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:41: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:56: error: parse error before "u_int8_t" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:56: warning: no semicolon at end of struct or union /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:59: warning: type defaults to `int' in declaration of `ip_tos' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:59: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:60: error: parse error before "ip_len" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:60: warning: type defaults to `int' in declaration of `ip_len' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:60: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:61: error: parse error before "ip_id" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:61: warning: type defaults to `int' in declaration of `ip_id' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:61: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:62: error: parse error before "ip_off" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:62: warning: type defaults to `int' in declaration of `ip_off' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:62: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:66: error: parse error before "ip_ttl" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:66: warning: type defaults to `int' in declaration of `ip_ttl' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:66: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:67: error: parse error before "ip_p" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:67: warning: type defaults to `int' in declaration of `ip_p' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:67: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:68: error: parse error before "ip_sum" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:68: warning: type defaults to `int' in declaration of `ip_sum' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:68: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:70: error: parse error before '}' token /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:77: error: parse error before "u_int16_t" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:77: warning: no semicolon at end of struct or union /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:78: warning: type defaults to `int' in declaration of `udp_dport' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:78: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:79: error: parse error before "udp_ulen" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:79: warning: type defaults to `int' in declaration of `udp_ulen' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:79: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:80: error: parse error before "udp_sum" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:80: warning: type defaults to `int' in declaration of `udp_sum' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:80: warning: data definition has no type or storage class radsniff.c: In function `got_packet': radsniff.c:135: error: invalid application of `sizeof' to an incomplete type radsniff.c:136: error: invalid application of `sizeof' to an incomplete type radsniff.c:137: error: invalid application of `sizeof' to an incomplete type radsniff.c:157: error: dereferencing pointer to incomplete type radsniff.c:158: error: dereferencing pointer to incomplete type radsniff.c:160: error: dereferencing pointer to incomplete type radsniff.c:161: error: dereferencing pointer to incomplete type radsniff.c:163: warning: assignment discards qualifiers from pointer target type radsniff.c:188: error: dereferencing pointer to incomplete type radsniff.c:188: error: dereferencing pointer to incomplete type radsniff.c:189: error: dereferencing pointer to incomplete type radsniff.c:189: error: dereferencing pointer to incomplete type radsniff.c: In function `main': radsniff.c:315: error: invalid application of `sizeof' to an incomplete type radsniff.c:315: error: invalid application of `sizeof' to an incomplete type radsniff.c:315: error: invalid application of `sizeof' to an incomplete type make[4]: *** [radsniff.lo] Error 1 make[4]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4' make: *** [all] Error 2 Schon gehört? Der neue WEB.DE MultiMessenger kann`s mit allen: *http://www.produkte.web.de/messenger/?did=3016* [http://www.produkte.web.de/messenger/?did=3016]

2 1

1.1.7 to 2.0.2 config for Realms problem
by Dean, Barry 05 Jun '08

05 Jun '08

I have a problem with a realm configuration that used to work with FR 1.1.7, but does not work at all with 2.0.2 and virtual servers. I have a virtual server defined in sites-available/janet-roaming thus: server jrsradius { listen { ipaddr = jrsradius2.liv.ac.uk port = 0 type = auth } listen { ipaddr = jrsradius2.liv.ac.uk port = 0 type = acct } proxy_requests = yes $INCLUDE jrs-proxy.conf $INCLUDE jrs-clients.conf authorize { preprocess chap mschap suffix eap { ok = return } unix files ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } ... some stuff removed for brevity! } jrs-proxy.conf contains: proxy server { default_fallback = no post_proxy_authorize = no } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } realm LOCAL { # If we do not specify a server pool, the realm is LOCAL, and # requests are not proxied to it. type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm liv.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } realm liverpool.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } (stuff for JENET NRPS servers removed) But logging in as testuser(a)liverpool.ac.uk I get: Thu Jun 5 11:57:21 2008 : Debug: rlm_realm: Looking up realm "liverpool.ac.uk" for User-Name = "testuser(a)liverpool.ac.uk" Thu Jun 5 11:57:21 2008 : Debug: rlm_realm: No such realm "liverpool.ac.uk" What have I done wrong in defining the realms for liv.ac.uk and liverpool.ac.uk? Wrong place? Wrong syntax? They are not mentioned during server startup with "-X and -xx" beyond: Thu Jun 5 11:57:16 2008 : Debug: including configuration file /usr/radius/etc/raddb/sites-enabled/janet-roaming Thu Jun 5 11:57:16 2008 : Debug: including configuration file /usr/radius/etc/raddb/jrs-proxy.conf so is the config being ignored because it is wrong? Thanks. --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

2 3

FreeRadius Client - Need help with Authentication Methods
by Knarkargott 05 Jun '08

05 Jun '08

I am using the FreeRadius Client against a IAS server. It works fine without any authentication method, but now I would like to add something like PEAP or MS-CHAP2 or similar. I cannot find this information anywhere, does anybody know how to set up the FreeRadius Client to use some authentication method? Or any idea on where to find this information? I only find information about the FreeRadius Server, not the client. Thanks in advance :) /Knarkargott -- View this message in context: http://www.nabble.com/FreeRadius-Client---Need-help-with-Authentication-Met… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

