March 2009 - Freeradius-Users - lists.freeradius.org

RADIUS challenge response using the PAM module
by Robert Svensson 19 Mar '09

19 Mar '09

Hi, I've been pulling my hair trying to get the PAM radius module to successfully authenticate against a radius server that thows a password challenge response AFTER a user has been verified using their user name and password (it's not a FreeRadius server). By looking at the source code, It seems as if this should be possible. But I can't figure this one out. The PAM module recieves the access challenge from the radius server. The problem is that instead of asking the user for additional input, the module returns an invald challenge back to the radius server and therefore the authentication fails. Does anyone out there have a working PAM module configuration that asks the user for additional input, such as a token value, after their user name and password has been checked? Any help is greatly appreciated thanx Robert

3 7

Re: freeradius and mikrotik auth problem pppoe error 691
by Lazar Cherveniakov 18 Mar '09

18 Mar '09

Sorry i`m new mail-list user While tracking installed following instructions http://abills.net.ua/wiki/doku.php?id=abills:docs_03:install:en[1] the all debug log is # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 2 main: max_requests = 102400 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) exec: wait = yes exec: program = "/usr/abills/libexec/rauth.pl pre_auth" exec: input_pairs = "request" exec: output_pairs = "config" exec: packet_type = "(null)" Module: Instantiated exec (pre_auth) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) exec: wait = yes exec: program = "/usr/abills/libexec/rauth.pl post_auth" exec: input_pairs = "request" exec: output_pairs = "config" exec: packet_type = "(null)" Module: Instantiated exec (post_auth) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.200.4:32768, id=2, length=144 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 4 NAS-Port-Type = Ethernet User-Name = "lacho" Calling-Station-Id = "00:15:AF:1F:23:1A" Called-Station-Id = "pppoe-in" NAS-Port-Id = "ether1" CHAP-Challenge = 0x00000a2d5c17177c86733bd3ed908d0c CHAP-Password = 0x0189c958b6e077d36f87977f590271a3dc NAS-Identifier = "TEST-RADIUS" NAS-IP-Address = 192.168.200.4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 Exec-Program output: Auth-Type := Accept Exec-Program-Wait: value-pairs: Auth-Type := Accept Exec-Program: returned: 0 modcall[authorize]: module "pre_auth" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 users: Matched entry DEFAULT at line 52 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Exec-Program output: Acct-Interim-Interval = 300, Session-Timeout = 31, Mikrotik-Xmit-Limit = 1073217536, Framed-IP-Address = 10.8.15.114, Mikrotik-Recv-Limit = 1073217536, Framed-IP-Netmask = 255.255.255.255, Exec-Program-Wait: value-pairs: Acct-Interim-Interval = 300, Session-Timeout = 31, Mikrotik-Xmit-Limit = 1073217536, Framed-IP-Address = 10.8.15.114, Mikrotik-Recv-Limit = 1073217536, Framed-IP-Netmask = 255.255.255.255, Exec-Program: returned: 0 Sending Access-Accept of id 2 to 192.168.200.4 port 32768 Acct-Interim-Interval = 300 Session-Timeout = 31 Mikrotik-Xmit-Limit = 1073217536 Framed-IP-Address = 10.8.15.114 Mikrotik-Recv-Limit = 1073217536 Framed-IP-Netmask = 255.255.255.255 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 192.168.200.4:32768, id=2, length=144 Sending duplicate reply to client TEST-RADIUS:32768 - ID: 2 Re-sending Access-Accept of id 2 to 192.168.200.4 port 32768 --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.200.4:32768, id=2, length=144 Sending duplicate reply to client TEST-RADIUS:32768 - ID: 2 Re-sending Access-Accept of id 2 to 192.168.200.4 port 32768 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 2 with timestamp 49c168d6 Nothing to do. Sleeping until we see a request. That`s all 10x to advanced -- Lazar Cherveniakov Micro computers system - Lazkom LIVE FREE OR DIE Links: ------ [1] http://abills.net.ua/wiki/doku.php?id=abills:docs_03:install:en ------------------------------------- Sportingbet – €1500 всеки ден, бонуси тенис залози на живо! http://bg.sportingbet.com/

2 1

None
by ahmed adel 18 Mar '09

18 Mar '09

Dear All I hope anyone can help me with these errors I have in the radius.log file: Error: rlm_sql_getvpdata: database query error Error: rlm_sql (sql): SQL query error; rejecting user Error: rlm_sql (sql): Couldn't update SQL accounting ALIVE record - 00000 I am using freeradius 1.1.7 with freetds and MSSQL 2005 as the backend database, the radius receives interim accounting update packets to calculate users utlized bandwidth and the data is inserted into the MSSQL database using SQL Procedures. Does anyone knows what may cause these errors to occure, note that when I run radius -X most of the update statements return with status ok and for the statements that return with this error, they run fine from the MSSQL console. Thanks in advance Ahmed Adel

