October 2009 - Freeradius-Users - lists.freeradius.org

how to get a UserName from a Pool
by Alisson 19 Oct '09

19 Oct '09

Hi, I need to redirect a customer to a page with the pool and I need to get his UserName. I tougth to use the MK API to acess, I used the NASIPAddress, UserName and Password, The redirect and acess MK API its easy, but my problem is how to get the UserName of one customer if I have alot of customers with one NASIpAddress? -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

2 2

HINTS and EAP correspondence issue.
by Matthieu Lazaro 19 Oct '09

19 Oct '09

Hello list, I have a little question about hints and EAP. Trying to set up machine authentification, I have been able to rewrite my user-name to match my requirements in my Open ldap: get rid of the host/ and add $ ( host/machinename --> machinename$) using hints. But it ends up with this error after ldap authorisation: [eap] Identity does not match User-Name, setting from EAP Identity And it fails the authentification part. How can I tell EAP the new user name? It works when I use realm in proxy.conf and remove the $ at the end of the machine uid in my ldap, but this won't do as I don't want to rename all the uids. Best regards, Matthew

2 3

Several virtual servers with different log files?
by Francisco Javier Valdera Garcia 19 Oct '09

19 Oct '09

Hi, I have a freeRadius 2.1.7 server with three virtual servers listening to different kinds of clients. I would like to know whether it is possible to define different log files for these virtual servers, instead of the global log file defined in radiusd.conf. Reading the README file inside the sites-available directory, it seems that it is not possible to define a 'log' section in a virtual server. Thanks for the help, Francisco Javier Valdera.

3 4

mysql radgroupcheck, deny access
by Michael Bowe 19 Oct '09

19 Oct '09

I had some older Debian 4.0 (etch) servers, with freeradius v1.1.3 installed from packages. I then upgraded to Debian 5.0 (lenny), which comes with freeradius v2.0.4 After upgrading I ran into some problems with my radgroupcheck rules. In radgroupcheck, I have some rules to restrict which NAS users are allowed to connect to. Here's an example : mysql> select * from radcheck where username = 'mbowe-test'; +------+------------+----------------+----+--------------------------------- ---+ | id | username | attribute | op | value | +------+------------+----------------+----+--------------------------------- ---+ | 708 | mbowe-test | Crypt-Password | := | <SNIPPED> | +------+------------+----------------+----+--------------------------------- ---+ mysql> select * from radreply where username = 'mbowe-test'; Empty set (0.00 sec) mysql> select * from radusergroup where username = 'mbowe-test'; +------------+----------------+----------+ | username | groupname | priority | +------------+----------------+----------+ | mbowe-test | dialup-freedom | 1 | +------------+----------------+----------+ mysql> select * from radgroupcheck where groupname = 'dialup-freedom'; +----+----------------+------------------+----+----------------------------- + | id | groupname | attribute | op | value | +----+----------------+------------------+----+----------------------------- + | 3 | dialup-freedom | NAS-IP-Address | !~ | ^111.222.333.(1|2|3|4|5|6)$ | | 4 | dialup-freedom | Simultaneous-Use | := | 1 | +----+----------------+------------------+----+----------------------------- + mysql> select * from radgroupreply where groupname = 'dialup-freedom'; +----+----------------+--------------------+----+---------------------+ | id | groupname | attribute | op | value | +----+----------------+--------------------+----+---------------------+ | 9 | dialup-freedom | Service-Type | := | Framed-User | | 10 | dialup-freedom | Framed-Protocol | := | PPP | | 11 | dialup-freedom | Framed-IP-Address | = | 255.255.255.254 | | 12 | dialup-freedom | Framed-IP-Netmask | := | 255.255.255.255 | | 13 | dialup-freedom | Framed-Compression | := | Van-Jacobson-TCP-IP | | 14 | dialup-freedom | Idle-Timeout | := | 1800 | | 15 | dialup-freedom | Session-Timeout | := | 14400 | | 16 | dialup-freedom | Port-Limit | := | 1 | +----+----------------+--------------------+----+---------------------+ Under the older freeradius, if the mbowe-test user tried to connect to a NAS with IP 111.222.333.1|2|3|4|5|6 then their access would be rejected. However under the newer freeradius, the user can now get online OK. (The group doesn't match so the 'dialup-freedom' attributes are not returned) In my sql.conf I have read_groups = yes I tried installing the freeradius 2.1.7 from source, and it gives the same result as the 2.0.4 from packages (user can get online). Am I doing something wrong? Let me know if you would like me to paste some debugs. Michael.

