May 2010 - Freeradius-Users - lists.freeradius.org

Cisco AP's with WPA sending Accounting info.
by Andrew Paternoster 17 May '10

17 May '10

Hi List. I have been trying to get some Cisco 1130AG's to work with freeradius. I have go them to authentcate but can not get them to send accounting data. I think i has somthing to with with the peap tunnel. as i remember seeing it listed some where. My question is how do others to accounting on WPA wireless clients? There is accounting stuff that i have setup in the cisco AP but it doesnt seems to do anything. Can any one please point me in the right direction? Thanks Andrew Paternoster -- Andrew Paternoster Senior System Engineer GPK Computers Pty Ltd T 1300 854 223 F 1300 854 228 Did you know that you can now log faults just by sending an email to support(a)gpk.net.au --------------------------------------------------------------------------- The information contained in or accompanying this e-mail is intended only for the use of the stated recipient and may contain information that is confidential and/or privileged. If the reader is not the intended recipient or the agent thereof, you are hereby notified that any dissemination, distribution or copying of this e-mail is strictly prohibited and may constitute a breach of confidence and/or privilege. If you have received this e-mail in error, please notify us immediately. Any views or opinions presented are those solely of the author and do not necessarily represent those of GPK Computers Pty Ltd.. Warning: Although the company has taken reasonable precautions to ensure no viruses are present in this e-mail, the company cannot accept responsibility for any loss or damage arising from the use of this e-mail or attachments ---------------------------------------------------------------------------

2 2

Authentication with existing MySQL database
by Quentin Smith 17 May '10

17 May '10

Hello all, I've set up and configured freeradius to properly authenticate users using the MySQL database schema specified on the freeradius.org website. However, since we already have a different database set up with users' passwords that is updated by scripts when users change their passwords or their accounts are disabled etc, I would like to be able to pull their password hashes directly from that database. This is what I've tried so far to do so, but it has not worked. I've changed in the sql.conf file the authorize_check_query to the following, but left the authorize_reply_query untouched: authorize_check_query = "SELECT id, name as UserName, 'NT-Password' as Attribute, nthashpass as Value, ':=' as op \ FROM users \ WHERE name = '%{SQL-User-Name}' \ ORDER BY id" However, when I run freeradius -X, it appears that for some reason that setting is erased. The following is the pertinent output: sql: authorize_check_query = "" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" Then, when I try to authenticate a user, the following error is output: lm_sql (sql): sql_set_user escaped user --> ''******' radius_xlat: '' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 I'm guessing the SQL query error is related to the fact that authorize_check_query is now an empty string, but I'm not sure why that's the case. Anyone have any insight? -- Quentin Smith

3 3

Re: EAP-TLS and MAC Authentication
by John Doppke 17 May '10

17 May '10

I've been told that Cisco APs won't do WPA with MAC auth in recent versions of IOS. -John

3 3

Supplicant authentication Issue
by Pedro Alves 17 May '10

17 May '10

Hello . Why using Supplicant Intel PROSet or Supplicant Broadcom i can authenticate with users from AD , and with Windows supplicant no ? I see in radiusd -X log this diference: Windows Supplicant: [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0791], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Intel PROSet Supplicant: [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0791], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Im losing with windows supplicant: [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A This is my issue ? Cumprimentos Pedro Alves

