August 2009 - Freeradius-Users - lists.freeradius.org

rlm_eap Errors
by Rokkhan 07 Aug '09

07 Aug '09

Hello! I upgraded Freeradius to version 2.1.6. as suggested and now sometimes i get some diferent EAP errors. My eap.conf is configured like this: eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 # Cisco LEAP leap { } ## EAP-TLS # tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = secret private_key_file = ${certdir}/cert-srv.pem certificate_file = ${certdir}/cert-srv.pem # Trusted Root CA list CA_file = ${cadir}/cacert.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes virtual_server = "tunel.interior.peap" } mschapv2 { } } And the errors i get are: Fri Aug 7 13:27:19 2009 : Error: rlm_eap_mschapv2: Response is of incorrect length 16 Fri Aug 7 13:27:38 2009 : Error: rlm_eap_mschapv2: Response is of incorrect length 16 Fri Aug 7 13:27:44 2009 : Error: rlm_eap: No EAP session matching the State variable. Fri Aug 7 13:27:56 2009 : Error: rlm_eap_mschapv2: Response is of incorrect length 16 Fri Aug 7 13:28:14 2009 : Error: rlm_eap_mschapv2: Response is of incorrect length 16 Fri Aug 7 13:28:32 2009 : Error: rlm_eap_mschapv2: Response is of incorrect length 16 By the way when is recomendable to enable cache? Whi is the better configuration for PEAP? Thanks in advance

2 3

How to hide passwords in the log file?
by Rokkhan 07 Aug '09

07 Aug '09

Hi, Does anyone knows how to hide passwords in the log file? I have read some posts about this, but the solution was to edit source, something that I'm not able to do. I don´t know if the 2.1.6 version has been implemented any option to do this without edit source. This is my configuration in radiusd.conf log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } I have no problems when users are authenticated by PEAP, because the log file doesn´t shows the passwords, but now, i want to configure a virtual server to work like tacacs+ on a Cisco ASA Firewall. The firewall supports only radius protocol and it sends passwords in cleartext (PAP), so the passwords are shown on the log, something i would like to avoid. I know that i could set auth = no, and then no authentication will appear in the log, but i need to keep this information to see if a user has logged in correctly or not. Another way to solve this problem could be (i dont know if it will possible), don't log the auth messages from this virtual server and keeping the auth information of other virtual server like radiusd.conf configuration. Thanks in advance.

2 2

Using encrypted passwords from LDAP
by Steffen Langhammer 07 Aug '09

07 Aug '09

Dear all, first of all: The LDAP-Server doesn't contain a clear-text password. They are encrypted and this isn't allowed to change. The password field is "userPassword". I was testing my LDAP-Configuration in Freeradius with NTRadPing. If I make an authentication Request I get a response: Access_accept. I am happy that freeradius can speak to LDAP :-)) Now my problem is: The wireless client is configured to LEAP, I enter the same user and password as in NTRadPing Utility. But I don't get access. I don't understand what I have done wrong. Maybee the eap-module is not able to forward the bind to the LDAP-Server ? If i use LEAP and set the password_attribute to an cleartext field in ldap it works. I was setting as password_attribute the field to givenname and enter as passwort the givenname of user. If I use the LEAP mode on the client the login to WLAN works fine (by using cleartext) But I have to use the encrypted password in LDAP because of security reasons. What can I do ?

2 5

freeradius2.1.6 daemon start up problems
by ramesh p 07 Aug '09

07 Aug '09

Hi All, I'm trying start freeradius process like the following: /usr/local/fnmt/radius2/sbin/radiusd ps -eaf|grep radius root 14524 1 0 06:39 ? 00:00:00 radiusd Is this the correct way start it? Thanks, Rams.

2 1

Re: Freeradius2.1.6 installation problem
by ramesh p 07 Aug '09

07 Aug '09

When i execute as root user it's working.. [root@localhost bin]# radtest root xxxxxxx localhost 1813 testing123 other Sending Access-Request of id 26 to 127.0.0.1 port 1812 User-Name = "root" User-Password = "ast4roslab" NAS-IP-Address = 255.255.255.255 NAS-Port = 1813 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=26, length=32 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP On Fri, Aug 7, 2009 at 4:38 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 52, Issue 37 (Rokkhan) > 2. Re: Freeradius-Users Digest, Vol 52, Issue 38 (ramesh p) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 7 Aug 2009 13:02:52 +0200 > From: Rokkhan <rokkhan(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 37 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <335289090908070402g38118a0fm3c3e1df0be853984(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Could yo show us your sites-enabled/(server), who is listening on 1812 > port? > > No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > Failed to authenticate the user. > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > Hi Alan, > > [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 > testing123 > > other > > Sending Access-Request of id 134 to 127.0.0.1 port 1812 > > User-Name = "radtest" > > User-Password = "somepass" > > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1813 > > Framed-Protocol = PPP > > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, > length=20 > > > > > > Debug messages: > > > > rad_recv: Access-Request packet from host 127.0.0.1 port 36433, id=134, > > length=65 > > User-Name = "radtest" > > User-Password = "somepass" > > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1813 > > Framed-Protocol = PPP > > +- entering group authorize {...} > > ++[preprocess] returns ok > > ++[chap] returns noop > > ++[mschap] returns noop > > [suffix] No '@' in User-Name = "radtest", looking up realm NULL > > [suffix] No such realm "NULL" > > ++[suffix] returns noop > > [eap] No EAP-Message, not doing EAP > > ++[eap] returns noop > > ++[unix] returns notfound > > [files] users: Matched entry DEFAULT at line 172 > > ++[files] returns ok > > ++[expiration] returns noop > > ++[logintime] returns noop > > [pap] WARNING! No "known good" password found for the user. > Authentication > > may fail because of this. > > ++[pap] returns noop > > No authenticate method (Auth-Type) configuration found for the request: > > Rejecting the user > > Failed to authenticate the user. > > Using Post-Auth-Type Reject > > +- entering group REJECT {...} > > [attr_filter.access_reject] expand: %{User-Name} -> radtest > > attr_filter: Matched entry DEFAULT at line 11 > > ++[attr_filter.access_reject] returns updated > > Delaying reject of request 1 for 1 seconds > > Going to the next request > > Waking up in 0.9 seconds. > > Sending delayed reject for request 1 > > Sending Access-Reject of id 134 to 127.0.0.1 port 36433 > > Waking up in 4.9 seconds. > > Cleaning up request 1 ID 134 with timestamp +3582 > > Ready to process requests. > > > > > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Fri, 7 Aug 2009 11:22:58 +0100 > >> From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > >> Subject: Re: Freeradius2.1.6 installation problem > >> To: FreeRadius users mailing list > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: <20090807102258.GC19103(a)lboro.ac.uk> > >> Content-Type: text/plain; charset=us-ascii > >> > >> hi, > >> > >> your debug showed no actual traffic or packets hitting the > >> freeradius server - so cannot help you. > >> > >> alan > >> > >> > >> ------------------------------ > >> > >> Message: 3 > >> Date: Fri, 7 Aug 2009 16:09:04 +0530 > >> From: ramesh p <rock786143(a)gmail.com> > >> Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > >> To: freeradius-users(a)lists.freeradius.org > >> Message-ID: > >> <6b6aa6710908070339w57559054lfa1637cf39e51a48(a)mail.gmail.com> > >> Content-Type: text/plain; charset="iso-8859-1" > >> > >> *> Have you added 127.0.0.1 in the clients.conf? > >> > >> *yes. > >> > >> client localhost { > >> ipaddr = 127.0.0.1 > >> secret = testing123 > >> nastype = other > >> require_message_authenticator = no > >> } > >> > >> Thanks, > >> Rams. > >> > >> * > >> * > >> On Fri, Aug 7, 2009 at 3:30 PM, < > >> freeradius-users-request(a)lists.freeradius.org> wrote: > >> > >