2 1

No NAS-Port seen warning
by Robert White 19 Oct '09

19 Oct '09

Hey, I keep getting a warning message in my Radius setup... WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent This is true enough. But I am sending a slightly different attribute: 'Quintum-NAS-Port'. Do I have control over this 'NAS-Port prefix? Or can I make rlm_acct_unique look for Quintum-NAS-Port instead of just NAS-Port? Any help appreciated. Thanks, Rob

4 4

None
by INACIO ALVES 19 Oct '09

19 Oct '09

I'm trying configure the freeRADIUS on my wireless network but i'm having problems. My scnario: Debian Lenny+MySQL5.0+freeRADIUS 2.1.7 clients ----- ((( AP ))) ____ [freeRADIUS server] When I execute the radiustest I get rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=168, length=20 and when I execute radclient I get Received response ID 146, code 2, length = 32 But when I try authenticate on my nootebook I get rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=168 My debug output is on address: http://pastebin.com/f7e47862f. My clients.conf is on: http://pastebin.com/f30e4955d And my users is on: http://pastebin.com/f5d958f63 This is my initial configuration. I want migrate to MySQL or PostgreSQL when the server is ready, I don't need proxy, and i need provide/revoke digital certificates to my clients. Inácio Alves http://www.polluxweb.com/inacioalves/site

3 2

How to configure Wrong Message-Authenticator in Free-radius server response
by Venseen 19 Oct '09

19 Oct '09

Hi, I have to insert cooked Message-authenticator in Free-radius srver Message, I tried to insert it in the users file in raddb. But, the configured value is not observed in the Access Accept packets for the Radius Server. Changes in raddb/users: hp Cleartext-Password := "hp123" Message-Authenticator = "0x12345000000000000000000000000000" Then I came to know that this wud not be taken while Calculating Message-Authenticator, Any help on cooking Message Authentictor without modifying the code is appreciated, Note: I have successfully modified code and able to do it, but i need to if it is possible by simple config file change Thanks Venseen -- View this message in context: http://www.nabble.com/How-to-configure-Wrong-Message-Authenticator-in-Free-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Help on adding value to mysql
by Simone Felici 19 Oct '09

19 Oct '09

Hello to all, I've freeradius installed on a CentOS 4.5: freeradius-1.1.5-0. I would like to add a new field to my radacct table to log a new value taken from sip/ser accounting. Until here ok, It's sufficient to alter the table, add the value into proper dictionary and alter the sql inserts to add the value. What I would like to do is to modify the value BEFORE insert it into mysql. The detail-file logs the following value: (...) Sip-Translated-Request-ID = "sip:<PHONE-NUMBER>@<IP-ADDRESS>:<PORT>;transport=udp" (...) Also I would like to add to MySQL (radacct) the Sip-Translated-Request-ID field, BUT ONLY the <IP-ADDRESS>. I should execute a sort of regexp or something that gives me the following result, for example: Sip-Translated-Request-ID = `echo "sip:<PHONE-NUMBER>@<IP-ADDRESS>:<PORT>;transport=udp" | awk -F@ '{ print $2 }' | awk -F: '{ print $1 }'` This would return me only the IP-ADDRESS to add within '%{Sip-Translated-Request-ID}'. Can someone help me a little bit? Thank's Simon

