August 2009 - Freeradius-Users - lists.freeradius.org

Re: Freeradius and winbind problem
by Jean-Hubert Monlord 10 Aug '09

10 Aug '09

Thank you for your reply. I tested with two hardware (Acer and Dell) and I have reinstalled the OS. I work with the windows supplicant. I don't see what can do that. I think it is the server, maybe winbind/samba or freeradius, because I need to restart these two daemon for going to the end of the challenge. Anyone have an other idea? Jean-Hubert Monlord Luis Azevedo a écrit : > That happened to me also. > > Still don't know the cause (if someone knows please let me know), but > the problem it's on the client side that doesn't reply to the radius > challenge. > > I've tried several other Windows machines and no problem whatsoever. > > The machine that was having problems had several supplicants installed > and I believe it could be one of the others supplicants that was > messing up with the default Windows supplicant. > I've reinstalled (the every windows problem solution) the machine just > to see if wasn't the NIC or any other hardware issue, and guess what, > no more problems. :) > > Hope it helps, > > Luis Azevedo > http://www.braceta.com > > > > On Aug 3, 2009, at 13:35 , Jean-Hubert Monlord wrote: > >> I have a problem with my freeradius installed on a Debian Lenny : >> I want to use PEAP with Active Directory. It works fine during a few >> minutes. >> After that, freeradius don't send the Access-Accept, it seems it >> waits for a response which never comes. >> I must restart winbind daemon and freeradius to succeed an >> authentification. >> >> The client is Aruba, but I have tested with Netgear with the same >> result.

2 2

Patch to update the default CA certificates to use SHA1 instead of MD5
by Walter Goulet 09 Aug '09

09 Aug '09

Hi, While I was building a version of FreeRADIUS 2.1.6 from source I was testing the certificates that are created using the certs makefile. I noticed that the CA certs (as well as server and client certs) use the default OpenSSL md5rsa signature algorithm. From the recently announced vulnerabilities against certs using this signature algorithm ( http://www.kb.cert.org/vuls/id/836068) it would be better if these certificates used the sha1rsa signature algorithm instead. Note that while the README explicitly states that the default test certificates shouldn't be used, it does tell users to generate their own certificates using the same certificate configuration files. The result is that users following these defaults will end up using md5rsa certificates. The following patches to the ca.cnf, server.cnf, and client.cnf files update them to use sha1rsa. Thanks, Walter --- ca.cnf.orig 2009-08-08 22:48:01.000000000 -0500 +++ ca.cnf 2009-08-08 22:49:44.000000000 -0500 @@ -16,7 +16,7 @@ cert_opt = ca_default default_days = 365 default_crl_days = 30 -default_md = md5 +default_md = sha1 preserve = no policy = policy_match --- client.cnf.orig 2009-08-08 22:48:08.000000000 -0500 +++ client.cnf 2009-08-08 22:49:33.000000000 -0500 @@ -16,7 +16,7 @@ cert_opt = ca_default default_days = 365 default_crl_days = 30 -default_md = md5 +default_md = sha1 preserve = no policy = policy_match --- server.cnf.orig 2009-08-08 22:48:16.000000000 -0500 +++ server.cnf 2009-08-08 22:49:56.000000000 -0500 @@ -16,7 +16,7 @@ cert_opt = ca_default default_days = 365 default_crl_days = 30 -default_md = md5 +default_md = sha1 preserve = no policy = policy_match

2 2

VMPS: Failed encoding packet: Failed to find VQP-Packet-Type in response packet
by Michael Bryant 09 Aug '09

09 Aug '09

Hi, Stock Freeradius version 2.1.6, compiled with dpkg-buildpackage. Using default sites-avaialable/vmps virtual server. Also using dynamic clients with clients in postgresql. Getting this error on every VMPS request: Failed encoding packet: Failed to find VQP-Packet-Type in response packet. Using a customised sites-enabled/vmps file, pulling data from postgresql, which was working in 2.1.0, I get the same error. Any ideas as to why this error is occurring? Cheers --Mike radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "vmps" ipaddr = * port = 1589 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on vmps address * port 1589 as server vmps Listening on proxy address * port 1814 Ready to process requests. server dynamic_client_server { rlm_sql (sqllocal): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT nasname FROM nas WHERE nasname >>= '127.0.0.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sqllocal): Released sql socket id: 4 rlm_sql (sqllocal): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT shortname FROM nas WHERE nasname >>= '127.0.0.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sqllocal): Released sql socket id: 3 rlm_sql (sqllocal): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT secret FROM nas WHERE nasname >>= '127.0.0.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sqllocal): Released sql socket id: 2 rlm_sql (sqllocal): Reserving sql socket id: 1 rlm_sql_postgresql: query: SELECT type FROM nas WHERE nasname >>= '127.0.0.1' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sqllocal): Released sql socket id: 1 } # server dynamic_client_server - Added client 127.0.0.1 with shared secret testing123 VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 10.252.24.2 VMPS-Port-Name = "Fa0/17" VMPS-VLAN-Name = "" VMPS-Domain-Name = "blah" VMPS-Unknown = 0x00 VMPS-MAC = 00:16:41:11:0b:ff server vmps { Doing VMPS Done VMPS } # server vmps Failed encoding packet: Failed to find VQP-Packet-Type in response packet Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 4660 with timestamp +87 Ready to process requests.

2 5

Re: Freeradius-Users Digest, Vol 52, Issue 45
by Gilbert Lo 09 Aug '09

09 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

using patch
by Eric 09 Aug '09

09 Aug '09

Hi, I'm new in linux and its scripts. I apologize for my foolish question. In this mailing list I found this patch http://bugs.gentoo.org/attachment.cgi?id=102981 for gigaword. But how to use it? Where should be added this patch? and another one http://www.netexpertise.eu/en/freeradius/daily-accounting.html. Where exactly should I set this scripts ?

