June 2009 - Freeradius-Users - lists.freeradius.org

Robust proxy accounting
by Chris Howley 15 Jun '09

15 Jun '09

Alan, Here's the output from FR2.1.7. Thanks for you help in advance, Chris ++[exec] returns noop Sending Access-Accept of id 128 to 10.12.80.109 port 32769 User-Name = "isschug" MS-MPPE-Recv-Key = 0x3019b4c8f9f76bb2fc4d69edbc20e98377351a661c0b412c760cd773e3b4c5f5 MS-MPPE-Send-Key = 0x5c7923cd941d8d7bd673b823632371b01435f0590105a5c38211b89b04fdea1b EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschug - student" Finished request 20. Going to the next request Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Cleaning up request 11 ID 119 with timestamp +601 Cleaning up request 12 ID 120 with timestamp +601 Cleaning up request 13 ID 121 with timestamp +601 Cleaning up request 14 ID 122 with timestamp +601 Cleaning up request 15 ID 123 with timestamp +601 Cleaning up request 16 ID 124 with timestamp +601 Cleaning up request 17 ID 125 with timestamp +601 Cleaning up request 18 ID 126 with timestamp +601 Cleaning up request 19 ID 127 with timestamp +601 Cleaning up request 20 ID 128 with timestamp +601 Waking up in 0.5 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52",User-Name = "isschug"' [acct_unique] Acct-Unique-Session-ID = "5b58953f85bf5074". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschug", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-17:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-17:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Fri Jun 12 17:10:06 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschug ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschug attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 253 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313434 Proxying request 21 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 253 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313434 Going to the next request Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.6 seconds. Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 144 due to unfinished request 21 Waking up in 0.3 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=144, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 144 due to unfinished request 21 Waking up in 0.4 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.4 seconds. Rejecting request 21 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 [detail.example.com] expand: %t -> Fri Jun 12 17:10:06 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 144 to 10.12.80.109 port 32769 Finished request 21. Cleaning up request 21 ID 144 with timestamp +611 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 225 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.5 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:17 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "5b58953f85bf5074" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST" Acct-Delay-Time = 7 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 42 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3133363235 Proxying request 23 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 42 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3133363235 Going to the next request Waking up in 0.9 seconds. Waking up in 0.1 seconds. Waking up in 0.9 seconds. Waking up in 0.7 seconds. Waking up in 0.5 seconds. Waking up in 0.4 seconds. Waking up in 1.0 seconds. Waking up in 1.0 seconds. Rejecting request 23 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com No response configured for request 23. Will retry in 30 seconds Finished request 23. Cleaning up request 23 ID 13625 with timestamp +618 Going to the next request Waking up in 24.4 seconds. Sending Status-Server of id 66 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 1.5 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "5b58953f85bf5074" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST" Acct-Delay-Time = 43 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 13 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3534373934 Proxying request 25 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 13 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3534373934 Going to the next request Waking up in 0.9 seconds. Waking up in 0.1 seconds. Waking up in 0.9 seconds. Waking up in 1.1 seconds. Waking up in 1.0 seconds. Waking up in 1.1 seconds. Waking up in 0.4 seconds. Rejecting request 25 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com No response configured for request 25. Will retry in 30 seconds Finished request 25. Cleaning up request 25 ID 54794 with timestamp +654 Going to the next request Waking up in 0.7 seconds. Waking up in 20.7 seconds. Sending Status-Server of id 81 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 5.2 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a327dde/00:13:02:8d:f3:1f/52" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "5b58953f85bf5074" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 17:10:06 BST" Acct-Delay-Time = 79 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response code 0 from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 27. Cleaning up request 27 ID 8957 with timestamp +690 Going to the next request Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Sending Status-Server of id 3 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.3 seconds.