1 1

Freeradius can't authenticate pptp users from Windows XP to LDAP
by tede 18 Oct '09

18 Oct '09

Hi, Sorry to bother, I've been reading almost every post here that talks about the same problem that I'm encountering, but I didn't find any solution for my trouble. Here is the thing, I'm using freeradius + LDAP + pptpd, to authenticate windows VPN Users. When I put users Cleartext-password in the freeradius'users file, everything works fine, but when I remove this information from users'file and I want that the authentication to be done by LDAP database, nothing works. Here is my users in LDAP database, for tests : dn: uid=light,ou=vpn,dc=home objectClass: account objectClass: simpleSecurityObject objectClass: radiusprofile uid: light cn: The Tester structuralObjectClass: account entryUUID: 74eeffe8-47c0-102e-87e0-8d7f2b5bb553 creatorsName: createTimestamp: 20091007190752Z userPassword:: dGVzdGVy entryCSN: 20091007193817.121196Z#000000#000#000000 modifiersName: cn=admin,dc=home modifyTimestamp: 20091007193817Z dn: uid=flash,ou=vpn,dc=home objectClass: account objectClass: simpleSecurityObject objectClass: radiusprofile uid: flash cn: Second one userPassword:: dGVzdGVy structuralObjectClass: account entryUUID: 6fa73a2e-47c4-102e-8f78-e10206a13f31 creatorsName: createTimestamp: 20091007193621Z entryCSN: 20091007193621.607389Z#000000#000#000000 modifiersName: modifyTimestamp: 20091007193621Z And there, my Debug from freeradius : Info: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Oct 3 2009 at 19:16:29 Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info: PARTICULAR PURPOSE. Info: You may redistribute copies of FreeRADIUS under the terms of the Info: GNU General Public License. Info: Starting - reading configuration files ... Debug: including configuration file /etc/freeradius/radiusd.conf Debug: including configuration file /etc/freeradius/clients.conf Debug: including configuration file /etc/freeradius/policy.conf Debug: including files in directory /etc/freeradius/sites-enabled/ Debug: including configuration file /etc/freeradius/sites-enabled/default Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Debug: including dictionary file /etc/freeradius/dictionary Debug: main { Debug: prefix = "/usr" Debug: localstatedir = "/var" Debug: logdir = "/var/log/freeradius" Debug: libdir = "/usr/lib/freeradius" Debug: radacctdir = "/var/log/freeradius/radacct" Debug: hostname_lookups = no Debug: max_request_time = 30 Debug: cleanup_delay = 5 Debug: max_requests = 1024 Debug: allow_core_dumps = no Debug: pidfile = "/var/run/freeradius/freeradius.pid" Debug: user = "freerad" Debug: group = "freerad" Debug: checkrad = "/usr/sbin/checkrad" Debug: debug_level = 0 Debug: proxy_requests = yes Debug: security { Debug: max_attributes = 200 Debug: reject_delay = 1 Debug: status_server = yes Debug: } Debug: } Debug: client localhost { Debug: ipaddr = 127.0.0.1 Debug: require_message_authenticator = no Debug: secret = "hometest" Debug: nastype = "other" Debug: } Debug: client 192.168.0.0/24 { Debug: require_message_authenticator = no Debug: secret = "hometest" Debug: shortname = "private-network-1" Debug: } Debug: radiusd: #### Loading Realms and Home Servers #### Debug: radiusd: #### Instantiating modules #### Debug: instantiate { Debug: (Loaded rlm_exec, checking if it's valid) Debug: Module: Linked to module rlm_exec Debug: Module: Instantiating exec Debug: exec { Debug: wait = yes Debug: input_pairs = "request" Debug: shell_escape = yes Debug: } Debug: (Loaded rlm_expr, checking if it's valid) Debug: Module: Linked to module rlm_expr Debug: Module: Instantiating expr Debug: (Loaded rlm_expiration, checking if it's valid) Debug: Module: Linked to module rlm_expiration Debug: Module: Instantiating expiration Debug: expiration { Debug: reply-message = "Password Has Expired " Debug: } Debug: (Loaded rlm_logintime, checking if it's valid) Debug: Module: Linked to module rlm_logintime Debug: Module: Instantiating logintime Debug: logintime { Debug: reply-message = "You are calling outside your allowed timespan " Debug: minimum-timeout = 60 Debug: } Debug: } Debug: radiusd: #### Loading Virtual Servers #### Debug: server inner-tunnel { Debug: modules { Debug: Module: Checking authenticate {...