April 2010 - Freeradius-Users - lists.freeradius.org

eap.conf - tls{private_key_password = whatever}
by Peter Carlstedt 15 Apr '10

15 Apr '10

Hello everyone, hope someone can answer me quite fast on this one =) Have tried google it but couldnt find something about it. Since I want to use peap i need to change the line "private_key_password = whatever" in the tls section to my own private key which I set in the server.cnf file which is used for creating the certs. What I wonder is which of the passwords is it that it asks for? The input_password or the output_password in the server.cnf file? I have just tested making certs once before and at that time I didnt know which I should use so I used same password for both input and output. Well now I need to know instead which one I should use since I use different password for input and output =) Hope someone can help. Thanks! /Peter Carlstedt _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

2 1

No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by Ahmed Munir 15 Apr '10

15 Apr '10

Hi, I installed latest version of it and followed the steps as mentioned in the website: http://wiki.freeradius.org/SQL_HOWTO. After configuring basic setup I'm facing i.e. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user when I run radtest I'm facing error as listed below; [root@newtest raddb]# radtest sqltest testpwd 127.0.0.1 1812 testing123 Sending Access-Request of id 38 to 127.0.0.1 port 1812 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=38, length=20 The logs of radiusd -X are listed down below; FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on Apr 9 2010 at 12:11:15 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd. conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default.orig including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "newtest" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 34663, id=160, length=59 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 160 to 127.0.0.1 port 34663 Waking up in 4.9 seconds. Cleaning up request 0 ID 160 with timestamp +6 Ready to process requests. It is further to be added that I'm facing this error when I configure FreeRadius with MySQL, but working fine when using "users" file. I even configure sql.conf and configure mysql parameters, include sql in radius.conf and on sites-available/default I enabled sql on account and authorize section as steps mentioned in website above. Because as I pass radius credentials, I can connect to MySQL. Is there other way to check radius connection with MySQL? Note: Firewall and SELinux has been disabled on my machine. Please advise how can I resolve this issue. -- Regards, Ahmed Munir

2 1

Freeradius With EAP-TTLS-LDAP and EAP-PEAP-AD
by Nathan McDavit-Van Fleet 14 Apr '10

14 Apr '10

Hello, I'm trying to get Freeradius 2.1.7 working on Redhat. I had previously gotten PEAP working with ntlm_auth using the walk-through on deployingradius.com on a Debian machine. However, it was version 2.0.7 so things have changed quite a bit in the config files. In the new walkthrough I noticed that the ntlm_auth definition is supposed to be its own module, even though there is still the commented out example inside the mschap module. The new walkthrough does not mention modifying the mschap module at all so I wonder which place I should have the config. I tried with it just in mschap, just in its own module, and both. So far I have not be successful in enabling the AD feature on my server. I tested ntlm_auth directly and it works perfectly. Samba and everything else is all good, I got TTLS and the users files authenticating well as well (so my cert is good and TLS is good). So it appears as if I'm missing something in my Freeradius configs that specifically has to do with PEAP/MSCHAP/AD. Thanks, -Nathan