2 1

Logging data packet count to accounting table?
by Maximilian Grobecker 15 Jun '09

15 Jun '09

Hello, I'm using FreeRadius for authenticating DSL users. Additional to the Input- and Output octets I would like to log the transferred packet count for the actual DSL session. I need this information to generate statistics - and in past i got this information from another (not local) Radius server, so I think, it should be not impossible. I didn't found any variables where this info is avaliable - is there any possibility to get this information? Thank you! Max (Wuppertal, Germany)

3 2

Failed to parse authenticate section
by Nakul Deshpande 15 Jun '09

15 Jun '09

I am a freeradius newbie. I have configured Freeradius 1.1.7 on a Debian/Linux system. When I give the command radisud -X i get the following errors: radiusd.conf[636] Failed to link to module 'rlm_unix': rlm_unix.a: cannot open shared object file: No such file or directory radiusd.conf[1971] Unknown module "unix". radiusd.conf[1931] Failed to parse authenticate section. I have tried searching the previous posts and read the outputs of the commands: ./configure, make and make install. I have not been able to debug this so far. Can somebody please help me out with this? DCC-Test-Server:/freeradius# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /freeradius/raddb/proxy.conf Config: including file: /freeradius/raddb/clients.conf Config: including file: /freeradius/raddb/snmp.conf Config: including file: /freeradius/raddb/eap.conf Config: including file: /freeradius/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.15.103 IP address [192.168.15.103] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) radiusd.conf[636] Failed to link to module 'rlm_unix': rlm_unix.a: cannot open shared object file: No such file or directory radiusd.conf[1971] Unknown module "unix". radiusd.conf[1931] Failed to parse authenticate section. DCC-Test-Server:/freeradius# Thanks, Nakul

2 1

Using Dictionary in With Freeradius
by Ashfaq-Ur-Rahman 15 Jun '09

15 Jun '09

Hi, This is my first post in this list. I work for an ISP. We use freeradius with mysql in the radius server, pptp/pppoe to in nas. I inherited a 5 years old freeradious installation (version 1.0.0) and its running fine . Now i need to shift it to another server (because server is too old). I have installed freeradius 2.1.6 in a new PC with Centos5.3 with mysql 5. I had dumped the mysql database from the old machine to new machine. There is a field like "client-type" and there are two types of customer "basic" and "shared". Bur when i added a nas is the radius, the user cannot be authenticated, the following error occurs... I am new with freeradius. [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [sql] expand: %{User-Name} -> user1 [sql] sql_set_user escaped user --> 'user1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "basic" for attribute name "Client-Type" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Invalid user: [user1/<CHAP-Password>] (from client nas-1 port 0) Delaying reject of request 0 for 4 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 2.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 155 to *.*.*.* port 1033 Waking up in 4.9 seconds. Cleaning up request 0 ID 155 with timestamp +46 Ready to process requests. I googled the problem and find it could be a dictionary issue. So I added dictionary. But this time freeradius is giving another problem (It is not running.) # /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on May 22 2009 at 01:41:36 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. ............ ........... /usr/local/etc/raddb/dictionary.compat[7]: Expecting section start brace '{' after "ATTRIBUTE Password" Errors reading /usr/local/etc/raddb/radiusd.conf # My system is CENTOS 5.3 (i386) Mysql-server-5.0.45 Freeradius 2.1.6 I will be glad to have your comments on it. Sorry for such a long mail. Thank you all for your patients, reading the mail. Ashfaq.

3 2

Migrate users file to mysql?
by michel＠casa.co.cu 14 Jun '09

14 Jun '09

Hello As you will see I'm still a beginner in freeradius I recently upgrade my version of freeradius to latest version V2.1.6, my users or the same parameters are declared in the file "users" These authenticate against an LDAP. I have several two NAS, NAS1 a module with an analog modems and NAS2 digital modems to connect where Dialin using the service. My question is: 1 - How can my users migrate users from the file into mysql? 2 - I have users connecting to both Access Server, but when they connect the NAS1, my server raidus assigned different parameters when connecting the NAS2 to pass other parameters or conditions, Framed-IP-Address etc... Currently I have declared the same user with different parameters and conditions. NAS1= 192.168.25.20 NAS2= 192.168.25.30 frank Auth-Type := LDAP, NAS-IP-Address == "192.168.25.20", Calling-Station-Id == "76415044", Simultaneous-Use := 1 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Framed-Protocol = PPP, Framed-IP-Address = 192.168.28.110, Framed-IP-Netmask = 255.255.255.0, Idle-Timeout = 0 frank Auth-Type := LDAP, NAS-IP-Address == "192.168.25.30", Simultaneous-Use := 1 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Framed-Protocol = PPP, Framed-IP-Address = 192.168.29.110, Framed-IP-Netmask = 255.255.255.0, Idle-Timeout = 0 As would be declared to migrate to mysql? I have to repeat them twice as I have done here? Thank you ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

