February 2009 - Freeradius-Users - lists.freeradius.org

Freeradius2.1.3 + Fedora9 + PEAP + AD = problem
by Andrey.Trubnikov＠unicreditgroup.ru 16 Feb '09

16 Feb '09

Hi I configure Freeradius 2.1.3 how it describes in http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO but it doesn't work. here is debug output: FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 16:00:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 10.6.0.0/16 { require_message_authenticator = no secret = "secret" shortname = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=123, length=155 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x02020019015350422e494d422e52555c747275626e696b6f76 Message-Authenticator = 0xca609e950b9d1b6e044b7b1e35ece327 NAS-Port-Type = Ethernet NAS-Port = 50020 NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 123 to 10.6.0.86 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59c899961300b089b526f445b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=124, length=228 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x0203005019800000004616030100410100003d03014994289f6e90304c75136fa081c24849e67c260665de87b51c9522d501063e5000001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xc5b019218bd1efacc9eb8657720601d4 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59c899961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 124 to 10.6.0.86 port 1645 EAP-Message = 0x0104040019c00000089b160301002a020000260301499428a3397c48ef2bf058423bf7bdf3f533b0e82d1d2323c12b36198d9554ff00000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303231323132353633385a170d3130303231323132353633385a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100be607ef369a0c5d803e13ed311e4ce6722607bd2b51a05394de4dcaaf45d4b2e0bae9e001a76dfac328a9e85beea2a32a40504b3fe3d3b9f51a76eac7999 EAP-Message = 0x457c18dc35beb05d700d0f0149de5709341a4c9b873c1001a74516e6594bf82b1fa72e2e09b4e32e4e3dc4a420f648506461e877942742347e42ea0d48614badf4866a4226b63fa2fcd8bc0f980544c4d04405ee96e5e656041e720eb92483ee20c26b2b82b840c3c33e6b05b9ba947e940e7a5a0efd802a9046d67232300932bd7eeaa16e6887768c4836819d0dba80eed0612cdeeb282c680df57f65cc27ab9f56dd53420b9219d72d0f735e9a97d8aa755b7bf3402bfcc011ec6cc276fbf125db0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010086ca73bda33dac167f EAP-Message = 0x80bc8fd2e714597d56198a94b45dcecbe3bd868c88fe759344759cf4a200205eeaedc663550feb4d86c7856d1cf6de9c8d87e2e35abd54eb2056b8c6c52e16ec95d4b58ff41bdbdcd85157c0bcafb01db3bab55e704d8a4bb3a23db7bde2721b3145ad4a0375616b008cf3cfb3f44eb8a8b2e3988c7a003f925f5fb3265b94844486254b2a6fe9e116e06a45a7b8c7e43a141dbbad2b91c0d767de58cc82bfa86f648d47049f4ac425137e83cfb8af113e12dcd0e9ac4c7f41d8d61c9e3b9cc5249d173c308c56d09c0fb504590e2fc4fdfa45f57703738925c24ba72feb69d05e4f4dbe0491c3c2216bd8fe7540b4a490cf2ed4f13f360004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59d8e9961300b089b526f445b Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=125, length=154 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020400061900 Message-Authenticator = 0x0e848ffd6bb8351f5ef907ebde5b7874 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59d8e9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 125 to 10.6.0.86 port 1645 EAP-Message = 0x010503fc194000adc70b5be0044ad3300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303231323132353633385a170d3130303231323132353633385a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d597421324695f36aae1a4ae9647c315c17da1da6caaa82a1028db432f0951f98af8947a591c0f77cfb99dd948e217f540840d7b9a1bfd31059173f700f582d017b9da6ff4f0b4c168def0b87dec3281d066ed8a6711431b92fe65234f5dfab96205f8f933b107fb283c79e4530e9f EAP-Message = 