December 2009 - Freeradius-Users - lists.freeradius.org

not able to get authenticated by free Radius
by Yagnesh Dave 03 Dec '09

03 Dec '09

Hi, I am not able to get authenticate from the free radius server. PLease fins the logs for the same on my LNS ################################################################# 072633: Dec 3 22:13:48.335 IST: ppp491 PPP: Authorization required 072634: Dec 3 22:13:48.335 IST: ppp491 PPP: Sent CHAP LOGIN Request 072635: Dec 3 22:13:48.335 IST: RADIUS/ENCODE(00001A39):Orig. component type = VPDN 072636: Dec 3 22:13:48.335 IST: RADIUS: AAA Unsupported Attr: interface [157] 15 072637: Dec 3 22:13:48.335 IST: RADIUS: 55 6E 69 71 2D 53 65 73 73 2D 49 44 34 [Uniq-Sess-ID4] 072638: Dec 3 22:13:48.335 IST: RADIUS(00001A39): Config NAS IP: 192.168.243.250 072639: Dec 3 22:13:48.335 IST: RADIUS/ENCODE(00001A39): acct_session_id: 10199 072640: Dec 3 22:13:48.335 IST: RADIUS(00001A39): sending 072641: Dec 3 22:13:48.335 IST: RADIUS(00001A39): Send Access-Request to 172.31.6.158:1645 id 1645/128, len 133 072642: Dec 3 22:13:48.335 IST: RADIUS: authenticator 44 7F FA 34 1E FE 1E 8C - DB F7 84 BE 44 0A 5E 40 072643: Dec 3 22:13:48.335 IST: RADIUS: Framed-Protocol [7] 6 PPP [1] 072644: Dec 3 22:13:48.335 IST: RADIUS: User-Name [1] 17 "tcl1(a)cisco1.com" 072645: Dec 3 22:13:48.335 IST: RADIUS: CHAP-Password [3] 19 * 072646: Dec 3 22:13:48.335 IST: RADIUS: NAS-Port-Type [61] 6 Virtual [5] 072647: Dec 3 22:13:48.335 IST: RADIUS: NAS-Port [5] 6 491 072648: Dec 3 22:13:48.335 IST: RADIUS: NAS-Port-Id [87] 17 "Uniq-Sess-ID491" 072649: Dec 3 22:13:48.335 IST: RADIUS: Calling-Station-Id [31] 17 "404001623674242" 072650: Dec 3 22:13:48.335 IST: RADIUS: Connect-Info [77] 13 "64000/57600" 072651: Dec 3 22:13:48.335 IST: RADIUS: Service-Type [6] 6 Framed [2] 072652: Dec 3 22:13:48.335 IST: RADIUS: NAS-IP-Address [4] 6 192.168.243.250 072653: Dec 3 22:13:48.567 IST: ppp492 PPP: Authorization required 072654: Dec 3 22:13:48.567 IST: ppp492 PPP: Sent CHAP LOGIN Request 072655: Dec 3 22:13:48.567 IST: RADIUS/ENCODE(00001A3A):Orig. component type = VPDN 072656: Dec 3 22:13:48.567 IST: RADIUS: AAA Unsupported Attr: interface [157] 15 072657: Dec 3 22:13:48.567 IST: RADIUS: 55 6E 69 71 2D 53 65 73 73 2D 49 44 34 [Uniq-Sess-ID4] 072658: Dec 3 22:13:48.567 IST: RADIUS(00001A3A): Config NAS IP: 192.168.243.250 072659: Dec 3 22:13:48.567 IST: RADIUS/ENCODE(00001A3A): acct_session_id: 10200 072660: Dec 3 22:13:48.567 IST: RADIUS(00001A3A): sending 072661: Dec 3 22:13:48.567 IST: RADIUS(00001A3A): Send Access-Request to 172.31.6.158:1645 id 1645/129, len 133 072662: Dec 3 22:13:48.567 IST: RADIUS: authenticator 24 41 31 64 0C 88 D8 9F - F6 12 B3 78 5E B7 27 09 072663: Dec 3 22:13:48.567 IST: RADIUS: Framed-Protocol [7] 6 PPP [1] 072664: Dec 3 22:13:48.571 IST: RADIUS: User-Name [1] 17 "tcl2(a)cisco1.com" 072665: Dec 3 22:13:48.571 IST: RADIUS: CHAP-Password [3] 19 * 072666: Dec 3 22:13:48.571 IST: RADIUS: NAS-Port-Type [61] 6 Virtual [5] 072667: Dec 3 22:13:48.571 IST: RADIUS: NAS-Port [5] 6 492 072668: Dec 3 22:13:48.571 IST: RADIUS: NAS-Port-Id [87] 17 "Uniq-Sess-ID492" 072669: Dec 3 22:13:48.571 IST: RADIUS: Calling-Station-Id [31] 17 "404000341609662" 072670: Dec 3 22:13:48.571 IST: RADIUS: Connect-Info [77] 13 "64000/57600" 072671: Dec 3 22:13:48.571 IST: RADIUS: Service-Type [6] 6 Framed [2] 072672: Dec 3 22:13:48.571 IST: RADIUS: NAS-IP-Address [4] 6 192.168.243.250 072673: Dec 3 22:13:49.351 IST: RADIUS: Received from id 1645/128 172.31.6.158:1645, Access-Reject, len 20 072674: Dec 3 22:13:49.351 IST: RADIUS: authenticator FC 4F 4F CC 30 09 61 22 - AC E0 57 93 17 B0 C5 A9 072675: Dec 3 22:13:49.351 IST: RADIUS(00001A39): Received from id 1645/128 072676: Dec 3 22:13:49.351 IST: ppp491 PPP: Received LOGIN Response FAIL 072677: Dec 3 22:13:49.351 IST: ppp491 CHAP: O FAILURE id 1 len 25 msg is "Authentication failed" 072678: Dec 3 22:13:49.583 IST: RADIUS: Received from id 1645/129 172.31.6.158:1645, Access-Reject, len 20 072679: Dec 3 22:13:49.583 IST: RADIUS: authenticator 94 73 B6 A0 77 2C FB 52 - 91 5A 52 20 A1 8A 00 A5 072680: Dec 3 22:13:49.583 IST: RADIUS(00001A3A): Received from id 1645/129 072681: Dec 3 22:13:49.583 IST: ppp492 PPP: Received LOGIN Response FAIL 072682: Dec 3 22:13:49.583 IST: ppp492 CHAP: O FAILURE id 1 len 25 msg is "Authentication failed" ################################################################### Debug Logs on the FreeRadius server ######################################################## rad_recv: Access-Request packet from host 192.168.243.250 port 1645, id=139, length=164 Framed-Protocol = PPP User-Name = "tcl1(a)cisco1.com" CHAP-Challenge = 0xe9c73ba6d4a4d55f4ecb135615450c55dcb53dc4a438afe357bb024f5e CHAP-Password = 0x012699c4cf08980486a7c5a2f124022fb7 NAS-Port-Type = Virtual NAS-Port = 502 NAS-Port-Id = "Uniq-Sess-ID502" Calling-Station-Id = "404000834680158" Connect-Info = "64000/57600" Service-Type = Framed-User NAS-IP-Address = 192.168.243.250 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "cisco1.com" for User-Name = "tcl1(a)cisco1.com" [suffix] Found realm "cisco1.com" [suffix] Adding Realm = "cisco1.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "tcl1(a)cisco1.com" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tcl1(a)cisco1.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 37 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 37 Sending Access-Reject of id 139 to 192.168.243.250 port 1645 ############################################################### Please let me know where I have done a mis-config. Thanks and Regards, Dave.

