March 2010 - Freeradius-Users - lists.freeradius.org

Logging Packet-Type of reply packets from inner-tunnel
by Bob Franklin 09 Mar '10

09 Mar '10

Hello, I'm trying to log aspects of the reply packet returned to the NAS at various stages during authentication using an inner tunnel, in particular the Packet-Type. This is on FreeRADIUS 2.1.6. My problem is that I can't find a way to retrieve this information in the middle of the inner tunnel sequence -- if the request is proxied, I can run a log module instance in 'post-proxy' to log %{proxy-reply:Packet-Type} and see things like 'Access-Challenge', 'Access-Reject', etc. However, I can't seem to do this with locally-handled packets -- I have 'post-auth' which runs for 'Access-Accept' and (optionally, through 'Post-Auth-Type REJECT'), 'Access-Reject'. But I would like to be able to log the intermediate 'Access-Challenge' packets. Putting %{reply:Packet-Type} at the end of the 'authorize' section doesn't work (I just get '0'). Is this something I can do? If so, I'm sure I'm missing something obvious - can someone please point me in the right direction? I would prefer to do the logging from inside the inner tunnel virtual server to have access to the inner tunnel attributes in the logging. Thanks in advance, - Bob -- Bob Franklin <rcf34(a)cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service

2 2

Re: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by omega bk 08 Mar '10

08 Mar '10

ok, i put on the top of users file: ###################" linatest Cleartext-Password := "linagora" so run the rad test: ################ radtest linatest linagora 127.0.0.1 0 testing123 my rfreeradius -X #############" freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Mar 8 2010 at 15:54:37 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.20.253 { require_message_authenticator = no secret = "testinglinagora" shortname = "ciscoswitch" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 46107, id=162, length=60 User-Name = "linatest" User-Password = "linagora" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 162 to 127.0.0.1 port 46107 Waking up in 4.9 seconds. Cleaning up request 0 ID 162 with timestamp +6 Ready to process requests. Still stuck. thank for your help 2010/3/8 John Dennis <jdennis(a)redhat.com> > On 03/08/2010 11:10 AM, omega bk wrote: > >> sorry. >> here is: >> > > Why send this to just me and not the list? > > Anyway, you don't have the user "linatest" defined anywhere, that's you're > first problem. Start by following the directions here: > > http://deployingradius.com/ > > do #1 first, then do #2 > > Once you have EAP working in a test scenario then move onto storing your > users in LDAP if that's your goal. If you're trying to authenticate Windows > users just be aware you're either going to need to store cleartext passwords > in ldap or use samba, or use ntlmauth. > > > -- > John Dennis <jdennis(a)redhat.com> > > Looking to carve out IT costs? > www.redhat.com/carveoutcosts/ >

4 3

No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by omega bk 08 Mar '10

08 Mar '10

hello, i sucess dpkg-buildpackage (after reinstalling os ubuntu on my server test) so i installed FreeRADIUS Version 2.1.8 via .deb file ok so know i tried the same configuration like before, but launching freeradius -X ireturns rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=254, length=155 User-Name = "linatest" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x0202000d016c696e6174657374 Message-Authenticator = 0xf55c29bf173484be884411a62582014c Cisco-NAS-Port = "FastEthernet0/24" NAS-Port = 50024 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.20.253 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. ?? => why? thanks

3 6

Problems with PEAP/mschapv2
by Casartello, Thomas 08 Mar '10

08 Mar '10

I've noticed recently that my PEAP/mschapv2 for my wireless network will randomly stop working and I have to reboot the server freeradius is running on. Don't ask me why this is working, but restarting the daemons won't fix it. Once I reboot everything works fine for a few days and then happens again. The only odd thing I can find is this in my log file: Mon Mar 8 10:21:02 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-d.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:02 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-a.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:02 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-d.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:06 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-b.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:12 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-c.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:20 2010 : Error: rlm_radutmp: Logout entry for NAS chaplin-wism-b.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:23 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-d.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:23 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-a.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:27 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-b.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:30 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-a.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:34 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-a.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:40 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-b.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:42 2010 : Error: rlm_radutmp: Logout entry for NAS chaplin-wism-a.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:43 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-a.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:44 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-c.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:45 2010 : Error: rlm_radutmp: Logout entry for NAS abbott-wism-b.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:46 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-c.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:48 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-d.wsc.ma.edu port 29 has wrong ID Mon Mar 8 10:21:48 2010 : Error: rlm_radutmp: Logout entry for NAS diller-wism-b.wsc.ma.edu port 29 has wrong ID This is constant I get tons of these messages per day. IS this anything to worry about is it normal? And is it possible this could be causing the authentication to stop working randomly? Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT)