1 0

Re: Freeradius-Users Digest, Vol 52, Issue 38
by ramesh p 07 Aug '09

07 Aug '09

>Could you show us, how you use radtest and if you get any error? [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 testing123 other Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "radtest" User-Password = "somepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1813 Framed-Protocol = PPP rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 On Fri, Aug 7, 2009 at 4:27 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 52, Issue 36 (Rokkhan) > 2. Re: Freeradius-Users Digest, Vol 52, Issue 37 (ramesh p) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 7 Aug 2009 12:49:01 +0200 > From: Rokkhan <rokkhan(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <335289090908070349y64d04f48ic5a987a28e978e35(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Could you show us, how you use radtest and if you get any error? > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > >> Have you added 127.0.0.1 in the clients.conf? > > > > yes. > > > > client localhost { > > ipaddr = 127.0.0.1 > > secret = testing123 > > nastype = other > > require_message_authenticator = no > > } > > > > Thanks, > > Rams. > > > > > > > > On Fri, Aug 7, 2009 at 3:30 PM, > > <freeradius-users-request(a)lists.freeradius.org> wrote: > >> > >> > >> Message: 2 > >> Date: Fri, 7 Aug 2009 11:58:56 +0200 > >> From: Rokkhan <rokkhan(a)gmail.com> > >> Subject: Re: Freeradius2.1.6 installation problem > >> To: FreeRadius users mailing list > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: > >> <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > >> Content-Type: text/plain; charset=ISO-8859-1 > >> > >> Have you added 127.0.0.1 in the clients.conf? > >> > >> 2009/8/7 ramesh p <rock786143(a)gmail.com>: > >> > Unable to execute radtest. > >> > > >> > # radiusd -X > >> > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > >> > 2009 > >> > at 07:17:32 > >> > Copyright (C) 1999-2009 The FreeRADIUS server project and > contributors. > >> > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > >> > PARTICULAR PURPOSE. > >> > You may redistribute copies of FreeRADIUS under the terms of the > >> > GNU General Public License v2. > >> > Starting - reading configuration files ... > >> > including configuration file /usr/local/fnmt/radius2//etc/ > >> >> > >> >> raddb/radiusd.conf > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/proxy.conf > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > >> >> including files in directory > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/ > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/always > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/files > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/eap.conf > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > >> >> including files in directory > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > >> >> including dictionary file > /usr/local/fnmt/radius2//etc/raddb/dictionary > >> >> main { > >> >> prefix = "/usr/local/fnmt/radius2/" > >> >> localstatedir = "/usr/local/fnmt/radius2//var" > >> >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > >> >> libdir = "/usr/local/fnmt/radius2//lib" > >> >> radacctdir = > "/usr/local/fnmt/radius2//var/log/radius/radacct" > >> >> hostname_lookups = no > >> >> max_request_time = 30 > >> >> cleanup_delay = 5 > >> >> max_requests = 1024 > >> >> allow_core_dumps = no > >> >> pidfile = > >> >> "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > >> >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > >> >> debug_level = 0 > >> >> proxy_requests = yes > >> >> log { > >> >> stripped_names = no > >> >> auth = no > >> >> auth_badpass = no > >> >> auth_goodpass = no > >> >> } > >> >> security { > >> >> max_attributes = 200 > >> >> reject_delay = 1 > >> >> status_server = yes > >> >> } > >> >> } > >> >> } > >> >> radiusd: #### Loading Realms and Home Servers #### > >> >> proxy server { > >> >> retry_delay = 5 > >> >> retry_count = 3 > >> >> default_fallback = no > >> >> dead_time = 120 > >> >> wake_all_if_all_dead = no > >> >> } > >> >> home_server localhost { > >> >> ipaddr = 127.0.0.1 > >> >> port = 1812 > >> >> type = "auth" > >> >> secret = "testing123" > >> >> response_window = 20 > >> >> max_outstanding = 65536 > >> >> require_message_authenticator = no > >> >> zombie_period = 40 > >> >> status_check = "status-server" > >> >> ping_interval = 30 > >> >> check_interval = 30 > >> >> num_answers_to_alive = 3 > >> >> num_pings_to_alive = 3 > >> >> revive_interval = 120 > >> >> status_check_timeout = 4 > >> >> irt = 2 > >> >> mrt = 16 > >> >> mrc = 5 > >> >> mrd = 30 > >> >> } > >> >> home_server_pool my_auth_failover { > >> >> type = fail-over > >> >> home_server = localhost > >> >> } > >> >> realm example.com { > >> >> auth_pool = my_auth_failover > >> >> } > >> >> realm LOCAL { > >> >> } > >> >> radiusd: #### Loading Clients #### > >> >> client localhost { > >> >> ipaddr = 127.0.0.1 > >> >> require_message_authenticator = no > >> >> secret = "testing123" > >> >> nastype = "other" > >> >> } > >> >> client xx.xx.xx.xx { > >> >> require_message_authenticator = no > >> >> secret = "testing123" > >> >> shortname = "rparsa" > >> >> nastype = "other" > >> >> login = "radtest" > >> >> } > >> >> radiusd: #### Instantiating modules #### > >> >> instantiate { > >> >> Module: Linked to module rlm_exec > >> >> Module: Instantiating exec > >> >> exec { > >> >> wait = no > >> >> input_pairs = "request" > >> >> shell_escape = yes > >> >> } > >> >> Module: Linked to module rlm_expr > >> >> Module: Instantiating expr > >> >> Module: Linked to module rlm_expiration > >> >> Module: Instantiating expiration > >> >> expiration { > >> >> reply-message = "Password Has Expired " > >> >> } > >> >> Module: Linked to module rlm_logintime > >> >> Module: Instantiating logintime > >> >> logintime { > >> >> reply-message = "You are calling outside your allowed > timespan > >> >> " > >> >> minimum-timeout = 60 > >> >> } > >> >> } > >> >> radiusd: #### Loading Virtual Servers #### > >> >> server inner-tunnel { > >> >> modules { > >> >> Module: Checking authenticate {...