} for more modules to load Debug: (Loaded rlm_pap, checking if it's valid) Debug: Module: Linked to module rlm_pap Debug: Module: Instantiating pap Debug: pap { Debug: encryption_scheme = "auto" Debug: auto_header = no Debug: } Debug: (Loaded rlm_chap, checking if it's valid) Debug: Module: Linked to module rlm_chap Debug: Module: Instantiating chap Debug: (Loaded rlm_mschap, checking if it's valid) Debug: Module: Linked to module rlm_mschap Debug: Module: Instantiating mschap Debug: mschap { Debug: use_mppe = yes Debug: require_encryption = no Debug: require_strong = no Debug: with_ntdomain_hack = no Debug: } Debug: (Loaded rlm_unix, checking if it's valid) Debug: Module: Linked to module rlm_unix Debug: Module: Instantiating unix Debug: unix { Debug: radwtmp = "/var/log/freeradius/radwtmp" Debug: } Debug: (Loaded rlm_ldap, checking if it's valid) Debug: Module: Linked to module rlm_ldap Debug: Module: Instantiating ldap Debug: ldap { Debug: server = "localhost" Debug: port = 389 Debug: password = "" Debug: identity = "" Debug: net_timeout = 1 Debug: timeout = 4 Debug: timelimit = 3 Debug: tls_mode = no Debug: start_tls = no Debug: tls_require_cert = "allow" Debug: tls { Debug: start_tls = no Debug: require_cert = "allow" Debug: } Debug: basedn = "ou=vpn,dc=home" Debug: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Debug: base_filter = "(objectclass=radiusprofile)" Debug: password_attribute = "userPassword" Debug: auto_header = yes Debug: access_attr_used_for_allow = yes Debug: groupname_attribute = "cn" Debug: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" Debug: dictionary_mapping = "/etc/freeradius/ldap.attrmap" Debug: ldap_debug = 0 Debug: ldap_connections_number = 5 Debug: compare_check_items = no Debug: do_xlat = yes Debug: edir_account_policy_check = no Debug: set_auth_type = no Debug: } Debug: rlm_ldap: Registering ldap_groupcmp for Ldap-Group Debug: rlm_ldap: Registering ldap_xlat with xlat_name ldap Debug: rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap Debug: rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ Debug: rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ Debug: rlm_ldap: LDAP digestHA1 mapped to RADIUS Digest-HA1 Debug: rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type Debug: rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use Debug: rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id Debug: rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id Debug: rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password Debug: rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password Debug: rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password Debug: rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password Debug: rlm_ldap: LDAP ntHash mapped to RADIUS NT-Hash Debug: rlm_ldap: LDAP lmHash mapped to RADIUS LM-Hash Debug: rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT Debug: rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration Debug: rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address Debug: rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type Debug: rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol Debug: rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address Debug: rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask Debug: rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route Debug: rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing Debug: rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id Debug: rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU Debug: rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression Debug: rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host Debug: rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service Debug: rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port Debug: rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number Debug: rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id Debug: rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network Debug: rlm_ldap: LDAP radiusClass mapped to RADIUS Class Debug: rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout Debug: rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout Debug: rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action Debug: rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service Debug: rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node Debug: rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group Debug: rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link Debug: rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network Debug: rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone Debug: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit Debug: rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port Debug: rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message Debug: conns: 0x85f0988 Debug: Module: Checking authorize {...