1 0

freeradius 2.1.8 : No authenticate method (Auth-Type) configuration found for the request: Rejecting the user / sites-enabled
by Klaus Schinkinger 08 Mar '10

08 Mar '10

Hi guys! I got this error as you can see from the subject, as far as I have learned now this is due to me not having any sites-enabled, problem is I don't even know which ones to enable. So here's what I am actually trying to accomplish: Currently we have a freeradius in the version 1.1.13 running on Debian Etch and I want to port this to 2.1.18 on Lenny, which isn't that easy as the config files/structure have completely changed... The server does not ask for any user-names or passwords but simply authenticates/authorizes with certificates (which have to be "unlocked" with a password). I'd be very thankful if you could tell me what to enter to sites-enabled, further if you could look over my config to see if i got any other parameters set wrong: falcon:/etc/freeradius# freeradius -Xxx Mon Mar 8 15:02:43 2010 : Info: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Mon Mar 8 15:02:43 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Mar 8 15:02:43 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Mar 8 15:02:43 2010 : Info: PARTICULAR PURPOSE. Mon Mar 8 15:02:43 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Mar 8 15:02:43 2010 : Info: GNU General Public License v2. Mon Mar 8 15:02:43 2010 : Info: Starting - reading configuration files ... Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/radiusd.conf Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/proxy.conf Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/clients.conf Mon Mar 8 15:02:43 2010 : Debug: including files in directory /etc/freeradius/modules/ Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/files Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/digest Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/always Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/exec Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/perl Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/echo Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/expr Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/chap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/otp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/cui Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/policy Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/pam Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/pap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/realm Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/unix Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/counter Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/inner-eap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/detail Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/eap.conf Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/policy.conf Mon Mar 8 15:02:43 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Mon Mar 8 15:02:43 2010 : Debug: main { Mon Mar 8 15:02:43 2010 : Debug: user = "freerad" Mon Mar 8 15:02:43 2010 : Debug: group = "freerad" Mon Mar 8 15:02:43 2010 : Debug: allow_core_dumps = no Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: including dictionary file /etc/freeradius/dictionary Mon Mar 8 15:02:43 2010 : Debug: main { Mon Mar 8 15:02:43 2010 : Debug: prefix = "/usr" Mon Mar 8 15:02:43 2010 : Debug: localstatedir = "/var" Mon Mar 8 15:02:43 2010 : Debug: logdir = "/var/log/freeradius" Mon Mar 8 15:02:43 2010 : Debug: libdir = "/usr/lib/freeradius" Mon Mar 8 15:02:43 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Mon Mar 8 15:02:43 2010 : Debug: hostname_lookups = no Mon Mar 8 15:02:43 2010 : Debug: max_request_time = 30 Mon Mar 8 15:02:43 2010 : Debug: cleanup_delay = 5 Mon Mar 8 15:02:43 2010 : Debug: max_requests = 1024 Mon Mar 8 15:02:43 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Mon Mar 8 15:02:43 2010 : Debug: checkrad = "/usr/sbin/checkrad" Mon Mar 8 15:02:43 2010 : Debug: debug_level = 0 Mon Mar 8 15:02:43 2010 : Debug: proxy_requests = yes Mon Mar 8 15:02:43 2010 : Debug: log { Mon Mar 8 15:02:43 2010 : Debug: stripped_names = no Mon Mar 8 15:02:43 2010 : Debug: auth = yes Mon Mar 8 15:02:43 2010 : Debug: auth_badpass = yes Mon Mar 8 15:02:43 2010 : Debug: auth_goodpass = yes Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: security { Mon Mar 8 15:02:43 2010 : Debug: max_attributes = 200 Mon Mar 8 15:02:43 2010 : Debug: reject_delay = 1 Mon Mar 8 15:02:43 2010 : Debug: status_server = yes Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Mon Mar 8 15:02:43 2010 : Debug: proxy server { Mon Mar 8 15:02:43 2010 : Debug: retry_delay = 5 Mon Mar 8 15:02:43 2010 : Debug: retry_count = 3 Mon Mar 8 15:02:43 2010 : Debug: default_fallback = no Mon Mar 8 15:02:43 2010 : Debug: dead_time = 120 Mon Mar 8 15:02:43 2010 : Debug: wake_all_if_all_dead = no Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: home_server localhost { Mon Mar 8 15:02:43 2010 : Debug: ipaddr = 127.0.0.1 Mon Mar 8 15:02:43 2010 : Debug: port = 1812 Mon Mar 8 15:02:43 2010 : Debug: type = "auth" Mon Mar 8 15:02:43 2010 : Debug: secret = "testing123" Mon Mar 8 15:02:43 2010 : Debug: response_window = 20 Mon Mar 8 15:02:43 2010 : Debug: max_outstanding = 65536 Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: zombie_period = 40 Mon Mar 8 15:02:43 2010 : Debug: status_check = "status-server" Mon Mar 8 15:02:43 2010 : Debug: ping_interval = 30 Mon Mar 8 15:02:43 2010 : Debug: check_interval = 30 Mon Mar 8 15:02:43 2010 : Debug: num_answers_to_alive = 3 Mon Mar 8 15:02:43 2010 : Debug: num_pings_to_alive = 3 Mon Mar 8 15:02:43 2010 : Debug: revive_interval = 120 Mon Mar 8 15:02:43 2010 : Debug: status_check_timeout = 4 Mon Mar 8 15:02:43 2010 : Debug: irt = 2 Mon Mar 8 15:02:43 2010 : Debug: mrt = 16 Mon Mar 8 15:02:43 2010 : Debug: mrc = 5 Mon Mar 8 15:02:43 2010 : Debug: mrd = 30 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: home_server_pool my_auth_failover { Mon Mar 8 15:02:43 2010 : Debug: type = fail-over Mon Mar 8 15:02:43 2010 : Debug: home_server = localhost Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: realm example.com { Mon Mar 8 15:02:43 2010 : Debug: auth_pool = my_auth_failover Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: realm LOCAL { Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Loading Clients #### Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.103 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap7" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap7" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.101 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap9" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap9" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.100 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap10" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap10" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.39.105 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap5" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap5" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.37.94 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap5" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap5" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 127.0.0.1 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap5" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap5" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.104 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap6" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap6" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.102 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap8" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap8" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.99 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap11" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap11" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.98 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap12" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap12" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Instantiating modules #### Mon Mar 8 15:02:43 2010 : Debug: instantiate { Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_exec Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating exec Mon Mar 8 15:02:43 2010 : Debug: exec { Mon Mar 8 15:02:43 2010 : Debug: wait = no Mon Mar 8 15:02:43 2010 : Debug: input_pairs = "request" Mon Mar 8 15:02:43 2010 : Debug: shell_escape = yes Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_expr Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating expr Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_expiration Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating expiration Mon Mar 8 15:02:43 2010 : Debug: expiration { Mon Mar 8 15:02:43 2010 : Debug: reply-message = "Password Has Expired " Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_logintime Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating logintime Mon Mar 8 15:02:43 2010 : Debug: logintime { Mon Mar 8 15:02:43 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Mon Mar 8 15:02:43 2010 : Debug: minimum-timeout = 60 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Loading Virtual Servers #### Mon Mar 8 15:02:43 2010 : Debug: server { Mon Mar 8 15:02:43 2010 : Debug: modules { Mon Mar 8 15:02:43 2010 : Debug: } # modules Mon Mar 8 15:02:43 2010 : Debug: } # server Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Mon Mar 8 15:02:43 2010 : Debug: listen { Mon Mar 8 15:02:43 2010 : Debug: type = "auth" Mon Mar 8 15:02:43 2010 : Debug: ipaddr = * Mon Mar 8 15:02:43 2010 : Debug: port = 1812 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: listen { Mon Mar 8 15:02:43 2010 : Debug: type = "acct" Mon Mar 8 15:02:43 2010 : Debug: ipaddr = * Mon Mar 8 15:02:43 2010 : Debug: port = 0 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: Listening on authentication address * port 1812 Mon Mar 8 15:02:43 2010 : Debug: Listening on accounting address * port 1813 Mon Mar 8 15:02:43 2010 : Debug: Listening on proxy address * port 1814 Mon Mar 8 15:02:43 2010 : Info: Ready to process requests. The complete error message was by the way: Ready to process requests. rad_recv: Access-Request packet from host 193.170.39.105 port 1027, id=1, length=109 NAS-IP-Address = 193.170.39.105 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 Calling-Station-Id = "0019d296e00f" Called-Station-Id = "00118550acf5" NAS-Identifier = "wlan-ap5" EAP-Message = 0x0201000501 Message-Authenticator = 0x793e8d344397eca7613421f7d482b309 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [<no User-Name attribute>/<no User-Password attribute>] (from client ap5 port 1 cli 0019d296e00f) Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 1 to 193.170.39.105 port 1027 Waking up in 4.9 seconds. Cleaning up request 3 ID 1 with timestamp +852861 Ready to process requests I tried this with several different methods, meaning also with user-name and password... If you need me to provide any further info please let me know! Your's Klaus