1 0

Group Authentication
by Mike Wilson 17 May '10

17 May '10

I have compiled FreeRADIUS 2.1.8 on a fresh Ubuntu 9.10 install. I am using Microsoft SQL Server as a backend. I have installed and successfully configured UnixODBC and FreeTDS to get FreeRADIUS to communicate with the server. FreeRADIUS will authenticate users correctly from the radcheck and radreply tables. However, I am also trying to get it to return attributes based on their group assignment. I have uncommented the 'read_groups = yes' directive and also put a 'Fall-Through = yes' into the radreply table, and FreeRADIUS still will not check the group assignments. I am at a loss here as I have tried to get this working for almost a week now. Any help would be greatly appreciated! Below is the output of my radiusd -X. FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on Mar 19 2010 at 16:33:42 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mssql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "test" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_unixodbc" server = "fradius" port = "" login = "platuser" password = "platuser" radius_db = "vz_plat7b" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time:-0} WHERE AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime = 0" accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to platuser@fradius:/vz_plat7b rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 59466, id=112, length=49 User-Name = "bobloblaw" User-Password = "bobloblaw" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "bobloblaw", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [sql] expand: %{User-Name} -> bobloblaw [sql] sql_set_user escaped user --> 'bobloblaw' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'bobloblaw' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'bobloblaw' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "bobloblaw" [pap] Using clear text password "bobloblaw" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> bobloblaw [sql] sql_set_user escaped user --> 'bobloblaw' ++[sql] returns noop ++[exec] returns noop Sending Access-Accept of id 112 to 127.0.0.1 port 59466 Session-Timeout := 6000 CHAP-Challenge := 0x313233 Mikrotik-Group := "email" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 112 with timestamp +6 Ready to process requests. -- Mike Wilson

1 0

MAC Address Authentication
by dorra aa 17 May '10

17 May '10

hi finally, i installed freeradius and mysql .and i add users. Now i'm working whith daloradius. first, i add other user by daloradius and now i add MAC Address Authentication. I know i may do radtest user password ip-adress port secret to test a serin my radius . but i want to know how to test , in the shell, the MAC Address Authentication that i added or it is just to confirm to user added and don't need any command? _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

1 0

FW: EAP_TLS
by Harshil Anil Kumar Shah 17 May '10

17 May '10

Dear Friends, I wanted to modify EAP-TLS protocol available in Freeradius. I found two files in src/modules/rlm_eap/libeap directory: eap_tls.c and tls.c. Can you please guide me to understand the code and which file does which functionality? Harshil A. Shah, Systems Engineer(SE), Convergence Labs, SETLabs, Bangalore, Contact#: 09742887966.

1 0

Active Directory, PEAP and random works....
by Abdessamad BARAKAT 17 May '10

17 May '10

Hi, I have a strange problem. I try to authenticate users againts AD, it's seems to be a typical deployment of freeradius. But it's works randomly. When it's don't works , the mschap/NTLM auth success, the server send a access-challenge, I see on the cisco aironet the access-challenge come back to the client and no reply from the client and the connection stucks: +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/MRSLAP03571.domain.priv with NT-Password expand: --username=%{mschap:User-Name:-None} -> --username=MRSLAP03571$ expand: %{mschap:NT-Domain} -> DOMAIN expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN} -> --domain=DOMAIN mschap2: 60 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=923aaffd82c69093 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=a7e9503bed0bfedf055e9e32e241e391ccb0dd649fe09bbe Exec-Program output: NT_KEY: 2254EC3D1B726196286DA65965D5D411 Exec-Program-Wait: plaintext: NT_KEY: 2254EC3D1B726196286DA65965D5D411 Exec-Program: returned: 0 ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010b00331a030a002e533d34423436443245344135353939434637453443423233353641343546393836333932393945373637 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe713faa1e618e0bc40c4047c03951291 PEAP: Processing from tunneled session code 0x1e9e490 11 EAP-Message = 0x010b00331a030a002e533d34423436443245344135353939434637453443423233353641343546393836333932393945373637 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe713faa1e618e0bc40c4047c03951291 PEAP: Got tunneled Access-Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 103 to <AIRONET CISCO> port 1645 EAP-Message = 0x010b004a1900170301003fd5c3f845006343c8072ae98874a3df6bc8c3594e045b31fe7220a5c44b269eac3e3cdf6f48de5d3066feeb70a8f1d958e6b25c5f7ead1fa5c9064b89cc24a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d184007551359eef79a3370536543a0 Finished request 8. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 95 with timestamp +56 Cleaning up request 1 ID 96 with timestamp +56 Cleaning up request 2 ID 97 with timestamp +56 I have already checked the XP extension is present on the certificate server: extendedKeyUsage = 1.3.6.1.5.5.7.3.1 ################################################## # # !!!!! WARNINGS for Windows compatibility !!!!! # ################################################## # # If you see the server send an Access-Challenge, # and the client never sends another Access-Request, # then # # STOP! # # The server certificate has to have special OID's # in it, or else the Microsoft clients will silently # fail. See the "scripts/xpextensions" file for # details, and the following page: # # http://support.microsoft.com/kb/814394/en- I use : freeradius 2.0.4 samba 3.2.5 cisco aironet 1240 I have tried other version of samba: 3.2.15 and 3.4.8 and freeradius 2.1.8 The samba / winbbind stuff seems to work correctly ( Tests wbinfo, ntlm_auth OK) I have the same issue with other XP / windows 7 supplicants. I think I have checked correctly the howto: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO I don't think I'm the first with the same problem so please help me before I'm going crazy :) Thanks a lot for any information.

