November 2010 - Freeradius-Users - lists.freeradius.org

Option 82 DHCP Snooping + Freeradius auth of DHCP requests
by Denis Iskandarov 25 Nov '10

25 Nov '10

Hello! I'm trying to setup network with DHCP Snooping Option 82 functionality + Freeradius auth for DHCP requests. DHCP server which receives DHCP packets from cisco switch "dhcp relay" is Mikrotik RouterBoard. freeradius2-2.1.7-7.el5. Also updated dictionary from new 2.1.10 package "Option 82" works perfectly without radius simply giving IPs to all requests. Mikrotik RB sends Option 82 request to freeradius with Redback vendor attributes. Also i've working eap-ttls and sql auth on same Freeradius server. But for simplicity i tried to used "files" auth method, which i think should work simultaniously depending on where user name where found and to which methods it applies. Please correct me if i'm wrong. I can't see files method in debug, by the way it says that it can't find auth method for username O_O :(. I don't know what to do else. Freeradius should receive Username Remote and Circuit IT and send Request-Accept with framed-ip from mikrotiks dhcp pool So here are my debugs and username configured in users file: Atributes seen in mikrotik: ARemote-id: 0:6:0:d:ed:21:a4:80 ACircuit-ID: 0:4:0:2:0:0 Atributes sniffed from packet seen in hex: Remote-ID: 0006000ded21a480 this is inside: VSA: l=10 t=Agent-Remote-Id(96): \000\006\000\r\355!\244\200 Circuit-ID: 000400020000 this is inside: VSA: l=8 t=Agent-Circuit-Id(97): \000\004\000\002\000\000 00:0C:42:40:40:38 Agent-Remote-Id = "0006000ded21a480" <============= Here i've tried different formats of these 2 atributes , sniffed with wireshark, with columns without Agent-Circuit-Id = "000400020000", | But as i have sniffed traffic and saw radius debud it accepts in different format with slashes Framed-IP-Address = 192.168.3.155 | hope those are unreadable ASCII characters as i was told and Here is radius debug output for first request-reject packets: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.101 { require_message_authenticator = no secret = "secret1" shortname = "shaper" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server_keycert.pem" certificate_file = "/etc/raddb/certs/server_keycert.pem" CA_file = "/etc/raddb/certs/cacert.pem" private_key_password = "lettheserverin" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" check_cert_issuer = "/C=GE/ST=Tbilisi/L=Tbilisi/O=CDN" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } [/etc/raddb/users]:2 WARNING! Changing 'Agent-Remote-Id =' to 'Agent-Remote-Id ==' for comparing RADIUS attribute in check item list for user 00:0C:42:40:40:38 Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radiusdb" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radiusdb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=10.0.2.5,shortname=ubntAP,secret=secret123 rlm_sql (sql): Adding client 10.0.2.5 (ubntAP, server=<none>) to clients list rlm_sql (sql): Read entry nasname=192.168.2.1,shortname=shaper,secret=secret1 rlm_sql (sql): Adding client 192.168.2.1 (shaper, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.101 port 45957, id=204, length=143 NAS-Port-Type = Ethernet NAS-Port = 2210401741 Calling-Station-Id = "1:0:c:42:40:40:38" Called-Station-Id = "CLIENTS_pool1" User-Name = "00:0C:42:40:40:38" User-Password = "" Agent-Remote-Id = "\000\006\000\r\355!\244\200" Agent-Circuit-Id = "\000\004\000\002\000" NAS-Identifier = "R1" NAS-IP-Address = 192.168.1.101 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "00:0C:42:40:40:38", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> 00:0C:42:40:40:38 [sql] sql_set_user escaped user --> '00:0C:42:40:40:38' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:0C:42:40:40:38' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '00:0C:42:40:40:38' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User 00:0C:42:40:40:38 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [00:0C:42:40:40:38] (from client shaper port 2210401741 cli 1:0:c:42:40:40:38) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00:0C:42:40:40:38 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 192.168.1.101 port 45957, id=204, length=143 Waiting to send Access-Reject to client shaper port 45957 - ID: 204 Waking up in 0.7 seconds. rad_recv: Access-Request packet from host 192.168.1.101 port 45957, id=204, length=143 Waiting to send Access-Reject to client shaper port 45957 - ID: 204 Waking up in 0.3 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 204 to 192.168.1.101 port 45957 Waking up in 4.9 seconds.