3 9

Multiple instances of attribute in tunnelled reply
by sunhualing 14 Apr '10

14 Apr '10

Hello everyone: I am using a freeradius-2.1.8, with eap-ttls mschap v2. I happen to get a problem that some attribute missing in the Access-Accept message, while it appears in the first Access-Challenge message. I still find that those attributes appear tunneled reply , i use the debug mode. Search the mail list , i find that similiar problem appears two years ago, here is the mail. Any suggestion is welcome, thanks a log sunhualing Hi, We formulate our reply inside of the virtual server dealing with EAP and send it back to the outer server. This is the only way I could think of to insert the Inner identity into the Access-Accept. It all works fine... however it seems there's a bug when dealing with multiple instances of the same attribute. For example: users / sql DEFAULT Service-Type == Framed-User, Realm == 'local', SS-Flags =~ "^.1........$" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 603, Reply-Message = "User %{%{Stripped-User-Name}:-%{User-Name}} authenticated for ResNet access on NAS:%{%{NAS-Identifier}:-Uknown NAS} SSID:%{%{Called-Station-SSID}:-none}.", HP-IP-FILTER-RAW = 'deny in 41 from any to any', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.1', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.2', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.3', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.4', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.5', Fall-Through = no Ends up being sent as the response: # server default-inner PEAP: Got tunneled reply RADIUS code 2 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User ac221 authenticated for ResNet access on NAS:hp-e-engg1-1-dev-8021x-sw1 SSID:none." HP-Ip-Filter-Raw = "deny in 41 from any to any" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.1" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.2" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.3" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.4" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.5" EAP-Message = 0x03490004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ac221" PEAP: Processing from tunneled session code 0x845cb10 2 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User ac221 authenticated for ResNet access on NAS:hp-e-engg1-1-dev-8021x-sw1 SSID:none." HP-Ip-Filter-Raw = "deny in 41 from any to any" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.1" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.2" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.3" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.4" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.5" EAP-Message = 0x03490004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ac221" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS Saving tunneled attributes for later So when it's actually used in the Access-Accept packet it appears as: Sending Access-Accept of id 173 to 139.184.8.16 port 1024 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" HP-Ip-Filter-Raw = "deny in 41 from any to any" User-Name = "ac221(a)sussex.ac.uk" MS-MPPE-Recv-Key = 0xdec383f4a269cb3d8fcf59cd9e351971c3a9a3683a7c245144a0b852634c7a03 MS-MPPE-Send-Key = 0xb9f49bba9f9020deaa745c6ea0e8f5b92e72e2fc5b6465aed4a9231f10edd696 EAP-Message = 0x034a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 9. What's really weird is in the previous rounds of EAP, the attributes retain the += operator, it's only in the one where the EAP-Success message is returned where all the operators are stripped out. Relevant EAP bits: eap { ... ttls { ... copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "default-inner" } } Thanks, Arran

2 4

Re: will hints file be processed?
by Alan DeKok 14 Apr '10

14 Apr '10

Stefan A. wrote: > Even If I assign values to THEattributes in hints file, some later > evaluations in the default file are pretending: > > "Request:THEattributes not found" What does that mean? > How may I debug the processing of the hints file? Debug mode is fine. > Starting "radiusd -Xx" works fine: > ... > Fri Apr 9 18:34:25 2010 : Debug: (Loaded rlm_preprocess, checking if > it's valid) > Fri Apr 9 18:34:25 2010 : Debug: Module: Linked to module rlm_preprocess > Fri Apr 9 18:34:25 2010 : Debug: Module: Instantiating preprocess > Fri Apr 9 18:34:25 2010 : Debug: preprocess { > Fri Apr 9 18:34:25 2010 : Debug: huntgroups = > "/usr/local/etc/raddb/huntgroups" > Fri Apr 9 18:34:25 2010 : Debug: hints = "/usr/local/etc/raddb/hints" > ... > > receiving the a packet, I will output > ... > Fri Apr 9 18:34:54 2010 : Info: +- entering group authorize {...} > Fri Apr 9 18:34:54 2010 : Info: ++[preprocess] returns ok Yes... it's not matching anything in the 'hints' file. > I remember, that it has shown something like 'matched Line 17' in the past. > I'm sure, editing the correct hints file: If I do a mistake in a DEFAULT > line, radiusd does not load. What is in the packet, and what is in the 'hints' file? A comparison of the two should show why it isn't matching. > Any Idea, how to get more output, at least for the positive matches? Edit the source code. Alan DeKok.

1 0

Dan Schaffer is not in the office
by Dan Schaffer 13 Apr '10

13 Apr '10

I will be out of the office starting Tue 04/13/2010 and will not return until Thu 04/15/2010. I will respond to your message when I return.