2 7

freeradius and mikrotik auth problem pppoe error 691
by Lazar Cherveniakov 18 Mar '09

18 Mar '09

Hello, I`m new radius user and i`m beginner. I have problem with connect mikrotik with radius server. My clients using pppoe server but i have connect to radius server but after configuration from internet documentation my server don`t work and i receive errors in radius.log and pppoe server show 691 error this is the errors Wed Mar 11 17:59:23 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 8 due to unfinished request 0 Wed Mar 11 17:59:26 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 9 due to unfinished request 1 Wed Mar 11 17:59:28 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 10 due to unfinished request 2 Wed Mar 11 18:44:28 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Mar 11 18:44:28 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Mar 11 18:44:28 2009 : Info: Ready to process requests. Wed Mar 11 18:57:43 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Mar 11 18:57:43 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Mar 11 18:57:43 2009 : Info: Ready to process requests. Mon Mar 16 22:20:07 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Mar 16 22:20:07 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Mar 16 22:20:07 2009 : Info: Ready to process requests. Wed Mar 18 22:35:19 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Mar 18 22:35:19 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Mar 18 22:35:19 2009 : Info: Ready to process requests. Wed Mar 18 22:35:25 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Mar 18 22:35:25 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Mar 18 22:35:25 2009 : Info: Ready to process requests. Wed Mar 18 22:35:39 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 1 due to unfinished request 0 Wed Mar 18 22:35:40 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 1 due to unfinished request 0 ~ ~ this is the mikrotik error mar/13 23:42:18 pppoe,info PPPoE connection established from 00:15:AF:1F:23:1A mar/13 23:42:18 pppoe,ppp,info <pppoe-0>: waiting for call... mar/13 23:42:19 pppoe,ppp,info <pppoe-lacho>: terminating... - user lacho authentication failed - radius timeout (6) mar/13 23:42:19 pppoe,ppp,info <pppoe-lacho>: disconnected please help me advanced Tanks. -- Lazar Cherveniakov Micro computers system - Lazkom LIVE FREE OR DIE ------------------------------------- Sportingbet – €1500 всеки ден, бонуси тенис залози на живо! http://bg.sportingbet.com/

2 1

AW: AW: gigawords and bandwith
by Lars 18 Mar '09

18 Mar '09

> So... get the NAS to send it. Or buy a NAS that semds it. I hoped that one of you can give me a hint on how. > See the NAS documentation for instructions on using RADIUS to limit > bandwidth. I wrote the version and the kind of NAS before, so I hoped it could be true that one of all the guys here did it before with the same configuration. The documentation of the NAS is not detailed enough to get the needed information! I wrote in freeradius-users also, but i think I can not get the list, but I subscribed to it and send to it without errors - so I ask here again. Regards Lars

3 2

Re: FreeRadius only works in debug mode
by Greg.Webster＠westfraser.com 18 Mar '09

18 Mar '09

Thanks for the thoughts on this...it looks like the permissions on those directories are all good: # ls -al /var/log/radius/ total 10 drwx------ 3 radiusd radiusd 128 Mar 12 14:54 . drwxr-xr-x 13 root root 1552 Mar 17 11:36 .. drwx------ 2 radiusd radiusd 48 Apr 23 2008 radacct -rw-r--r-- 1 radiusd radiusd 5150 Mar 17 11:51 radius.log -rw-r--r-- 1 radiusd radiusd 0 Apr 23 2008 radutmp # ls -al /tmp drwxrwxrwt 9 root root 616 Mar 18 08:54 . # ls -al /etc/raddb/ total 208 drwxr-xr-x 3 root root 664 Mar 12 16:11 . drwxr-xr-x 83 root root 7072 Mar 17 11:33 .. -rw-r--r-- 1 root radiusd 422 Apr 23 2008 acct_users -rw-r--r-- 1 root radiusd 4074 Apr 23 2008 attrs drwxr-x--- 3 root radiusd 472 Mar 12 14:41 certs -rw-r----- 1 root radiusd 2937 Apr 23 2008 clients.conf -rw-r--r-- 1 root radiusd 929 Apr 23 2008 dictionary -rw-r----- 1 root radiusd 9332 Apr 23 2008 eap.conf -rw-r----- 1 root radiusd 4620 Apr 23 2008 example.pl -rw-r--r-- 1 root radiusd 2396 Apr 23 2008 hints -rw-r--r-- 1 root radiusd 1604 Apr 23 2008 huntgroups -rw-r--r-- 1 root radiusd 2333 Apr 23 2008 ldap.attrmap -rw-r----- 1 root radiusd 9330 Apr 23 2008 mssql.conf -rw-r----- 1 root radiusd 856 Apr 23 2008 naspasswd -rw-r--r-- 1 root radiusd 7316 Apr 23 2008 otp.conf -rw-r----- 1 root radiusd 1396 Apr 23 2008 otppasswd.sample -rw-r----- 1 root radiusd 14467 Apr 23 2008 postgresql.conf -rw-r----- 1 root radiusd 1039 Apr 23 2008 preproxy_users -rw-r----- 1 root radiusd 8834 Apr 23 2008 proxy.conf -rw-r--r-- 1 root radiusd 64646 Mar 12 16:06 radiusd.conf -rw-r----- 1 root radiusd 1405 Apr 23 2008 snmp.conf -rw-r----- 1 root radiusd 14173 Apr 23 2008 sql.conf -rw-r----- 1 root radiusd 6974 Mar 12 14:54 users So, unless there's another location that the radiusd user needs access to? I've verified that the service is definitely running as radiusd. I also looked up the possibility of the selinux protection and it's not set up at all on this system. Other thoughts? I'm stumped on this one. Thanks, Greg A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, > > > when run in debug, it runs with greater privs - check your eg /var/log/radius > directory, your used tmp directories, /etc/raddb etc for their permissions - does the > user/group you have defined in radiusd.conf have relevant read/write permissions > > other common issue is eg selinux daemon/service protection > > alan ---------------------------- This e-mail message and any attachments are confidential. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. If you are not the intended recipient, please notify me by return e-mail, do not open any attachment and delete this communication and any copy. Thank you

