January 2010 - Freeradius-Users - lists.freeradius.org

Authentication Failed
by Devinder Singh 20 Jan '10

20 Jan '10

Hi Ivan, I created the certificates basd on the README file in etc/raddb and copied ca.der and client.p12 to Windows XP I also also made changed to the Makefile which runs on XP but when i connect to the SSID i get authentication failde and the radius does not seem to get any response from the Proxim AP. -- Devinder

1 6

Defining Reply-Message for Access-Reject Packets
by Luiz Gustavo de Villa Scandelari 20 Jan '10

20 Jan '10

Hi, I have a Freeradius server v2.1.7 with mysql 5 in CentOs 5.3. The two situations I need to define reply messages are: 1) Username correct but wrong password; 2) Username and password wrong or just Username wrong; Thanks to Arran Cudbard-Bell and EasyHorpak.com, I was able to solve the first situation, but I have no ideas how to solve the second situation, because the rlm_sql module returns notfound ("User not found") and chap returns invalid causing a Access-Reject packet. Please can anyone give me an idea of how to solve that? Should I write some unlang at the sql or at the authorize section? Other point I need some help is about changing the dailycounter reply-message ("Your maximum daily usage time has been reached "). I don´t have also any idea howto do that. I´ve read in some emails that I should change the source code in order to get it working, is that right? Hope to receive some answer. Thanks, LUIZ GUSTAVO DE VILLA SCANDELARI Skype: luiz.gustavo.wni

2 1

How to set default ENVIRONMENT for programs runned from cron?
by Коньков Евгений 20 Jan '10

20 Jan '10

Hi If program runned from cron run another process like: curl or wget or anithign else located at PATH it says: can not find curl etc. NOTICE: when programm is runned from cron there is no PATH environment variable Does any know how to pass environment for programs runned from cron? -- mailto:kes-kes@yandex.ru

2 1

EAP-FAST
by Stefan Winter 20 Jan '10

20 Jan '10

Hello, every now and then there's a mild interest on this list about enabling EAP-FAST. In our eduroam R&D group, we are currently looking into EAP-FAST, which naturally includes FreeRADIUS support. Is it worthwhile posting our results here, for others "play with it" as well? Or has everybody already run away from the somwhat complicated installation of EAP-FAST support in FreeRADIUS [we certainly had our difficulties...] Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 4

samba domain as realm
by Christophe Deze 20 Jan '10

20 Jan '10

hello is it possible to use samba(+ldap) domain name as realm ? i want that if on a XP laptop plug on my NAS (switch) DOMAIN1\username log on , the ldap+radius is authentificate on DOMAIN1 ldap server DOMAIN2\username log on , the ldap+radius is authentificate on DOMAIN2 ldap server the username can be identical but the ldap domain differente my problem is that if the username exists in the DOMAIN1 ldap server, DOMAIN2\username will never get his good VLAN-id (from users file), freeradius give him DOMAIN1\username vlan-id... i 've try ntdomain realm but it doesn't work any tutorial ? thanks

1 0

No "known good" in ldap authorizes?
by freeradius＠corwyn.net 20 Jan '10

20 Jan '10

I've got something odd happening. I'm using freeradius and it's ldap module to authenticate/ authorize users for a l2tp vpn connection. Works (mostly) fine, except for some odd timeout issues I'll cover elsewhere (see following post re: LDAP timeouts). Valid users with valid passwords connect, other combinations don't (valid user,. invalid password, invalid user with invalid password,etc.) But i see this in the log when running with radiusd -X: [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user test_user authorized to use remote access ? Rick

2 2

Values not being returned as expected
by Steven Carr 20 Jan '10

20 Jan '10

Hi list, We are running FreeRADIUS 2.16 (sparc-sun-solaris2.10) and we are are seing some unexpected results, the following is snippets of configuration followed by debug output... # entry in huntgroups > dot1x-allowed NAS-IP-Address == 192.168.0.1 # only entries in users file... > DEFAULT Service-Type == Framed-User, Huntgroup-Name == "dot1x-allowed" > Service-Type = Framed-User, > Tunnel-Type = "VLAN", > Tunnel-Medium-Type = "IEEE-802", > Fall-Through = Yes > > DEFAULT Ldap-Group == "somegroup" > Reply-Message = "Welcome, you are in the somegroup group" # radiusd -X debug... > Login OK: [username] (from client 192.168.0.1 port 50122 cli 00-24-21-9A-C6-68) > +- entering group post-auth {...} > ++[exec] returns noop > ++? if ((Huntgroup-Name == "dot1x-allowed") && (Service-Type == Framed-User)) > ?? Evaluating (Huntgroup-Name == "dot1x-allowed") -> TRUE > ?? Evaluating (Service-Type == Framed-User) -> TRUE > ++? if ((Huntgroup-Name == "dot1x-allowed") && (Service-Type == Framed-User)) -> TRUE > ++- entering if ((Huntgroup-Name == "dot1x-allowed") && (Service-Type == Framed-User)) {...} > +++? if ((!reply:Tmp-String-0) || (reply:Tmp-String-0 == "")) > ?? Evaluating !(reply:Tmp-String-0) -> FALSE > ?? Evaluating (reply:Tmp-String-0 == "") -> FALSE > +++? if ((!reply:Tmp-String-0) || (reply:Tmp-String-0 == "")) -> FALSE > +++- entering else else {...} > expand: %{reply:Tmp-String-0} -> admin > ++++[reply] returns noop > +++- else else returns noop > ++- if ((Huntgroup-Name == "dot1x-allowed") && (Service-Type == Framed-User)) returns noop > Sending Access-Accept of id 207 to 192.168.0.1 port 1645 > Reply-Message = "Welcome, you are in the group" > User-Name = "username" > MS-MPPE-Recv-Key = 0xb46d59aaee8c0eb2a1920ae89f45a117335310a4de90c3ae2c9865293033491f > MS-MPPE-Send-Key = 0xeb4263c8dc5e281bac5fbc263761a78cf69254c11c3e9f139b98f3a04c38d7ec > EAP-Message = 0x03490004 > Message-Authenticator = 0x00000000000000000000000000000000 > Tunnel-Private-Group-Id:0 = "admin" > Finished request 9. > Going to the next request The question is... why am I not getting the Service-Type, Tunnel-Type and Tunnel-Medium-Type values being sent back in the access accept packet? If you need any further debug/info let me know. Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953