1 0

How to handle challenge response using PAM auth in FreeRadius
by Rajendra Hegde 13 Apr '10

13 Apr '10

Hello, I am developing a PAM module for radius server. The radius server is configured to use PAM auth. It reads /etc/pam.d/radiusd and loads it on receiving auth request. The PAM module talks to external Authentication server and sometimes gets back "Challenge Respose". How can this be returned back to radius server from pam_sm_authenticate from my PAM module ? Please note that this is different than what pam_radius_auth.c does. pam_radius_auth.c talks to radius directly via network where as my module directly gets loaded by Radius. Why should not there be a way to return "Challenge Respose" from linux PAM back to it's loader ? Can this possible linux limitation be overcome by radius calling another exported function for PAM module covering all scenarios including "Challenge Response" ? Where should I look into in the freeradius codebase, if I were to add that functionality ? with best regards, The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. Please see our legal details at http://www.cryptocard.com CRYPTOCard Inc. is registered in the province of Ontario, Canada with Business number 80531 6478. CRYPTOCard Europe is limited liability company registered in England and Wales (with registered number 05728808 and VAT number 869 3979 41); its registered office is Aztec Centre, Aztec West, Almondsbury, Bristol, UK, BS32 4TD

4 10

Daemon exit normally but unexpectedly
by gorec2005 gorec2005 13 Apr '10

13 Apr '10

Tell my - how can you search exactly where the error occurs because of what the daemon exit's: Tue Apr 6 09:51:28 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 14:52:34 2010 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Apr 7 14:52:34 2010 : Info: rlm_sql (sql): Attempting to connect to radius@10.1.1.111:/radius Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Apr 7 14:52:34 2010 : Info: Loaded virtual server <default> Wed Apr 7 14:52:34 2010 : Info: Ready to process requests. Wed Apr 7 14:52:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 14:52:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 14:52:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Apr 7 14:52:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 14:59:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 14:59:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 14:59:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Apr 7 14:59:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 14:59:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 14:59:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 14:59:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 14:59:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:00:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:00:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:00:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Apr 7 15:00:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:00:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:00:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:00:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Apr 7 15:00:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:01:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:01:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:01:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Apr 7 15:01:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:02:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:02:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:02:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Apr 7 15:02:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:04:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:04:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:04:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 15:04:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:06:42 2010 : Info: Exiting normally.

2 1

PEAP/MS-CHAPv2 issue: mschap verified successful, but peap got no responses.
by Wang Nan 13 Apr '10

