July 2009 - Freeradius-Users - lists.freeradius.org

Captive portal: can I use chap or pap in conjunction with ntlm_auth?
by john 28 Jul '09

28 Jul '09

Hi all, I am trying to get a captive portal working so my wireless users can enter their Windows domain credentials and get internet access. I've been working with chilispot/hotspotlogin.cgi and/or Copspot (an implementation of chilispot for IPCOP) both of which try to do CHAP with freeradius. Chili can also just hand a clear text password through. Either approach works fine if I put users in the users file, however I can't get this to work with my AD backend. NTLM auth does work if I use WPA2, however I am trying to push users through a TOS splash page and validate their domain credentials. I hope someone can help me figure out this out. Thanks! John Here's the output of from my attempts to authenticate: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.114.0.39 port 32772, id=0, length=216 User-Name = "flyboy" CHAP-Challenge = 0xd4a3fb75001e61f38b8216844306287c CHAP-Password = 0x00fcd3e064aa8829713fc8263c5b7e8303 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "00-21-5C-15-6D-8B" Called-Station-Id = "00-50-DA-1A-EF-77" NAS-Identifier = "nas01" Acct-Session-Id = "4a6f716d00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x452e7d3ec37b78ce9dc2d08eb447f6c9 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "flyboy", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "flyboy" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> flyboy attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 10.114.0.39 port 32772 Waking up in 4.9 seconds

4 4

etc_passwd
by Kaz Zurad 28 Jul '09

28 Jul '09

Hi. How to set up freeradius on redhat 4 to use etc_passwd? I'm new in freeradius, so please forgive me a lamer question. KG

5 10

Problem with compilation
by Julio Villacis Guevara 28 Jul '09

28 Jul '09

Hi i am have problema with the compilation in a box SUN SPARC T6300 with Solaris 10 the following is the messages display gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c fifo.c -o fifo.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c packet.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c packet.c -fPIC -DPIC -o .libs/packet.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c packet.c -o packet.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c event.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c event.c -fPIC -DPIC -o .libs/event.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c event.c -o event.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c getaddrinfo.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c getaddrinfo.c -fPIC -DPIC -o .libs/getaddrinfo.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c getaddrinfo.c -o getaddrinfo.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c vqp.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c vqp.c -fPIC -DPIC -o .libs/vqp.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c vqp.c -o vqp.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c heap.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c heap.c -fPIC -DPIC -o .libs/heap.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c heap.c -o heap.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c dhcp.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c dhcp.c -fPIC -DPIC -o .libs/dhcp.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/export/home/install/freeradius-server-2.1.6/src -c dhcp.c -o dhcp.o >/dev/null 2>&1 /export/home/install/freeradius-server-2.1.6/libtool --mode=link gcc -release 2.1.6 \ -export-dynamic -o libfreeradius-radius.la -rpath /usr/local/lib dict.lo filters.lo hash.lo hmac.lo hmacsha1.lo isaac.lo log.lo misc.lo missing.lo md4.lo md5.lo print.lo radius.lo rbtree.lo sha1.lo snprintf.lo strlcat.lo strlcpy.lo token.lo udpfromto.lo valuepair.lo fifo.lo packet.lo event.lo getaddrinfo.lo vqp.lo heap.lo dhcp.lo gcc -shared -Wl,-h -Wl,libfreeradius-radius-2.1.6.so -o .libs/libfreeradius-radius-2.1.6.so .libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o .libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o .libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o .libs/snprintf.o .libs/strlcat.o .libs/strlcpy.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o .libs/fifo.o .libs/packet.o .libs/event.o .libs/getaddrinfo.o .libs/vqp.o .libs/heap.o .libs/dhcp.o -lc (cd .libs && rm -f libfreeradius-radius.so && ln -s libfreeradius-radius-2.1.6.so libfreeradius-radius.so) false cru .libs/libfreeradius-radius.a dict.o filters.o hash.o hmac.o hmacsha1.o isaac.o log.o misc.o missing.o md4.o md5.o print.o radius.o rbtree.o sha1.o snprintf.o strlcat.o strlcpy.o token.o udpfromto.o valuepair.o fifo.o packet.o event.o getaddrinfo.o vqp.o heap.o dhcp.o gmake[4]: *** [libfreeradius-radius.la] Error 1 gmake[4]: Leaving directory `/export/home/install/freeradius-server-2.1.6/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/export/home/install/freeradius-server-2.1.6/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/install/freeradius-server-2.1.6/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/install/freeradius-server-2.1.6' make: *** [all] Error 2 # Thanks in advence.