2 8

Automatically Generating "Expiration" - Freeradius 2.1.9 / mysql 5.1 / dialup admin
by mikal 25 Nov '10

25 Nov '10

What I'm trying to do is enable a non-technical person to create temporary, "guest like" accounts using the dialup admin interface. The accounts will be created as needed, they need to expire within a predetermined time frame(s) and I'm trying to avoid asking the person creating the accounts to be entering "Expiration". So how would I approach having the "Expiration" field auto populated based on the account creation date/time and a predetermined account lifetime? For instance, creation date/time + 12-hours, or date + 1-day. Thanks in advance for any guidance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Automatically-Generating-Expiration… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Logging reply-detail only produces single line of output
by Robert White 25 Nov '10

25 Nov '10

I want to log all replies from Radius to my NAS so I edited my sites-enabled file and uncommented 'reply_log'. I then went to modules/detail and added: detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } Now if i go to my log directory I do see reply-detail-%Y%m%d files created however the content is not what I expected. Rather than outputting all the attributes of the reply, all i see is: Thu Nov 25 02:11:29 2010 Packet-Type = Access-Accept Thu Nov 25 08:29:22 2010 Packet-Type = Access-Accept How can I change the behavior to log all reply attributes? Thanks, Rob White ------------------------------------------------- IMPORTANT NOTICE : The information in this email is confidential and may also be privileged. If you are not the intended recipient, any use or dissemination of the information and any disclosure or copying of this email is unauthorised and strictly prohibited. If you have received this email in error, please promptly inform us by reply email or telephone. You should also delete this email and destroy any hard copies produced.

2 2

dar de alta
by osvaldo aviña avalos 24 Nov '10

24 Nov '10

I have ubuntu and a freeradius server where users need to give high command to give them high

1 0

(no subject)
by Hugo Lúa Garcia 24 Nov '10

24 Nov '10

COULD SOMEONE HELP ME TO KNOW WHAT ARE THE FILES THAT SHOULD CHANGE TO VALIDATE USER THROUGH THE MAC ADDRESS, AND I HAVE ALREADY INSTALLED FreeRADIUS 2.1.10 and am running the server on a Ubuntu operating system, HOW DO YOU ADD USER the server and validate MAC ADDRESS?

6 5

eap-gtc error in authentication
by Robert Masters 24 Nov '10

24 Nov '10

We've been working on using Freeradius on RHEL5.4 to link a Motorola RFS6000 with Oracle OID. We've had a number of hiccoughs along the way, and solved most of them - mainly thanks to the archives of this list. We are now getting the following error: "rlm_eap_gtc: ERROR: Clear-test User-Password is required for authentication." We are running : radiusd: FreeRADIUS Version 1.1.3, for host i386-redhat-linux-gnu, built on Dec 4 2009 at 13:48:28 Which we are kind of stuck on if we want to maintain consistency with RHN. The full conversation log is long (882 lines), and with the config files this is getting long enough, but I'll post it if it will help (and apologise to the digest readers). Some pertinent bits from it, though (these all refer to a conversation that starts with request 0): Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/gtc rlm_eap: processing type gtc rlm_eap_gtc: ERROR: Clear-test User-Password is required for authentication. rlm_eap: Handler failed in EAP/gtc rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x977b0b0 3 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 Here is our radiusd.conf: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = clear } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "stingaree.bbs.bunnings.com.au" port = 3061 identity = "cn=bglpdtven,cn=users,dc=bbs,dc=bunnings,dc=com,dc=au" password = XXXXXXXXXXX basedn = "dc=bbs,dc=bunnings,dc=com,dc=au" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "OrclPassword" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUn iqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess suffix eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { } And our eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = Local } tls { private_key_password = XXXXXXXXXXXXXX private_key_file = /etc/raddb/certs/bunnings-key.pem certificate_file = /etc/raddb/certs/bunnings-cert.pem CA_path = /etc/raddb/certs/CA CA_file = /etc/raddb/certs/CA/bunnings-ca.crt dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } peap { default_eap_type = mschapv2 } mschapv2 { } } And our users file: DEFAULT Auth-Type = LDAP Fall-Through = Yes DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP Unix Systems Administrator Bunnings Group Limited 126 Pilbara Street, Welshpool WA 6106 Locked Bag 20, Welshpool WA 6986 Phone : (08) 9365-1507 Fax : (08) 9358-6054 E-mail : rmasters(a)bunnings.com.au Website : www.bunnings.com.au ************************************************************************ Bunnings Legal Disclaimer: 1) This email is confidential and may contain legally privileged information. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this email in error, please notify us immediately by return email and delete the document. 2) All emails sent to and sent from Bunnings Group Limited. are scanned for content. Any material deemed to contain inappropriate subject matter will be reported to the email administrator of all parties concerned. ************************************************************************

