June 2008 - Freeradius-Users - lists.freeradius.org

Logs in radacct
by Daniel Davidson 03 Jun '08

03 Jun '08

For some ready my accounting information isnt being written at all, even though I cannot find a difference in the config file with another radius server I am running. I have included what I believe to be the appropriate parts or radiuxsd -x below. Seems like the %{Client-IP-Address} directories are not created, but I dont know why. I am using radius 1.1.5-1. thanks, Dan Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes .......(skipping stuff)..... Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Detail Portion: detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d:%H detailperm = 0600 }

2 1

Hints file and Strip-User-Name
by Paul Khavkine 03 Jun '08

03 Jun '08

Hi. I'm trying to match a suffix in the username using the hints file and strip the suffix. I have the following configured: raddb/hints: DEFAULT Suffix == ".d", Strip-User-Name = Yes Hint = "Dynamic" raddb/users: DEFAULT Hint == "Dynamic" Framed-IP-Address := 255.255.255.254, Fall-Through = Yes user Cleartext-Password := "password" Service-Type = Framed-User, Framed-IP-Address = XXX.XXX.XXX.XXX, Framed-Protocol = PPP, Framed-Routing = None, Session-Timeout = 604800, Idle-Timeout = 86400, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP When run radiusd -W I can see it enter the preprocess module and match an entry, but the suffix is not being stripped and entry in users file not being matched: Tue Jun 3 12:54:15 2008 : Debug: +- entering group authorize Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Tue Jun 3 12:54:15 2008 : Debug: rlm_realm: No '@' in User-Name = "user.d", looking up realm NULL Tue Jun 3 12:54:15 2008 : Debug: rlm_realm: No such realm "NULL" Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Tue Jun 3 12:54:15 2008 : Debug: ++[suffix] returns noop Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Jun 3 12:54:15 2008 : Debug: hints: Matched DEFAULT at 79 Tue Jun 3 12:54:15 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Jun 3 12:54:15 2008 : Debug: ++[preprocess] returns ok Tue Jun 3 12:54:15 2008 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jun 3 12:54:15 2008 : Debug: auth: Failed to validate the user. Tue Jun 3 12:54:15 2008 : Auth: Login incorrect: [user.d/password] (from client ERX-LAB port 2152726802 cli #ERX01.OTWODDS#BLC01.OTW23DS atm 3/1:0.35#) Tue Jun 3 12:54:15 2008 : Debug: Found Post-Auth-Type Reject Tue Jun 3 12:54:15 2008 : Debug: +- entering group REJECT Tue Jun 3 12:54:15 2008 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Tue Jun 3 12:54:15 2008 : Debug: expand: %{User-Name} -> user.d Tue Jun 3 12:54:15 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 3 12:54:15 2008 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Tue Jun 3 12:54:15 2008 : Debug: ++[attr_filter.access_reject] returns updated Tue Jun 3 12:54:15 2008 : Debug: Delaying reject of request 0 for 1 seconds Tue Jun 3 12:54:15 2008 : Debug: Going to the next request Tue Jun 3 12:54:15 2008 : Debug: Waking up in 0.9 seconds. Tue Jun 3 12:54:16 2008 : Debug: Sending delayed reject for request 0 Tue Jun 3 12:54:16 2008 : Debug: Waking up in 4.9 seconds. Tue Jun 3 12:54:21 2008 : Debug: Cleaning up request 0 ID 5 with timestamp +79 Tue Jun 3 12:54:21 2008 : Debug: Ready to process requests. Any ideas ? I'm running FreeRADIUS 2.0.3. Thanx Paul

2 4

Problem with EAP-MD5
by Adnan 03 Jun '08

03 Jun '08

I'm trying to authenticate my wireless users using EAP-MD5 protocol. This is what I have on verbose radiusd -X -s This is entry in my user file 001de03cf351 Cleartext-Password := "001de03cf351" Can some one help me with this problem: rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Adnan. Going to the next request Waking up in 0.6 seconds. Acct-Session-Id = "2f85c35c" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "001de03cf351" Calling-Station-Id = "00-1D-E0-3C-F3-51" Called-Station-Id = "00-03-52-A1-B5-F0" EAP-Message = 0x024e002204103e504f11bd1ec75aa2a7d10c9761143b303031646530336366333531 State = 0xc6684373c61e47f3b7d0c70f4760f357 NAS-Identifier = "K068-00419" NAS-IP-Address = 192.168.1.43 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Login-User Chargeable-User-Identity = "\000" Colubris-AVPair = "ssid=Colubris Networks 3" Colubris-AVPair = "vsc-name=Studentski domovi 2" Colubris-Attr-254 = 0x00 Colubris-Attr-251 = 0x00000000 Colubris-Attr-253 = 0x01 Colubris-Attr-252 = 0x00000001 Message-Authenticator = 0x94c597ad490d05130436e281862cacb6 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "001de03cf351", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 78 length 34 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry DEFAULT at line 53 users: Matched entry 001de03cf351 at line 74 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [001de03cf351/<via Auth-Type = EAP>] (from client mibo port 1 cli 00-1D-E0-3C-F3-51) Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.6 seconds. Cleaning up request 0 ID 203 with timestamp +72 Waking up in 0.3 seconds.