FreeRadius + VPN Clients
by youness hsina 05 Jun '08

05 Jun '08

Hi all, Thank you in advance for your help. i have users on a LDAP server and i want to make a vpn connection with one of my users using a vpn router. i can make a connection from a radius server to my LDAP server. But i don't now how i can do make a vpn connection with one of my users who is located on an LDAP server. Will you help me please Sorry for my english uness

3 9

rlm_ippool fail
by tg_melo＠bol.com.br 05 Jun '08

05 Jun '08

Hi all. I had a freeradius server 1.1.7 running up with some errors when doing updates in radacct (mysql) some hours after it just started. Since then, I decided to upgrade to 2.0.4. But now, it refuses to start with the error "rlm_ippool: Failed to open file $(raddbdir)/db.ippool: No such file or directory". The system it's running on, is a freebsd 6.3. I also tryed to install the ports version 2.0.3 with the freeradius user and group assignments. But without success in getting it started. All the tryings were almost clean install ones, with both versions. I only modified the essencial conf files in order to set up the database, user, password, ip, etc. And at last, uncommented the main_pool lines in the accounting and post-auth sections in sites-enabled/default. Here is the output of radiusd -X: FreeRADIUS Version 2.0.3, for host i386-portbld-freebsd6.3, built on Jun 5 2008 at 04:51:09 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "freeradius" group = "freeradius" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_ippool Module: Instantiating main_pool ippool main_pool { session-db = "$(raddbdir)/db.ippool" ip-index = "$(raddbdir)/db.ipindex" key = "%{NAS-IP-Address} %{NAS-Port}" range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 override = no maximum-timeout = 0 } rlm_ippool: Failed to open file $(raddbdir)/db.ippool: No such file or directory /usr/local/etc/raddb/radiusd.conf[1746]: Instantiation failed for module "main_pool" /usr/local/etc/raddb/sites-enabled/default[308]: Failed to find module "main_pool". /usr/local/etc/raddb/sites-enabled/default[286]: Errors parsing accounting section. } } Errors initializing modules Finally, /usr/local/etc/raddb/ is with the right permissions to the user freeradius. So, what's wrong? Thanks in advance.

3 2

FreeRadius client with IAS server; Wireshark - Code: Access Reject (3)
by Knarkargott 05 Jun '08

05 Jun '08

Hi! I use FreeRadius as a client to a IAS server. I get connection but as soon as I set the IAS to authenticate on the server, I only get "User-Name = "DsH"" several times until timeout: "No response from client ID..."). When I sniff with Wireshark, I get the error code: Access Reject (3). My test should be quite basic I think, but somehow I fail. My setup is as follows: Computer A: Active Directory Computer B: Windows IAS server (IP 192.168.0.155) Computer C: FreeRadius Client (this is actually a virtual machine) Computer A contains user DsH with pwd RADIUS. I have configured the IAS (2003) to allow everything on Computer B and secret = RADIUS. I logged in as DSH with pwd RADIUS on Computer C, with secret = RADIUS for the FreeRadius client (v.1.1.6). I have tried both radtest and radclient, with -x for debug; ------------ radtest DsH 123456 192.168.0.155 10 RADIUS -x => Radclient:: Invalid octet string "123456" for attribute name "User-Password" ------------ echo "User-Name = DsH" | .../radclient 192.168.0.155:1812 auth RADIUS => User-Name = "DsH" (several times until timeout: "No response from client ID...") ------------ Anybody have any idea? I have tried for a while reading the manuals and browsing the forum, but I just don't get it to work! Any tips will be greatly appreciated! Thanks in advance :) /Knarkargott -- View this message in context: http://www.nabble.com/FreeRadius-client-with-IAS-server--Wireshark---Code%3… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Help with FreeRadius + Switch + Mac Based Auth - question
by Daniel Machado Grilo 05 Jun '08