2 2

SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
by john 13 Jun '09

13 Jun '09

Hello All, I am not able able to successfully get a port authorized via dot1x (wired connection). I am using SecureW2 suite as a client. I get the following message in the debug output of freeradius: "rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate" I think this means that my windows XP client isn't returning a certificate to the radius server, but I am not sure. I hope someone can help me figure this out. Below is a fuller output from freeradius. Thanks! John +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 218 to 10.1.3.222 port 1024 EAP-Message = 0x010601541580000009363f8ea34a8928213fd268bf7e6095409ac959f34f444b40faf097692923ad83963e0395fa7c5dbee0011b5a9e43c819695e8dff5e4e393438c1f21a524eb69847838585d3d3c5dc5768677062f7f1fa98a14c0a1efe75201e211059691499941fa930077d23734c28a28c985d3131b7f01d21faa3dea7a544df8e6c2e87746d1b4e82eec6475a3b538d87a6cad17520189c2f86f1aa9a6e1c0deca5e45d9ee916030100a60d00009e0301024000980096308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a13045649 EAP-Message = 0x53443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c2044697374726963740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4aacbade4eaaaf8b77d4bfdb2d602cc2 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=219, length=558 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x4aacbade4eaaaf8b77d4bfdb2d602cc2 EAP-Message = 0x02060150150016030100070b00000300000016030101061000010201001ec801e7b54f1bacc0068882e8c18fce1cc9781c535dc2a9406139225a5f85a8bf309d83741a9c1980c009a09e60088af3eb8f6b0140772ca72a788e4653bf8b5df15e8a38eaa34da31bc6f2604438fb83156d7750ba083ee83838c06cdd09838e86289fb9dfe1e1664da15f157228a86ba5d248db4fae6c9e7d6c782ec9594d0e3c643becf5709608041eab084d0f2aa2237601f71b6ef98d0ee2a190101d67a908a98373884030becfb0df0b8c31349bcbfffc92e072bf3fc8591da21a70edfb234a916d3d1d19533ebec53f245e5facea057e1822a9ab93464dda7903198b EAP-Message = 0xa87b9eb6eee9a3bca55c890b7161b1997f57f84244ef309bdbd91d5e63f9fab3140301000101160301002841175ab1eb200cb6ed8eb09ebdd827dcb0c94fb2f0cc4bbc1057c217d57c7082f6232bda1742633c Message-Authenticator = 0x6d04184f1dac42b9c7c6da356158f8c5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0007], Certificate [ttls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 219 to 10.1.3.222 port 1024 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.5 seconds. Cleaning up request 0 ID 214 with timestamp +10 Cleaning up request 1 ID 215 with timestamp +10 Cleaning up request 2 ID 216 with timestamp +10 Cleaning up request 3 ID 217 with timestamp +10 Cleaning up request 4 ID 218 with timestamp +10 Waking up in 1.2 seconds. Cleaning up request 5 ID 219 with timestamp +10 Ready to process requests. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=220, length=211 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x02070009016a6f686e Message-Authenticator = 0x4bff9404e7321b17c71b169a7fe8c714 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[control] returns updated ++[unix] returns updated [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 220 to 10.1.3.222 port 1024 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bd9ee655f64d832ead121cf75 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=221, length=226 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bd9ee655f64d832ead121cf75 EAP-Message = 0x020800060315 Message-Authenticator = 0xf05ccffdc48c602e7055f1f09fd9f5bc +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[control] returns updated ++[unix] returns updated [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 221 to 10.1.3.222 port 1024 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010900061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bd8ef695f64d832ead121cf75 