1 0

Can't Assign IP address my users
by Tevfik Ceydeliler 20 Jan '10

20 Jan '10

Hi, My problem is, If I try to assign a static I address to my user, I got error. I have Secovid OTP server as realm. And my all users use token to create password. In test case, when I try to connect to my radius server via gprs I see some error: ... .... Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' ... ... I did not edit DEFAULTS. My users settings is here: tevfikceydeliler Packet-Type == Access-Request , Proxy-To-Realm := 10.1.1.51, Framed-IP-Address := 172.30.64.120 , Framed-IP-Netmask := 255.255.255.255 And my ippool settings: ippool main_pool { range-start = 172.30.64.1 range-stop = 172.30.64.5 netmask = 255.255.240.0 cache-size = 5 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } ippool birmas { range-start = 172.30.64.51 range-stop = 172.30.64.100 netmask = 255.255.240.0 session-db = ${db_dir}/db.ippool_birmas ip-index = ${db_dir}/db.ipindex_birmas override = yes maximum-timeout = 0 cache_size = 50 } And here is my sites-enabled/defults settings: authorize { preprocess detail chap mschap suffix eap { ok = return } unix files expiration logintime } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp main_pool birmas } session { radutmp } post-auth { main_pool birmas detail exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { detail } post-proxy { eap } I dont know how to solve tihs problem. Can anybody gives me a hint? Here is the my logs: root@radiusII:/etc/freeradius# freeradius -Xxx Wed Jan 20 09:58:35 2010 : Info: FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Sep 17 2009 at 17:22:02 Wed Jan 20 09:58:35 2010 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Wed Jan 20 09:58:35 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Jan 20 09:58:35 2010 : Info: PARTICULAR PURPOSE. Wed Jan 20 09:58:35 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Jan 20 09:58:35 2010 : Info: GNU General Public License v2. Wed Jan 20 09:58:35 2010 : Info: Starting - reading configuration files ... Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/radiusd.conf Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/proxy.conf Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/clients.conf Wed Jan 20 09:58:35 2010 : Debug: including files in directory /etc/freeradius/modules/ Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/policy Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/detail Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/files Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/expr Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/exec Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/inner-eap Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/chap Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/realm Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/echo Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/always Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/counter Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/modules/unix Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/eap.conf Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/policy.conf Wed Jan 20 09:58:35 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/default Wed Jan 20 09:58:35 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Wed Jan 20 09:58:35 2010 : Debug: including dictionary file /etc/freeradius/dictionary Wed Jan 20 09:58:35 2010 : Debug: main { Wed Jan 20 09:58:35 2010 : Debug: prefix = "/usr" Wed Jan 20 09:58:35 2010 : Debug: localstatedir = "/var" Wed Jan 20 09:58:35 2010 : Debug: logdir = "/var/log/freeradius" Wed Jan 20 09:58:35 2010 : Debug: libdir = "/usr/lib/freeradius" Wed Jan 20 09:58:35 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Wed Jan 20 09:58:35 2010 : Debug: hostname_lookups = no Wed Jan 20 09:58:35 2010 : Debug: max_request_time = 30 Wed Jan 20 09:58:35 2010 : Debug: cleanup_delay = 5 Wed Jan 20 09:58:35 2010 : Debug: max_requests = 1024 Wed Jan 20 09:58:35 2010 : Debug: allow_core_dumps = no Wed Jan 20 09:58:35 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Wed Jan 20 09:58:35 2010 : Debug: checkrad = "/usr/sbin/checkrad" Wed Jan 20 09:58:35 2010 : Debug: debug_level = 0 Wed Jan 20 09:58:35 2010 : Debug: proxy_requests = yes Wed Jan 20 09:58:35 2010 : Debug: log { Wed Jan 20 09:58:35 2010 : Debug: stripped_names = no Wed Jan 20 09:58:35 2010 : Debug: auth = no Wed Jan 20 09:58:35 2010 : Debug: auth_badpass = no Wed Jan 20 09:58:35 2010 : Debug: auth_goodpass = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: security { Wed Jan 20 09:58:35 2010 : Debug: max_attributes = 200 Wed Jan 20 09:58:35 2010 : Debug: reject_delay = 1 Wed Jan 20 09:58:35 2010 : Debug: status_server = yes Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: client localhost { Wed Jan 20 09:58:35 2010 : Debug: ipaddr = 127.0.0.1 Wed Jan 20 09:58:35 2010 : Debug: require_message_authenticator = no Wed Jan 20 09:58:35 2010 : Debug: secret = "testing123" Wed Jan 20 09:58:35 2010 : Debug: nastype = "other" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: client 10.65.8.100 { Wed Jan 20 09:58:35 2010 : Debug: require_message_authenticator = no Wed Jan 20 09:58:35 2010 : Debug: secret = "testing123" Wed Jan 20 09:58:35 2010 : Debug: shortname = "tceydelilerNB" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: client 172.30.80.1 { Wed Jan 20 09:58:35 2010 : Debug: require_message_authenticator = no Wed Jan 20 09:58:35 2010 : Debug: secret = "1q2w3e4r" Wed Jan 20 09:58:35 2010 : Debug: shortname = "turkcellapn" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed Jan 20 09:58:35 