March 2010 - Freeradius-Users - lists.freeradius.org

How to crypt password in database
by Paweł Pogorzelski 25 Mar '10

25 Mar '10

Hi I have problem with password encryption in mysql database: ----------------------------- *If i have in database: 1 test@realm User-Password := test I get Access Accept. ----------------------------- ----------------------------- *When i have: 2 test1@realm Crypt-Password := test123 Then i get: [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for test1@realm with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject ----------------------------- ----------------------------- in my sql.conf i have: # Read driver-specific configuration $INCLUDE sql/${database}/dialup.conf password_header = "{CRYPT}" auto_header = yes password_attribute = userPassword ----------------------------- Please help me with those crypted passwords. Best regards

3 2

Re: EAP (PEAP)+ntlm_auth doesn't send password by it self
by Cesar Ortega 25 Mar '10

25 Mar '10

Hi Alan, Thanks for your response. It didn't work either, the output is: Listening on authentication address * port 1645 Listening on accounting address * port 1646 Listening on proxy address * port 1647 Ready to process requests. rad_recv: Access-Request packet from host "AP's IP" port 1645, id=91, length=181 User-Name = "MyDOMAIN\\ortegaca" Framed-MTU = 1400 Called-Station-Id = "0015.62c8.75d0" Calling-Station-Id = "001f.3c2d.78d6" Cisco-AVPair = "ssid=radiusd" Service-Type = Login-User Message-Authenticator = 0x96ffc01213282f492a9dfebcac5f5cf0 EAP-Message = 0x02020017015044565341323030305c6f72746567616361 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "3280" NAS-Port = 3280 NAS-IP-Address = "AP's IP" NAS-Identifier = "ap" +- entering group authorize {...} [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] ... expanding second conditional [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] expand: %{User-Name:-None} -> MyDOMAIN\ortegaca [ntlm_auth] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=MyDOMAIN\ortegaca [ntlm_auth] No MS-CHAP-Challenge in the request. [ntlm_auth] expand: --challenge=%{mschap:Challenge:-00} -> --challenge= [ntlm_auth] No MS-CHAP-Response or MS-CHAP2-Response was found in the request. [ntlm_auth] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response= hex decode of failed! (only got 0 bytes) Exec-Program output: Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> MyDOMAIN\ortegaca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 91 to "AP's IP" port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host "AP's IP" port 1645, id=92, length=181 User-Name = "MyDOMAIN\\ortegaca" Framed-MTU = 1400 Called-Station-Id = "0015.62c8.75d0" Calling-Station-Id = "001f.3c2d.78d6" Cisco-AVPair = "ssid=radiusd" Service-Type = Login-User Message-Authenticator = 0x33d0e749e1bb30e03f6bbe53e0601d27 EAP-Message = 0x02010017015044565341323030305c6f72746567616361 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "3281" NAS-Port = 3281 NAS-IP-Address = "AP's IP" NAS-Identifier = "ap" +- entering group authorize {...} [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] ... expanding second conditional [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] expand: %{User-Name:-None} -> MyDOMAIN\ortegaca [ntlm_auth] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=MyDOMAIN\ortegaca [ntlm_auth] No MS-CHAP-Challenge in the request. [ntlm_auth] expand: --challenge=%{mschap:Challenge:-00} -> --challenge= [ntlm_auth] No MS-CHAP-Response or MS-CHAP2-Response was found in the request. [ntlm_auth] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response= hex decode of failed! (only got 0 bytes) Exec-Program output: Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> MyDOMAIN\ortegaca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. As you can see above, there is something about the challenge but I really don't know what it is. So, again: What can I do for a transparent authentication against my Active Directory when a user is logged on it?. Cesar _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

2 5

How can I set freeradius to connect to another freeradius server to find external database.
by joe joe 25 Mar '10

25 Mar '10

Hello all I need to setup 2 freeradius servers for mac address authentication. My scenario is Access point send access-request to 1st freeradius server to do mac address authentication .If 1st server doesn’t have MAC Address in database ,it must send this request to 2nd server(which is freeradius server too) to find in another database. I try to config proxy.conf file in 1st server as follow home_server pri_home_server { type = auth+acct ipaddr = localhost port = 1812 secret = xxx response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3}home_server sec_home_server { type = auth+acct ipaddr = xxx port = 1812 secret = xxx response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3} home_server_pool auth_failover_pool { type = fail-over home_server = pri_home_server home_server = sec_home_server} realm users{ type=radius auth_pool=auth_failover_pool acct_pool=auth_failover_pool nostrip} but it doesn’t work So the question is Do I need to config proxy.conf or others files ?or other method to setup for this scenario ? Any help is appreciated. Thanks in advance.