1 0

Rlm_sqlippool and dialupadmin
by Omer Faruk SEN 03 Jun '08

03 Jun '08

Hi, I am planning to develop a patch for dialupadmin so i can use radippool tablo for Rlm_sqlippool. I just wanted to be sure what to add to the GUI - dialupadmin- 1) There must a a new tab to add IP addresses to the radippool table. At http://wiki.freeradius.org/Rlm_sqlippool IP addresses are added like: INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.1'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.2'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.3'); INSERT INTO radippool (pool_name, framedipaddress) VALUES ('main_pool', '192.168.0.4 2) The code must edit radgroupcheck table (Not radgroupreply since it is a control attribute not a reply attribute) to add the group to the related pool (for example main_pool) just like in http://lists.cistron.nl/pipermail/freeradius-users/2006-October/057508.html Is there any additional steps that needs to be implemented? BTW am I right about radgroupcheck is used for Control Attributes but radgroupreply is used for reply attributes? Best Regards. -- Best regards, Omer mailto:omer@faruk.net

1 0

Freeradius and OpenVpn
by Sascha Kiefer 02 Jun '08

02 Jun '08

Hi, I set up a openvpn server with radius plugin. Everything seems to run. Now, i submit my username + password using the openvpn win client from openvpn.se . For debugging, i enabled password logging in radius Mon Jun 2 03:44:14 2008 : Auth: Login incorrect: [hugo/boss] (from client ds01 port 3 cli 1.2.3.4) Mon Jun 2 03:44:15 2008 : Auth: Login incorrect: [hugo/boss] (from client ds01 port 3 cli 1.2.3.4) But the hugo/boss combination is right. I also have a poptop server running which uses the same radius server. There i get the following message Mon Jun 2 04:13:33 2008 : Auth: Login OK: [hugo/<no User-Password attribute>] (from client ds01 port 1 cli 7.19) Well, now as i see this message, it it because i only support MsCHAPv2 ??? :-) So i guess, i have to allow something else? What is it? Regards, Sascha

3 2

"looking" into local db after Realm Default was found
by Hans Bornemann 02 Jun '08

02 Jun '08

Hi, I don't know why my radius does the following: my freeradius-server (1.1.7) retrieves the username from the local db AFTER "Found realm "DEFAULT". Then the query was send to the correct radius. Thanks Hans Debug: ....... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 50 modcall[authorize]: module "preprocess" returns ok for request 50 modcall[authorize]: module "chap" returns noop for request 50 modcall[authorize]: module "mschap" returns noop for request 50 rlm_realm: Looking up realm "dfn.de" for User-Name = "bornemann(a)dfn.de" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user bornemann to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 50 rlm_eap: Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 50 radius_xlat: 'bornemann(a)dfn.de' rlm_sql (sql): sql_set_user escaped user --> 'bornemann(a)dfn.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bornemann(a)dfn.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): User bornemann(a)dfn.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bornemann(a)dfn.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bornemann(a)dfn.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User bornemann(a)dfn.de not found in radgroupcheck rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 50 modcall[authorize]: module "pap" returns noop for request 50 modcall: leaving group authorize (returns updated) for request 50 Sending Access-Request of id 0 to 123.123.123.123 port 1812 ... -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

3 4

Online users
by Eduardo Cavalcanti 02 Jun '08

02 Jun '08

I want to list the online users, but I don't want to use a database such as mysql. Is there any alternative for me?? Is there any command to list the online users?? I tried "radwho" but it doesn't list any user... Any help?

2 1

if passwd returns notfound -> reject?
by Wolfgang Burger 02 Jun '08

02 Jun '08

Good morning to all, I`m using the passwd module to add an atribute to the request. How can I configure the server to reject the request if the modeule returns "notfound"? One idea would be to add an default value to the attribute and check wether it has changed after the module was called. Would this be possible? Or is there a better way? Thank you all, Wolfgang Burger

2 4

Is it possible to use FreeRadius Client with Microsoft IAS?
by Knarkargott 02 Jun '08

02 Jun '08

Hi! I am new to both Linux and RADIUS, but I really want to learn about this. I have been trying to get the FreeRadius client to work with IAS for a while now but without success, so I really need some help with this. My test should be quite basic I think, but somehow I fail. My setup is as follows: Computer A: Active Directory Computer B: Windows IAS server (IP 192.168.0.155) Computer C: FreeRadius Client (this is actually a virtual machine) Computer A contains user DsH with pwd RADIUS. I have configured the IAS (2003) to allow everything on Computer B and secret = RADIUS. I logged in as DSH with pwd RADIUS on Computer C, with secret = RADIUS for the FreeRadius client (v.1.1.6). I have tried both radtest and radclient, with -x for debug; ------------ radtest DsH 123456 192.168.0.155 10 RADIUS -x => Radclient:: Invalid octet string "123456" for attribute name "User-Password" ------------ echo "User-Name = DsH" | .../radclient 192.168.0.155:1812 auth RADIUS => User-Name = "DsH" (several times until timeout: "No response from client ID...") ------------ Anybody have any idea? Did I miss something basic here, or does FreeRadius Client/IAS just doesn't work together? I have tried for a while reading the manuals and browsing the forum, but I just don't get it to work! Any tips will be greatly appreciated! Thanks in advance :) /Knarkargott -- View this message in context: http://www.nabble.com/Is-it-possible-to-use-FreeRadius-Client-with-Microsof… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

MSCHAP V2 + Plain Text
by vijayakumar 02 Jun '08

02 Jun '08

Dear All , 1) Does MSCHAP V2 supports clear text password only ? 2) Can I integrate MSCHAP V2 with LDAP .If so what changes tobe made in configuration file. Thanks &Regards. VIJAY PUNE

3 4