2010 : Debug: proxy server { Wed Jan 20 09:58:35 2010 : Debug: retry_delay = 5 Wed Jan 20 09:58:35 2010 : Debug: retry_count = 3 Wed Jan 20 09:58:35 2010 : Debug: default_fallback = no Wed Jan 20 09:58:35 2010 : Debug: dead_time = 120 Wed Jan 20 09:58:35 2010 : Debug: wake_all_if_all_dead = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: realm 10.1.1.51 { Wed Jan 20 09:58:35 2010 : Debug: authhost = 10.1.1.51:1812 Wed Jan 20 09:58:35 2010 : Debug: secret = geheim Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: radiusd: #### Instantiating modules #### Wed Jan 20 09:58:35 2010 : Debug: instantiate { Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_exec Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating exec Wed Jan 20 09:58:35 2010 : Debug: exec { Wed Jan 20 09:58:35 2010 : Debug: wait = no Wed Jan 20 09:58:35 2010 : Debug: input_pairs = "request" Wed Jan 20 09:58:35 2010 : Debug: shell_escape = yes Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_expr Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating expr Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_expiration Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating expiration Wed Jan 20 09:58:35 2010 : Debug: expiration { Wed Jan 20 09:58:35 2010 : Debug: reply-message = "Password Has Expired " Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_logintime Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating logintime Wed Jan 20 09:58:35 2010 : Debug: logintime { Wed Jan 20 09:58:35 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Wed Jan 20 09:58:35 2010 : Debug: minimum-timeout = 60 Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: radiusd: #### Loading Virtual Servers #### Wed Jan 20 09:58:35 2010 : Debug: server inner-tunnel { Wed Jan 20 09:58:35 2010 : Debug: modules { Wed Jan 20 09:58:35 2010 : Debug: Module: Checking authenticate {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_pap Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating pap Wed Jan 20 09:58:35 2010 : Debug: pap { Wed Jan 20 09:58:35 2010 : Debug: encryption_scheme = "auto" Wed Jan 20 09:58:35 2010 : Debug: auto_header = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_chap Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating chap Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_mschap Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating mschap Wed Jan 20 09:58:35 2010 : Debug: mschap { Wed Jan 20 09:58:35 2010 : Debug: use_mppe = yes Wed Jan 20 09:58:35 2010 : Debug: require_encryption = no Wed Jan 20 09:58:35 2010 : Debug: require_strong = no Wed Jan 20 09:58:35 2010 : Debug: with_ntdomain_hack = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_unix Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating unix Wed Jan 20 09:58:35 2010 : Debug: unix { Wed Jan 20 09:58:35 2010 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_eap Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating eap Wed Jan 20 09:58:35 2010 : Debug: eap { Wed Jan 20 09:58:35 2010 : Debug: default_eap_type = "md5" Wed Jan 20 09:58:35 2010 : Debug: timer_expire = 60 Wed Jan 20 09:58:35 2010 : Debug: ignore_unknown_eap_types = no Wed Jan 20 09:58:35 2010 : Debug: cisco_accounting_username_bug = no Wed Jan 20 09:58:35 2010 : Debug: max_sessions = 2048 Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating eap-md5 Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating eap-leap Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating eap-gtc Wed Jan 20 09:58:35 2010 : Debug: gtc { Wed Jan 20 09:58:35 2010 : Debug: challenge = "Password: " Wed Jan 20 09:58:35 2010 : Debug: auth_type = "PAP" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Ignoring EAP-Type/tls because we do not have OpenSSL support. Wed Jan 20 09:58:35 2010 : Debug: Ignoring EAP-Type/ttls because we do not have OpenSSL support. Wed Jan 20 09:58:35 2010 : Debug: Ignoring EAP-Type/peap because we do not have OpenSSL support. Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating eap-mschapv2 Wed Jan 20 09:58:35 2010 : Debug: mschapv2 { Wed Jan 20 09:58:35 2010 : Debug: with_ntdomain_hack = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Checking authorize {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_realm Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating suffix Wed Jan 20 09:58:35 2010 : Debug: realm suffix { Wed Jan 20 09:58:35 2010 : Debug: format = "suffix" Wed Jan 20 09:58:35 2010 : Debug: delimiter = "@" Wed Jan 20 09:58:35 2010 : Debug: ignore_default = no Wed Jan 20 09:58:35 2010 : Debug: ignore_null = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_files, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_files Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating files Wed Jan 20 09:58:35 2010 : Debug: files { Wed Jan 20 09:58:35 2010 : Debug: usersfile = "/etc/freeradius/users" Wed Jan 20 09:58:35 2010 : Debug: acctusersfile = "/etc/freeradius/acct_users" Wed Jan 20 09:58:35 2010 : Debug: preproxy_usersfile = "/etc/freeradius/preproxy_users" Wed Jan 20 09:58:35 2010 : Debug: compat = "no" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Checking session {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_radutmp Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating radutmp Wed Jan 20 09:58:35 2010 : Debug: radutmp { Wed Jan 20 09:58:35 2010 : Debug: filename = "/var/log/freeradius/radutmp" Wed Jan 20 09:58:35 2010 : Debug: username = "%{User-Name}" Wed Jan 20 09:58:35 2010 : Debug: case_sensitive = yes Wed Jan 20 09:58:35 2010 : Debug: check_with_nas = yes Wed Jan 20 09:58:35 2010 : Debug: perm = 384 Wed Jan 20 09:58:35 2010 : Debug: callerid = yes Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: Module: Checking post-auth {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_attr_filter Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating attr_filter.access_reject Wed Jan 20 09:58:35 2010 : Debug: attr_filter attr_filter.access_reject { Wed Jan 20 09:58:35 2010 : Debug: attrsfile = "/etc/freeradius/attrs.access_reject" Wed Jan 20 09:58:35 2010 : Debug: key = "%{User-Name}" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: modules { Wed Jan 20 09:58:35 2010 : Debug: Module: Checking authenticate {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: Module: Checking authorize {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_preprocess Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating preprocess Wed Jan 20 09:58:35 2010 : Debug: preprocess { Wed Jan 20 09:58:35 2010 : Debug: huntgroups = "/etc/freeradius/huntgroups" Wed Jan 20 09:58:35 2010 : Debug: hints = "/etc/freeradius/hints" Wed Jan 20 09:58:35 2010 : Debug: with_ascend_hack = no Wed Jan 20 09:58:35 2010 : Debug: ascend_channels_per_line = 23 Wed Jan 20 09:58:35 2010 : Debug: with_ntdomain_hack = no Wed Jan 20 09:58:35 2010 : Debug: with_specialix_jetstream_hack = no Wed Jan 20 09:58:35 2010 : Debug: with_cisco_vsa_hack = no Wed Jan 20 09:58:35 2010 : Debug: with_alvarion_vsa_hack = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_detail Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating detail Wed Jan 20 09:58:35 2010 : Debug: detail { Wed Jan 20 09:58:35 2010 : Debug: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Wed Jan 20 09:58:35 2010 : Debug: header = "%t" Wed Jan 20 09:58:35 2010 : Debug: detailperm = 384 Wed Jan 20 09:58:35 2010 : Debug: dirperm = 493 Wed Jan 20 09:58:35 2010 : Debug: locking = no Wed Jan 20 09:58:35 2010 : Debug: log_packet_header = no Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Checking preacct {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_acct_unique Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating acct_unique Wed Jan 20 09:58:35 2010 : Debug: acct_unique { Wed Jan 20 09:58:35 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Checking accounting {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: (Loaded rlm_ippool, checking if it's valid) Wed Jan 20 09:58:35 2010 : Debug: Module: Linked to module rlm_ippool Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating main_pool Wed Jan 20 09:58:35 2010 : Debug: ippool main_pool { Wed Jan 20 09:58:35 2010 : Debug: session-db = "/etc/freeradius/db.ippool" Wed Jan 20 09:58:35 2010 : Debug: ip-index = "/etc/freeradius/db.ipindex" Wed Jan 20 09:58:35 2010 : Debug: key = "%{NAS-IP-Address} %{NAS-Port}" Wed Jan 20 09:58:35 2010 : Debug: range-start = 172.30.64.1 Wed Jan 20 09:58:35 2010 : Debug: range-stop = 172.30.64.5 Wed Jan 20 09:58:35 2010 : Debug: netmask = 255.255.255.0 Wed Jan 20 09:58:35 2010 : Debug: cache-size = 800 Wed Jan 20 09:58:35 2010 : Debug: override = no Wed Jan 20 09:58:35 2010 : Debug: maximum-timeout = 0 Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating birmas Wed Jan 20 09:58:35 2010 : Debug: ippool birmas { Wed Jan 20 09:58:35 2010 : Debug: session-db = "/etc/freeradius/db.ippool_birmas" Wed Jan 20 09:58:35 2010 : Debug: ip-index = "/etc/freeradius/db.ipindex_birmas" Wed Jan 20 09:58:35 2010 : Debug: key = "%{NAS-IP-Address} %{NAS-Port}" Wed Jan 20 09:58:35 2010 : Debug: range-start = 172.30.64.51 Wed Jan 20 09:58:35 2010 : Debug: range-stop = 172.30.64.100 Wed Jan 20 09:58:35 2010 : Debug: netmask = 255.255.240.0 Wed Jan 20 09:58:35 2010 : Debug: cache-size = 1000 Wed Jan 20 09:58:35 2010 : Debug: override = yes Wed Jan 20 09:58:35 2010 : Debug: maximum-timeout = 0 Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Instantiating attr_filter.accounting_response Wed Jan 20 09:58:35 2010 : Debug: attr_filter attr_filter.accounting_response { Wed Jan 20 09:58:35 2010 : Debug: attrsfile = "/etc/freeradius/attrs.accounting_response" Wed Jan 20 09:58:35 2010 : Debug: key = "%{User-Name}" Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Module: Checking session {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: Module: Checking pre-proxy {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: Module: Checking post-auth {...} for more modules to load Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Wed Jan 20 09:58:35 2010 : Debug: listen { Wed Jan 20 09:58:35 2010 : Debug: type = "auth" Wed Jan 20 09:58:35 2010 : Debug: ipaddr = * Wed Jan 20 09:58:35 2010 : Debug: port = 0 Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: listen { Wed Jan 20 09:58:35 2010 : Debug: type = "acct" Wed Jan 20 09:58:35 2010 : Debug: ipaddr = * Wed Jan 20 09:58:35 2010 : Debug: port = 0 Wed Jan 20 09:58:35 2010 : Debug: } Wed Jan 20 09:58:35 2010 : Debug: Listening on authentication address * port 1812 Wed Jan 20 09:58:35 2010 : Debug: Listening on accounting address * port 1813 Wed Jan 20 09:58:35 2010 : Debug: Listening on proxy address * port 1814 Wed Jan 20 09:58:35 2010 : Debug: Ready to process requests. .. ... rad_recv: Access-Request packet from host 172.30.80.1 port 2005, id=50, length=139 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 57819256 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Wed Jan 20 10:01:07 2010 : Info: +- entering group authorize {...