4 4

EAP and NTLM support (fwd)
by JR Mayberry 24 Nov '10

24 Nov '10

Is there a preferred method for doing EAP (from Wireless infrastructure) to Active Directory for authentication via FreeRADIUS? Or is there an alternative to EAP? It appears that NTLM is being deprecated and Samba is removing support in RedHat 5---- but NTLM seems to be the current recommended method. Thanks

3 4

Freeradius + LDAP auth
by Old Eduardo 24 Nov '10

24 Nov '10

Sorry list, but i try to configure this in few weeks and no get sucess. Realy need help for list. im try to all sites in google, but no get sucess. i try this: http://blog.yufeng.net/index.php/2010/07/debian-poptop-freeradius-openldap/ http://wiki.freeradius.org/Rlm_ldap http://mhoran.wordpress.com/2007/11/25/freeradius-on-freebsd-and-openldap/ my debug only appears: rad_recv: Access-Request packet from host 10.12.60.32 port 35717, id=31, length=64 User-Name = "ipe-dp" User-Password = "7\271D\250yhG'E\361\t{\237\366S\347" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Framed-Protocol = PPP Tue Nov 23 07:37:24 2010 : Debug: +- entering group authorize Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Nov 23 07:37:24 2010 : Debug: ++[preprocess] returns ok Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: - authorize Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: performing user authorization for ipe-dp Tue Nov 23 07:37:24 2010 : Debug: expand: (uid=%u) -> (uid=ipe-dp) Tue Nov 23 07:37:24 2010 : Debug: expand: dc=policiacivil,dc=rs,dc=gov,dc=br -> dc=policiacivil,dc=rs,dc=gov,dc=br Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: attempting LDAP reconnection Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: (re)connect to ldap.intra proxy.intra localhost:389, authentication 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: bind as uid=vpnpptp,ou=sistemas,dc=policiacivil,dc=rs,dc=gov,dc=br/dfjk129!@ to ldap.intra proxy.intra localhost:389 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: waiting for bind result ... Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: Bind was successful Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: performing search in dc=policiacivil,dc=rs,dc=gov,dc=br, with filter (uid=ipe-dp) Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: Added User-Password = {SSHA}dd3MzvDRyDeyeuDkPTy391H3FX2vynZl in check items Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: No default NMAS login sequence Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: looking for check items in directory... Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: LDAP attribute sambaNTPassword as RADIUS attribute NT-Password == 0x3244413944423342333039463632333434374232384536393635374142333642 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: LDAP attribute sambaLMPassword as RADIUS attribute LM-Password == 0x3845433036323546444141393630353041414433423433354235313430344545 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: LDAP attribute cn as RADIUS attribute Group == "ipe-dp" Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: looking for reply items in directory... Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: user ipe-dp authorized to use remote access Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Tue Nov 23 07:37:24 2010 : Debug: ++[ldap] returns ok Tue Nov 23 07:37:24 2010 : Debug: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Nov 23 07:37:24 2010 : Debug: !!! Replacing User-Password in config items with Cleartext-Password. !!! Tue Nov 23 07:37:24 2010 : Debug: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Nov 23 07:37:24 2010 : Debug: !!! Please update your configuration so that the "known good" !!! Tue Nov 23 07:37:24 2010 : Debug: !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Tue Nov 23 07:37:24 2010 : Debug: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Nov 23 07:37:24 2010 : Debug: auth: type Local Tue Nov 23 07:37:24 2010 : Debug: auth: user supplied User-Password does NOT match local User-Password Tue Nov 23 07:37:24 2010 : Debug: auth: Failed to validate the user. Tue Nov 23 07:37:24 2010 : Auth: Login incorrect: [ipe-dp/7\271D\250yhG'E\361\t{\237\366S\347] (from client BrasilTelecom port 1812) Tue Nov 23 07:37:24 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Tue Nov 23 07:37:24 2010 : Debug: Delaying reject of request 0 for 1 seconds Tue Nov 23 07:37:24 2010 : Debug: Going to the next request Tue Nov 23 07:37:24 2010 : Debug: Waking up in 0.9 seconds. Tue Nov 23 07:37:25 2010 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 31 to 10.12.60.32 port 35717 Tue Nov 23 07:37:25 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Reject packet from host 10.12.60.32 port 1812, id=31, length=20 rad_verify: Received Access-Reject packet from client 10.12.60.32 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) attention to auth type Local! WHY Local if i put in configuration to auth type LDAP? Sorry, i dont understand . Please help. Sorry for my bad english.