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=222, length=276 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bd8ef695f64d832ead121cf75 EAP-Message = 0x020900381500160301002d0100002903013faeaed39396e322ae3de01571d4a0cd64ad1a76a0e496d88b18489466fa7e58000002000a0100 Message-Authenticator = 0xb689989c467d49826a7819dc6283749e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 56 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 002d], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 0857], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 00a6], CertificateRequest [ttls] TLS_accept: SSLv3 write certificate request A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 222 to 10.1.3.222 port 1024 EAP-Message = 0x010a040015c000000936160301002a0200002603014a32986de07b75d573655c77f11d4537645a9e1e9e971ae8d47560ff836ac66800000a0016030108570b00085300085000039f3082039b30820283a003020102020101300d06092a864886f70d0101040500308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374 EAP-Message = 0x301e170d3039303630383139323933385a170d3130303630383139323933385a3075310b3009060355040613025553311330110603550408130a57617368696e67746f6e310d300b060355040a1304564953443119301706035504031310564953442052616469757320436572743127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100a9fb1e03259aafb1864477e036bb8f09194747b63bc2596d7c451882edd20837cb08675acf0e2d5fde4144bee680a0e2db76ed8fc5d717ae2cf3ab7f51acc522c7d3e50acd EAP-Message = 0xa727b5aceb75346f22c7eef985b9703d2f7ac67192feb1e7762cd35e3c987bf5659fcd4167f60bdbf4a393ddf4b839fc6ef538c225f2277540cfd89602512127dd8c669c2010d7e7dbb2890e3b26ccc0912e3d67d0c115df2e9522999e5fc984e002890a87046517d6cc5b7a95b5e60ab5aa3b0bdc2471d3ae9a3c0a6774e29ef4df460cb409b010e998b0a80f17032e1c71cf4047f9ece5f2501fd32b6f7b4e25a4d62544f1cde4497f191c7224386d6762a6e1aba1e472af3ab50203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010093bff95e424f631cf806273bae99ae9e EAP-Message = 0xced52efcd8e0905a6ea89f11adec836027c810257d2007ae4862ee5d6ca2dc969866d0f851ea82d7ef607da5a544b99d6392c1f86388ed55837c61f6fb634c4b537dd646332b25d729d2e6b6504f5d79f5c973d307573459f1a1afc0b86831d033c8a64bab7ba84875028362a2d44a605b1097e244073a1d9df1ca3d51622e536be8e570dacb061726210a814eb075a15b42715bec94fe1d4d6c36dbed8382bb141163ea74331741736ebafd5ac8497a639d024648badffe66853fb42c81bc83f0053b6fec9b4795035e094090d8183a340625e32903f380a38eb5578bd79940931644a6c1ef74bb15815f2cffcd7f290004ab308204a73082038fa003 EAP-Message = 0x020102020900833987f5f546 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bdbec695f64d832ead121cf75 Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=223, length=226 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bdbec695f64d832ead121cf75 EAP-Message = 0x020a00061500 Message-Authenticator = 0x16540a47b56572901005cd0703be8083 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 223 to 10.1.3.222 port 1024 EAP-Message = 0x010b040015c0000009363b43300d06092a864886f70d0101050500308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374301e170d3039303630383139323833395a170d3130303630383139323833395a308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d060355 EAP-Message = 0x04071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c20446973747269637430820122300d06092a864886f70d01010105000382010f003082010a0282010100a55584aa47296e32cbab93cdad9908b909d0d7b633fde3e846df3b9a70d74940eb63cd058ed1557ae9f98342785555a7f69b29a170e1b0cc9865448cf75f18bdf837559e6c58f8f8ed427076258110aa99459a3ee88350fe1ea5a295fe7b8d9b4861e4dc8281bee62c64ae560fad3d741127 EAP-Message = 