0x2db2999043968b3d4d1081804b5896d30be16a0bc958a3b9d91aeff3075d36aa8d93758bfd86770e6647af75f60600b95e675eaffdb0b55c8e08aa5b56f970d6120ee85db50ae37b5c020eee094f81e8c8b25c9ee5e817365a7c88173b46479bd45b42896894321e147b319e9cac56cebc7e0c883a44d8662842068281cedf9f2226d45fb9551ff7eac9231c9e0647e8a50203010001a381fb3081f8301d0603551d0e0416041455460e5d2216933d47b1213dcba48130590f3f803081c80603551d230481c03081bd801455460e5d2216933d47b1213dcba48130590f3f80a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900adc70b5be0044ad3300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000ca4fa0b2aeffd6f41b81c005b44979fb69bb157f76d01da7df39102b54c920862d6e184047adde5178e98f2b8d635dd9be7eae5e2b39640a7d5164cbd3f2cb1f080ea6b8b852b39e603151bb38ab0d744eb EAP-Message = 0xa0d53927f55728a7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59e8f9961300b089b526f445b Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=126, length=154 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020500061900 Message-Authenticator = 0x16385baf4cb2818e88325444881d1247 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59e8f9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 126 to 10.6.0.86 port 1645 EAP-Message = 0x010600b51900aa0831430c97a13773e7deac05ec51fcbd0f3d4126c04ed338ec3d6213a156682ba77e3840cbd0b30bbcb2e14c5e2103a1b6bfa11381916245226510c11d083385ac4f08c37e80267304e623ad73a104b26a124f324eff7d42ef6cf02f8bfd456664c793bd4cf1e2e8cda3f565a40decd9f9ba557d9f6933cf5d710a395e11e0d6654a5da345c48f4e91eeab7174a64912a5495e04a0b82daf07bbb9af7db00c0f5452738d1616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59f8c9961300b089b526f445b Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=127, length=470 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x02060140198000000136160301010610000102010078a20bd953aea703502943c0e100284b5c866240b1d05afbf17f5c83411c651a86d18f15491f2b28be61f0fc2ca5ae927f11607777fed0c96e089fc07acf3f31ac8add249b45fafc690a0e4fb6cea1aad9041c188e602fa171ee2a5054ff7a0d38ba2d06dc5766d04f1b16f7bfd5c886a424b2298b745098be9446996003741f308da494612bc0f0cedc9d8c472390a2a3d90d3ba9495a9d2c2776de2badbf9cfcfa5a2e4262d3ed54094bec0b61a83912fa6134ed1b22ec63fa039f6c93b976df06dad786cf1a38164cdb645ce07d75a640d2f49da9c5987f1deafd07ac91c3722cecdea9459600 EAP-Message = 0x29d5d86f8e2440200273e63839ac3a263bdd90dc7aa1005d1403010001011603010020facefc49020de52c0a23b0d8fdbbe5912ab3268be088aa6c4dea17a9c8e91ab9 Message-Authenticator = 0xf6aecb8339699f0c4fe8e16a5e63ead0 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59f8c9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 127 to 10.6.0.86 port 1645 EAP-Message = 0x0107003119001403010001011603010020e49a8d4b1fd41d9c02ec41a3b101afe07da0b4e9635fde3e11cb6b0c9c979c07 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f5988d9961300b089b526f445b Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=128, length=154 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020700061900 Message-Authenticator = 0x0db67edd1af97688be40d5c86c800a5e NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f5988d9961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 128 to 10.6.0.86 port 1645 EAP-Message = 0x0108002019001703010015a20163ee50d59c13086db8efb27fdb8847cd1ba680 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f599829961300b089b526f445b Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=129, length=196 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020800301900170301002522a3717e23f4deab80a11045682aca6e40f14811082939e96a5afde4c52730cb4fc2263852 Message-Authenticator = 0xc32ec3ed44e0fd447b981ddffff6cf5c NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f599829961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 48 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - SPB.IMB.RU\trubnikov [peap] Got tunneled request EAP-Message = 0x02080019015350422e494d422e52555c747275626e696b6f76 server { PEAP: Got tunneled identity of SPB.IMB.RU\trubnikov PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to SPB.IMB.RU\trubnikov Sending tunneled request EAP-Message = 0x02080019015350422e494d422e52555c747275626e696b6f76 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SPB.IMB.RU\\trubnikov" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 