3 4

COA default configuration...Need help to test radclient
by Eric Martell 17 May '10

17 May '10

Hi, I followed the direction of how to setup COA in the freeradius. Uncommented from client.conf coa_server = localhost-coa When I ran the sample radclient, I am not seeing any response back. echo "User-Name='cisco',User-Password='cisco',cisco-avpair='subscriber:command=account-logon',Cisco-Account-Info='S172.16.12.12'" | /home/test/freeradius-2.1.8/bin/radclient -x localhost:3799 coa testing123 Sending CoA-Request of id 79 to 127.0.0.1 port 3799 User-Name = "cisco" User-Password = "cisco" Cisco-AVPair = "subscriber:command=account-logon" Cisco-Account-Info = "S172.16.xx.xx" Sending CoA-Request of id 79 to 127.0.0.1 port 3799 User-Name = "cisco" User-Password = "cisco" Cisco-AVPair = "subscriber:command=account-logon" Cisco-Account-Info = "S172.16.xx.xx" Sending CoA-Request of id 79 to 127.0.0.1 port 3799 User-Name = "cisco" User-Password = "cisco" Cisco-AVPair = "subscriber:command=account-logon" Cisco-Account-Info = "S172.16.xx.xx" radclient: no response from server for ID 79 socket 3 Do I have to do anything more than any default configuration? Please help. Thanks and Regards, Log attached. # ./radiusd -xX Fri May 14 19:59:04 2010 : Info: FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on May 14 2010 at 15:36:52 Fri May 14 19:59:04 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Fri May 14 19:59:04 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri May 14 19:59:04 2010 : Info: PARTICULAR PURPOSE. Fri May 14 19:59:04 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri May 14 19:59:04 2010 : Info: GNU General Public License v2. Fri May 14 19:59:04 2010 : Info: Starting - reading configuration files ... Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/radiusd.conf Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/proxy.conf Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/clients.conf Fri May 14 19:59:04 2010 : Debug: including files in directory /home/test/freeradius-2.1.8/etc/raddb/modules/ Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/preprocess Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/perl Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/exec Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/detail.example.com Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/checkval Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/smbpasswd Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/smsotp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/radutmp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/ldap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/detail.log Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/krb5 Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/etc_group Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/attr_filter Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/expr Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/ntlm_auth Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/passwd Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/otp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/unix Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/detail Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/sradutmp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/policy Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/logintime Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/pam Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/sql_log Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/attr_rewrite Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/files Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/cui Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/pap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/counter Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/mschap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/sqlcounter_expire_on_login Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/realm Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/echo Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/digest Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/wimax Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/always Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/acct_unique Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/mac2vlan Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/inner-eap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/chap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/linelog Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/mac2ip Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/expiration Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/ippool Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/eap.conf Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/policy.conf