} for more modules to load Debug: (Loaded rlm_realm, checking if it's valid) Debug: Module: Linked to module rlm_realm Debug: Module: Instantiating suffix Debug: realm suffix { Debug: format = "suffix" Debug: delimiter = "@" Debug: ignore_default = no Debug: ignore_null = no Debug: } Debug: (Loaded rlm_files, checking if it's valid) Debug: Module: Linked to module rlm_files Debug: Module: Instantiating files Debug: files { Debug: usersfile = "/etc/freeradius/users" Debug: acctusersfile = "/etc/freeradius/acct_users" Debug: preproxy_usersfile = "/etc/freeradius/preproxy_users" Debug: compat = "no" Debug: } Debug: Module: Checking session {...} for more modules to load Debug: (Loaded rlm_radutmp, checking if it's valid) Debug: Module: Linked to module rlm_radutmp Debug: Module: Instantiating radutmp Debug: radutmp { Debug: filename = "/var/log/freeradius/radutmp" Debug: username = "%{User-Name}" Debug: case_sensitive = yes Debug: check_with_nas = yes Debug: perm = 384 Debug: callerid = yes Debug: } Debug: Module: Checking post-auth {...} for more modules to load Debug: (Loaded rlm_attr_filter, checking if it's valid) Debug: Module: Linked to module rlm_attr_filter Debug: Module: Instantiating attr_filter.access_reject Debug: attr_filter attr_filter.access_reject { Debug: attrsfile = "/etc/freeradius/attrs.access_reject" Debug: key = "%{User-Name}" Debug: } Debug: } Debug: } Debug: server { Debug: modules { Debug: Module: Checking authenticate {...} for more modules to load Debug: Module: Checking authorize {...} for more modules to load Debug: (Loaded rlm_preprocess, checking if it's valid) Debug: Module: Linked to module rlm_preprocess Debug: Module: Instantiating preprocess Debug: preprocess { Debug: huntgroups = "/etc/freeradius/huntgroups" Debug: hints = "/etc/freeradius/hints" Debug: with_ascend_hack = no Debug: ascend_channels_per_line = 23 Debug: with_ntdomain_hack = no Debug: with_specialix_jetstream_hack = no Debug: with_cisco_vsa_hack = no Debug: with_alvarion_vsa_hack = no Debug: } Debug: Module: Checking preacct {...} for more modules to load Debug: (Loaded rlm_acct_unique, checking if it's valid) Debug: Module: Linked to module rlm_acct_unique Debug: Module: Instantiating acct_unique Debug: acct_unique { Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Debug: } Debug: Module: Checking accounting {...} for more modules to load Debug: (Loaded rlm_detail, checking if it's valid) Debug: Module: Linked to module rlm_detail Debug: Module: Instantiating detail Debug: detail { Debug: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Debug: header = "%t" Debug: detailperm = 384 Debug: dirperm = 493 Debug: locking = no Debug: log_packet_header = no Debug: } Debug: Module: Instantiating attr_filter.accounting_response Debug: attr_filter attr_filter.accounting_response { Debug: attrsfile = "/etc/freeradius/attrs.accounting_response" Debug: key = "%{User-Name}" Debug: } Debug: Module: Checking session {...} for more modules to load Debug: Module: Checking post-auth {...} for more modules to load Debug: } Debug: } Debug: radiusd: #### Opening IP addresses and Ports #### Debug: listen { Debug: type = "auth" Debug: ipaddr = * Debug: port = 0 Debug: } Debug: listen { Debug: type = "acct" Debug: ipaddr = * Debug: port = 0 Debug: } Debug: main { Debug: snmp = no Debug: smux_password = "" Debug: snmp_write_access = no Debug: } Debug: Listening on authentication address * port 1812 Debug: Listening on accounting address * port 1813 Debug: Listening on proxy address * port 1814 Debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 42393, id=88, length=144 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "light" MS-CHAP-Challenge = 0xb0e4f30555c866750a41eca5b070dd38 MS-CHAP2-Response = 0x0600ee6e8f48c9792c51f31cd89d99b33bdb0000000000000000b2e5571c233fe74a670d9dc9fbc59caf3076ab53eff195fe