} Wed Jan 20 10:01:07 2010 : Info: ++[preprocess] returns ok Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: [chap] Setting 'Auth-Type := CHAP' Wed Jan 20 10:01:07 2010 : Info: ++[chap] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[mschap] returns noop Wed Jan 20 10:01:07 2010 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL Wed Jan 20 10:01:07 2010 : Info: [suffix] No such realm "NULL" Wed Jan 20 10:01:07 2010 : Info: ++[suffix] returns noop Wed Jan 20 10:01:07 2010 : Info: [eap] No EAP-Message, not doing EAP Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[unix] returns notfound Wed Jan 20 10:01:07 2010 : Info: [files] users: Matched entry tevfikceydeliler at line 219 Wed Jan 20 10:01:07 2010 : Info: ++[files] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[expiration] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[logintime] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[pap] returns noop Wed Jan 20 10:01:07 2010 : Info: +- entering group pre-proxy {...} Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Sending Access-Request of id 107 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 57819256 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x3530 Wed Jan 20 10:01:07 2010 : Info: Proxying request 1 to home server 10.1.1.51 port 1812 Sending Access-Request of id 107 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 57819256 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x3530 Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=107, length=24 Proxy-State = 0x3530 Wed Jan 20 10:01:07 2010 : Info: +- entering group post-proxy {...} Wed Jan 20 10:01:07 2010 : Info: [eap] No pre-existing handler found Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: Found Auth-Type = CHAP Wed Jan 20 10:01:07 2010 : Info: Found Auth-Type = Accept Wed Jan 20 10:01:07 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' >>>>>>>>>>>>>>>>>>>ERROR HERE Wed Jan 20 10:01:07 2010 : Info: Auth-Type = Accept, accepting the user Wed Jan 20 10:01:07 2010 : Info: +- entering group post-auth {...} Wed Jan 20 10:01:07 2010 : Info: [main_pool] Could not find Pool-Name attribute. Wed Jan 20 10:01:07 2010 : Info: ++[main_pool] returns noop Wed Jan 20 10:01:07 2010 : Info: [birmas] Could not find Pool-Name attribute. Wed Jan 20 10:01:07 2010 : Info: ++[birmas] returns noop Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 50 to 172.30.80.1 port 2005 Wed Jan 20 10:01:07 2010 : Info: Finished request 1. Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.30.80.1 port 1806, id=154, length=139 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Wed Jan 20 10:01:07 2010 : Info: +- entering group authorize {...} Wed Jan 20 10:01:07 2010 : Info: ++[preprocess] returns ok Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Wed Jan 20 10:01:07 2010 : Info: [chap] Setting 'Auth-Type := CHAP' Wed Jan 20 10:01:07 2010 : Info: ++[chap] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[mschap] returns noop Wed Jan 20 10:01:07 2010 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL Wed Jan 20 10:01:07 2010 : Info: [suffix] No such realm "NULL" Wed Jan 20 10:01:07 2010 : Info: ++[suffix] returns noop Wed Jan 20 10:01:07 2010 : Info: [eap] No EAP-Message, not doing EAP Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[unix] returns notfound Wed Jan 20 10:01:07 2010 : Info: [files] users: Matched entry tevfikceydeliler at line 219 Wed Jan 20 10:01:07 2010 : Info: ++[files] returns ok Wed Jan 20 10:01:07 2010 : Info: ++[expiration] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[logintime] returns noop Wed Jan 20 10:01:07 2010 : Info: ++[pap] returns noop Wed Jan 20 10:01:07 2010 : Info: +- entering group pre-proxy {...} Wed Jan 20 10:01:07 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100120 Wed Jan 20 10:01:07 2010 : Debug: expand: %t -> Wed Jan 20 10:01:07 2010 Wed Jan 20 10:01:07 2010 : Info: ++[detail] returns ok Sending Access-Request of id 115 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Info: Proxying request 2 to home server 10.1.1.51 port 1812 Sending Access-Request of id 115 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 40329920 CHAP-Challenge = 0x224a9ef9367e1507dc0e1114ce97e66b User-Name = "tevfikceydeliler" CHAP-Password = 0x0142e9c0c54eb5526890378c5f4d16ff35 Calling-Station-Id = "905308507313" Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 10.1.1.51 port 1812, id=115, length=25 Proxy-State = 0x313534 Wed Jan 20 10:01:07 2010 : Info: +- entering group post-proxy {...} Wed Jan 20 10:01:07 2010 : Info: [eap] No pre-existing handler found Wed Jan 20 10:01:07 2010 : Info: ++[eap] returns noop Wed Jan 20 10:01:07 2010 : Info: Using Post-Auth-Type Reject Wed Jan 20 10:01:07 2010 : Info: +- entering group REJECT {...} Wed Jan 20 10:01:07 2010 : Debug: expand: %{User-Name} -> tevfikceydeliler Wed Jan 20 10:01:07 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Jan 20 10:01:07 2010 : Info: ++[attr_filter.access_reject] returns updated Wed Jan 20 10:01:07 2010 : Info: Delaying reject of request 2 for 1 seconds Wed Jan 20 10:01:07 2010 : Debug: Going to the next request Wed Jan 20 10:01:07 2010 : Debug: Waking up in 0.9 seconds. Wed Jan 20 10:01:08 2010 : Info: Sending delayed reject for request 2 Sending Access-Reject of id 154 to 172.30.80.1 port 1806 Wed Jan 20 10:01:08 2010 : Debug: Waking up in 3.9 seconds. Wed Jan 20 10:01:12 2010 : Info: Cleaning up request 1 ID 50 with timestamp +166 Wed Jan 20 10:01:12 2010 : Debug: Waking up in 1.0 seconds. Wed Jan 20 10:01:13 2010 : Info: Cleaning up request 2 ID 154 with timestamp +166 Wed Jan 20 10:01:13 2010 : Debug: Ready to process requests. Tevfik Ceydeliler Ağ &Web Teknolojileri Uzmanı Astron Proje Ofisi  (232) 435 82 88 dahili 131 ( tevfik.ceydeliler@ astron.yasar.com.tr  www.astron.ws 7/24 Acil Müdahele: 0 533 658 85 57 Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