} for more modules to load > >> >> Module: Linked to module rlm_pap > >> >> Module: Instantiating pap > >> >> pap { > >> >> encryption_scheme = "auto" > >> >> auto_header = no > >> >> } > >> >> Module: Linked to module rlm_chap > >> >> Module: Instantiating chap > >> >> Module: Linked to module rlm_mschap > >> >> Module: Instantiating mschap > >> >> mschap { > >> >> use_mppe = yes > >> >> require_encryption = no > >> >> require_strong = no > >> >> with_ntdomain_hack = no > >> >> } > >> >> Module: Linked to module rlm_unix > >> >> Module: Instantiating unix > >> >> unix { > >> >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > >> >> } > >> >> Module: Linked to module rlm_eap > >> >> Module: Instantiating eap > >> >> eap { > >> >> default_eap_type = "md5" > >> >> timer_expire = 60 > >> >> ignore_unknown_eap_types = no > >> >> cisco_accounting_username_bug = no > >> >> max_sessions = 2048 > >> >> } > >> >> Module: Linked to sub-module rlm_eap_md5 > >> >> Module: Instantiating eap-md5 > >> >> Module: Linked to sub-module rlm_eap_leap > >> >> Module: Instantiating eap-leap > >> >> Module: Linked to sub-module rlm_eap_gtc > >> >> Module: Instantiating eap-gtc > >> >> gtc { > >> >> challenge = "Password: " > >> >> auth_type = "PAP" > >> >> } > >> >> Module: Linked to sub-module rlm_eap_tls > >> >> Module: Instantiating eap-tls > >> >> tls { > >> >> rsa_key_exchange = no > >> >> dh_key_exchange = yes > >> >> rsa_key_length = 512 > >> >> dh_key_length = 512 > >> >> verify_depth = 0 > >> >> pem_file_type = yes > >> >> private_key_file = > >> >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> >> certificate_file = > >> >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > >> >> private_key_password = "whatever" > >> >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > >> >> random_file = > "/usr/local/fnmt/radius2//etc/raddb/certs/random" > >> >> fragment_size = 1024 > >> >> include_length = yes > >> >> check_crl = no > >> >> cipher_list = "DEFAULT" > >> >> make_cert_command = > >> >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > >> >> cache { > >> >> enable = no > >> >> lifetime = 24 > >> >> max_entries = 255 > >> >> } > >> >> } > >> >> Module: Linked to sub-module rlm_eap_ttls > >> >> Module: Instantiating eap-ttls > >> >> ttls { > >> >> default_eap_type = "md5" > >> >> copy_request_to_tunnel = no > >> >> use_tunneled_reply = no > >> >> virtual_server = "inner-tunnel" > >> >> include_length = yes > >> >> } > >> >> Module: Linked to sub-module rlm_eap_peap > >> >> Module: Instantiating eap-peap > >> >> peap { > >> >> default_eap_type = "mschapv2" > >> >> copy_request_to_tunnel = no > >> >> use_tunneled_reply = no > >> >> proxy_tunneled_request_as_eap = yes > >> >> virtual_server = "inner-tunnel" > >> >> } > >> >> Module: Linked to sub-module rlm_eap_mschapv2 > >> >> Module: Instantiating eap-mschapv2 > >> >> mschapv2 { > >> >> with_ntdomain_hack = no > >> >> } > >> >> Module: Checking authorize {...} for more modules to load > >> >> Module: Linked to module rlm_preprocess > >> >> Module: Instantiating preprocess > >> >> preprocess { > >> >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > >> >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > >> >> with_ascend_hack = no > >> >> ascend_channels_per_line = 23 > >> >> with_ntdomain_hack = no > >> >> with_specialix_jetstream_hack = no > >> >> with_cisco_vsa_hack = no > >> >> with_alvarion_vsa_hack = no > >> >> } > >> >> Module: Checking preacct {...} for more modules to load > >> >> Module: Linked to module rlm_acct_unique > >> >> Module: Instantiating acct_unique > >> >> acct_unique { > >> >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > >> >> Client-IP-Address, NAS-Port" > >> >> } > >> >> Module: Checking accounting {...} for more modules to load > >> >> Module: Linked to module rlm_detail > >> >> Module: Instantiating detail > >> >> detail { > >> >> detailfile = > >> >> > >> >> > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > >> >> header = "%t" > >> >> detailperm = 384 > >> >> dirperm = 493 > >> >> locking = no > >> >> log_packet_header = no > >> >> } > >> >> Module: Instantiating attr_filter.accounting_response > >> >> attr_filter attr_filter.accounting_response { > >> >> attrsfile = > >> >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > >> >> key = "%{User-Name}" > >> >> } > >> >> Module: Checking session {...} for more modules to load > >> >> Module: Checking post-proxy {...} for more modules to load > >> >> Module: Checking post-auth {...} for more modules to load > >> >> } # modules > >> >> } # server > >> >> radiusd: #### Opening IP addresses and Ports #### > >> >> listen { > >> >> type = "auth" > >> >> ipaddr = * > >> >> port = 0 > >> >> } > >> >> listen { > >> >> type = "acct" > >> >> ipaddr = * > >> >> port = 0 > >> >> } > >> >> listen { > >> >> type = "control" > >> >> listen { > >> >> socket = > >> >> "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > >> >> } > >> >> } > >> >> Listening on authentication address * port 1812 > >> >> Listening on accounting address * port 1813 > >> >> Listening on command file > >> >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > >> >> Listening on proxy address * port 1814 > >> >> Ready to process requests. > >> >> > >> >> I'm able to send packets using NTRadping tool however the packets are > >> >> rejected using radtest? > >> >> Why? Anthing wrong in the configuration? > >> >> > >> >> Thanks, > >> >> Rams. > >> > > >> > - > >> > List info/subscribe/unsubscribe? See > >> > http://www.freeradius.org/list/users.html > >> > > >> > >> > >> ------------------------------ > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > >> > >> End of Freeradius-Users Digest, Vol 52, Issue 36 > >> ************************************************ > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 2 > Date: Fri, 7 Aug 2009 16:27:07 +0530 > From: ramesh p <rock786143(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 37 > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <6b6aa6710908070357k13c0f2dl58f859c9b547a67b(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Alan, > [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 testing123 > other > Sending Access-Request of id 134 to 127.0.0.1 port 1812 > User-Name = "radtest" > User-Password = "somepass" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1813 > Framed-Protocol = PPP > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 > > > Debug messages: > > rad_recv: Access-Request packet from host 127.0.0.1 port 36433, id=134, > length=65 > User-Name = "radtest" > User-Password = "somepass" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1813 > Framed-Protocol = PPP > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "radtest", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > [files] users: Matched entry DEFAULT at line 172 > ++[files] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > No authenticate method (Auth-Type) configuration found for the request: > Rejecting the user > Failed to authenticate the user. > Using Post-Auth-Type Reject > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> radtest > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 1 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 1 > Sending Access-Reject of id 134 to 127.0.0.1 port 36433 > Waking up in 4.9 seconds. > Cleaning up request 1 ID 134 with timestamp +3582 > Ready to process requests. > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Fri, 7 Aug 2009 11:22:58 +0100 > > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > > Subject: Re: Freeradius2.1.6 installation problem > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <20090807102258.GC19103(a)lboro.ac.uk> > > Content-Type: text/plain; charset=us-ascii > > > > hi, > > > > your debug showed no actual traffic or packets hitting the > > freeradius server - so cannot help you. > > > > alan > > > > > > ------------------------------ > > > > Message: 3 > > Date: Fri, 7 Aug 2009 16:09:04 +0530 > > From: ramesh p <rock786143(a)gmail.com> > > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > > To: freeradius-users(a)lists.freeradius.org > > Message-ID: > > <6b6aa6710908070339w57559054lfa1637cf39e51a48(a)mail.gmail.com> > > Content-Type: text/plain; charset="iso-8859-1" > > > > *> Have you added 127.0.0.1 in the clients.conf? > > > > *yes. > > > > client localhost { > > ipaddr = 127.0.0.1 > > secret = testing123 > > nastype = other > > require_message_authenticator = no > > } > > > > Thanks, > > Rams. > > > > * > > * > > On Fri, Aug 7, 2009 at 3:30 PM, < > > freeradius-users-request(a)lists.freeradius.org> wrote: > > > > > > > > > > > Message: 2 > > > Date: Fri, 7 Aug 2009 11:58:56 +0200 > > > From: Rokkhan <rokkhan(a)gmail.com> > > > Subject: Re: Freeradius2.1.6 installation problem > > > To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > > Message-ID: > > > <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > > > Content-Type: text/plain; charset=ISO-8859-1 > > > > > > *Have you added 127.0.0.1 in the clients.conf?* > > > > > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > > > Unable to execute radtest. > > > > > > > > # radiusd -X > > > > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > > > 2009 > > > > at 07:17:32 > > > > Copyright (C) 1999-2009 The FreeRADIUS server project and > contributors. > > > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > > > > PARTICULAR PURPOSE. > > > > You may redistribute copies of FreeRADIUS under the terms of the > > > > GNU General Public License v2. > > > > Starting - reading configuration files ... > > > > including configuration file /usr/local/fnmt/radius2//etc/ > > > >> > > > >> raddb/radiusd.conf > > > >> including configuration file > > > /usr/local/fnmt/radius2//etc/raddb/proxy.conf > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > > > >> including files in directory > > /usr/local/fnmt/radius2//etc/raddb/modules/ > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/always > > > >> including configuration file > > > >> > /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/files > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > > > >> including configuration file > > /usr/local/fnmt/radius2//etc/raddb/eap.conf > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > > > >> including files in directory > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > > > >> including dictionary file > > /usr/local/fnmt/radius2//etc/raddb/dictionary > > > >> main { > > > >> prefix = "/usr/local/fnmt/radius2/" > > > >> localstatedir = "/usr/local/fnmt/radius2//var" > > > >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > > > >> libdir = "/usr/local/fnmt/radius2//lib" > > > >> radacctdir = > "/usr/local/fnmt/radius2//var/log/radius/radacct" > > > >> hostname_lookups = no > > > >> max_request_time = 30 > > > >> cleanup_delay = 5 > > > >> max_requests = 1024 > > > >> allow_core_dumps = no > > > >> pidfile = > > "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > > > >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > > > >> debug_level = 0 > > > >> proxy_requests = yes > > > >> log { > > > >> stripped_names = no > > > >> auth = no > > > >> auth_badpass = no > > > >> auth_goodpass = no > > > >> } > > > >> security { > > > >> max_attributes = 200 > > > >> reject_delay = 1 > > > >> status_server = yes > > > >> } > > > >> } > > > >> } > > > >> radiusd: #### Loading Realms and Home Servers #### > > > >> proxy server { > > > >> retry_delay = 5 > > > >> retry_count = 3 > > > >> default_fallback = no > > > >> dead_time = 120 > > > >> wake_all_if_all_dead = no > > > >> } > > > >> home_server localhost { > > > >> ipaddr = 127.0.0.1 > > > >> port = 1812 > > > >> type = "auth" > > > >> secret = "testing123" > > > >> response_window = 20 > > > >> max_outstanding = 65536 > > > >> require_message_authenticator = no > > > >> zombie_period = 40 > > > >> status_check = "status-server" > > > >> ping_interval = 30 > > > >> check_interval = 30 > > > >> num_answers_to_alive = 3 > > > >> num_pings_to_alive = 3 > > > >> revive_interval = 120 > > > >> status_check_timeout = 4 > > > >> irt = 2 > > > >> mrt = 16 > > > >> mrc = 5 > > > >> mrd = 30 > > > >> } > > > >> home_server_pool my_auth_failover { > > > >> type = fail-over > > > >> home_server = localhost > > > >> } > > > >> realm example.com { > > > >> auth_pool = my_auth_failover > > > >> } > > > >> realm LOCAL { > > > >> } > > > >> radiusd: #### Loading Clients #### > > > >> client localhost { > > > >> ipaddr = 127.0.0.1 > > > >> require_message_authenticator = no > > > >> secret = "testing123" > > > >> nastype = "other" > > > >> } > > > >> client xx.xx.xx.xx { > > > >> require_message_authenticator = no > > > >> secret = "testing123" > > > >> shortname = "rparsa" > > > >> nastype = "other" > > > >> login = "radtest" > > > >> } > > > >> radiusd: #### Instantiating modules #### > > > >> instantiate { > > > >> Module: Linked to module rlm_exec > > > >> Module: Instantiating exec > > > >> exec { > > > >> wait = no > > > >> input_pairs = "request" > > > >> shell_escape = yes > > > >> } > > > >> Module: Linked to module rlm_expr > > > >> Module: Instantiating expr > > > >> Module: Linked to module rlm_expiration > > > >> Module: Instantiating expiration > > > >> expiration { > > > >> reply-message = "Password Has Expired " > > > >> } > > > >> Module: Linked to module rlm_logintime > > > >> Module: Instantiating logintime > > > >> logintime { > > > >> reply-message = "You are calling outside your allowed > timespan > > > " > > > >> minimum-timeout = 60 > > > >> } > > > >> } > > > >> radiusd: #### Loading Virtual Servers #### > > > >> server inner-tunnel { > > > >> modules { > > > >> Module: Checking authenticate {...