0x090cf68c60831fe46c8a894e4b15d923bea2b62ffc0b274dafe6f18012a821d91c25e5a16763ce21fa710f971d003503692a98ec8bc7e7aa68ab0e35c8f98d6dee0e3997055d3dab1d5f02890e50c2e57c8f41bd59aae1eb012900d4772c0f4f833db3c0e43ca8ad1653a13316e926364cd35f252e607b0cedd51d257a82a5bdb87320d7984f7e3b3bc864e923710203010001a381fb3081f8301d0603551d0e04160414543e18343eb614370c4130e3ff1afd8cf93fe9af3081c80603551d230481c03081bd8014543e18343eb614370c4130e3ff1afd8cf93fe9afa18199a48196308193310b3009060355040613025553311330110603550408130a EAP-Message = 0x57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a1304564953443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c204469737472696374820900833987f5f5463b43300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007b2ccc21443a1b43a5562175e927500efa22c16d4d8dd566cdead0b0830269d54cd7afa1098199403df344c78059d781af4ce410cfcd663c52cec5440540b0663a6096dd0084bd20b8ea8601860e244d922f85b7f1 EAP-Message = 0xfc18f3952fd1dda7d4ecca4e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bdaed695f64d832ead121cf75 Finished request 9. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=224, length=226 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bdaed695f64d832ead121cf75 EAP-Message = 0x020b00061500 Message-Authenticator = 0xb4dd50363a7aa33881d9d2ba2fad1f4b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 224 to 10.1.3.222 port 1024 EAP-Message = 0x010c01541580000009363f8ea34a8928213fd268bf7e6095409ac959f34f444b40faf097692923ad83963e0395fa7c5dbee0011b5a9e43c819695e8dff5e4e393438c1f21a524eb69847838585d3d3c5dc5768677062f7f1fa98a14c0a1efe75201e211059691499941fa930077d23734c28a28c985d3131b7f01d21faa3dea7a544df8e6c2e87746d1b4e82eec6475a3b538d87a6cad17520189c2f86f1aa9a6e1c0deca5e45d9ee916030100a60d00009e0301024000980096308193310b3009060355040613025553311330110603550408130a57617368696e67746f6e310f300d06035504071306566173686f6e310d300b060355040a13045649 EAP-Message = 0x53443127302506092a864886f70d010901161874656368737570706f727440766173686f6e73642e6f7267312630240603550403131d566173686f6e2049736c616e64205363686f6f6c2044697374726963740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd9e67c5bddea695f64d832ead121cf75 Finished request 10. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.3.222 port 1024, id=225, length=558 Framed-MTU = 1480 NAS-IP-Address = 10.1.3.222 NAS-Identifier = "HP ProCurve Switch 2524" User-Name = "john" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 16 NAS-Port-Type = Ethernet NAS-Port-Id = "16" Called-Station-Id = "00-04-ea-a7-c2-70" Calling-Station-Id = "00-1c-25-93-26-16" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xd9e67c5bddea695f64d832ead121cf75 EAP-Message = 0x020c0150150016030100070b000003000000160301010610000102010029f7cad2a5ed026b3f6ac94cbeff92814502139418aa0c84ac8530c3f8b94a1a7aa8e8d45cf5b45d5779353a166d916292d43cff1264d5d99484b5aca8c6a381dd11db935d9d5cdb36d718c0b5e1c6ef7cb8774a461feb431c3918b706066e0a112a991af85400d62bf7ef76b370a3aeea705256c55afedf775aeb1405edeb429ac74753aa03b82c52c1c56a7e8145056e0f01a5d1a689cca54cb9ed121ea86a1e6ace3ac093f9d757752049924ab81792d47beb638b4e6eecdc55e88da3218972a2aa0380bf2d38b517101373498c55bd60d6ae9e581a5d976662a6188ec416 EAP-Message = 0x258d45ed623983520f1b0a30aa81bda3ecc551ac0617eb0de1185927b79dca21140301000101160301002874cdc78d855874525e120a085bfeb198cb565313472a4bda41ca3a52acb2df5b2df7561652ffa1d9 Message-Authenticator = 0xc93875552209af406690e002d9d996ee +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "john", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0007], Certificate [ttls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 225 to 10.1.3.222 port 1024 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.5 seconds. Cleaning up request 6 ID 220 with timestamp +71 Cleaning up request 7 ID 221 with timestamp +71 Cleaning up request 8 ID 222 with timestamp +71 Cleaning up request 9 ID 223 with timestamp +71 Cleaning up request 10 ID 224 with timestamp +71 Waking up in 1.3 seconds. Cleaning up request 11 ID 225 with timestamp +71 Ready to process requests.