2 1

question on users file
by Jeffrey Wang 25 Mar '10

25 Mar '10

I am using freeradius server against my ldap server for regular user access and eap. I need the wireless user treated differently. So I created a entry in users file and would like to set user-password for these users in encrypted form. For the users that are not in ldap, they worked fine. However, the users are in the ldap, had been updated with cleartext-password and radius ignores my user-password and uses cleartext-password from ldap. Can I delete the configuration items (cleartext-password) I set in previous process, such as ldap or password file? TIA

2 2

"Invalid packet code 11 sent to authentication port from client" error
by Rob Brickhouse 25 Mar '10

25 Mar '10

I hope someone can help me with this. I tested setting up freeradius 2.1.6 on an opensuse 10.2 box and was able to get everything authenticating against novell edirectory. Now that I'm finally ready to put it on my production box, only 2.1.8 is available but I figure no big deal since it appeared to have alot of fixes. After going through and setting everything up like I did before, I can use my test utility to verify that I can successfully read the username and password from edirectory but I get the message "Invalid packet code 11 sent to authentication port from client TESAP8 port 1041 : IGNORED" when my Netgear access point connects. I can change the ip to my 2.1.6 freeradius box and it works so I don't think the issue is with my AP even though that is what the message seems to indicate. Here is my console log as it loads, returns an access_accept to my test utility from my desktop, and finally fails for the same user from a laptop connecting through the AP. Rob ------------------------------------------------- FreeRADIUS Version 2.1.8, for host i686-suse-linux-gnu, built on Mar 10 2010 at 14:35:09 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.1.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "private-network" } client 10.6.4.108 { require_message_authenticator = no secret = "testing123" shortname = "TESAP8" } client 10.6.4.107 { require_message_authenticator = no secret = "testing123" shortname = "TESAP7" } client 10.6.0.17 { require_message_authenticator = no secret = "testing123" shortname = "Rob" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.1.0.40" port = 636 password = "radiusadmin" identity = "cn=radiusadmin,o=BOE" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = yes start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=CHS-VOCED" filter = "(&(objectClass=inetOrgPerson)(uid=%{Stripped-User-Name:-%{User-Name}}))" base_filter = "(objectclass=radiusprofile)" password_attribute = "nspmPassword" auto_header = no access_attr = "dialupAccess" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x801428f8 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.6.0.17 port 3865, id=0, length=46 User-Name = "radstu" User-Password = "testing" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "radstu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for radstu [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> radstu [ldap] expand: (&(objectClass=inetOrgPerson)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=inetOrgPerson)(uid=radstu)) [ldap] expand: o=CHS-VOCED -> o=CHS-VOCED [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.1.0.40:636, authentication 0 [ldap] setting TLS mode to 1 [ldap] bind as cn=radiusadmin,o=BOE/radiusadmin to 10.1.0.40:636 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=CHS-VOCED, with filter (&(objectClass=inetOrgPerson)(uid=radstu)) [ldap] checking if remote access for radstu is allowed by dialupAccess [ldap] Added the eDirectory password testing in check items as Cleartext-Password [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user radstu authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 0 to 10.6.0.17 port 3865 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +14 Ready to process requests. rad_recv: Access-Request packet from host 10.6.4.108 port 1041, id=20, length=168 Message-Authenticator = 0x1e9b558c032898d0c5762dbfeeddc228 Service-Type = Framed-User User-Name = "radstu" Framed-MTU = 1488 Called-Station-Id = "061F3373903B:tyco" Calling-Station-Id = "002100E5E763" NAS-Identifier = "TESAP8" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01726164737475 NAS-IP-Address = 10.6.4.108 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "radstu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for radstu [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> radstu [ldap] expand: (&(objectClass=inetOrgPerson)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=inetOrgPerson)(uid=radstu)) [ldap] expand: o=CHS-VOCED -> o=CHS-VOCED [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=CHS-VOCED, with filter (&(objectClass=inetOrgPerson)(uid=radstu)) [ldap] checking if remote access for radstu is allowed by dialupAccess [ldap] Added the eDirectory password testing in check items as Cleartext-Password [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user radstu authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 20 to 10.6.4.108 port 1041 EAP-Message = 0x010100160410eae98bafd4b076dcf8b6341b415000fe Message-Authenticator = 0x00000000000000000000000000000000 State = 0x731ac834731bcca6975b39a87528fad1 Finished request 1. Going to the next request Waking up in 4.9 seconds. Invalid packet code 11 sent to authentication port from client TESAP8 port 1041 : IGNORED Waking up in 4.0 seconds. Invalid packet code 11 sent to authentication port from client TESAP8 port 1041 : IGNORED Waking up in 3.0 seconds. Cleaning up request 1 ID 20 with timestamp +47 Ready to process requests. Ready to process requests. Exiting normally.