} for more modules to load > > > >> Module: Linked to module rlm_pap > > > >> Module: Instantiating pap > > > >> pap { > > > >> encryption_scheme = "auto" > > > >> auto_header = no > > > >> } > > > >> Module: Linked to module rlm_chap > > > >> Module: Instantiating chap > > > >> Module: Linked to module rlm_mschap > > > >> Module: Instantiating mschap > > > >> mschap { > > > >> use_mppe = yes > > > >> require_encryption = no > > > >> require_strong = no > > > >> with_ntdomain_hack = no > > > >> } > > > >> Module: Linked to module rlm_unix > > > >> Module: Instantiating unix > > > >> unix { > > > >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > > > >> } > > > >> Module: Linked to module rlm_eap > > > >> Module: Instantiating eap > > > >> eap { > > > >> default_eap_type = "md5" > > > >> timer_expire = 60 > > > >> ignore_unknown_eap_types = no > > > >> cisco_accounting_username_bug = no > > > >> max_sessions = 2048 > > > >> } > > > >> Module: Linked to sub-module rlm_eap_md5 > > > >> Module: Instantiating eap-md5 > > > >> Module: Linked to sub-module rlm_eap_leap > > > >> Module: Instantiating eap-leap > > > >> Module: Linked to sub-module rlm_eap_gtc > > > >> Module: Instantiating eap-gtc > > > >> gtc { > > > >> challenge = "Password: " > > > >> auth_type = "PAP" > > > >> } > > > >> Module: Linked to sub-module rlm_eap_tls > > > >> Module: Instantiating eap-tls > > > >> tls { > > > >> rsa_key_exchange = no > > > >> dh_key_exchange = yes > > > >> rsa_key_length = 512 > > > >> dh_key_length = 512 > > > >> verify_depth = 0 > > > >> pem_file_type = yes > > > >> private_key_file = > > > >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > > > >> certificate_file = > > "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > > > >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > > > >> private_key_password = "whatever" > > > >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > > > >> random_file = > > "/usr/local/fnmt/radius2//etc/raddb/certs/random" > > > >> fragment_size = 1024 > > > >> include_length = yes > > > >> check_crl = no > > > >> cipher_list = "DEFAULT" > > > >> make_cert_command = > > > >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > > > >> cache { > > > >> enable = no > > > >> lifetime = 24 > > > >> max_entries = 255 > > > >> } > > > >> } > > > >> Module: Linked to sub-module rlm_eap_ttls > > > >> Module: Instantiating eap-ttls > > > >> ttls { > > > >> default_eap_type = "md5" > > > >> copy_request_to_tunnel = no > > > >> use_tunneled_reply = no > > > >> virtual_server = "inner-tunnel" > > > >> include_length = yes > > > >> } > > > >> Module: Linked to sub-module rlm_eap_peap > > > >> Module: Instantiating eap-peap > > > >> peap { > > > >> default_eap_type = "mschapv2" > > > >> copy_request_to_tunnel = no > > > >> use_tunneled_reply = no > > > >> proxy_tunneled_request_as_eap = yes > > > >> virtual_server = "inner-tunnel" > > > >> } > > > >> Module: Linked to sub-module rlm_eap_mschapv2 > > > >> Module: Instantiating eap-mschapv2 > > > >> mschapv2 { > > > >> with_ntdomain_hack = no > > > >> } > > > >> Module: Checking authorize {...} for more modules to load > > > >> Module: Linked to module rlm_preprocess > > > >> Module: Instantiating preprocess > > > >> preprocess { > > > >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > > > >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > > > >> with_ascend_hack = no > > > >> ascend_channels_per_line = 23 > > > >> with_ntdomain_hack = no > > > >> with_specialix_jetstream_hack = no > > > >> with_cisco_vsa_hack = no > > > >> with_alvarion_vsa_hack = no > > > >> } > > > >> Module: Checking preacct {...} for more modules to load > > > >> Module: Linked to module rlm_acct_unique > > > >> Module: Instantiating acct_unique > > > >> acct_unique { > > > >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > > > >> Client-IP-Address, NAS-Port" > > > >> } > > > >> Module: Checking accounting {...} for more modules to load > > > >> Module: Linked to module rlm_detail > > > >> Module: Instantiating detail > > > >> detail { > > > >> detailfile = > > > >> > > > > > > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > > >> header = "%t" > > > >> detailperm = 384 > > > >> dirperm = 493 > > > >> locking = no > > > >> log_packet_header = no > > > >> } > > > >> Module: Instantiating attr_filter.accounting_response > > > >> attr_filter attr_filter.accounting_response { > > > >> attrsfile = > > > >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > > > >> key = "%{User-Name}" > > > >> } > > > >> Module: Checking session {...} for more modules to load > > > >> Module: Checking post-proxy {...} for more modules to load > > > >> Module: Checking post-auth {...} for more modules to load > > > >> } # modules > > > >> } # server > > > >> radiusd: #### Opening IP addresses and Ports #### > > > >> listen { > > > >> type = "auth" > > > >> ipaddr = * > > > >> port = 0 > > > >> } > > > >> listen { > > > >> type = "acct" > > > >> ipaddr = * > > > >> port = 0 > > > >> } > > > >> listen { > > > >> type = "control" > > > >> listen { > > > >> socket = > > "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > > > >> } > > > >> } > > > >> Listening on authentication address * port 1812 > > > >> Listening on accounting address * port 1813 > > > >> Listening on command file > > > >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > > > >> Listening on proxy address * port 1814 > > > >> Ready to process requests. > > > >> > > > >> I'm able to send packets using NTRadping tool however the packets > are > > > >> rejected using radtest? > > > >> Why? Anthing wrong in the configuration? > > > >> > > > >> Thanks, > > > >> Rams. > > > > > > > > - > > > > List info/subscribe/unsubscribe? See > > > > http://www.freeradius.org/list/users.html > > > > > > > > > > > > > ------------------------------ > > > > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > > > > > > End of Freeradius-Users Digest, Vol 52, Issue 36 > > > ************************************************ > > > > >