2 1

freeradius 2.1.8 : No authenticate method (Auth-Type) configuration found for the request: Rejecting the user / sites-enabled
by Klaus Schinkinger 08 Mar '10

08 Mar '10

Hi guys! I got this error as you can see from the subject, as far as I have learned now this is due to me not having any sites-enabled, problem is I don't even know which ones to enable. So here's what I am actually trying to accomplish: Currently we have a freeradius in the version 1.1.13 running on Debian Etch and I want to port this to 2.1.18 on Lenny, which isn't that easy as the config files/structure have completely changed... The server does not ask for any user-names or passwords but simply authenticates/authorizes with certificates (which have to be "unlocked" with a password). I'd be very thankful if you could tell me what to enter to sites-enabled, further if you could look over my config to see if i got any other parameters set wrong: falcon:/etc/freeradius# freeradius -Xxx Mon Mar 8 15:02:43 2010 : Info: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Mon Mar 8 15:02:43 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Mar 8 15:02:43 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Mar 8 15:02:43 2010 : Info: PARTICULAR PURPOSE. Mon Mar 8 15:02:43 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Mar 8 15:02:43 2010 : Info: GNU General Public License v2. Mon Mar 8 15:02:43 2010 : Info: Starting - reading configuration files ... Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/radiusd.conf Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/proxy.conf Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/clients.conf Mon Mar 8 15:02:43 2010 : Debug: including files in directory /etc/freeradius/modules/ Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/files Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/digest Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/always Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/exec Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/perl Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/echo Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/expr Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/chap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/otp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/cui Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/policy Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/pam Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/pap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/realm Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/unix Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/counter Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/inner-eap Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/modules/detail Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/eap.conf Mon Mar 8 15:02:43 2010 : Debug: including configuration file /etc/freeradius/policy.conf Mon Mar 8 15:02:43 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Mon Mar 8 15:02:43 2010 : Debug: main { Mon Mar 8 15:02:43 2010 : Debug: user = "freerad" Mon Mar 8 15:02:43 2010 : Debug: group = "freerad" Mon Mar 8 15:02:43 2010 : Debug: allow_core_dumps = no Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: including dictionary file /etc/freeradius/dictionary Mon Mar 8 15:02:43 2010 : Debug: main { Mon Mar 8 15:02:43 2010 : Debug: prefix = "/usr" Mon Mar 8 15:02:43 2010 : Debug: localstatedir = "/var" Mon Mar 8 15:02:43 2010 : Debug: logdir = "/var/log/freeradius" Mon Mar 8 15:02:43 2010 : Debug: libdir = "/usr/lib/freeradius" Mon Mar 8 15:02:43 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Mon Mar 8 15:02:43 2010 : Debug: hostname_lookups = no Mon Mar 8 15:02:43 2010 : Debug: max_request_time = 30 Mon Mar 8 15:02:43 2010 : Debug: cleanup_delay = 5 Mon Mar 8 15:02:43 2010 : Debug: max_requests = 1024 Mon Mar 8 15:02:43 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Mon Mar 8 15:02:43 2010 : Debug: checkrad = "/usr/sbin/checkrad" Mon Mar 8 15:02:43 2010 : Debug: debug_level = 0 Mon Mar 8 15:02:43 2010 : Debug: proxy_requests = yes Mon Mar 8 15:02:43 2010 : Debug: log { Mon Mar 8 15:02:43 2010 : Debug: stripped_names = no Mon Mar 8 15:02:43 2010 : Debug: auth = yes Mon Mar 8 15:02:43 2010 : Debug: auth_badpass = yes Mon Mar 8 15:02:43 2010 : Debug: auth_goodpass = yes Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: security { Mon Mar 8 15:02:43 2010 : Debug: max_attributes = 200 Mon Mar 8 15:02:43 2010 : Debug: reject_delay = 1 Mon Mar 8 15:02:43 2010 : Debug: status_server = yes Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Mon Mar 8 15:02:43 2010 : Debug: proxy server { Mon Mar 8 15:02:43 2010 : Debug: retry_delay = 5 Mon Mar 8 15:02:43 2010 : Debug: retry_count = 3 Mon Mar 8 15:02:43 2010 : Debug: default_fallback = no Mon Mar 8 15:02:43 2010 : Debug: dead_time = 120 Mon Mar 8 15:02:43 2010 : Debug: wake_all_if_all_dead = no Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: home_server localhost { Mon Mar 8 15:02:43 2010 : Debug: ipaddr = 127.0.0.1 Mon Mar 8 15:02:43 2010 : Debug: port = 1812 Mon Mar 8 15:02:43 2010 : Debug: type = "auth" Mon Mar 8 15:02:43 2010 : Debug: secret = "testing123" Mon Mar 8 15:02:43 2010 : Debug: response_window = 20 Mon Mar 8 15:02:43 2010 : Debug: max_outstanding = 65536 Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: zombie_period = 40 Mon Mar 8 15:02:43 2010 : Debug: status_check = "status-server" Mon Mar 8 15:02:43 2010 : Debug: ping_interval = 30 Mon Mar 8 15:02:43 2010 : Debug: check_interval = 30 Mon Mar 8 15:02:43 2010 : Debug: num_answers_to_alive = 3 Mon Mar 8 15:02:43 2010 : Debug: num_pings_to_alive = 3 