13 Apr '10

(others keywords: ActiveDirectory, Active Directory, AD, winbind, samba, eap.conf, peap, mschap) Hi FreeRARIUS gurus, I was implementing FreeRADIUS solution integrated with AD environment by using Samba/Winbind. EAP/TLS works, but not PEAP/MSCHAPv2, in that peap module is waiting for something after ntlm_auth returns success. I tested kinit/wbinfo/ntlm_auth individually, and they all works. I they tried all the ways (modifying around in /etc/raddb) came into my mind before I decided to ask help from freeradius mailling-list. I also tried with incorrect domain credentials, and the freeradius successfully rejected, whereas the correct could not successfully pass. I don't know if I misunderstand anything about freeradius configuration, so I post the log here. It would be appreciated if somebody here could give me a hand. Many Thanks, Eric Version: FreeRADIUS 2.1.6 AD box: MS Windows 2003 Radius box: OpenSUSE 11.2 Switch: Cisco 2950 Test Clients: WinXP(SP3) The following messages are copied from /var/log/radius.log: group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 10.6.10.4 { require_message_authenticator = no secret = "test" shortname = "10.6.10.4" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/MyCerts/server.key" certificate_file = "/etc/raddb/certs/MyCerts/server.pem" CA_file = "/etc/raddb/certs/MyCerts/ca.pem" private_key_password = "testing123" dh_file = "/etc/raddb/certs/MyCerts/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no make_cert_command = "/etc/raddb/certs/MyCerts/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 } Thread spawned new child 1. Total threads in pool: 1 Thread 1 waiting to be assigned a request Thread spawned new child 2. Total threads in pool: 2 Thread 2 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 5 waiting to be assigned a request Thread pool initialized radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to socket: Address already in use /etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 Waking up in 0.9 seconds. Thread 1 got semaphore Thread 1 handling request 8, (2 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 0 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Finished request 8. Going to the next request Thread 1 waiting to be assigned a request Waking up in 0.9 seconds. Thread 5 got semaphore Thread 5 handling request 9, (2 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 1 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0a8f], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 9. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.9 seconds. Thread 4 got semaphore Thread 4 handling request 10, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 10. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.9 seconds. Thread 3 got semaphore Thread 3 handling request 11, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 11. Going to the next request Thread 3 waiting to be assigned a request Waking up in 0.9 seconds. Thread 2 got semaphore Thread 2 handling request 12, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 4 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 182 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 12. Going to the next request Thread 2 waiting to be assigned a request Waking up in 0.9 seconds. Thread 1 got semaphore Thread 1 handling request 13, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Finished request 13. Going to the next request Thread 1 waiting to be assigned a request Waking up in 0.8 seconds. Thread 5 got semaphore Thread 5 handling request 14, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 6 length 41 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - MYDOMAIN\user2 PEAP: Got tunneled identity of MYDOMAIN\user2 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to MYDOMAIN\user2 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 6 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled [peap] Got tunneled Access-Challenge ++[eap] returns handled Finished request 14. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.8 seconds. Thread 4 got semaphore Thread 4 handling request 15, (4 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 7 length 95 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 PEAP: Setting User-Name to MYDOMAIN\user2 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 7 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for user2 with NT-Password [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=MYDOMAIN [mschap] expand: --username=%{mschap:User-Name} -> --username=user2 [mschap] mschap2: ab [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=482dd107d4b6071b [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=7cb8be62e4bf7ef40c1d0e858acf3c321d869149d0be4215 Exec-Program output: NT_KEY: 99EC5F817A0D1BC302A389EA28204422 Exec-Program-Wait: plaintext: NT_KEY: 99EC5F817A0D1BC302A389EA28204422 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled [peap] Got tunneled Access-Challenge ++[eap] returns handled Finished request 15. Going to the next request Thread 4 waiting to be assigned a request Waking up in 3.8 seconds. Cleaning up request 8 ID 218 with timestamp +93 Cleaning up request 9 ID 219 with timestamp +93 Cleaning up request 10 ID 220 with timestamp +93 Cleaning up request 11 ID 221 with timestamp +93 Cleaning up request 12 ID 222 with timestamp +93 Cleaning up request 13 ID 223 with timestamp +93 Cleaning up request 14 ID 224 with timestamp +93 Waking up in 0.1 seconds. Cleaning up request 15 ID 225 with timestamp +93 Ready to process requests. Ready to process requests. Exiting normally.

1 0

Re: No authenticate method (Auth-Type) configuration found
by Ahmed Munir 13 Apr '10

13 Apr '10

Hi, Thanks for reply. Well user is created on SQL, and I uncommented 'sql' from sites-enabled/default on Authorized section and Accounting Section. But when I add 'sql' in Authenticate section I'm getting same error. i.e. [root@newtest raddb]# radtest sqltest testpwd 127.0.0.1 1812 testing123 Sending Access-Request of id 38 to 127.0.0.1 port 1812 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=38, length=20 The user I created in SQL listed down below; id username attribute op value 1 sqltest Cleartext-Password := testpwd Please advise what am I missing? Kindly assist me. Date: Mon, 12 Apr 2010 13:25:45 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: No authenticate method (Auth-Type) configuration found > for the request: Rejecting the user > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20100412122545.GA14869(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I'm newbie in FreeRadius, I installed latest version of it and followed > the steps as mentioned in the websites: > http://www.howtoforge.com/authentication-authorization-and-accounting-with-… > http://wiki.freeradius.org/SQL_HOWTO. After configuring basic setup I'm > facing i.e. No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user when I issue "radtest sqltest testpwd 127.0.0.1 > 1812 testing123". > > the username 'sqltest' gives a slight hint. > > is this user in 'users' file or in SQL? if the username is > in SQL, then you need to activate the SQL stuff (uncomment or > add SQL to the auth section) - its not on by default because > then all sites would have to have SQL up and running for anything > to work (or else it'd crash and burn) > > alan > > > -- Regards, Ahmed Munir

2 1