3 2

Accounting using SQL
by James2010 20 Jan '10

20 Jan '10

Hi, I am having a problem where nothing is getting written into radacct on my database. I can although validate a user on the database using radtest, so i am guessing dialup.conf (which i haven't touched) is not running the accounting section. Curently i have not added a NAS, and running locally so i am unclear on whether this is the reason why no information is being added? I followed the howto on SQL from the freeradius wiki. I used the supplied schema in the sql file, and changed sql.conf to use the database user name and password, which i have kept to 'root' and 'password'. I have also uncommented sql in the accounting section for radiusd.conf. I have posted two files below: sql.conf and the default file from sites-available. If you require any more please let me know. Any help will be appreciated, James # -*- text -*- ## ## sql.conf -- SQL modules ## ## $Id$ ###################################################################### # # Configuration for the SQL module # # The database schemas and queries are located in subdirectories: # # sql/DB/schema.sql Schema # sql/DB/dialup.conf Basic dialup (including policy) queries # sql/DB/counter.conf counter # sql/DB/ippool.conf IP Pools in SQL # sql/DB/ippool.sql schema for IP pools. # # Where "DB" is mysql, mssql, oracle, or postgresql. # sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "mysql" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "localhost" port = 3306 login = "root" password = "password" # Database table configuration for everything except Oracle radius_db = "radius" # If you are using Oracle then use this instead # radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "radusergroup" # If set to 'yes' (default) we read the group tables # If set to 'no' the user MUST have Fall-Through = Yes in the radreply table # read_groups = yes # Remove stale session if checkrad does not see a double login deletestalesessions = yes # Print all SQL statements when in debug mode (-x) sqltrace = yes sqltracefile = ${logdir}/sqltrace.sql # number of sql connections to make to server num_sql_socks = 5 # number of seconds to dely retrying on a failed database # connection (per_socket) connect_failure_retry_delay = 60 # lifetime of an SQL socket. If you are having network issues # such as TCP sessions expiring, you may need to set the socket # lifetime. If set to non-zero, any open connections will be # closed "lifetime" seconds after they were first opened. lifetime = 0 # Maximum number of queries used by an SQL socket. If you are # having issues with SQL sockets lasting "too long", you can # limit the number of queries performed over one socket. After # "max_qeuries", the socket will be closed. Use 0 for "no limit". max_queries = 0 # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. For performance # and security reasons, finding clients via SQL queries CANNOT # be done "live" while the server is running. # #readclients = yes # Table to keep radius client info nas_table = "nas" # Read driver-specific configuration $INCLUDE sql/${database}/dialup.conf } ###################################################################### # # As of 2.0.0, FreeRADIUS supports virtual hosts using the # "server" section, and configuration directives. # # Virtual hosts should be put into the "sites-available" # directory. Soft links should be created in the "sites-enabled" # directory to these files. This is done in a normal installation. # # $Id$ # ###################################################################### # # Read "man radiusd" before editing this file. See the section # titled DEBUGGING. It outlines a method where you can quickly # obtain the configuration you want, without running into # trouble. See also "man unlang", which documents the format # of this file. # # This configuration is designed to work in the widest possible # set of circumstances, with the widest possible number of # authentication methods. This means that in general, you should # need to make very few changes to this file. # # The best way to configure the server for your local system # is to CAREFULLY edit this file. Most attempts to make large # edits to this file will BREAK THE SERVER. Any edits should # be small, and tested by running the server with "radiusd -X". # Once the edits have been verified to work, save a copy of these # configuration files somewhere. (e.g. as a "tar" file). Then, # make more edits, and test, as above. # # There are many "commented out" references to modules such # as ldap, sql, etc. These references serve as place-holders. # If you need the functionality of that module, then configure # it in radiusd.conf, and un-comment the references to it in # this file. In most cases, those small changes will result # in the server being able to connect to the DB, and to # authenticate users. # ###################################################################### # # In 1.x, the "authorize", etc. sections were global in # radiusd.conf. As of 2.0, they SHOULD be in a server section. # # The server section with no virtual server name is the "default" # section. It is used when no server name is specified. # # We don't indent the rest of this file, because doing so # would make it harder