4 3

Freeradius not working with Ubuntu's default install
by Wim De Hul 03 Dec '09

03 Dec '09

Dear members, I have an issue with the default install of freeradius on Ubuntu 9.04. I only added a user in /etc/freeradius/users: wim Cleartext-Password := "test123" I started freeradius: /usr/sbin/freeradius -X But when I try: radtest wim test123 127.0.0.1 0 testing123 I see: Sending Access-Request of id 96 to 127.0.0.1 port 1812 User-Name = "wim" User-Password = "test123" NAS-IP-Address = 192.168.1.152 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=96, length=20 In my radiusd output, I see that the passwords do not match: <snip> ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test123" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CRYPT password check failed): [wim/test123] (from client localhost port 0) <snip> Does anyone have an idea of what's going on?

3 3

FreeRadius with ntlm_auth
by charles＠copel.com 03 Dec '09

03 Dec '09

Hi All: My name is Charles and I need to "Configure my FreeRadius to use ntlm_auth" to authenticate NT users. Actually, I am getting to do this for only one NT group, but I need to do this for more NT groups. My configuration in "radius.conf" for ntlm_auth for one NT group is: exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "/usr/local/bin/ntlm_auth --request-nt-key --domain=COPEL --username=%{User-Name:-None} --password=%{User-Password} --require-membership-of=COPEL\\Group1" } My environment is: FreeBSD 6.2 + Samba 3.0.26a + freeradius 1.1.7 How can I do this configuration for more than one NT group ? Any idea ? Thanks, Charles.