3 5

Re: Freeradius-Users Digest, Vol 51, Issue 120
by Gilbert Lo 28 Jul '09

28 Jul '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Radius client configuration issue
by merajs＠gmail.com 28 Jul '09

28 Jul '09

I want to use PAM for user authentication. I am trying to setup radius client but unable to configure it. Radius client's setup is at Solaris and Radius Server (RKS emulator) is at Linux machine. Can any one tell the procedure to configure radius client so that it can communicate with Radius server? Is there any script required for that or all the commands needed to configure are in some config file? Also, how to login with radius client to check the authentication. Thanks in Advance. -- View this message in context: http://www.nabble.com/Radius-client-configuration-issue-tp24678845p24678845… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

Salu2...
by Frank Ernesto Morales Quiroga 28 Jul '09

28 Jul '09

install in freebsd freeradius friends and when my clients try to connect this poster draws me, it can be: +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "cdr.cu" for User-Name = "test(a)cdr.cu" [suffix] No such realm "cdr.cu" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 85 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test(a)cdr.cu attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 158 to 192.168.25.50 port 17963 Waking up in 4.9 seconds. Cleaning up request 2 ID 158 with timestamp +158 Ready to process requests.

3 5

LDAP and attributes from user file.
by Cliff Becker 27 Jul '09

27 Jul '09

OK. I'm stuck. I don't understand what I am doing wrong. I have installed freeradius with version 2.1.1-6.1 for SLE 10 SP2. I fumbled my way through LDAP authentication to edirectory (probably in all the wrong ways I'm sure). The issue I have now is that the attributes I set in the user file: DEFAULT Huntgroup-Name == WirelessGear, Ldap-Group == "cn=WirelessAllowed,o=integrity" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 10 The attributes are not included in the Access-Accept when using radtest or a XP workstation using the Novell 802.1x client. Below is the debug: rad_recv: Access-Request packet from host 10.1.0.24 port 32888, id=30, length=59 User-Name = "testuser" User-Password = "password" NAS-IP-Address = 10.1.0.24 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.1.0.24/auth-detail-20090725 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.1.0.24/auth-detail-20090725 [auth_log] expand: %t -> Sat Jul 25 08:20:43 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> testuser [ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=testuser) [ldap] expand: o=integrity -> o=integrity rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to oes1.nteg.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as cn=ldapuser,o=integrity/ldappass to oes1.nteg.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=integrity, with filter (cn=testuser) [ldap] Added the eDirectory password password in check items as Cleartext-Password [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.1.0.24/reply-detail-20090725 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.1.0.24/reply-detail-20090725 [reply_log] expand: %t -> Sat Jul 25 08:20:43 2009 ++[reply_log] returns ok rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to oes1.nteg.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as cn=testuser,o=integrity/password to oes1.nteg.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[exec] returns noop Sending Access-Accept of id 30 to 10.1.0.24 port 32888 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 30 with timestamp +27 Ready to process requests. However when I use an XP client and no Novell client or ntradping I see the attributes and I am assigned the correct VLAN Here is the debug below: rad_recv: Access-Request packet from host 10.1.0.5 port 1541, id=6, length=48 User-Name = "testuser" CHAP-Password = 0xa734db980a0367669cce38acbf8badf1bc +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.1.0.5/auth-detail-20090725 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.1.0.5/auth-detail-20090725 [auth_log] expand: %t -> Sat Jul 25 08:18:16 2009 ++[auth_log] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() [files] expand: o=integrity -> o=integrity [files] expand: %{Stripped-User-Name} -> [files] expand: %{User-Name} -> testuser [files] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=testuser) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to oes1.nteg.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as cn=ldapuser,o=integrity/ldappass to oes1.nteg.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=integrity, with filter (cn=testuser) rlm_ldap: ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dtestuser\2co\3dintegrity))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dtestuser\2co\3dintegrity))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=WirelessDisabled,o=integrity, with filter (|(&(objectClass=GroupOfNames)(member=cn\3dtestuser\2co\3dintegrity))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dtestuser\2co\3dintegrity))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=WirelessDisabled,o=integrity not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() [files] expand: o=integrity -> o=integrity [files] expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dtestuser\2co\3dintegrity))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dtestuser\2co\3dintegrity))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=WirelessAllowed,o=integrity, with filter (|(&(objectClass=GroupOfNames)(member=cn\3dtestuser\2co\3dintegrity))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dtestuser\2co\3dintegrity))) rlm_ldap::ldap_groupcmp: User found in group cn=WirelessAllowed,o=integrity rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 4 ++[files] returns ok [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> testuser [ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=testuser) [ldap] expand: o=integrity -> o=integrity rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=integrity, with filter (cn=testuser) [ldap] Added the eDirectory password password in check items as Cleartext-Password [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "testuser" with CHAP password [chap] Using clear text password "password" for user testuser authentication. [chap] chap user testuser authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.1.0.5/reply-detail-20090725 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.1.0.5/reply-detail-20090725 [reply_log] expand: %t -> Sat Jul 25 08:18:16 2009 ++[reply_log] returns ok rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to oes1.nteg.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as cn=testuser,o=integrity/password to oes1.nteg.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[exec] returns noop Sending Access-Accept of id 6 to 10.1.0.5 port 1541 Service-Type = Login-User Tunnel-Type:0 == VLAN Tunnel-Medium-Type:0 == IEEE-802 Tunnel-Private-Group-Id:0 == "10" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 6 with timestamp +9 Ready to process requests. I will not even pretend to know what I am doing wrong. I don't understand why I receive the following errors as well: WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. This is all that is in the users file and I cannot find Auth-Type = Local in any other file: DEFAULT Huntgroup-Name == WirelessGear, Ldap-Group == "cn=WirelessAllowed,o=integrity" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 10 Thank you in advance for your time and patience.