1 0

urgent
by RANDRIAMAMPIONONA José Johnny 08 Aug '09

08 Aug '09

Hi everyone, I ve just setup freeradius-server 2.1.6 + OpenLdap. Everything seems to be cool without the output which looks like contradictory. The *output of radtest blabla ect ..* proves that there is no response from the server. Then the server gives these lines: *Sun Aug 2 14:36:17 2009 : Info: FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 29 2009 at 23:42:06 Sun Aug 2 14:36:17 2009 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Sun Aug 2 14:36:17 2009 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Sun Aug 2 14:36:17 2009 : Info: PARTICULAR PURPOSE. Sun Aug 2 14:36:17 2009 : Info: You may redistribute copies of FreeRADIUS under the terms of the Sun Aug 2 14:36:17 2009 : Info: GNU General Public License v2. Sun Aug 2 14:36:17 2009 : Info: Starting - reading configuration files ...* ....................................................................................................................................................................................... *Sun Aug 2 14:36:17 2009 : Debug: main { Sun Aug 2 14:36:17 2009 : Debug: prefix = "/usr/local/freeradius-server-2.1.6" Sun Aug 2 14:36:17 2009 : Debug: localstatedir = "/usr/local/freeradius-server-2.1.6/var" Sun Aug 2 14:36:17 2009 : Debug: logdir = "/usr/local/freeradius-server-2.1.6/var/log/radius" Sun Aug 2 14:36:17 2009 : Debug: libdir = "/usr/local/freeradius-server-2.1.6/lib" Sun Aug 2 14:36:17 2009 : Debug: radacctdir = "/usr/local/freeradius-server-2.1.6/var/log/radius/radacct" Sun Aug 2 14:36:17 2009 : Debug: hostname_lookups = no Sun Aug 2 14:36:17 2009 : Debug: max_request_time = 30 Sun Aug 2 14:36:17 2009 : Debug: cleanup_delay = 5 Sun Aug 2 14:36:17 2009 : Debug: max_requests = 1024 Sun Aug 2 14:36:17 2009 : Debug: allow_core_dumps = no Sun Aug 2 14:36:17 2009 : Debug: pidfile = "/usr/local/freeradius-server-2.1.6/var/run/radiusd/radiusd.pid" Sun Aug 2 14:36:17 2009 : Debug: checkrad = "/usr/local/freeradius-server-2.1.6/sbin/checkrad" Sun Aug 2 14:36:17 2009 : Debug: debug_level = 0 Sun Aug 2 14:36:17 2009 : Debug: proxy_requests = yes Sun Aug 2 14:36:17 2009 : Debug: log { Sun Aug 2 14:36:17 2009 : Debug: stripped_names = no Sun Aug 2 14:36:17 2009 : Debug: auth = no Sun Aug 2 14:36:17 2009 : Debug: auth_badpass = no Sun Aug 2 14:36:17 2009 : Debug: auth_goodpass = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: security { Sun Aug 2 14:36:17 2009 : Debug: max_attributes = 200 Sun Aug 2 14:36:17 2009 : Debug: reject_delay = 1 Sun Aug 2 14:36:17 2009 : Debug: status_server = yes Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: radiusd: #### Loading Realms and Home Servers #### Sun Aug 2 14:36:17 2009 : Debug: proxy server { Sun Aug 2 14:36:17 2009 : Debug: retry_delay = 5 Sun Aug 2 14:36:17 2009 : Debug: retry_count = 3 Sun Aug 2 14:36:17 2009 : Debug: default_fallback = no Sun Aug 2 14:36:17 2009 : Debug: dead_time = 120 Sun Aug 2 14:36:17 2009 : Debug: wake_all_if_all_dead = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: home_server localhost { Sun Aug 2 14:36:17 2009 : Debug: ipaddr = 127.0.0.1 Sun Aug 2 14:36:17 2009 : Debug: port = 1812 Sun Aug 2 14:36:17 2009 : Debug: type = "auth" Sun Aug 2 14:36:17 2009 : Debug: secret = "testing123" Sun Aug 2 14:36:17 2009 : Debug: response_window = 20 Sun Aug 2 14:36:17 2009 : Debug: max_outstanding = 65536 Sun Aug 2 14:36:17 2009 : Debug: require_message_authenticator = no Sun Aug 2 14:36:17 2009 : Debug: zombie_period = 40 Sun Aug 2 14:36:17 2009 : Debug: status_check = "status-server" Sun Aug 2 14:36:17 2009 : Debug: ping_interval = 30 Sun Aug 2 14:36:17 2009 : Debug: check_interval = 30 Sun Aug 2 14:36:17 2009 : Debug: num_answers_to_alive = 3 Sun Aug 2 14:36:17 2009 : Debug: num_pings_to_alive = 3 Sun Aug 2 14:36:17 2009 : Debug: revive_interval = 120 Sun Aug 2 14:36:17 2009 : Debug: status_check_timeout = 4 Sun Aug 2 14:36:17 2009 : Debug: irt = 2 Sun Aug 2 14:36:17 2009 : Debug: mrt = 16 Sun Aug 2 14:36:17 2009 : Debug: mrc = 5 Sun Aug 2 14:36:17 2009 : Debug: mrd = 30 Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: home_server_pool my_auth_failover { Sun Aug 2 14:36:17 2009 : Debug: type = fail-over Sun Aug 2 14:36:17 2009 : Debug: home_server = localhost Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: realm example.com { Sun Aug 2 14:36:17 2009 : Debug: auth_pool = my_auth_failover Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: realm LOCAL { Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: radiusd: #### Loading Clients #### Sun Aug 2 14:36:17 2009 : Debug: client 127.0.0.1 { Sun Aug 2 14:36:17 2009 : Debug: require_message_authenticator = no Sun Aug 2 14:36:17 2009 : Debug: secret = "testtest" Sun Aug 2 14:36:17 2009 : Debug: shortname = "localhost" Sun Aug 2 14:36:17 2009 : Debug: nastype = "other" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: radiusd: #### Instantiating modules #### Sun Aug 2 14:36:17 2009 : Debug: instantiate { Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_exec, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_exec Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating exec Sun Aug 2 14:36:17 2009 : Debug: exec { Sun Aug 2 14:36:17 2009 : Debug: wait = no Sun Aug 2 14:36:17 2009 : Debug: input_pairs = "request" Sun Aug 2 14:36:17 2009 : Debug: shell_escape = yes Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_expr, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_expr Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating expr Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_expiration, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_expiration Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating expiration Sun Aug 2 14:36:17 2009 : Debug: expiration { Sun Aug 2 14:36:17 2009 : Debug: reply-message = "Password Has Expired " Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_logintime, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_logintime Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating logintime Sun Aug 2 14:36:17 2009 : Debug: logintime { Sun Aug 2 14:36:17 2009 : Debug: reply-message = "You are calling outside your allowed timespan " Sun Aug 2 14:36:17 2009 : Debug: minimum-timeout = 60 Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: radiusd: #### Loading Virtual Servers #### Sun Aug 2 14:36:17 2009 : Debug: server inner-tunnel { Sun Aug 2 14:36:17 2009 : Debug: modules { Sun Aug 2 14:36:17 2009 : Debug: Module: Checking authenticate {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_pap, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_pap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating pap Sun Aug 2 14:36:17 2009 : Debug: pap { Sun Aug 2 14:36:17 2009 : Debug: encryption_scheme = "auto" Sun Aug 2 14:36:17 2009 : Debug: auto_header = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_chap, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_chap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating chap Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_mschap, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_mschap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating mschap Sun Aug 2 14:36:17 2009 : Debug: mschap { Sun Aug 2 14:36:17 2009 : Debug: use_mppe = yes Sun Aug 2 14:36:17 2009 : Debug: require_encryption = no Sun Aug 2 14:36:17 2009 : Debug: require_strong = no Sun Aug 2 14:36:17 2009 : Debug: with_ntdomain_hack = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_unix, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_unix Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating unix Sun Aug 2 14:36:17 2009 : Debug: unix { Sun Aug 2 14:36:17 2009 : Debug: radwtmp = "/usr/local/freeradius-server-2.1.6/var/log/radius/radwtmp" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_eap, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_eap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap Sun Aug 2 14:36:17 2009 : Debug: eap { Sun Aug 2 14:36:17 2009 : Debug: default_eap_type = "md5" Sun Aug 2 14:36:17 2009 : Debug: timer_expire = 60 Sun Aug 2 14:36:17 2009 : Debug: ignore_unknown_eap_types = no Sun Aug 2 14:36:17 2009 : Debug: cisco_accounting_username_bug = no Sun Aug 2 14:36:17 2009 : Debug: max_sessions = 2048 Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_md5 Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-md5 Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_leap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-leap Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_gtc Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-gtc Sun Aug 2 14:36:17 2009 : Debug: gtc { Sun Aug 2 14:36:17 2009 : Debug: challenge = "Password: " Sun Aug 2 14:36:17 2009 : Debug: auth_type = "PAP" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_tls Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-tls Sun Aug 2 14:36:17 2009 : Debug: tls { Sun Aug 2 14:36:17 2009 : Debug: rsa_key_exchange = no Sun Aug 2 14:36:17 2009 : Debug: dh_key_exchange = yes Sun Aug 2 14:36:17 2009 : Debug: rsa_key_length = 512 Sun Aug 2 14:36:17 2009 : Debug: dh_key_length = 512 Sun Aug 2 14:36:17 2009 : Debug: verify_depth = 0 Sun Aug 2 14:36:17 2009 : Debug: pem_file_type = yes Sun Aug 2 14:36:17 2009 : Debug: private_key_file = "/usr/local/freeradius-server-2.1.6/etc/raddb/certs/server.pem" Sun Aug 2 14:36:17 2009 : Debug: certificate_file = "/usr/local/freeradius-server-2.1.6/etc/raddb/certs/server.pem" Sun Aug 2 14:36:17 2009 : Debug: CA_file = "/usr/local/freeradius-server-2.1.6/etc/raddb/certs/ca.pem" Sun Aug 2 14:36:17 2009 : Debug: private_key_password = "whatever" Sun Aug 2 14:36:17 2009 : Debug: dh_file = "/usr/local/freeradius-server-2.1.6/etc/raddb/certs/dh" Sun Aug 2 14:36:17 2009 : Debug: random_file = "/usr/local/freeradius-server-2.1.6/etc/raddb/certs/random" Sun Aug 2 14:36:17 2009 : Debug: fragment_size = 1024 Sun Aug 2 14:36:17 2009 : Debug: include_length = yes Sun Aug 2 14:36:17 2009 : Debug: check_crl = no Sun Aug 2 14:36:17 2009 : Debug: cipher_list = "DEFAULT" Sun Aug 2 14:36:17 2009 : Debug: make_cert_command = "/usr/local/freeradius-server-2.1.6/etc/raddb/certs/bootstrap" Sun Aug 2 14:36:17 2009 : Debug: cache { Sun Aug 2 14:36:17 2009 : Debug: enable = no Sun Aug 2 14:36:17 2009 : Debug: lifetime = 24 Sun Aug 2 14:36:17 2009 : Debug: max_entries = 255 Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_ttls Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-ttls Sun Aug 2 14:36:17 2009 : Debug: ttls { Sun Aug 2 14:36:17 2009 : Debug: default_eap_type = "md5" Sun Aug 2 14:36:17 2009 : Debug: copy_request_to_tunnel = no Sun Aug 2 14:36:17 2009 : Debug: use_tunneled_reply = no Sun Aug 2 14:36:17 2009 : Debug: virtual_server = "inner-tunnel" Sun Aug 2 14:36:17 2009 : Debug: include_length = yes Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_peap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-peap Sun Aug 2 14:36:17 2009 : Debug: peap { Sun Aug 2 14:36:17 2009 : Debug: default_eap_type = "mschapv2" Sun Aug 2 14:36:17 2009 : Debug: copy_request_to_tunnel = no Sun Aug 2 14:36:17 2009 : Debug: use_tunneled_reply = no Sun Aug 2 14:36:17 2009 : Debug: proxy_tunneled_request_as_eap = yes Sun Aug 2 14:36:17 2009 : Debug: virtual_server = "inner-tunnel" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating eap-mschapv2 Sun Aug 2 14:36:17 2009 : Debug: mschapv2 { Sun Aug 2 14:36:17 2009 : Debug: with_ntdomain_hack = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Checking authorize {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_realm, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_realm Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating suffix Sun Aug 2 14:36:17 2009 : Debug: realm suffix { Sun Aug 2 14:36:17 2009 : Debug: format = "suffix" Sun Aug 2 14:36:17 2009 : Debug: delimiter = "@" Sun Aug 2 14:36:17 2009 : Debug: ignore_default = no Sun Aug 2 14:36:17 2009 : Debug: ignore_null = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_files, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_files Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating files Sun Aug 2 14:36:17 2009 : Debug: files { Sun Aug 2 14:36:17 2009 : Debug: usersfile = "/usr/local/freeradius-server-2.1.6/etc/raddb/users" Sun Aug 2 14:36:17 2009 : Debug: acctusersfile = "/usr/local/freeradius-server-2.1.6/etc/raddb/acct_users" Sun Aug 2 14:36:17 2009 : Debug: preproxy_usersfile = "/usr/local/freeradius-server-2.1.6/etc/raddb/preproxy_users" Sun Aug 2 14:36:17 2009 : Debug: compat = "no" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Checking session {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_radutmp, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_radutmp Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating radutmp Sun Aug 2 14:36:17 2009 : Debug: radutmp { Sun Aug 2 14:36:17 2009 : Debug: filename = "/usr/local/freeradius-server-2.1.6/var/log/radius/radutmp" Sun Aug 2 14:36:17 2009 : Debug: username = "%{User-Name}" Sun Aug 2 14:36:17 2009 : Debug: case_sensitive = yes Sun Aug 2 14:36:17 2009 : Debug: check_with_nas = yes Sun Aug 2 14:36:17 2009 : Debug: perm = 384 Sun Aug 2 14:36:17 2009 : Debug: callerid = yes Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Checking post-proxy {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: Module: Checking post-auth {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_attr_filter Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating attr_filter.access_reject Sun Aug 2 14:36:17 2009 : Debug: attr_filter attr_filter.access_reject { Sun Aug 2 14:36:17 2009 : Debug: attrsfile = "/usr/local/freeradius-server-2.1.6/etc/raddb/attrs.access_reject" Sun Aug 2 14:36:17 2009 : Debug: key = "%{User-Name}" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: } # modules Sun Aug 2 14:36:17 2009 : Debug: } # server Sun Aug 2 14:36:17 2009 : Debug: server { Sun Aug 2 14:36:17 2009 : Debug: modules { Sun Aug 2 14:36:17 2009 : Debug: Module: Checking authenticate {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_ldap, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_ldap Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating ldap Sun Aug 2 14:36:17 2009 : Debug: ldap { Sun Aug 2 14:36:17 2009 : Debug: server = "ldap.uae.ac.ma" Sun Aug 2 14:36:17 2009 : Debug: port = 389 Sun Aug 2 14:36:17 2009 : Debug: password = "" Sun Aug 2 14:36:17 2009 : Debug: identity = "" Sun Aug 2 14:36:17 2009 : Debug: net_timeout = 1 Sun Aug 2 14:36:17 2009 : Debug: timeout = 4 Sun Aug 2 14:36:17 2009 : Debug: timelimit = 3 Sun Aug 2 14:36:17 2009 : Debug: tls_mode = no Sun Aug 2 14:36:17 2009 : Debug: start_tls = no Sun Aug 2 14:36:17 2009 : Debug: tls_require_cert = "allow" Sun Aug 2 14:36:17 2009 : Debug: tls { Sun Aug 2 14:36:17 2009 : Debug: start_tls = no Sun Aug 2 14:36:17 2009 : Debug: require_cert = "allow" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: basedn = "ou=People,dc=uae,dc=ac,dc=ma" Sun Aug 2 14:36:17 2009 : Debug: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Sun Aug 2 14:36:17 2009 : Debug: base_filter = "(objectclass=radiusprofile)" Sun Aug 2 14:36:17 2009 : Debug: auto_header = no Sun Aug 2 14:36:17 2009 : Debug: access_attr_used_for_allow = yes Sun Aug 2 14:36:17 2009 : Debug: groupname_attribute = "cn" Sun Aug 2 14:36:17 2009 : Debug: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" Sun Aug 2 14:36:17 2009 : Debug: dictionary_mapping = "/usr/local/freeradius-server-2.1.6/etc/raddb/ldap.attrmap" Sun Aug 2 14:36:17 2009 : Debug: ldap_debug = 0 Sun Aug 2 14:36:17 2009 : Debug: ldap_connections_number = 5 Sun Aug 2 14:36:17 2009 : Debug: compare_check_items = no Sun Aug 2 14:36:17 2009 : Debug: do_xlat = yes Sun Aug 2 14:36:17 2009 : Debug: set_auth_type = yes Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: Registering ldap_groupcmp for Ldap-Group Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: Registering ldap_xlat with xlat_name ldap Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius-server-2.1.6/etc/raddb/ldap.attrmap Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusClass mapped to RADIUS Class Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type Sun Aug 2 14:36:17 2009 : Debug: rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id Sun Aug 2 14:36:17 2009 : Debug: conns: 0xa15daf0 Sun Aug 2 14:36:17 2009 : Debug: Module: Checking authorize {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_preprocess, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_preprocess Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating preprocess Sun Aug 2 14:36:17 2009 : Debug: preprocess { Sun Aug 2 14:36:17 2009 : Debug: huntgroups = "/usr/local/freeradius-server-2.1.6/etc/raddb/huntgroups" Sun Aug 2 14:36:17 2009 : Debug: hints = "/usr/local/freeradius-server-2.1.6/etc/raddb/hints" Sun Aug 2 14:36:17 2009 : Debug: with_ascend_hack = no Sun Aug 2 14:36:17 2009 : Debug: ascend_channels_per_line = 23 Sun Aug 2 14:36:17 2009 : Debug: with_ntdomain_hack = no Sun Aug 2 14:36:17 2009 : Debug: with_specialix_jetstream_hack = no Sun Aug 2 14:36:17 2009 : Debug: with_cisco_vsa_hack = no Sun Aug 2 14:36:17 2009 : Debug: with_alvarion_vsa_hack = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Checking preacct {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_acct_unique Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating acct_unique Sun Aug 2 14:36:17 2009 : Debug: acct_unique { Sun Aug 2 14:36:17 2009 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Checking accounting {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: (Loaded rlm_detail, checking if it's valid) Sun Aug 2 14:36:17 2009 : Debug: Module: Linked to module rlm_detail Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating detail Sun Aug 2 14:36:17 2009 : Debug: detail { Sun