25 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0109002e1a0109002910ecbf829566172500625bf7620a4f36795350422e494d422e52555c747275626e696b6f76 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a497d85df4b8501b130a3e04c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0109002e1a0109002910ecbf829566172500625bf7620a4f36795350422e494d422e52555c747275626e696b6f76 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a497d85df4b8501b130a3e04c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 129 to 10.6.0.86 port 1645 EAP-Message = 0x010900451900170301003ae178bf20a442a8ff436523b002959ace4150be491e8556ec798a439ef98a4b92c28e69dd1717e1e27fbe0081f057d5adc31304e15be33f58af79 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59a839961300b089b526f445b Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.6.0.86 port 1645, id=130, length=250 User-Name = "SPB.IMB.RU\\trubnikov" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-13-C3-81-2A-16" Calling-Station-Id = "00-11-25-45-BB-9A" EAP-Message = 0x020900661900170301005b17cfadd420103a62807796ebc81cccc17ba868a0b32728ff8bd1be18aecfc4f8ee7032778a54581ecd13584dba8f36928343485c3718fbe3d96aba19ba1b9ece6a082e8a44ae4d9633e5ee1a2b24a4804836cfcc5f49c7456b9fd4 Message-Authenticator = 0x42701fb6beac1b74efafc2943d30f102 NAS-Port-Type = Ethernet NAS-Port = 50020 State = 0x9c8a80f59a839961300b089b526f445b NAS-IP-Address = 10.6.0.86 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 102 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209004f1a0209004a3183289583fd8f07645a9e0b401989b0aa00000000000000005b2390610fbbb0a33313369bf434352cf94105042703b5e0005350422e494d422e52555c747275626e696b6f76 server { PEAP: Setting User-Name to SPB.IMB.RU\trubnikov Sending tunneled request EAP-Message = 0x0209004f1a0209004a3183289583fd8f07645a9e0b401989b0aa00000000000000005b2390610fbbb0a33313369bf434352cf94105042703b5e0005350422e494d422e52555c747275626e696b6f76 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SPB.IMB.RU\\trubnikov" State = 0x49749f5a497d85df4b8501b130a3e04c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "SPB.IMB.RU\trubnikov", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 79 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for trubnikov with NT-Password [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=SPB.IMB.RU [mschap] expand: --username=%{mschap:User-Name} -> --username=trubnikov [mschap] mschap2: ec [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=9bb858a0208cb30a [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=5b2390610fbbb0a33313369bf434352cf94105042703b5e0 Exec-Program output: NT_KEY: E5E69707F927B4D612960B8BE48C7887 Exec-Program-Wait: plaintext: NT_KEY: E5E69707F927B4D612960B8BE48C7887 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d45423936393838454632313731423530383032373337324435444239463534333937393336394337 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a487e85df4b8501b130a3e04c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d45423936393838454632313731423530383032373337324435444239463534333937393336394337 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49749f5a487e85df4b8501b130a3e04c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 130 to 10.6.0.86 port 1645 EAP-Message = 0x010a004a1900170301003f7201bd50ad95ad02eed7b8c10e950ce1d0858a8d2e64401635f1f270813682833ee111b5a1eb2db22fd25daf6a8fea82236d0ff920182b9e3325150deefeeb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9c8a80f59b809961300b089b526f445b Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 123 with timestamp +51 Cleaning up request 1 ID 124 with timestamp +51 Cleaning up request 2 ID 125 with timestamp +51 Cleaning up request 3 ID 126 with timestamp +51 Cleaning up request 4 ID 127 with timestamp +51 Cleaning up request 5 ID 128 with timestamp +51 Cleaning up request 6 ID 129 with timestamp +51 Cleaning up request 7 ID 130 with timestamp +51 Ready to process requests.