to read. # # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. preprocess # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. # auth_log # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authenticate' section. # digest # # The WiMAX specification says that the Calling-Station-Id # is 6 octets of the MAC. This definition conflicts with # RFC 3580, and all common RADIUS practices. Un-commenting # the "wimax" module here means that it will fix the # Calling-Station-Id attribute to the normal format as # specified in RFC 3580 Section 3.21 # wimax # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # suffix # ntdomain # # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP # authentication. # # It also sets the EAP-Type attribute in the request # attribute list to the EAP type from the packet. # # As of 2.0, the EAP module returns "ok" in the authorize stage # for TTLS and PEAP. In 1.x, it never returned "ok" here, so # this change is compatible with older configurations. # # The example below uses module failover to avoid querying all # of the following modules if the EAP module returns "ok". # Therefore, your LDAP and/or SQL servers will not be queried # for the many packets that go back and forth to set up TTLS # or PEAP. The load on those servers will therefore be reduced. # eap { ok = return } # # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # unix # # Read the 'users' file files # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd # # The ldap module will set Auth-Type to LDAP if it has not # already been set # ldap # # Enforce daily limits on time spent logged in. # daily # # Use the checkval module # checkval expiration logintime # # If no other module has claimed responsibility for # authentication, then try to use PAP. This allows the # other modules listed above to add a "known good" password # to the request, and to do nothing else. The PAP module # will then see that password, and use it to do PAP # authentication. # # This module should be listed last, so that the other modules # get a chance to set Auth-Type for themselves. # pap # # If "status_server = yes", then Status-Server messages are passed # through the following section, and ONLY the following section. # This permits you to do DB queries, for example. If the modules # listed here return "fail", then NO response is sent. # # Autz-Type Status-Server { # # } } # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user (Auth-Type := Reject), # or to or forcibly accept the user (Auth-Type := Accept). # # Note that Auth-Type := Accept will NOT work with EAP. # # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. # digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS suffix # ntdomain # # Read the 'acct_users' file files } # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp # # See "Simultaneous Use Checking Queries" in sql.conf # sql } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf # sql # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap exec # # Calculate the various WiMAX keys. In order for this to work, # you will need to define the WiMAX NAI, usually via # # update request { # WiMAX-MN-NAI = "%{User-Name}" # } # # If you want various keys to be calculated, you will need to # update the reply with "template" values. The module will see # this, and replace the template values with the correct ones # taken from the cryptographic calculations. e.g. # # update reply { # WiMAX-FA-RK-Key = 0x00 # WiMAX-MSK = "%{EAP-MSK}" # } # # You may want to delete the MS-MPPE-*-Keys from the reply, # as some WiMAX clients behave badly when those attributes # are included. See "raddb/modules/wimax", configuration # entry "delete_mppe_keys" for more information. # # wimax # If the WiMAX module did it's work, you may want to do more # things here, like delete the MS-MPPE-*-Key attributes. # # if (updated) { # update reply { # MS-MPPE-Recv-Key !* 0x00 # MS-MPPE-Send-Key !* 0x00 # } # } # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject } } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { # attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. # post_proxy_log # attr_rewrite # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter.post-proxy # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap # # If the server tries to proxy a request and fails, then the # request is processed through the modules in this section. # # The main use of this section is to permit robust proxying # of accounting packets. The server can be configured to # proxy accounting packets as part of normal processing. # Then, if the home server goes down, accounting packets can # be logged to a local "detail" file, for processing with # radrelay. When the home server comes back up, radrelay # will read the detail file, and send the packets to the # home server. # # With this configuration, the server always responds to # Accounting-Requests from the NAS, but only writes # accounting packets to disk if the home server is down. # # Post-Proxy-Type Fail { # detail # } } -- View this message in context: http://old.nabble.com/Accounting-using-SQL-tp27200709p27200709.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

PEAP/MSCHAPv2 on a Samsung mobile - more than 50 EAP packets?
by Stefan Winter 20 Jan '10