Aug 2 14:36:17 2009 : Debug: detailfile = "/usr/local/freeradius-server-2.1.6/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Sun Aug 2 14:36:17 2009 : Debug: header = "%t" Sun Aug 2 14:36:17 2009 : Debug: detailperm = 384 Sun Aug 2 14:36:17 2009 : Debug: dirperm = 493 Sun Aug 2 14:36:17 2009 : Debug: locking = no Sun Aug 2 14:36:17 2009 : Debug: log_packet_header = no Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Instantiating attr_filter.accounting_response Sun Aug 2 14:36:17 2009 : Debug: attr_filter attr_filter.accounting_response { Sun Aug 2 14:36:17 2009 : Debug: attrsfile = "/usr/local/freeradius-server-2.1.6/etc/raddb/attrs.accounting_response" Sun Aug 2 14:36:17 2009 : Debug: key = "%{User-Name}" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Module: Checking session {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: Module: Checking post-proxy {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: Module: Checking post-auth {...} for more modules to load Sun Aug 2 14:36:17 2009 : Debug: } # modules Sun Aug 2 14:36:17 2009 : Debug: } # server Sun Aug 2 14:36:17 2009 : Debug: radiusd: #### Opening IP addresses and Ports #### Sun Aug 2 14:36:17 2009 : Debug: listen { Sun Aug 2 14:36:17 2009 : Debug: type = "auth" Sun Aug 2 14:36:17 2009 : Debug: ipaddr = * Sun Aug 2 14:36:17 2009 : Debug: port = 0 Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: listen { Sun Aug 2 14:36:17 2009 : Debug: type = "acct" Sun Aug 2 14:36:17 2009 : Debug: ipaddr = * Sun Aug 2 14:36:17 2009 : Debug: port = 0 Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: listen { Sun Aug 2 14:36:17 2009 : Debug: type = "control" Sun Aug 2 14:36:17 2009 : Debug: listen { Sun Aug 2 14:36:17 2009 : Debug: socket = "/usr/local/freeradius-server-2.1.6/var/run/radiusd/radiusd.sock" Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: } Sun Aug 2 14:36:17 2009 : Debug: Listening on authentication address * port 1812 Sun Aug 2 14:36:17 2009 : Debug: Listening on accounting address * port 1813 Sun Aug 2 14:36:17 2009 : Debug: Listening on command file /usr/local/freeradius-server-2.1.6/var/run/radiusd/radiusd.sock Sun Aug 2 14:36:17 2009 : Debug: Listening on proxy address * port 1814 Sun Aug 2 14:36:17 2009 : Debug: Ready to process requests.* ...................................................................................................................................................................................... *rad_recv: Access-Request packet from host 127.0.0.1 port 52375, id=252, length=58 User-Name = "m_user" User-Password = "passwd" NAS-IP-Address = 10.1.1.12 NAS-Port = 0 Sun Aug 2 14:36:53 2009 : Info: +- entering group authorize {...} Sun Aug 2 14:36:53 2009 : Info: ++[preprocess] returns ok Sun Aug 2 14:36:53 2009 : Info: ++[chap] returns noop Sun Aug 2 14:36:53 2009 : Info: ++[mschap] returns noop Sun Aug 2 14:36:53 2009 : Info: [suffix] No '@' in User-Name = "m_user", looking up realm NULL Sun Aug 2 14:36:53 2009 : Info: [suffix] No such realm "NULL" Sun Aug 2 14:36:53 2009 : Info: ++[suffix] returns noop Sun Aug 2 14:36:53 2009 : Info: [eap] No EAP-Message, not doing EAP Sun Aug 2 14:36:53 2009 : Info: ++[eap] returns noop Sun Aug 2 14:36:53 2009 : Info: ++[unix] returns notfound Sun Aug 2 14:36:53 2009 : Info: ++[files] returns noop Sun Aug 2 14:36:53 2009 : Info: [ldap] performing user authorization for m_user Sun Aug 2 14:36:53 2009 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Sun Aug 2 14:36:53 2009 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=m_user) Sun Aug 2 14:36:53 2009 : Info: [ldap] expand: ou=People,dc=uae,dc=ac,dc=ma -> ou=People,dc=uae,dc=ac,dc=ma Sun Aug 2 14:36:53 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Sun Aug 2 14:36:53 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Sun Aug 2 14:36:53 2009 : Debug: rlm_ldap: attempting LDAP reconnection Sun Aug 2 14:36:53 2009 : Debug: rlm_ldap: (re)connect to ldap.uae.ac.ma:389, authentication 0 Sun Aug 2 14:36:53 2009 : Debug: rlm_ldap: bind as / to ldap.uae.ac.ma:389 Sun Aug 2 14:37:09 2009 : Debug: rlm_ldap: waiting for bind result ... Sun Aug 2 14:37:09 2009 : Debug: rlm_ldap: Bind was successful Sun Aug 2 14:37:09 2009 : Debug: rlm_ldap: performing search in ou=People,dc=uae,dc=ac,dc=ma, with filter (uid=m_user) Sun Aug 2 14:37:09 2009 : Info: [ldap] looking for check items in directory... Sun Aug 2 14:37:09 2009 : Info: [ldap] looking for reply items in directory... Sun Aug 2 14:37:09 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Sun Aug 2 14:37:09 2009 : Info: [ldap] Setting Auth-Type = LDAP Sun Aug 2 14:37:09 2009 : Info: [ldap] user ytabaa authorized to use remote access Sun Aug 2 14:37:09 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Sun Aug 2 14:37:09 2009 : Info: ++[ldap] returns ok Sun Aug 2 14:37:09 2009 : Info: ++[expiration] returns noop Sun Aug 2 14:37:09 2009 : Info: ++[logintime] returns noop Sun Aug 2 14:37:09 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sun Aug 2 14:37:09 2009 : Info: ++[pap] returns noop Sun Aug 2 14:37:09 2009 : Info: Found Auth-Type = LDAP Sun Aug 2 14:37:09 2009 : Info: +- entering group LDAP {...} Sun Aug 2 14:37:09 2009 : Info: [ldap] login attempt by "ytabaa" with password "coucou" Sun Aug 2 14:37:09 2009 : Info: [ldap] user DN: uid=ytabaa,ou=People,dc=uae,dc=ac,dc=ma Sun Aug 2 14:37:09 2009 : Debug: rlm_ldap: (re)connect to ldap.uae.ac.ma:389, authentication 1 Sun Aug 2 14:37:09 2009 : Debug: rlm_ldap: bind as uid=ytabaa,ou=People,dc=uae,dc=ac,dc=ma/passwd to ldap.uae.ac.ma:389 ******************************************************************************************************************************************************** Does anyone know what's wrong in my configuration?Is it the expiration in the configuration file that I have to expand (what file?) to give a server a possibility to response? *thank u. -- * JJohnny R.* *National School of Applied Sciences*