5 8

Fall-Through attribute, reply or configure item?
by Damjan 16 Feb '09

16 Feb '09

I'm reading the documentation of freeradius 2.1.3 (I've not gone through it all yet) and I find that "Fall-Through = Yes" is always specified as a reply attribute. But it isn't a real reply attribute isn't it? It's more of a configure attribute like Cleartext-Password, right? So it should be used in a check line with := (or radcheck DB table). I understand that changing this will probably mean to much work for FR administrators, I'm only asking to make things clearer to me. ps. is there a list of the special configure attributes that freeradius works with? -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk -- not my mail address, it's a Jabber ID --^ :)

3 3

using Calling-Station-Id to give ippool name to vpn server
by Eric 16 Feb '09

16 Feb '09

Hi. there is a radius server with VPN server as its nas. radius server use ldap server in back end for authentication and authorization. we want if Calling-Station-Id of user is valid radius could give ippool number=1 in access reply to vpn server and if Calling-Station-Id of user is invalid could give ippool number=2. how radius can do this compare? my user file configuration: DEFAULT Client-IP-Address == 192.168.200.123, Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn and in client.conf: client 192.168.200.123{ secret = newvpnsecret shortname = vpn }

2 1

sql problem
by tincboy 16 Feb '09

16 Feb '09

Hi, I've just configured my new freeradius installation with mysql, but the output of my test command is Rejected. radtest home home 127.0.0.1 1812 testing123 radius -x output is: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@127.0.0.1:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32866, id=176, length=56 User-Name = "home" User-Password = "home" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rad_recv: Access-Request packet from host 127.0.0.1:32866, id=176, length=56 Sending Access-Reject of id 176 to 127.0.0.1 port 32866 ------------------------------------------------------------ I've found out nothing from this output, why it's not sending any sql command to mysql?

2 1

Freeradius is crashing in krb auth
by Lisa Besko 16 Feb '09

16 Feb '09

Freeradius keeps crashing on us. I finally put it in debug mode and this is the tail end of the messages I get before it dies: -------------------------------- users: Matched entry DEFAULT at line 5 modcall[authorize]: module "files" returns ok for request 9 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns ok) for request 9 rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" Processing the authenticate section of radiusd.conf modcall: entering group kerberos for request 9 Segmentation fault (core dumped) ------------------------------- Part of what is frustrating is I've been running this same configuration on another system and it's fine. I just moved it to a production system and I'm having issues. They are both running FreeRadius 1.1.7_3 and MIT Kerberos 1.6.3_5. The setup that works well is running FreeBSD 7.0 Stable on an i386 system. The one that keeps crashing is running FreeBSD 7.1 PreRelease on an AMD system. Anyone have any ideas about what is happening here? LB -- Lisa Besko Systems Administrator Network Management Academic Technology Services

2 3

Re: Session-timeout problem
by Will D. Spann 16 Feb '09

16 Feb '09

Mitul, >I have tried this configuration and it's working fine with radtest but Glad to hear you have this working with radtest. This means you have this functionality properly configured on the FreeRADIUS side now. >Ever i am getting session time out value on AP side also but during the change request time . actually i want the session time out in >accept-access time. >is it the normal scenario? >can you help me in this case? With the configuration I showed, FreeRADIUS will send the Session-Timeout attribute to the AP in an Access-Accept packet, in response to the AP sending an Access-Request packet to FreeRADIUS that is accepted. I'm not sure what you're referring to when you say change request time. Can you elaborate? It sounds like you may have a configuration issue on the AP side. Unfortunately, if this is an AP configuration issue, I doubt I'd be of much help. On the AP side, I've only worked with the ChilliSpot network access server (used for WiFi hotpots). Regards, Will D. Spann

1 0

Re: Session-timeout problem
by Will D. Spann 16 Feb '09

16 Feb '09

>i have tried this thing but when i am doing so its taking this as a default entry and giving error for user name and password >i have entered username and cleartext-password in user file. Could you post your users file (with any non-testing passwords starred out of course)? My apologies; let me add a clarification. If your user entries in the users file don't have the "Fall-Through = Yes" attribute set, putting the DEFAULT section at the end of the file won't apply the Session-Timeout to the users. However, it shouldn't cause an error. Have you tried testing without the DEFAULT section, using a user with Cleartext-Password? I've tested the following configuration on FreeRADIUS 2.1.1 with success. test Cleartext-Password := "testing" Fall-Through = Yes DEFAULT Session-Timeout = 60 Try testing this with radtest, such as the following, where "testing123" is your shared secret and the server is running on localhost. This should return an Access-Accept message with Session-Timeout specified. (I assume you're also running the server with debug output, as "radiusd -X".) radtest test testing localhost 0 testing123 If you don't want to add the Fall-Through attribute to each of your user entries, you could instead use the following modified DEFAULT section near the top of the users file, before all the authorized user entries. I've also tested this configuration. (Note the comma.) DEFAULT Session-Timeout = <timeout>, Fall-Through = Yes >also i have configured the mysql database for authentication and accounting. so at that time i am getting error "no User-password or >CHAP-password" in request. Are you using both the users file and MySQL for authentication, or are you testing each setup separately? I'd recommend getting FreeRADIUS working with the users file alone before setting up database-based authentication. Will D. Spann

1 0

Grouping different kinds of clients and returning different attributes
by David Bailey 16 Feb '09