Calling-Station-Id = "192.168.0.1" NAS-IP-Address = 0x0101 NAS-Port = 0 Debug: +- entering group authorize Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Debug: ++[preprocess] returns ok Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Debug: ++[chap] returns noop Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Debug: rlm_ldap: - authorize Debug: rlm_ldap: performing user authorization for light Debug: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Debug: expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=light) Debug: expand: ou=vpn,dc=home -> ou=vpn,dc=home Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Debug: rlm_ldap: attempting LDAP reconnection Debug: rlm_ldap: (re)connect to localhost:389, authentication 0 Debug: rlm_ldap: bind as / to localhost:389 Debug: rlm_ldap: waiting for bind result ... Debug: rlm_ldap: Bind was successful Debug: rlm_ldap: performing search in ou=vpn,dc=home, with filter (uid=light) Debug: rlm_ldap: No default NMAS login sequence Debug: rlm_ldap: looking for check items in directory... Debug: rlm_ldap: looking for reply items in directory... Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Debug: rlm_ldap: user light authorized to use remote access Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Debug: ++[ldap] returns ok Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Debug: ++[mschap] returns ok Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Debug: rlm_realm: No '@' in User-Name = "light", looking up realm NULL Debug: rlm_realm: No such realm "NULL" Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Debug: ++[suffix] returns noop Debug: modsingle[authorize]: calling unix (rlm_unix) for request 0 Debug: modsingle[authorize]: returned from unix (rlm_unix) for request 0 Debug: ++[unix] returns notfound Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Debug: ++[files] returns noop Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Debug: ++[expiration] returns noop Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Debug: ++[logintime] returns noop Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Debug: ++[pap] returns noop Debug: rad_check_password: Found Auth-Type mschap Debug: auth: type "MSCHAP" Debug: +- entering group MS-CHAP Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 0 Debug: rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. Debug: rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. Debug: rlm_mschap: Told to do MS-CHAPv2 for light with NT-Password Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Debug: ++[mschap] returns reject Debug: auth: Failed to validate the user. Auth: Login incorrect: [light/<via Auth-Type = mschap>] (from client localhost port 0 cli 192.168.0.1) Debug: Found Post-Auth-Type Reject Debug: +- entering group REJECT Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Debug: expand: %{User-Name} -> light Debug: attr_filter: Matched entry DEFAULT at line 11 Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Debug: ++[attr_filter.access_reject] returns updated Debug: Delaying reject of request 0 for 1 seconds Debug: Going to the next request Debug: Waking up in 0.9 seconds. Debug: Sending delayed reject for request 0 Sending Access-Reject of id 88 to 127.0.0.1 port 42393 Debug: Waking up in 4.9 seconds. Debug: Cleaning up request 0 ID 88 with timestamp +8 Debug: Ready to process requests. Thank you very much for your Help. Tede -- View this message in context: http://www.nabble.com/Freeradius-can%27t-authenticate-pptp-users-from-Windo… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 26

Segmentation fault
by Anusha K 18 Oct '09

18 Oct '09

Please help me i'm facing problem installing radius on Ubuntu 8.04 - the Hardy Heron. It shows segementation fault. anusha@anusha-desktop:/$ sudo freeradius start -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Segmentation fault anusha@anusha-desktop:/$ ./configure bash: ./configure: No such file or directory anusha@anusha-desktop:/$ docs/bugs bash: docs/bugs: No such file or directory anusha@anusha-desktop:/$ /docs/bugs bash: /docs/bugs: No such file or directory anusha@anusha-desktop:/$ sudo freeradius start -X [sudo] password for anusha: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Segmentation fault radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Segmentation fault

2 1