Mon Mar 8 15:02:43 2010 : Debug: revive_interval = 120 Mon Mar 8 15:02:43 2010 : Debug: status_check_timeout = 4 Mon Mar 8 15:02:43 2010 : Debug: irt = 2 Mon Mar 8 15:02:43 2010 : Debug: mrt = 16 Mon Mar 8 15:02:43 2010 : Debug: mrc = 5 Mon Mar 8 15:02:43 2010 : Debug: mrd = 30 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: home_server_pool my_auth_failover { Mon Mar 8 15:02:43 2010 : Debug: type = fail-over Mon Mar 8 15:02:43 2010 : Debug: home_server = localhost Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: realm example.com { Mon Mar 8 15:02:43 2010 : Debug: auth_pool = my_auth_failover Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: realm LOCAL { Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Loading Clients #### Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.103 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap7" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap7" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.101 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap9" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap9" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.100 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap10" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap10" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.39.105 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap5" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap5" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.37.94 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap5" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap5" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 127.0.0.1 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap5" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap5" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.104 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap6" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap6" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.102 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap8" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap8" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.99 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap11" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap11" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: client 193.170.38.98 { Mon Mar 8 15:02:43 2010 : Debug: require_message_authenticator = no Mon Mar 8 15:02:43 2010 : Debug: secret = "wlan-ap12" Mon Mar 8 15:02:43 2010 : Debug: shortname = "ap12" Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Instantiating modules #### Mon Mar 8 15:02:43 2010 : Debug: instantiate { Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_exec Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating exec Mon Mar 8 15:02:43 2010 : Debug: exec { Mon Mar 8 15:02:43 2010 : Debug: wait = no Mon Mar 8 15:02:43 2010 : Debug: input_pairs = "request" Mon Mar 8 15:02:43 2010 : Debug: shell_escape = yes Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_expr Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating expr Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_expiration Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating expiration Mon Mar 8 15:02:43 2010 : Debug: expiration { Mon Mar 8 15:02:43 2010 : Debug: reply-message = "Password Has Expired " Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Mon Mar 8 15:02:43 2010 : Debug: Module: Linked to module rlm_logintime Mon Mar 8 15:02:43 2010 : Debug: Module: Instantiating logintime Mon Mar 8 15:02:43 2010 : Debug: logintime { Mon Mar 8 15:02:43 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Mon Mar 8 15:02:43 2010 : Debug: minimum-timeout = 60 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Loading Virtual Servers #### Mon Mar 8 15:02:43 2010 : Debug: server { Mon Mar 8 15:02:43 2010 : Debug: modules { Mon Mar 8 15:02:43 2010 : Debug: } # modules Mon Mar 8 15:02:43 2010 : Debug: } # server Mon Mar 8 15:02:43 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Mon Mar 8 15:02:43 2010 : Debug: listen { Mon Mar 8 15:02:43 2010 : Debug: type = "auth" Mon Mar 8 15:02:43 2010 : Debug: ipaddr = * Mon Mar 8 15:02:43 2010 : Debug: port = 1812 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: listen { Mon Mar 8 15:02:43 2010 : Debug: type = "acct" Mon Mar 8 15:02:43 2010 : Debug: ipaddr = * Mon Mar 8 15:02:43 2010 : Debug: port = 0 Mon Mar 8 15:02:43 2010 : Debug: } Mon Mar 8 15:02:43 2010 : Debug: Listening on authentication address * port 1812 Mon Mar 8 15:02:43 2010 : Debug: Listening on accounting address * port 1813 Mon Mar 8 15:02:43 2010 : Debug: Listening on proxy address * port 1814 Mon Mar 8 15:02:43 2010 : Info: Ready to process requests. The complete error message was by the way: Ready to process requests. rad_recv: Access-Request packet from host 193.170.39.105 port 1027, id=1, length=109 NAS-IP-Address = 193.170.39.105 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 Calling-Station-Id = "0019d296e00f" Called-Station-Id = "00118550acf5" NAS-Identifier = "wlan-ap5" EAP-Message = 0x0201000501 Message-Authenticator = 0x793e8d344397eca7613421f7d482b309 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [<no User-Name attribute>/<no User-Password attribute>] (from client ap5 port 1 cli 0019d296e00f) Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 1 to 193.170.39.105 port 1027 Waking up in 4.9 seconds. Cleaning up request 3 ID 1 with timestamp +852861 Ready to process requests I tried this with several different methods, meaning also with user-name and password... If you need me to provide any further info please let me know! Your's Klaus