2 1

radclient:: Failed to find IP address for dhcppc0
by vnsquall 18 Mar '09

18 Mar '09

Hi everyone, i'm a newbie for configuring radius and i have some problems when i try to use radtest to test the freeradius-server-2.1.3. I have installed by following commands: $ ./configure --prefix=/usr/local/freeradius $ make $ make install Everything is OK and i type: [root@localhost ~]# /usr/local/freeradius/sbin/radiusd -X .................................. .................................. radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. After that, on another shell command, i try to test with radtest: /usr/local/freeradius/bin/radtest test test 127.0.0.1 0 testing123 radclient:: Failed to find IP address for dhcppc0 radclient: Nothing to send. I try to test with ping command: [root@dhcppc0 ~]# ping 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.046 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.046 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.050 ms 64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.044 ms ^C --- 127.0.0.1 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 0.044/0.046/0.050/0.007 ms -All the others conf file is the default setting. Thank you for any try to help me!!!! -- View this message in context: http://www.nabble.com/radclient%3A%3A-Failed-to-find-IP-address-for-dhcppc0… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: FreeRadius 2.0.5... canŽt make it work
by Jan Strauch 18 Mar '09

18 Mar '09

Many thanks There have been quite a few changes since 1.0.2. Now the clients are loaded from the nas-table. The logins are looked up in the DB too, but not working. IŽll be back if I canŽt fix it by myself. Jan > -----Ursprüngliche Nachricht----- > Von: <tnt(a)kalik.net> > Gesendet: 18.03.09 16:38:55 > An: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Betreff: Re: FreeRadius 2.0.5... canŽt make it work > >terminal 1 : radiusd -X gives me : > > > .. > >radiusd: #### Instantiating modules #### > > instantiate { > > Module: Linked to module rlm_exec > > Module: Instantiating exec > > exec { > > wait = no > > input_pairs = "request" > > shell_escape = yes > > } > > Module: Linked to module rlm_expr > > Module: Instantiating expr > > Module: Linked to module rlm_expiration > > Module: Instantiating expiration > > expiration { > > reply-message = "Password Has Expired " > > } > > Module: Linked to module rlm_logintime > > Module: Instantiating logintime > > logintime { > > reply-message = "You are calling outside your allowed timespan " > > minimum-timeout = 60 > > } > > } > .. > > ... but 127.0.0.1 is not unknown > > Yes, it is unknown. > > > >sql.conf : readclients = yes > >clients.conf : completely commented out > > As are many other things. sql among them. > > > > >mysql> select * from nas order by id desc limit 1; > >+----+-----------+-----------+--------+-------+--------+-----------+-------------+ > >| id | nasname | shortname | type | ports | secret | community | description | > >+----+-----------+-----------+--------+-------+--------+-----------+-------------+ > >| 56 | 127.0.0.1 | localhost | MikTik | NULL | test | NULL | NULL | > >+----+-----------+-----------+--------+-------+--------+-----------+-------------+ > >1 row in set (0.00 sec) > > > >What do I do wrong ? > > You haven't listed sql anywhere. So, the server is not reading nas > table. Even if it did read it - you haven't got any authentication > modules enabled. Go back to default configuration, add sql in > instantiate in radiusd.conf - and watch it work. Then make *small* > changes to configuration files. When you break something you will know > what you have done. Butchering configuration blindly like this can end > only one way - failure. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > _______________________________________________________________________ Aufgepasst: Sind Ihre Daten beim Online-Banking auch optimal geschützt? Jetzt absichern: https://homebanking.web.de/?mc=mail@footer.hb