3 7

Re: Freeradius-Users Digest, Vol 52, Issue 43
by Gilbert Lo 08 Aug '09

08 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

conditional variable assignment
by Marlon Duksa 07 Aug '09

07 Aug '09

Hi - if there any way to conditionally assign returned variables in users file? For example: DEFAULT User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$", Cleartext-Password := "csetestp" Alc-Subsc-ID-Str := "%{NAS-Port-Id}", Alc-Subsc-Prof-Str := "%{1}", Now I want to do this: if %{2} == 'value 1' then Framed-IP-Address := 21.0.0.2 if %{2} == 'value 2' then Framed-IP-Address := 31.0.0.2 after this conditional assignment, continue normally: Alc-SLA-Prof-Str := "%{2}", Alc-MSAP-Serv-Id := "100", Alc-MSAP-Policy := "msaps", Alc-Default-Router := 20.0.0.1, Framed-IP-Netmask := 255.255.0.0, Session-Timeout := 600, Fall-Through = Yes DEFAULT NAS-Port-Id =~ "^([^:]+):" Alc-MSAP-Interface := "port-%{1}" Thanks, Marlon

4 14

Re: Freeradius-Users Digest, Vol 52, Issue 37
by ramesh p 07 Aug '09

07 Aug '09

Hi Alan, [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 testing123 other Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "radtest" User-Password = "somepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1813 Framed-Protocol = PPP rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 Debug messages: rad_recv: Access-Request packet from host 127.0.0.1 port 36433, id=134, length=65 User-Name = "radtest" User-Password = "somepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1813 Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "radtest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> radtest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 134 to 127.0.0.1 port 36433 Waking up in 4.9 seconds. Cleaning up request 1 ID 134 with timestamp +3582 Ready to process requests. > > ------------------------------ > > Message: 2 > Date: Fri, 7 Aug 2009 11:22:58 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Freeradius2.1.6 installation problem > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090807102258.GC19103(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > hi, > > your debug showed no actual traffic or packets hitting the > freeradius server - so cannot help you. > > alan > > > ------------------------------ > > Message: 3 > Date: Fri, 7 Aug 2009 16:09:04 +0530 > From: ramesh p <rock786143(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <6b6aa6710908070339w57559054lfa1637cf39e51a48(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > *> Have you added 127.0.0.1 in the clients.conf? > > *yes. > > client localhost { > ipaddr = 127.0.0.1 > secret = testing123 > nastype = other > require_message_authenticator = no > } > > Thanks, > Rams. > > * > * > On Fri, Aug 7, 2009 at 3:30 PM, < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > > > > > Message: 2 > > Date: Fri, 7 Aug 2009 11:58:56 +0200 > > From: Rokkhan <rokkhan(a)gmail.com> > > Subject: Re: Freeradius2.1.6 installation problem > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: > > <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > > Content-Type: text/plain; charset=ISO-8859-1 > > > > *Have you added 127.0.0.1 in the clients.conf?* > > > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > > Unable to execute radtest. > > > > > > # radiusd -X > > > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > > 2009 > > > at 07:17:32 > > > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > > > PARTICULAR PURPOSE. > > > You may redistribute copies of FreeRADIUS under the terms of the > > > GNU General Public License v2. > > > Starting - reading configuration files ... > > > including configuration file /usr/local/fnmt/radius2//etc/ > > >> > > >> raddb/radiusd.conf > > >> including configuration file > > /usr/local/fnmt/radius2//etc/raddb/proxy.conf > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > > >> including files in directory > /usr/local/fnmt/radius2//etc/raddb/modules/ > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/always > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/files > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > > >> including configuration file > /usr/local/fnmt/radius2//etc/raddb/eap.conf > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > > >> including files in directory > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > > >> including configuration file > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > > >> including dictionary file > /usr/local/fnmt/radius2//etc/raddb/dictionary > > >> main { > > >> prefix = "/usr/local/fnmt/radius2/" > > >> localstatedir = "/usr/local/fnmt/radius2//var" > > >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > > >> libdir = "/usr/local/fnmt/radius2//lib" > > >> radacctdir = "/usr/local/fnmt/radius2//var/log/radius/radacct" > > >> hostname_lookups = no > > >> max_request_time = 30 > > >> cleanup_delay = 5 > > >> max_requests = 1024 > > >> allow_core_dumps = no > > >> pidfile = > "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > > >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > > >> debug_level = 0 > > >> proxy_requests = yes > > >> log { > > >> stripped_names = no > > >> auth = no > > >> auth_badpass = no > > >> auth_goodpass = no > > >> } > > >> security { > > >> max_attributes = 200 > > >> reject_delay = 1 > > >> status_server = yes > > >> } > > >> } > > >> } > > >> radiusd: #### Loading Realms and Home Servers #### > > >> proxy server { > > >> retry_delay = 5 > > >> retry_count = 3 > > >> default_fallback = no > > >> dead_time = 120 > > >> wake_all_if_all_dead = no > > >> } > > >> home_server localhost { > > >> ipaddr = 127.0.0.1 > > >> port = 1812 > > >> type = "auth" > > >> secret = "testing123" > > >> response_window = 20 > > >> max_outstanding = 65536 > > >> require_message_authenticator = no > > >> zombie_period = 40 > > >> status_check = "status-server" > > >> ping_interval = 30 > > >> check_interval = 30 > > >> num_answers_to_alive = 3 > > >> num_pings_to_alive = 3 > > >> revive_interval = 120 > > >> status_check_timeout = 4 > > >> irt = 2 > > >> mrt = 16 > > >> mrc = 5 > > >> mrd = 30 > > >> } > > >> home_server_pool my_auth_failover { > > >> type = fail-over > > >> home_server = localhost > > >> } > > >> realm example.com { > > >> auth_pool = my_auth_failover > > >> } > > >> realm LOCAL { > > >> } > > >> radiusd: #### Loading Clients #### > > >> client localhost { > > >> ipaddr = 127.0.0.1 > > >> require_message_authenticator = no > > >> secret = "testing123" > > >> nastype = "other" > > >> } > > >> client xx.xx.xx.xx { > > >> require_message_authenticator = no > > >> secret = "testing123" > > >> shortname = "rparsa" > > >> nastype = "other" > > >> login = "radtest" > > >> } > > >> radiusd: #### Instantiating modules #### > > >> instantiate { > > >> Module: Linked to module rlm_exec > > >> Module: Instantiating exec > > >> exec { > > >> wait = no > > >> input_pairs = "request" > > >> shell_escape = yes > > >> } > > >> Module: Linked to module rlm_expr > > >> Module: Instantiating expr > > >> Module: Linked to module rlm_expiration > > >> Module: Instantiating expiration > > >> expiration { > > >> reply-message = "Password Has Expired " > > >> } > > >> Module: Linked to module rlm_logintime > > >> Module: Instantiating logintime > > >> logintime { > > >> reply-message = "You are calling outside your allowed timespan > > " > > >> minimum-timeout = 60 > > >> } > > >> } > > >> radiusd: #### Loading Virtual Servers #### > > >> server inner-tunnel { > > >> modules { > > >> Module: Checking authenticate {...