4 3

Problems when trying to start Freeradius with eap
by Peter Carlstedt 03 Dec '09

03 Dec '09

Hello everyone. Im trying to start my radius server and have some problems doing that. I think I have missed to uncomment eap somewhere or something like that but I can find where. I will give the output from the terminal, i've also tried to make my own certificate, but it says it has problems making them, dont really understand why and it is in the same output. Hope you can help me on this one because I cant find what Im doing wrong. peter@freeradius:~$ sudo radiusd -X FreeRADIUS Version 2.1.7, for host i686-pc-linux-gnu, built on Dec 2 2009 at 16:29:59 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client Netgear1 { ipaddr = 192.168.118.15 require_message_authenticator = no secret = "kaffe" nastype = "other" } client Netgear2 { ipaddr = 192.168.118.25 require_message_authenticator = no secret = "kaffe" nastype = "other" } client Mikrotik { ipaddr = 192.168.118.10 require_message_authenticator = no secret = "kaffe" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "kaffe" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Generating a 2048 bit RSA private key ..........................+++ ....................................................................................................................................................................................................+++ unable to write 'random state' writing new private key to 'server.key' ----- problems making Certificate Request 4098:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 make: *** [server.csr] Error 1 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ......................................................+.........+...................................................................+...................+......................................+...................................+...........................................................+...........................................................................+.............+........................+.......................................................................+........++*++*++* unable to write 'random state' Generating a 2048 bit RSA private key .......+++ ...........................................+++ unable to write 'random state' writing new private key to 'server.key' ----- problems making Certificate Request 4101:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 Exec-Program output: openssl req -new -out server.csr -keyout server.key -config ./server.cnf Exec-Program-Wait: plaintext: openssl req -new -out server.csr -keyout server.key -config ./server.cnf Exec-Program: returned: 1 rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Thanks! Best regards/ Peter _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

Re: FreeRadius with ntlm_auth
by freeradius＠corwyn.net 03 Dec '09

03 Dec '09

At 08:44 AM 12/3/2009, charles(a)copel.com wrote: >My environment is: FreeBSD 6.2 + Samba 3.0.26a + freeradius 1.1.7 > >How can I do this configuration for more than one NT group ? Any idea ? See my post from "Re: separating users", ~6:30, 12/1/09 I tried your approach (separate ntlm_auth execs). In the end I ended up using LDAP Rick

1 0

Freeradius with JRadius Performance issues.
by Hemlata Shekatkar 03 Dec '09

03 Dec '09

Hi, I am evaluating freeradius with jradius. Currently i am performing performance testing for the Freeradius-Jradius combination using radperf tool. JRadius is simply authenticating the user from the jradius-config.xml file using one of the default handlers, so nothing fancy there. Here are a few numbers that i get. Standalone Freeradius 500 requests/sec gives me 461 1000 requests/sec gives me 858 Freeradius with JRadius ( Standard 8 connections in the configuration) 500 requests/sec gives me 60 1000 requests/sec gives me 152 So, as you can see, the performance numbers are way lower when JRadius is used. I tried increasing the connections and the threads in jradius but it did not help. I understand that since the freeradius to jradius connection pool uses tcp sockets, the performance will be lower than when freeradius is run by itself but this low is something I did not expect. Has anybody run into this issue? Is there a way around to getting the performance numbers higher? Thanks for your help! Hema.

2 3

error := Invalid version in module 'rlm_exec'
by Yagnesh Dave 03 Dec '09

03 Dec '09

Hi Everybody, I am getting this error while trying to run the freeradius, pls help me to get this resolved. The error is, radiusd: #### Instantiating modules #### instantiate { /usr/local/etc/raddb/modules/exec[24]: Invalid version in module 'rlm_exec' Errors initializing modules Thanks in advance. Regards, Dave,