Fri May 14 19:59:04 2010 : Debug: including files in directory /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/ Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/originate-coa Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/inner-tunnel Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/default Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/control-socket Fri May 14 19:59:04 2010 : Debug: main { Fri May 14 19:59:04 2010 : Debug: allow_core_dumps = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: including dictionary file /home/test/freeradius-2.1.8/etc/raddb/dictionary Fri May 14 19:59:04 2010 : Debug: main { Fri May 14 19:59:04 2010 : Debug: prefix = "/home/test/freeradius-2.1.8" Fri May 14 19:59:04 2010 : Debug: localstatedir = "/home/test/freeradius-2.1.8/var" Fri May 14 19:59:04 2010 : Debug: logdir = "/home/test/freeradius-2.1.8/var/log/radius" Fri May 14 19:59:04 2010 : Debug: libdir = "/home/test/freeradius-2.1.8/lib" Fri May 14 19:59:04 2010 : Debug: radacctdir = "/home/test/freeradius-2.1.8/var/log/radius/radacct" Fri May 14 19:59:04 2010 : Debug: hostname_lookups = no Fri May 14 19:59:04 2010 : Debug: max_request_time = 30 Fri May 14 19:59:04 2010 : Debug: cleanup_delay = 5 Fri May 14 19:59:04 2010 : Debug: max_requests = 1024 Fri May 14 19:59:04 2010 : Debug: pidfile = "/home/test/freeradius-2.1.8/var/run/radiusd/radiusd.pid" Fri May 14 19:59:04 2010 : Debug: checkrad = "/home/test/freeradius-2.1.8/sbin/checkrad" Fri May 14 19:59:04 2010 : Debug: debug_level = 0 Fri May 14 19:59:04 2010 : Debug: proxy_requests = yes Fri May 14 19:59:04 2010 : Debug: log { Fri May 14 19:59:04 2010 : Debug: stripped_names = no Fri May 14 19:59:04 2010 : Debug: auth = no Fri May 14 19:59:04 2010 : Debug: auth_badpass = no Fri May 14 19:59:04 2010 : Debug: auth_goodpass = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: security { Fri May 14 19:59:04 2010 : Debug: max_attributes = 200 Fri May 14 19:59:04 2010 : Debug: reject_delay = 1 Fri May 14 19:59:04 2010 : Debug: status_server = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri May 14 19:59:04 2010 : Debug: proxy server { Fri May 14 19:59:04 2010 : Debug: retry_delay = 5 Fri May 14 19:59:04 2010 : Debug: retry_count = 3 Fri May 14 19:59:04 2010 : Debug: default_fallback = no Fri May 14 19:59:04 2010 : Debug: dead_time = 120 Fri May 14 19:59:04 2010 : Debug: wake_all_if_all_dead = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server localhost { Fri May 14 19:59:04 2010 : Debug: ipaddr = 127.0.0.1 Fri May 14 19:59:04 2010 : Debug: port = 1812 Fri May 14 19:59:04 2010 : Debug: type = "auth" Fri May 14 19:59:04 2010 : Debug: secret = "testing123" Fri May 14 19:59:04 2010 : Debug: response_window = 20 Fri May 14 19:59:04 2010 : Debug: max_outstanding = 65536 Fri May 14 19:59:04 2010 : Debug: require_message_authenticator = no Fri May 14 19:59:04 2010 : Debug: zombie_period = 40 Fri May 14 19:59:04 2010 : Debug: status_check = "status-server" Fri May 14 19:59:04 2010 : Debug: ping_interval = 30 Fri May 14 19:59:04 2010 : Debug: check_interval = 30 Fri May 14 19:59:04 2010 : Debug: num_answers_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: num_pings_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: revive_interval = 120 Fri May 14 19:59:04 2010 : Debug: status_check_timeout = 4 Fri May 14 19:59:04 2010 : Debug: irt = 2 Fri May 14 19:59:04 2010 : Debug: mrt = 16 Fri May 14 19:59:04 2010 : Debug: mrc = 5 Fri May 14 19:59:04 2010 : Debug: mrd = 30 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server_pool my_auth_failover { Fri May 14 19:59:04 2010 : Debug: type = fail-over Fri May 14 19:59:04 2010 : Debug: home_server = localhost Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: realm example.com { Fri May 14 19:59:04 2010 : Debug: auth_pool = my_auth_failover Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: realm LOCAL { Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server localhost-coa { Fri May 14 19:59:04 2010 : Debug: ipaddr = 127.0.0.1 Fri May 14 