} for more modules to load > > >> Module: Linked to module rlm_pap > > >> Module: Instantiating pap > > >> pap { > > >> encryption_scheme = "auto" > > >> auto_header = no > > >> } > > >> Module: Linked to module rlm_chap > > >> Module: Instantiating chap > > >> Module: Linked to module rlm_mschap > > >> Module: Instantiating mschap > > >> mschap { > > >> use_mppe = yes > > >> require_encryption = no > > >> require_strong = no > > >> with_ntdomain_hack = no > > >> } > > >> Module: Linked to module rlm_unix > > >> Module: Instantiating unix > > >> unix { > > >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > > >> } > > >> Module: Linked to module rlm_eap > > >> Module: Instantiating eap > > >> eap { > > >> default_eap_type = "md5" > > >> timer_expire = 60 > > >> ignore_unknown_eap_types = no > > >> cisco_accounting_username_bug = no > > >> max_sessions = 2048 > > >> } > > >> Module: Linked to sub-module rlm_eap_md5 > > >> Module: Instantiating eap-md5 > > >> Module: Linked to sub-module rlm_eap_leap > > >> Module: Instantiating eap-leap > > >> Module: Linked to sub-module rlm_eap_gtc > > >> Module: Instantiating eap-gtc > > >> gtc { > > >> challenge = "Password: " > > >> auth_type = "PAP" > > >> } > > >> Module: Linked to sub-module rlm_eap_tls > > >> Module: Instantiating eap-tls > > >> tls { > > >> rsa_key_exchange = no > > >> dh_key_exchange = yes > > >> rsa_key_length = 512 > > >> dh_key_length = 512 > > >> verify_depth = 0 > > >> pem_file_type = yes > > >> private_key_file = > > >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > > >> certificate_file = > "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > > >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > > >> private_key_password = "whatever" > > >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > > >> random_file = > "/usr/local/fnmt/radius2//etc/raddb/certs/random" > > >> fragment_size = 1024 > > >> include_length = yes > > >> check_crl = no > > >> cipher_list = "DEFAULT" > > >> make_cert_command = > > >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > > >> cache { > > >> enable = no > > >> lifetime = 24 > > >> max_entries = 255 > > >> } > > >> } > > >> Module: Linked to sub-module rlm_eap_ttls > > >> Module: Instantiating eap-ttls > > >> ttls { > > >> default_eap_type = "md5" > > >> copy_request_to_tunnel = no > > >> use_tunneled_reply = no > > >> virtual_server = "inner-tunnel" > > >> include_length = yes > > >> } > > >> Module: Linked to sub-module rlm_eap_peap > > >> Module: Instantiating eap-peap > > >> peap { > > >> default_eap_type = "mschapv2" > > >> copy_request_to_tunnel = no > > >> use_tunneled_reply = no > > >> proxy_tunneled_request_as_eap = yes > > >> virtual_server = "inner-tunnel" > > >> } > > >> Module: Linked to sub-module rlm_eap_mschapv2 > > >> Module: Instantiating eap-mschapv2 > > >> mschapv2 { > > >> with_ntdomain_hack = no > > >> } > > >> Module: Checking authorize {...} for more modules to load > > >> Module: Linked to module rlm_preprocess > > >> Module: Instantiating preprocess > > >> preprocess { > > >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > > >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > > >> with_ascend_hack = no > > >> ascend_channels_per_line = 23 > > >> with_ntdomain_hack = no > > >> with_specialix_jetstream_hack = no > > >> with_cisco_vsa_hack = no > > >> with_alvarion_vsa_hack = no > > >> } > > >> Module: Checking preacct {...} for more modules to load > > >> Module: Linked to module rlm_acct_unique > > >> Module: Instantiating acct_unique > > >> acct_unique { > > >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > > >> Client-IP-Address, NAS-Port" > > >> } > > >> Module: Checking accounting {...} for more modules to load > > >> Module: Linked to module rlm_detail > > >> Module: Instantiating detail > > >> detail { > > >> detailfile = > > >> > > > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > >> header = "%t" > > >> detailperm = 384 > > >> dirperm = 493 > > >> locking = no > > >> log_packet_header = no > > >> } > > >> Module: Instantiating attr_filter.accounting_response > > >> attr_filter attr_filter.accounting_response { > > >> attrsfile = > > >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > > >> key = "%{User-Name}" > > >> } > > >> Module: Checking session {...} for more modules to load > > >> Module: Checking post-proxy {...} for more modules to load > > >> Module: Checking post-auth {...} for more modules to load > > >> } # modules > > >> } # server > > >> radiusd: #### Opening IP addresses and Ports #### > > >> listen { > > >> type = "auth" > > >> ipaddr = * > > >> port = 0 > > >> } > > >> listen { > > >> type = "acct" > > >> ipaddr = * > > >> port = 0 > > >> } > > >> listen { > > >> type = "control" > > >> listen { > > >> socket = > "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > > >> } > > >> } > > >> Listening on authentication address * port 1812 > > >> Listening on accounting address * port 1813 > > >> Listening on command file > > >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > > >> Listening on proxy address * port 1814 > > >> Ready to process requests. > > >> > > >> I'm able to send packets using NTRadping tool however the packets are > > >> rejected using radtest? > > >> Why? Anthing wrong in the configuration? > > >> > > >> Thanks, > > >> Rams. > > > > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > > > > > > ------------------------------ > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > End of Freeradius-Users Digest, Vol 52, Issue 36 > > ************************************************ > > >