1 0

FreeRadius 2.0.5... canŽt make it work
by Jan Strauch 18 Mar '09

18 Mar '09

Hello world ! I try to set up a new FR-server (v2.0.5). I lost 4 days until now and it still does not work. It just generates amounts of output without accepting anything: terminal 1 : radiusd -X gives me : FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Oct 9 2008 at 16:13:43 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/snmp.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = yes max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. terminal 2 : radtest test test localhost 0 test Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 radclient: no response from server for ID 178 socket 3 Parallel on terminal 1 : Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 59802 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 59802 Ready to process requests. ... ... but 127.0.0.1 is not unknown sql.conf : readclients = yes clients.conf : completely commented out mysql> select * from nas order by id desc limit 1; +----+-----------+-----------+--------+-------+--------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+-----------+-----------+--------+-------+--------+-----------+-------------+ | 56 | 127.0.0.1 | localhost | MikTik | NULL | test | NULL | NULL | +----+-----------+-----------+--------+-------+--------+-----------+-------------+ 1 row in set (0.00 sec) What do I do wrong ? This thing does not care what I configure, it always does the same, nothing. I have sqltrace = yes, but after days of trying there is no sqltrace.sql on the server (yes I made updatedb) there is nearly nothing in the log, but I configured it to log everything (good-auth, bad-auth, etc) All this worked best with FR 1.x.x. Please help thx _______________________________________________________________________ Aufgepasst: Sind Ihre Daten beim Online-Banking auch optimal geschützt? Jetzt absichern: https://homebanking.web.de/?mc=mail@footer.hb

3 2

LDAP Config Clarification
by Jason Frisvold 18 Mar '09

18 Mar '09

Hi all, I recently set up a new freeradius installation for VPN authentication. This is my first foray into using the LDAP module and, while I am successfully authenticating, I want to make sure that my config is both correct and streamlined. I am seeing a few failed authentications due to loss of LDAP connections, so I'm also trying to identify where that problem exists. The radius server is currently very low use, handling only a few requests an hour. This may increase later on, but I don't see it having to handle more than a few requests per minute. However, I would like to make sure those requests are handled efficiently and quickly. The current radius ldap config looks like this : modules { ldap { server = "ldap.example.com" port = 636 identity = "cn=manager,o=MyOrg" password = MySuperSecretPassword basedn = "o=MyOrg" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "memberOf" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))" groupmembership_attribute = memberOf net_timeout = 1 timeout = 8 timelimit = 3 } } In our users file, we have the following : DEFAULT Auth-Type := Reject Fall-Through = 1 DEFAULT Ldap-Group == "cn=vpn,ou=groups,o=myorg", Auth-Type := Accept Fall-Through = 1 DEFAULT Ldap-Group == "cn=admin,ou=groups,o=myorg" Class = ADMIN, Fall-Through = 1 DEFAULT Ldap-Group == "cn=user,ou=groups,o=myorg" Class = USER, Fall-Through = 1 Essentially, we want to assign a user to a specific class based on what group they are in, with some groups superseding others. Our LDAP entries have multiple memberOf attributes that list the groups a user is in, as well as groups that list the members. I was able to get this to work, but it appears that every group is scanned to find the user rather than merely using the memberOf attribute in the main LDAP record. Is there a way to trigger on that rather than scanning the groups? Note: The dictionary mapping file (ldap.attrs) is the default one, I have made no changes. With respect to the users file, I believe I can remove the Fall-Through parameter there for all but the vpn LDAP group. That would cut down, somewhat, on the group scanning. In the main radius config, can I remove all of the unused modules? I don't believe we're using PAP/CHAP/MS-CHAP at all, nor are we using the unix passwd file or EAP. Those can all be commented out to save time/resources, correct? And finally, can someone give me a few hints on how to identify the cause of the "LDAP connection lost" messages we see? They seem to be intermittent and I am unable to find a cause for them. The network is stable and there is no loss of connectivity at the lower layers. I believe radius is sending keepalives, correct, so a loss of connectivity could indicate keepalives being lost? Any help is appreciated! Thanks! If there's any additional information I can provide that would help, please let me know. -- --------------------------- Jason Frisvold xenophage0(a)gmail.com --------------------------- "I love deadlines. I like the whooshing sound they make as they fly by." - Douglas Adams

3 7