3 18

WiFi-Users / AP / Freeradius / Active-Directory
by Manuel Lamora 24 Nov '10

24 Nov '10

Hello everybody, I'm trying to setup the following setup. Wifi-Users should have access to the Access-Point when connecting with 802.1x (PEAP) and their Active-Directory-Account. Everything seems to work but clients cannot connect. I hope that someone could point me to my configuration mistake or give me further information where my problem resists. Thanks a lot in advance. Regards, Manuel Freeradius-Version : freeradius-server-2.1.9-1.7.i586 clients.conf with Accesspoint as a client: client 172.24.0.2 { secret = ******************* shortname = tunnel-3 nastype = other } wbinfo -a tuser%********* plaintext password authentication succeeded challenge/response password authentication succeeded ntlm_auth --request-nt-key --domain=SCS-NT --username=tuser --password=1passwort* NT_STATUS_OK: Success (0x0) In users file I have set now : DEFAULT Auth-Type = ntlm_auth radtest tuser ********* localhost 0 testing123 Sending Access-Request of id 132 to 127.0.0.1 port 1812 User-Name = "tuser" User-Password = "*********" NAS-IP-Address = 172.24.0.113 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=132, length=20 Starting the server with /usr/sbin/radiusd -X radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.24.0.2 { require_message_authenticator = no secret = "###################" shortname = "tunnel-3" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=SCS-NT --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-SCS-NT} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. ###################################################################### ###################################################################### First connect of a Windows-Client with user inst. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=233, length=142 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02010010015343532d4e545c696e7374 Message-Authenticator = 0x82f0744dde0b55a114ce2f8c9ad3a53e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 44 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 233 to 172.24.0.2 port 1672 EAP-Message = 0x010200160410b800e23c327d070babda5440b83449ca Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62d8dbfa4763ae991f0fa4312 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=234, length=150 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 State = 0x2d8fbba62d8dbfa4763ae991f0fa4312 Message-Authenticator = 0x3d7a4fa0b7403e4eb6fd176cc82cf0ed +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 44 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 234 to 172.24.0.2 port 1672 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62c8ca2a4763ae991f0fa4312 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=235, length=231 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203005719800000004d16030100480100004403014ced306e1c4adb3d4aa8f39fc989daf0 6b7debe9c53ad8f44d9cf85bcc37f7da00001600040005000a00090064006200030006001300 12006301000005ff01000100 State = 0x2d8fbba62c8ca2a4763ae991f0fa4312 Message-Authenticator = 0x977a1ef017b18a24365f696e4ffb768c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 235 to 172.24.0.2 port 1672 EAP-Message = 0x0104040019c0000008a216030100310200002d03014ced306f6ad45cd2b5af8e314b52e10e 4de253d26fd93fe24eb8ed3f12f929aa000004000005ff01000100160301085e0b00085a0008 570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193 310b3009060355040613024652310f300d060355040813065261646975733112301006035504 071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3130313132333134313533395a170d3131313132333134313533 395a307c310b3009060355040613024652310f300d0603550408130652616469757331153013 060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c6520 5365727665722043657274696669636174653120301e06092a864886f70d010901161161646d 696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f00 3082010a0282010100cd9faa1657088905b7ef37030f9f10f4acc72b4fb54b593dd4f4e59a34 aeae75d5ba2edfd2cc2690dc8eb88284cb10460f3983ca55af87 EAP-Message = 0x6ad7d63b37c4e4aeaaba70d7dbb828f23ed8dcf44bed922c66ac81643ea0355b251e18073d f3017697c1388fde20db7c7a4986a3682272044265c5f36cf15785221c39372d231bdbe96156 