2 1

FW: Free Radius & Cisco
by Johnston, Ian 03 Dec '09

03 Dec '09

Hi, Thanks for Free Radius - I'm confident it will be just what we need. I have set it up on a Dell DL360 G5 running CentOS 2.3 and created simple clients.conf, raddb.conf and users files. Radtest and logins from a couple of clients are working well. However, when I try to move up from the absolute basics, e.g. to give my user who telnets to a Cisco switch an enabled priveledge leval it just doesn't work: the user logons OK but is still at the plain command prompt. I'm sure it's something simple I've missed and I'd be grateful if you could give me any pointers. I've looked through the mailing-list archive, and although one question is exactly the same Freeradius and Cisco (cisco-avpair = "shell:priv-lvl=15" doesn't work) I seem to have everything they have suggested in the answers? Thanks in advance for your help. Regards, Ian Here are some cuts from various files: Switch Config aaa authentication login nocusers group radius aaa authorization exec nocusers group radius aaa session-id common radius-server host 10.210.27.4 auth-port 1645 acct-port 1646 radius-server source-ports 1645-1646 line vty 0 4 exec-timeout 60 0 login authentication nocusers users dan Cleartext-Password := "password" Reply-Message = "Hello, %{User-Name}", Service-Type = Administrative-user, cisco-avpair = "shell:priv-lvl=15" ipj Cleartext-Password := "password" Reply-Message = "Hello, %{User-Name}", Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" I also tried: dan Cleartext-Password := "password", Service-Type = Administrative-user, cisco-avpair = "shell:priv-lvl=15" Reply-Message = "Hello, %{User-Name}", Service-Type = Administrative-user, and dan Cleartext-Password := "password" Reply-Message = "Hello, %{User-Name}", Service-Type = "Administrative-user", # and Shell-user, and login and a few other things !-( cisco-avpair = "shell:priv-lvl=15" the login failed with the first alternate and logged on as a plain user on the second. Snips from radiusd -X output Sending Access-Accept of id 42 to 10.210.27.2 port 1645 Reply-Message = "Hello, ipj" Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Sending Access-Accept of id 43 to 10.210.27.2 port 1645 Reply-Message = "Hello, dan" Service-Type = Administrative-User Cisco-AVPair = "shell:priv-lvl=15" Output from radtest [root@radius1 raddb]# radtest dan password radius1:1645 0 testing123 Sending Access-Request of id 33 to 10.210.27.4 port 1645 User-Name = "dan" User-Password = "password" NAS-IP-Address = 10.210.27.4 NAS-Port = 0 rad_recv: Access-Request packet from host 10.210.27.4 port 32770, id=33, length=55 User-Name = "dan" User-Password = "password" NAS-IP-Address = 10.210.27.4 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry dan at line 11 [files] expand: Hello, %{User-Name} -> Hello, dan ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "password" [pap] User authenticated successfully ++[pap] returns ok Login OK: [dan] (from client radius1 port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 33 to 10.210.27.4 port 32770 Service-Type = Administrative-User Cisco-AVPair = "shell:priv-lvl=15" Reply-Message = "Hello, dan" Finished request 2. Going to the next request rad_recv: Access-Accept packet from host 10.210.27.4 port 1645, id=33, length=63 Waking up in 4.9 seconds. Service-Type = Administrative-User Cisco-AVPair = "shell:priv-lvl=15" Reply-Message = "Hello, dan" [root@radius1 raddb]# Cleaning up request 2 ID 33 with timestamp +62 Ready to process requests.

4 3

MS-CHAP2 Response is incorrect.
by Garcia Herguedas, Unai 03 Dec '09

03 Dec '09

Hi, I´m having a problem deploying a FreeRadius server to authenticate Wireless users with an Active Directory. I get this message in the logs (user, challenge, domain and nt-response edited): Wed Dec 2 12:05:59 2009 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 6 Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: Told to do MS-CHAPv2 for username with NT-Password Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Wed Dec 2 12:05:59 2009 : Debug: expand: --username=%{mschap:User-Name} -> --username=username Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'Challenge' Wed Dec 2 12:05:59 2009 : Debug: mschap2: 60 Wed Dec 2 12:05:59 2009 : Debug: expand: --challenge=%{mschap:Challenge:-00} -> --challenge=challenge Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' Wed Dec 2 12:05:59 2009 : Debug: expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=nt-response Wed Dec 2 12:05:59 2009 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' Wed Dec 2 12:05:59 2009 : Debug: expand: --domain=%{mschap:NT-Domain} -> --domain=domain Wed Dec 2 12:05:59 2009 : Debug: Exec-Program output: Wed Dec 2 12:05:59 2009 : Debug: Exec-Program: returned: 1 Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: External script failed. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Wed Dec 2 12:05:59 2009 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 6 Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: External script failed. Wed Dec 2 12:05:59 2009 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect If I execute in a shell the ntlm_auth with the same parameters as the log pointed I get an NT Key, so don´t really know why it's not working. I have tried varius solutions founded in internet without success. BTW, The entire log is attached (edited user, challenge.....). If needed I can send conf files. Thanks in advance. Unai.

2 5

That's my AAA model
by Wagner Pereira 03 Dec '09

03 Dec '09

Hi, folks. I hope that can help begginers to understand better how the AAA model works: http://twitpic.com/ru4za/full And how I implemented that in my case. Hugs. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fone@RNP 1015-8902

3 4