3 4

2 authorization tables?
by Paweł Pogorzelski 25 Mar '10

25 Mar '10

1. Can i add another table for user authorizations in the same database for example racheck and radcheck2? 2. For what is radreply table ? Best regards, and many thanks for help

2 1

eric bonnay
by Benjamin Marvin 25 Mar '10

25 Mar '10

http://overgeldersegrenzen.nl/go.my.friend.htm _________________________________________________________________ Hotmail: posta elettronica attendibile grazie alla protezione avanzata dalla posta indesiderata. https://signup.live.com/signup.aspx?id=60969

1 0

Re: Freeradius says it is listening on port 1812, but isn't
by Gary Gatten 24 Mar '10

24 Mar '10

If u really want 2 knw the issue, undo the changes one by one until it breaks again. ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wed Mar 24 04:56:19 2010 Subject: Re: Freeradius says it is listening on port 1812, but isn't Hi, I believe the problem is now resolved The only things I changed was that my hosts file was wrong, the IP for the servers FQDN was incorrect but I'm not sure this is what it was I also turned off ip forwarding with sysctl -w net.inet.ip.forwarding=0 Even though natd, and the firewall have been disabled. must be a weird OSX thing Sorry for wasting your time guys and thanks for the help Regards, Matt Harlum On 24/03/2010, at 8:27 PM, Matt Harlum wrote: > On 24/03/2010, at 8:21 PM, Fajar A. Nugraha wrote: > >> On Wed, Mar 24, 2010 at 3:51 PM, Matt Harlum <matt(a)cactuar.net> wrote: >>> Hi, >>> >>> I'm running Freeradius 2.1.6 on MacOSX 10.5.7 on a Dual-G4 867Mhz PowerMac >>> >>> Since march last year I've had 2.1.6 installed however it's been switched off for the last few months. >>> Recently I powered it back on and have run system updates etc and got to the point I am now >>> >>> When I launch FreeRadius it says it is listening on *:1812 for auth however my AP is unable to connect, >> >> "unable to connect" is the result. Many things can cause it, from >> incorrent radius IP/secret settings on AP to firewalls blocking >> packets. > > Checked both which are correct, no firewalls enabled > >> >>> and trying telnet on port 1812 results in "Connection Refused" >> >> you can't test UDP with telnet. Try the included radtest and radclient >> > > Ahh ok, I'll give those a try > >>> >>> I've tried reverting the configuration to default but it hasn't worked. running radiusd -x does not throw any errors >> >> does it print incoming packets and process it? >> does tcpdump (or whatever packet capture tools you have) shows incoming packets? >> > > It doesn't show anything when connection attempts are made, I'll let you know how I go with netcat and the radtest tools > Thanks > >> -- >> Fajar >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

oliver hinz
by Benjamin Marvin 24 Mar '10

24 Mar '10

http://www.music-works.de/lndex.html _________________________________________________________________ Hotmail: posta elettronica attendibile grazie alla protezione avanzata Microsoft dalla posta indesiderata. https://signup.live.com/signup.aspx?id=60969

1 0

Christopher Abraham
by Benjamin Marvin 24 Mar '10

24 Mar '10

http://sp69_0002.w.interia.pl/go.my.friend.htm _________________________________________________________________ La tua posta e molto altro anche in viaggio. Richiedi gratuitamente Windows Live Hotmail. https://signup.live.com/signup.aspx?id=60969

1 0