1 0

Login Scrip
by Hamada Caspy 08 Mar '10

08 Mar '10

Dear FreeRadius Users I would like to put a script that maps a netowrk drive when a user logs in. I am using Ldap to authenticate users. everything is working fine just donno how and where to put the script. How to use the Exec-Progrm-Wait module? Where can i put it or look for it? is it possible to put a batch file? regards _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

1 0

Re: Lost and confused
by jin jin 07 Mar '10

07 Mar '10

Message: 1 Date: Fri, 5 Mar 2010 16:59:09 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Lost and confused To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100305165909.GB28057(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > To start FreeRadius in debug mode with time stamps use the command: radiusd -XX > To shutdown FreeRadius use the command: killall radiusd in his case its killall freeradius I believe..as thats the process name from the netstat alan ------------------------------ Thanks to everyone who replied! I think it's working! Here is the debug output: lauwk@lauwk-desktop:~$ sudo freeradius -X FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Sep 17 2009 at 17:22:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. One thing that I'm still not sure about was when I am using the "killall freeradius" command: lauwk@lauwk-desktop:~$ sudo killall freeradius freeradius: no process found I tried "killall radiusd but the output was still the same. Should I worry about this if I am able to get the debug mode started up? Also I like to thank you guys again for the help, it's very much appreciated :) Regards, Jin New Email names for you! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/sg/

2 1

Threads & Perl
by Alexandr Kovalenko 07 Mar '10

07 Mar '10

Hello! I'm trying to find out if FreeRADIUS create separate Perl instance per each thread (thread pool {}) (2.1.8) ? The main question is: will FreeRADIUS with use of rlm_perl script be able to serve multiple requests simultaneously or each next request should wait until previous will finish? -- Alexandr Kovalenko http://uafug.org.ua/

3 4

freeradius for windows error
by drycreek＠gmail.com 07 Mar '10

07 Mar '10

Hi, I was wondering if anyone knows if the freeradius version for windows will run on other windows versions than XP? It shows XP on the site. I am trying to run it on a Windows 2000 box and when running the debug batch file I get the error: //etc/raddb/sql.conf[143]: Line is not in 'arrtibute = value' format Errors reading radius.conf Thank you for any help!

2 1