2 1

Multiple AD's and domains?
by Justin Steward 27 Jul '09

27 Jul '09

Hi Guys, I have an upcoming project where the setup is going to be something along the following: Client logs in using their username/password for domain FreeRadius authenticates the user against the AD server for that domain There will be clients using the service from MULTIPLE different AD domains with multiple different AD servers. The freeRadius version will be built from the latest stable source. Now, the stock standard way of authenticating against AD is using samba, joining the domain, and using NTLM Auth. Since I have multiple AD domains, how would this best be handled? I know that PHP is capable of using LDAP to authenticate against an AD server. Can freeRadius also do this? How, or why not? Thanks, ~Justin

3 5

howto pstack running freeradius process
by George Chelidze 27 Jul '09

27 Jul '09

Hello, I am investigating one issue with freeradius 2.1.6 custom module and would like to get a stack trace of running process. pstack <pid of radiusd> fails with the following error: 23246: /usr/local/freeradius-2.1.6/sbin/radiusd '': opening object file: No such file or directory Could not open object file. The following commands was used to build the freeradius server: ./configure --prefix=/usr/local/freeradius-2.1.6 --enable-developer make make install Please point me to the right direction. Thanks in advance, George Chelidze

4 9

RE: rlm_perl problems]
by sigor＠blic.net 25 Jul '09

25 Jul '09

On Sat, 25 Jul 2009 12:26:42 , <sigor(a)blic.net> sent: > > >On Sat, 25 Jul 2009 00:01 , 'Garber, Neal' Neal.Garber(a)energyeast.com> sent: > >>Igor: Can you rebuild FR and look at the output of rlm_perl on >>your system to see if you see similar errors? > I have tried 2.1.7 and got same error. I will try to compile it with --enable-developer and see if i can find out anything from gdb output. I realy don't know why would this happen because exactly the same setup worked on older releases. All i did was to compile the new version (2.1.6) and then copy old raddb dir.

1 0