1 0

Re: Freeradius-Users Digest, Vol 52, Issue 36
by ramesh p 07 Aug '09

07 Aug '09

*> Have you added 127.0.0.1 in the clients.conf? *yes. client localhost { ipaddr = 127.0.0.1 secret = testing123 nastype = other require_message_authenticator = no } Thanks, Rams. * * On Fri, Aug 7, 2009 at 3:30 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > > > Message: 2 > Date: Fri, 7 Aug 2009 11:58:56 +0200 > From: Rokkhan <rokkhan(a)gmail.com> > Subject: Re: Freeradius2.1.6 installation problem > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > *Have you added 127.0.0.1 in the clients.conf?* > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > Unable to execute radtest. > > > > # radiusd -X > > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > 2009 > > at 07:17:32 > > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > > PARTICULAR PURPOSE. > > You may redistribute copies of FreeRADIUS under the terms of the > > GNU General Public License v2. > > Starting - reading configuration files ... > > including configuration file /usr/local/fnmt/radius2//etc/ > >> > >> raddb/radiusd.conf > >> including configuration file > /usr/local/fnmt/radius2//etc/raddb/proxy.conf > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > >> including files in directory /usr/local/fnmt/radius2//etc/raddb/modules/ > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/always > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/files > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > >> including configuration file /usr/local/fnmt/radius2//etc/raddb/eap.conf > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > >> including files in directory > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > >> including dictionary file /usr/local/fnmt/radius2//etc/raddb/dictionary > >> main { > >> prefix = "/usr/local/fnmt/radius2/" > >> localstatedir = "/usr/local/fnmt/radius2//var" > >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > >> libdir = "/usr/local/fnmt/radius2//lib" > >> radacctdir = "/usr/local/fnmt/radius2//var/log/radius/radacct" > >> hostname_lookups = no > >> max_request_time = 30 > >> cleanup_delay = 5 > >> max_requests = 1024 > >> allow_core_dumps = no > >> pidfile = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > >> debug_level = 0 > >> proxy_requests = yes > >> log { > >> stripped_names = no > >> auth = no > >> auth_badpass = no > >> auth_goodpass = no > >> } > >> security { > >> max_attributes = 200 > >> reject_delay = 1 > >> status_server = yes > >> } > >> } > >> } > >> radiusd: #### Loading Realms and Home Servers #### > >> proxy server { > >> retry_delay = 5 > >> retry_count = 3 > >> default_fallback = no > >> dead_time = 120 > >> wake_all_if_all_dead = no > >> } > >> home_server localhost { > >> ipaddr = 127.0.0.1 > >> port = 1812 > >> type = "auth" > >> secret = "testing123" > >> response_window = 20 > >> max_outstanding = 65536 > >> require_message_authenticator = no > >> zombie_period = 40 > >> status_check = "status-server" > >> ping_interval = 30 > >> check_interval = 30 > >> num_answers_to_alive = 3 > >> num_pings_to_alive = 3 > >> revive_interval = 120 > >> status_check_timeout = 4 > >> irt = 2 > >> mrt = 16 > >> mrc = 5 > >> mrd = 30 > >> } > >> home_server_pool my_auth_failover { > >> type = fail-over > >> home_server = localhost > >> } > >> realm example.com { > >> auth_pool = my_auth_failover > >> } > >> realm LOCAL { > >> } > >> radiusd: #### Loading Clients #### > >> client localhost { > >> ipaddr = 127.0.0.1 > >> require_message_authenticator = no > >> secret = "testing123" > >> nastype = "other" > >> } > >> client xx.xx.xx.xx { > >> require_message_authenticator = no > >> secret = "testing123" > >> shortname = "rparsa" > >> nastype = "other" > >> login = "radtest" > >> } > >> radiusd: #### Instantiating modules #### > >> instantiate { > >> Module: Linked to module rlm_exec > >> Module: Instantiating exec > >> exec { > >> wait = no > >> input_pairs = "request" > >> shell_escape = yes > >> } > >> Module: Linked to module rlm_expr > >> Module: Instantiating expr > >> Module: Linked to module rlm_expiration > >> Module: Instantiating expiration > >> expiration { > >> reply-message = "Password Has Expired " > >> } > >> Module: Linked to module rlm_logintime > >> Module: Instantiating logintime > >> logintime { > >> reply-message = "You are calling outside your allowed timespan > " > >> minimum-timeout = 60 > >> } > >> } > >> radiusd: #### Loading Virtual Servers #### > >> server inner-tunnel { > >> modules { > >> Module: Checking authenticate {...