3 2

Use LDAP-Groups for rejecting a user
by Anja Ruckdaeschel 07 Aug '09

07 Aug '09

Hello there! I´m using freeradius 2.1.6 and use a ldap-group to reject some users. The problem is, when the ldap-servers are not responding when doing the search for the ldap-dn or when doing the search for the dn in the group the files-Module returns ok because the user abc matches for the next entry. So a correct named bind is triggered and the user gets access-accept even though he´s in the reject-group. How can I get something like "[files] returns failed" in that case??? I´m doing the module loading for the groups in radiusd.conf: instantiate { ... ldagroups1 ldagroups2 } Here´s the users-File. I hope anyone can help ... DEFAULT Auth-Type :=REJECT, User-Name =~ "^(\.*)([a-zA-Z]{3})", ldapgroups1-Ldap-Group == 'cn =rejectgroup,ou=public,o=mycompany,c=de' DEFAULT Auth-Type :=REJECT, User-Name =~ "^(\.*)([a-zA-Z]{3})", ldapgroups2-Ldap-Group == 'cn =rejectgroup,ou=public,o=mycompany,c=de' ... DEFAULT User-Name =~ "^(\.*)([a-zA-Z]{3})", FreeRADIUS-Proxied-To !* 127.0.0.1, Auth-Type :=LDAP ... DEFAULT Auth-Type :=reject Thanks a lot Anja --------------------------------------------------------------------------------------------- Anja Ruckdäschel M.A.; Rechenzentrum der Universität Regensburg; Universitätsstr.31; 93 053 Regensburg Telefon: +49 941 943 4826 ---------------------------------------------------------------------------------------------

1 0