3 6

XP Home SP3 WPA2 Enterprise oddity
by Seann Clark 12 Jun '09

12 Jun '09

All, I know this is an old(ish) issue, but one I have been playing with a lot lately. I have a Vista Ultimate box that works perfectly, but an XP SP3 box that stopped working after SP3 was applied. What I am seeing is the inital challenge come in from the XP box, the freeRadius box responding, an additional response from the XP system, and the final challenge from the Radius box goes out and never gets an answer. This repeats indefinitely until the WLAN is shut off on the XP box. It seems to be failing only on this last challenge response section, the XP box just never responds back. I am stumped as to what changed, and what else I can hammer on, without mindlessly breaking a working Radius server. My EAP.conf section is : # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4 2004/04/15 18:34:41 aland Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = peap # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = yes # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { #private_key_password = zaq1ZAQ!zaq1ZAQ #private_key_file = ${raddbdir}/certs/haruhi.pem private_key_file = /etc/pki/tls/private/haruhi.tsukinokage.net.key # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. #certificate_file = ${raddbdir}/certs/haruhi.crt certificate_file = /etc/pki/tls/certs/haruhi.tsukinokage.net.crt # Trusted Root CA list #CA_file = ${raddbdir}/certs/CA/ca.cer CA_file = /etc/pki/tls/certs/CA/ca.cer dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random random_file = /dev/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd # check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # check_cert_cn = %{User-Name} } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. default_eap_type = md5 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} # copy_request_to_tunnel = no # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # use_tunneled_reply = no } # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } } If anyone knows what needs done to get this working please assist. Thanks, Seann

2 1

Logical "or not" operator in users file?
by Donnelly, Michael (OFT) 12 Jun '09

12 Jun '09

I have a check to verify that a user is allowed to use radius at all, simply by checking if they are in the "radius" group. DEFAULT Group != "radius", Auth-Type == Reject Reply-Message == " Not in radius group" I would like to expand this to check against TWO groups. If user is in either one then pass , if user is in neither then generate the Reply-Message == " Not in radius group(s)" Its likely a simple tweak, but its escaping me. Is this where !* would serve? Thank You! ________________________________ This e-mail, including any attachments, may be confidential, privileged or otherwise legally protected. It is intended only for the addressee. If you received this e-mail in error or from someone who was not authorized to send it to you, do not disseminate, copy or otherwise use this e-mail or its attachments. Please notify the sender immediately by reply e-mail and delete the e-mail from your system.

2 2

Re: MAC Authentication
by Steve Wu 12 Jun '09

12 Jun '09

OK, it took a server reboot for FR to see the change in the users file. Case does count. Brain dead, thanks for giving me the nudge... it's all good now, onto MySQL and Daloradius... ----- Original Message ----- From: "Kenneth Grady" <klg(a)lanl.gov> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Thursday, June 11, 2009 12:50:26 PM GMT -05:00 US/Canada Eastern Subject: Re: MAC Authentication case counts, try adding the entry in your users file with lowercase. Steve Wu wrote: > Everyone - > > I'm being a bit brain dead most likely. I have been tinkering with > Freeradius and MAC authentication successfully. Now I have a real > server to build FR on so I proceeded to build the new server. After > going through the *same* steps to build FR, duplicating the > clients.conf and users file, I can't get the auth to work again. In my > notes these were the two files I touched to get it going, but I'm > hoping I missed something simple. > > My -Xy output looks like this: > > --- Walking the entire request list --- > Waking up in 1 seconds... > rad_recv: Access-Request packet from host 10.10.18.208:1030, id=16, > length=53 > User-Name = "000e35-84610a" > User-Password = "000e35-84610a" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "000e35-84610a", looking up realm > NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 1 > modcall[authorize]: module "files" returns notfound for request 1 > rlm_pap: WARNING! No "known good" password found for the user. > Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for request 1 > modcall: leaving group authorize (returns ok) for request 1 > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 1 seconds... > > My users file: > > 000E35-84610A Cleartext-Password := "000E35-84610A" > > > Any help to recover from my brain lapse would be greatly appreciated. > Did I miss some other config tweak so it's looking at the user file? > > Thx in advance! > > > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Logical "or not" operator in users file?
by Ivan Kalik 12 Jun '09

12 Jun '09

> I have a check to verify that a user is allowed to use radius at all, > simply > by checking if they are in the "radius" group. > > DEFAULT Group != "radius", Auth-Type == Reject > Reply-Message == " Not in radius group" > > I would like to expand this to check against TWO groups. If user is in > either one then pass , > if user is in neither then generate the Reply-Message == " Not in > radius group(s)" > > Its likely a simple tweak, but its escaping me. Is this where !* would > serve? DEFAULT Group == "group1" DEFAULT Group == "group2" DEFAULT Auth-Type == Reject Reply-Message == " Not in radius group" Ivan Kalik Kalik Informatika ISP

1 0