} for more modules to load > >> Module: Linked to module rlm_pap > >> Module: Instantiating pap > >> pap { > >> encryption_scheme = "auto" > >> auto_header = no > >> } > >> Module: Linked to module rlm_chap > >> Module: Instantiating chap > >> Module: Linked to module rlm_mschap > >> Module: Instantiating mschap > >> mschap { > >> use_mppe = yes > >> require_encryption = no > >> require_strong = no > >> with_ntdomain_hack = no > >> } > >> Module: Linked to module rlm_unix > >> Module: Instantiating unix > >> unix { > >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > >> } > >> Module: Linked to module rlm_eap > >> Module: Instantiating eap > >> eap { > >> default_eap_type = "md5" > >> timer_expire = 60 > >> ignore_unknown_eap_types = no > >> cisco_accounting_username_bug = no > >> max_sessions = 2048 > >> } > >> Module: Linked to sub-module rlm_eap_md5 > >> Module: Instantiating eap-md5 > >> Module: Linked to sub-module rlm_eap_leap > >> Module: Instantiating eap-leap > >> Module: Linked to sub-module rlm_eap_gtc > >> Module: Instantiating eap-gtc > >> gtc { > >> challenge = "Password: " > >> auth_type = "PAP" > >> } > >> Module: Linked to sub-module rlm_eap_tls > >> Module: Instantiating eap-tls > >> tls { > >> rsa_key_exchange = no > >> dh_key_exchange = yes > >> rsa_key_length = 512 > >> dh_key_length = 512 > >> verify_depth = 0 > >> pem_file_type = yes > >> private_key_file = > >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> certificate_file = "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > >> private_key_password = "whatever" > >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > >> random_file = "/usr/local/fnmt/radius2//etc/raddb/certs/random" > >> fragment_size = 1024 > >> include_length = yes > >> check_crl = no > >> cipher_list = "DEFAULT" > >> make_cert_command = > >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > >> cache { > >> enable = no > >> lifetime = 24 > >> max_entries = 255 > >> } > >> } > >> Module: Linked to sub-module rlm_eap_ttls > >> Module: Instantiating eap-ttls > >> ttls { > >> default_eap_type = "md5" > >> copy_request_to_tunnel = no > >> use_tunneled_reply = no > >> virtual_server = "inner-tunnel" > >> include_length = yes > >> } > >> Module: Linked to sub-module rlm_eap_peap > >> Module: Instantiating eap-peap > >> peap { > >> default_eap_type = "mschapv2" > >> copy_request_to_tunnel = no > >> use_tunneled_reply = no > >> proxy_tunneled_request_as_eap = yes > >> virtual_server = "inner-tunnel" > >> } > >> Module: Linked to sub-module rlm_eap_mschapv2 > >> Module: Instantiating eap-mschapv2 > >> mschapv2 { > >> with_ntdomain_hack = no > >> } > >> Module: Checking authorize {...} for more modules to load > >> Module: Linked to module rlm_preprocess > >> Module: Instantiating preprocess > >> preprocess { > >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > >> with_ascend_hack = no > >> ascend_channels_per_line = 23 > >> with_ntdomain_hack = no > >> with_specialix_jetstream_hack = no > >> with_cisco_vsa_hack = no > >> with_alvarion_vsa_hack = no > >> } > >> Module: Checking preacct {...} for more modules to load > >> Module: Linked to module rlm_acct_unique > >> Module: Instantiating acct_unique > >> acct_unique { > >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > >> Client-IP-Address, NAS-Port" > >> } > >> Module: Checking accounting {...} for more modules to load > >> Module: Linked to module rlm_detail > >> Module: Instantiating detail > >> detail { > >> detailfile = > >> > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > >> header = "%t" > >> detailperm = 384 > >> dirperm = 493 > >> locking = no > >> log_packet_header = no > >> } > >> Module: Instantiating attr_filter.accounting_response > >> attr_filter attr_filter.accounting_response { > >> attrsfile = > >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > >> key = "%{User-Name}" > >> } > >> Module: Checking session {...} for more modules to load > >> Module: Checking post-proxy {...} for more modules to load > >> Module: Checking post-auth {...} for more modules to load > >> } # modules > >> } # server > >> radiusd: #### Opening IP addresses and Ports #### > >> listen { > >> type = "auth" > >> ipaddr = * > >> port = 0 > >> } > >> listen { > >> type = "acct" > >> ipaddr = * > >> port = 0 > >> } > >> listen { > >> type = "control" > >> listen { > >> socket = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > >> } > >> } > >> Listening on authentication address * port 1812 > >> Listening on accounting address * port 1813 > >> Listening on command file > >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > >> Listening on proxy address * port 1814 > >> Ready to process requests. > >> > >> I'm able to send packets using NTRadping tool however the packets are > >> rejected using radtest? > >> Why? Anthing wrong in the configuration? > >> > >> Thanks, > >> Rams. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 52, Issue 36 > ************************************************ >