16 Feb '09

I'm new to FreeRadius, so please understand that my understanding of the vocabulary and structures are limited. I've read through the documentation and I'm trying to do something that may be obvious to some. I'm trying to configure FreeRadius to do administrator authentication from a series of switches, routers, and firewalls. Some are Cisco IOS, some HP Procurve, and some Juniper. I've got it working so that all are properly authenticating. The back-end authentication is LDAP. The problem is that there are roughly 250 units on various IP addresses across the WAN. I'd like to redirect them all to the same RADIUS server. The problem is that although I have some 250 client definitions in clients.conf, I'd rather avoid using 250 definitions in users. I'm trying to find a way to categorize the RADIUS clients into Cisco, HP, etc. What I was trying to do was to give each client a name: client Cisco_IOS.host-10.1.2.3 { ipaddr = 10.1.2.3 secret = supersecret } client HP_Procurve.host-10.3.2.1 { ipaddr = 10.3.2.1 secret = alsoverysecret } And then build something to refer to them in the users file along the lines of: DEFAULT Client-Shortname =~ "Cisco_IOS.*", User-Name := "someadmin", Cleartext-Password := "goodpassword" Service-Type = NAS-Prompt-User DEFAULT Client-Shortname =~ "HP_Procurve.*", User-Name := "anotheradmin", Cleartext-Password := "greatpassword" Service-Type = 6 of maybe DEFAULT Client-Shortname =~ "Somethingelse.*", Auth-Type := Pam (or LDAP) Service-Type = (something else), Other-attributes = XXXXXXX I'm having some problems, so I'm either missing something, or I'm going down an entirely wrong path. I got the "Client-Shortname" from the Run-time variables page in the Wiki, but I suspect it isn't evaluating like I think it ought to. Thank you for your time. -- View this message in context: http://www.nabble.com/Grouping-different-kinds-of-clients-and-returning-dif… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Segfault in module accessing custom attributes fields
by D'AVELLA STEFANO 16 Feb '09

16 Feb '09

Hi all, I am having some problems in trying to write a little module to handle some custom attributes. Because I have a project regarding very specific requirements I preferred to write a module instead of trying to use the existing ones, so I can know in a better way where to go to change things when I want a different behaviour. What I am doing right now is trying to have a testbed with a client, a proxy and a server, exchanging some custom attributes saved in the users file of the server and transmitted with auth-accept messages. The proxy should intercept these new attributes and save them in a specific syntax in a local file. I managed to create and transfer successfully the custom attributes and to have them saved in a local file by the proxy. The problem is that if these attributes have a string as a value, there is no problem in reading it using the field vp_strvalue. If these attributes have the attribute ipv6address, when I try to access to them using vp_ipv6address I get a segFault. The values are correctly stored in the packets because I can see them with wireshark and the client receives them successfully. In the documentation (the wiki) there is written to access the attributes through request->packet->vps but I managed to do it only with request->reply->vps. (initially I wanted to save this local file using the post-proxy section because I was thinking that it was the best place to do it (it's an action to do when the proxy receives the reply from the server) but I couldn't access the right packet through the API and so I found out that I could do it in the post-auth phase) I would not want to disturb you too much but the problem is that it seems to me that there is a bit of lack in the documentation regarding how write modules in the newer versions of freeradius and so I didn't know other places to look (I have been looking at the source code for all the day but maybe I can do it faster if pointed into the right direction) Thank you in advance for any answer, Best regards, D'Avella Stefano Bell Labs Alcatel-Lucent Centre de Villarceaux Route de Villejust 91625 NOZAY

2 1

Restrict access to certain groups
by kevin leblanc 16 Feb '09

16 Feb '09

Hi I have a Freeradius which checks if an user has right to connect to a network equipment via LDAP. For security reasons, i want to restrict access to certain users (network administrator). At the beginning, I wanted to do it by adding host attribute to a user, it will contain all allowed hosts he can connect : I don't find a solution. But, i found another way : in my schema I added an OU which contains all computers in the network, and to allow a user to connect to one of them, I make it "member of" this host. So, I want to check if the user is "member of" the host he try to connect, to give him corresponding access. I don't know if it's possible and how to do this (if it's possible). May I change users file ? radiusd.conf ? cleints.conf ? I'm lost whereas I'm on it since the last week :( thanx for all possible solutions -- KeV

1 2