e2fe7e9645e71c4ea0a701b017cf033556cfbb4792f0e5ce14e6865104c2cd8b30f4e324d7dc 849d3546f2e21c2ae8a5c0e6187e216122621204175cfb2cbb0dd16d912b1f44f05238837518 c78a99588d5d5e2fe2ba7c1d365b36ff9192a79dded81bc10a81cbfbfc32d97291c5a20e0423 7febc44e1d6a1b8e86067bc30203010001a317301530130603551d25040c300a06082b060105 05070301300d06092a864886f70d0101050500038201010004fe EAP-Message = 0xe92adfd12c15035baba3ffffeee195e1428bf9715fbf0ef781b7e85cada065a78bf823b88a eec6bc3b67d1ec42d758c5ea1d16bace3ace1b6638f335a440cec3b01523892210520e1961c9 39a1d83f614698447a86564455f360784e05352dcf1eaf5a2fd62d0e9933136ff972bc5b75f7 bc4506ccf905e476c0af9865062b11161488bff753dd0e29bace5d01c9ebf4ff7f969d0d71f4 f11b8bf6096a03ea472e6b17bfdc78591620d5d070f04dc18488787aee1df0ba6fffee64ca68 c302ab4e650f6d98e462b22f3b9c79d866cc1c76a06a911b099dd5acf58c4526e749f2f9b76e 3a553180ac9762544c1aa0244ced68f5ccedbe9524731930d897 EAP-Message = 0x7c0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62f8ba2a4763ae991f0fa4312 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=236, length=150 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 State = 0x2d8fbba62f8ba2a4763ae991f0fa4312 Message-Authenticator = 0x6e97590c4d270aba01cfeb24814b0dc6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 236 to 172.24.0.2 port 1672 EAP-Message = 0x010503fc1940a003020102020900c83083d5f969607c300d06092a864886f70d0101050500 308193310b3009060355040613024652310f300d060355040813065261646975733112301006 035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e 3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024 0603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e 170d3130313132343135323233365a170d3131313132343135323233365a308193310b300906 0355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c65 20496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f 6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72 69747930820122300d06092a864886f70d01010105000382010f003082010a0282010100e635 de9cfdf5138774c61db62af4030d6c2e0fa16d2b32d5604bc5b0d183fe151aa9c8c40b099170 76a816aeeedeca498b3a86e9ea262b5d119c40ccadc3fed7e7a27f3e7c90eb7963e8b22295fe 46b26081fcb27f0c75666eeb59433aeae672a5d2a0e4ffc637a4 EAP-Message = 0x7a67a9ec4686061fb76289017e020dfc5a470ba00f4a3f9f09c351a60b19b404229642d34a 66dc17c30f85e88403b11c141965c66d1f41c19bd3d171fbdeaffec605619c065ec731e1ec03 113ab0a169d17dd125b2f654ba76f301ef01164d1e15c13e291c742dd6f488373a645e34e7a3 1e035719dd97b78f3ca24f47dff94ffc1ef177cf868797790d84de107e009f2bf714d6eef1b9 c90203010001a381fb3081f8301d0603551d0e0416041494a9d6739159773c049f83f718cd41 0133e7c3fa3081c80603551d230481c03081bd801494a9d6739159773c049f83f718cd410133 e7c3faa18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531 153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01090116 1161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043 6572746966696361746520417574686f72697479820900c83083d5f969607c300c0603551d13 040530030101ff300d06092a864886f70d010105050003820101006df485af7c40e594d6bf84 f59e929b6e7453bea850b2779ca4f69f1dbf13b6c5c0e9c0341f478e4569dfa8abbf47967acd 4a7b64b446e02c03fee653c2860da577b648ca3152fbf386ca92 EAP-Message = 0x934b8abcb4ea3bdd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62e8aa2a4763ae991f0fa4312 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=237, length=150 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 State = 0x2d8fbba62e8aa2a4763ae991f0fa4312 Message-Authenticator = 0x6affd650e887650568615a8f0ba11d7e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 237 to 172.24.0.2 port 1672 EAP-Message = 0x010600bc19000ac6f2571787135ef92e7bee24970a6a167246b46795b516de48d6caeac159 8a5416171a183b903fc2cdc8527dda8c6294389cee6158073332d9720b89f35c9826a2997560 d9484d0809681953f980cbfce4c2f1117dc893e8d5338933c294f234ec731677abe133b7077c 1f9f2194c48b36a41cf41936ebaf81662e75691b3ece44a5d3cec5f2c5d0ccd36c833708f689 bc755c662cca303b6a68b1b1de9e3e9d9755f8c885b4902955b5180316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62989a2a4763ae991f0fa4312 Finished request 4. Going to the next request

2 1

(no subject)
by paulina santillan mendez 24 Nov '10

24 Nov '10

Hello I have already installed and configured freeradius in Ubuntu operating system, how to add users through my MAC address?

1 0