20 Jan '10

Hi, I'm seeing a strange behaviour for a 802.1X supplicant, and can't really explain it. The device (Samsung GT-S5560 mobile) claims to do PEAP/MSCHAPv2. In -X debug, the server certificate gets exchanged just fine, but the device doesn't proceed to the tunnel. It keeps sending EAP-Messages though - so it's not like the client device doesn't like the cert. In fact, we tried scenarios where it doesn't like the cert intentionally and in these cases it just aborts. So this here is when it *does* like the cert (ceritficate checking is off on the device). It sends packets like the following over and over again Wed Jan 20 10:24:34 2010 : Debug: Received Access-Request packet from host 158.64.X.Y port 1815, id=172, length=246 Wed Jan 20 10:24:34 2010 : Debug: User-Name = "someuser(a)somerealm.lu" Wed Jan 20 10:24:34 2010 : Debug: Calling-Station-Id = "C8-7E-75-F6-B1-7D" Wed Jan 20 10:24:34 2010 : Debug: Called-Station-Id = "00-1F-49-AA-EE-00:eduroam" Wed Jan 20 10:24:34 2010 : Debug: NAS-Port = 29 Wed Jan 20 10:24:34 2010 : Debug: NAS-IP-Address = 10.50.1.5 Wed Jan 20 10:24:34 2010 : Debug: NAS-Identifier = "ROC_WLC1" Wed Jan 20 10:24:34 2010 : Debug: Airespace-Wlan-Id = 3 Wed Jan 20 10:24:34 2010 : Debug: Service-Type = Framed-User Wed Jan 20 10:24:34 2010 : Debug: Framed-MTU = 1300 Wed Jan 20 10:24:34 2010 : Debug: NAS-Port-Type = Wireless-802.11 Wed Jan 20 10:24:34 2010 : Debug: Tunnel-Type:0 = VLAN Wed Jan 20 10:24:34 2010 : Debug: Tunnel-Medium-Type:0 = IEEE-802 Wed Jan 20 10:24:34 2010 : Debug: Tunnel-Private-Group-Id:0 = "\00036" Wed Jan 20 10:24:34 2010 : Debug: EAP-Message = 0x023200061900 Wed Jan 20 10:24:34 2010 : Debug: State = 0xe397bed9cca5a786162171ebc3153379 Wed Jan 20 10:24:34 2010 : Debug: Message-Authenticator = 0xd7a6608853e306106d5d8bca9d880cb1 Wed Jan 20 10:24:34 2010 : Debug: RESTENA-hotspot-Id = "somehotspot" Wed Jan 20 10:24:34 2010 : Debug: RESTENA-Service-Type = "eduroam-lu" Wed Jan 20 10:24:34 2010 : Debug: Proxy-State = 0x323336 ... Wed Jan 20 10:24:34 2010 : Debug: +- entering group authenticate {...} Wed Jan 20 10:24:34 2010 : Debug: [eap] Request found, released from the list Wed Jan 20 10:24:34 2010 : Debug: [eap] EAP/peap Wed Jan 20 10:24:34 2010 : Debug: [eap] processing type peap Wed Jan 20 10:24:34 2010 : Debug: [peap] processing EAP-TLS Wed Jan 20 10:24:34 2010 : Debug: [peap] Received TLS ACK Wed Jan 20 10:24:34 2010 : Debug: [peap] ACK handshake fragment handler in application data Wed Jan 20 10:24:34 2010 : Debug: [peap] eaptls_verify returned 1 Wed Jan 20 10:24:34 2010 : Debug: [peap] eaptls_process returned 13 Wed Jan 20 10:24:34 2010 : Debug: [peap] EAPTLS_HANDLED Wed Jan 20 10:24:34 2010 : Debug: ++[eap] returns handled Wed Jan 20 10:24:34 2010 : Debug: } # server split-outside Wed Jan 20 10:24:34 2010 : Debug: Sending Access-Challenge packet to host 158.64.1.8 port 1815, id=172, length=0 Wed Jan 20 10:24:34 2010 : Debug: EAP-Message = 0x013300061900 Wed Jan 20 10:24:34 2010 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Wed Jan 20 10:24:34 2010 : Debug: State = 0xe397bed9d3a4a786162171ebc3153379 Wed Jan 20 10:24:34 2010 : Debug: Proxy-State = 0x323336 Wed Jan 20 10:24:34 2010 : Debug: Finished request 4226376. That fragment handler seems strangely placed, and the EAP-Message is very short. It replies with the bytewise identical EAP-Message on the next round-trip. Up until the point where FreeRADIUS gives up: Wed Jan 20 10:24:34 2010 : Debug: Found Auth-Type = EAP Wed Jan 20 10:24:34 2010 : Debug: +- entering group authenticate {...} Wed Jan 20 10:24:34 2010 : Debug: [eap] More than 50 authentication packets for this EAP session. Aborted. Wed Jan 20 10:24:34 2010 : Debug: [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request Wed Jan 20 10:24:34 2010 : Debug: [eap] Failed in handler Wed Jan 20 10:24:34 2010 : Debug: ++[eap] returns invalid Wed Jan 20 10:24:34 2010 : Debug: Failed to authenticate the user. Wed Jan 20 10:24:34 2010 : Debug: } # server split-outside Wed Jan 20 10:24:34 2010 : Debug: Using Post-Auth-Type Reject I don't know what this device is talking here. Other PEAP clients don't do this kind of stuff. Anyone a clue what is going on? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 1