05 Jun '08

Hi, I'm hopping that you can help me, because i'm trying this for a lot of time I'm testing an SMC6248M switch to check if radius support is fine, so I configured a freeradius server in one fedora 8. I've made some tests adding clients to clients.conf and making requests via radtest to ensure that the radius is well configured, ex: [root@black ~]# radtest 003084-87faf2 ********* 192.168.1.13 1812 oincoinc Sending Access-Request of id 116 to 192.168.1.13 port 1812 User-Name = "003084-87faf2" User-Password = "*************" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 116 to 192.168.1.13 port 1812 User-Name = "003084-87faf2" User-Password = "omGtkKyB" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 192.168.1.13:1812, id=116, length=20 rad_verify: Received Access-Reject packet from client 192.168.1.13 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) If i change switch configuration to Auth by Local,RADIUS and then try to access the administration interface with a password that i only have in RADIUS config i get: Username: dmgrilo Password: CLI session with the Tiger Stack 10/100 is opened. To end the CLI session, enter [Exit]. logs show: rad_recv: Access-Request packet from host 192.168.1.251:1815, id=204, length=55 User-Name = "dmgrilo" User-Password = "12345" NAS-IP-Address = 192.168.1.251 NAS-Identifier = "" Sending Access-Accept of id 204 to 192.168.1.251 port 1815 which is ok. But now i have a computer in ethernet 1/35 that i want to auth via RADIUS, so i changed the port to "dot1x port-control auto" and make the interface re-auth, i loose connection to that machine and switch claims that it is not authenticated. So, my question is, in the users from FreeRadius I have the mac-address for the machine and passowrd: # Green 000244-09a361 Auth-Type := Local, User-Password == "****" Tunnel-Medium-Type = IEEE-802, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = 1 So why does the switch don't ask the RADIUS to get access? (nothing appears in logs) I don't want to have supplicants installed in client, because i want to connect phones too, but i guess with auth via MAC-Address it wouldn't need supplicants, right? One important thing is that when i check the show dot1x in the switch it doesn't determine the supplicant mac-address.. i guess it should right? 802.1X is enabled on port 1/35 reauth-enabled: Enable reauth-period: 3600 quiet-period: 60 tx-period: 30 supplicant-timeout: 30 server-timeout: 10 reauth-max: 2 max-req: 2 Status Unauthorized Operation mode Single-Host Max count 5 Port-control Auto Supplicant 00-00-00-00-00-00 Current Identifier 1 Authenticator State Machine State Connecting Reauth Count 2 Backend State Machine State Idle Request Count 0 Identifier(Server) 0 Reauthentication State Machine State Initialize So My real (resumed) question: Do I need to have supplicants even so i want to authenticate with the mac-address, or could it be that this switch doesn't support this, and the normal behaviour should be that the switch asks RADIUS to have access showing the machine credentials (MAC Address)!? Tks in Adv. Daniel

2 1

Group Expiration Date
by CoMeC 05 Jun '08

05 Jun '08

Hi, I was try to find an answer for my question, but without success.. I wanted to ask if it is possible to set expiration date for a group, so all users in this group won't get access after expiration date? "Expiration" works for single user (as a radcheck table attribute), but when I enter it in radgroupcheck, it doesn't work. Do I make a mistake anywhere, or it is just impossible? There are any other solutions? Please let me know, or send me any link, where I could get those info's. Best regards, CoMeC

4 3

Proxy Not working
by Bryan Evege 05 Jun '08

05 Jun '08

We are setting up 2 factor authentication with Wikid via our current freeradius server. Using Centos 4.6 and freeradisu 1.1.7. Raidus is currently using LDAP for user authentication. For some reason the radius server will not forward the Proxy requests to the wikid server even though it finds the realm in the proxy.conf file. If I run a tcpdump on the wiikid server there is nothing sent by the radius server. The radius server just continues down it's local ldap lookup and returns a user not found. I really need to get this working. I can post my entire radisud.conf if necessary. Any help would be greatly appreciated. Here's what I get in debug mode //rlm_realm: Looking up realm "vpn.net" for User-Name = "testuser(a)vpn.net" rlm_realm: Found realm "vpn.net" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm vpn.net rlm_realm: Adding Realm = "vpn.net" rlm_realm: Authentication realm is LOCAL. <-----This is what is strange to me. Why is it local? Shouldn't it be the server I have defined in proxy.conf (vpn.net)? Relevant radiusd.conf proxy_requests = yes $INCLUDE ${confdir}/proxy.conf ----------------- realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = yes (I've tried this with yes and with no. Makes no difference) ignore_null = yes (I've tried this with yes and with no. Makes no difference) } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } Startup Info [******]$ sudo /opt/freeradius/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 3 ldap: timelimit = 5 ldap: identity = *************************** ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "********" ldap: basedn = "dc=csctus,dc=net" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/opt/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 10 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute atlanta-Ldap-Group rlm_ldap: Registering ldap_groupcmp for atlanta-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name atlanta rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /opt/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x86ff188 Module: Instantiated ldap (atlanta) ldap: server = "************" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 3 ldap: timelimit = 5 ldap: identity = "******************" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "********" ldap: basedn = "dc=csctus,dc=net" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/opt/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 10 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute denver-Ldap-Group rlm_ldap: Registering ldap_groupcmp for denver-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name denver rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /opt/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x87002f0 Module: Instantiated ldap (denver) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/opt/freeradius/etc/raddb/huntgroups" preprocess: hints = "/opt/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/freeradius/etc/raddb/users" files: acctusersfile = "/opt/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/opt/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) main: smux_password = "**********" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: **************** SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. SMUX read start SMUX read len: 6 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 6 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Proxy.conf settings proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } { realm NULL { Type = radius Authhost = currentradius_server_IP:1812 # accthost = 127.0.0.1:1813 Secret = ************* } realm vpn.net { Type = radius Authhost = wikidserver_ip:1812 # accthost = 127.0.0.1:1813 Secret = ************** } Bryan Evege

2 1