2 1

Freeradius2.1.6 installation problem
by ramesh p 07 Aug '09

07 Aug '09

Unable to execute radtest. # radiusd -X FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 2009 at 07:17:32 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/fnmt/radius2//etc/ > > raddb/radiusd.conf > including configuration file /usr/local/fnmt/radius2//etc/raddb/proxy.conf > including configuration file > /usr/local/fnmt/radius2//etc/raddb/clients.conf > including files in directory /usr/local/fnmt/radius2//etc/raddb/modules/ > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/ldap > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/pap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/exec > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/expr > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/always > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/ > detail.example.com > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/unix > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/chap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/expiration > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/pam > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/wimax > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/logintime > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/realm > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/linelog > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/otp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/checkval > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/mschap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/counter > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/detail > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/digest > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/passwd > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/files > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/policy > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/perl > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/ippool > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/echo > including configuration file /usr/local/fnmt/radius2//etc/raddb/eap.conf > including configuration file /usr/local/fnmt/radius2//etc/raddb/policy.conf > including files in directory > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > including configuration file > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > including configuration file > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > including configuration file > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > including dictionary file /usr/local/fnmt/radius2//etc/raddb/dictionary > main { > prefix = "/usr/local/fnmt/radius2/" > localstatedir = "/usr/local/fnmt/radius2//var" > logdir = "/usr/local/fnmt/radius2//var/log/radius" > libdir = "/usr/local/fnmt/radius2//lib" > radacctdir = "/usr/local/fnmt/radius2//var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > allow_core_dumps = no > pidfile = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client xx.xx.xx.xx { > require_message_authenticator = no > secret = "testing123" > shortname = "rparsa" > nastype = "other" > login = "radtest" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = > "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > certificate_file = "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > random_file = "/usr/local/fnmt/radius2//etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = > "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating preprocess > preprocess { > huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating detail > detail { > detailfile = > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Instantiating attr_filter.accounting_response > attr_filter attr_filter.accounting_response { > attrsfile = > "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > } > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file > /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > Listening on proxy address * port 1814 > Ready to process requests. > > I'm able to send packets using NTRadping tool however the packets are > rejected using radtest? > Why? Anthing wrong in the configuration? > > Thanks, > Rams.

3 2

regex not evaluated?
by Marlon Duksa 07 Aug '09

07 Aug '09

Hi - does anyone know why this does not work: basic-TP User-Password == "csetestp" User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$", Alc-Subsc-ID-Str := "%{NAS-Port-Id}", Alc-Subsc-Prof-Str := "%{1}", Alc-SLA-Prof-Str := "%{2}", Alc-MSAP-Serv-Id := "100", Alc-MSAP-Policy := "msaps", Alc-Default-Router := 20.0.0.1, Framed-IP-Address := 20.0.0.2, Framed-IP-Netmask := 255.255.0.0, Session-Timeout := 600, Fall-Through = Yes DEFAULT NAS-Port-Id =~ "^([^:]+):" Alc-MSAP-Interface := "port-%{1}" The request qoes through all lines but the Alc-Subsc-Prof-Str and Alc-Subsc-SLA-Str are empty. Obviously, the User-Name matches the regexpr, therefore, those two string should have returned values of %{1} and %{2}. This is the request: rad_recv: Access-Request packet from host 114.0.1.1:51080, id=29, length=90 User-Name = "basic-TP" User-Password = "csetestp" NAS-IP-Address = 1.1.1.1 DSL-Circuit-ID = "basic-TP" DSL-Remote-ID = "-0" NAS-Port-Type = Ethernet NAS-Port-Id = "1/1/1:10" This is what is returned: Sending Access-Accept of id 29 to 114.0.1.1 port 51080 User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$" Alc-Subsc-ID-Str := "1/1/1:10" Alc-Subsc-Prof-Str := "" Alc-SLA-Prof-Str := "" Alc-MSAP-Serv-Id := 100 Alc-MSAP-Policy := "msaps" Alc-Default-Router := 20.0.0.1 Framed-IP-Address := 20.0.0.2 Framed-IP-Netmask := 255.255.0.0 Session-Timeout := 600 Alc-MSAP-Interface := "port-1/1/1" Thanks, Marlon.

3 2

rlm_sql module won't compile under Solaris 10
by shivashankar 07 Aug '09

07 Aug '09

hi, i am using Freeradius 2.1.6. gcc -shared -Wl,-h -Wl,rlm_sql_mysql-2.1.6.so -o .libs/rlm_sql_mysql-2.1.6.so .libs/sql_mysql.o -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread -lc -m64 ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32 ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-2.1.6.so collect2: ld returned 1 exit status gmake[10]: *** [rlm_sql_mysql.la] Error 1 gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2:,( -- View this message in context: http://www.nabble.com/rlm_sql-module-won%27t-compile-under-Solaris-10-tp248… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1