19:59:04 2010 : Debug: port = 3799 Fri May 14 19:59:04 2010 : Debug: type = "coa" Fri May 14 19:59:04 2010 : Debug: secret = "testing1234" Fri May 14 19:59:04 2010 : Debug: response_window = 30 Fri May 14 19:59:04 2010 : Debug: max_outstanding = 65536 Fri May 14 19:59:04 2010 : Debug: zombie_period = 40 Fri May 14 19:59:04 2010 : Debug: status_check = "none" Fri May 14 19:59:04 2010 : Debug: ping_interval = 30 Fri May 14 19:59:04 2010 : Debug: check_interval = 30 Fri May 14 19:59:04 2010 : Debug: num_answers_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: num_pings_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: revive_interval = 300 Fri May 14 19:59:04 2010 : Debug: status_check_timeout = 4 Fri May 14 19:59:04 2010 : Debug: irt = 2 Fri May 14 19:59:04 2010 : Debug: mrt = 16 Fri May 14 19:59:04 2010 : Debug: mrc = 5 Fri May 14 19:59:04 2010 : Debug: mrd = 30 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server_pool coa { Fri May 14 19:59:04 2010 : Debug: type = fail-over Fri May 14 19:59:04 2010 : Debug: virtual_server = originate-coa.example.com Fri May 14 19:59:04 2010 : Debug: home_server = localhost-coa Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Loading Clients #### Fri May 14 19:59:04 2010 : Debug: client localhost { Fri May 14 19:59:04 2010 : Debug: ipaddr = 127.0.0.1 Fri May 14 19:59:04 2010 : Debug: require_message_authenticator = no Fri May 14 19:59:04 2010 : Debug: secret = "testing123" Fri May 14 19:59:04 2010 : Debug: nastype = "other" Fri May 14 19:59:04 2010 : Debug: coa_server = "localhost-coa" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Instantiating modules #### Fri May 14 19:59:04 2010 : Debug: instantiate { Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_exec Fri May 14 19:59:04 2010 : Debug: Module: Instantiating exec Fri May 14 19:59:04 2010 : Debug: exec { Fri May 14 19:59:04 2010 : Debug: wait = no Fri May 14 19:59:04 2010 : Debug: input_pairs = "request" Fri May 14 19:59:04 2010 : Debug: shell_escape = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_expr Fri May 14 19:59:04 2010 : Debug: Module: Instantiating expr Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_expiration Fri May 14 19:59:04 2010 : Debug: Module: Instantiating expiration Fri May 14 19:59:04 2010 : Debug: expiration { Fri May 14 19:59:04 2010 : Debug: reply-message = "Password Has Expired " Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_logintime Fri May 14 19:59:04 2010 : Debug: Module: Instantiating logintime Fri May 14 19:59:04 2010 : Debug: logintime { Fri May 14 19:59:04 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Fri May 14 19:59:04 2010 : Debug: minimum-timeout = 60 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Loading Virtual Servers #### Fri May 14 19:59:04 2010 : Debug: server originate-coa.example.com { Fri May 14 19:59:04 2010 : Debug: modules { Fri May 14 19:59:04 2010 : Debug: Module: Checking pre-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_always, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_always Fri May 14 19:59:04 2010 : Debug: Module: Instantiating ok Fri May 14 19:59:04 2010 : Debug: always ok { Fri May 14 19:59:04 2010 : Debug: rcode = "ok" Fri May 14 19:59:04 2010 : Debug: simulcount = 0 Fri May 14 19:59:04 2010 : Debug: mpp = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Instantiating fail Fri May 14 19:59:04 2010 : Debug: always fail { Fri May 14 19:59:04 2010 : Debug: rcode = "fail" Fri May 14 19:59:04 2010 : Debug: simulcount = 0 Fri May 14 19:59:04 2010 : Debug: mpp = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } # modules Fri May 14 19:59:04 2010 : Debug: } # server Fri May 14 19:59:04 2010 : Debug: server inner-tunnel { Fri May 14 19:59:04 2010 : Debug: modules { Fri May 14 19:59:04 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_pap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating pap Fri May 14 19:59:04 2010 : Debug: pap { Fri May 14 19:59:04 2010 : Debug: encryption_scheme = "auto" Fri May 14 19:59:04 2010 : Debug: auto_header = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_chap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating chap Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_mschap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating mschap Fri May 14 19:59:04 2010 : Debug: mschap { Fri May 14 19:59:04 2010 : Debug: use_mppe = yes Fri May 14 19:59:04 2010 : Debug: require_encryption = no Fri May 14 19:59:04 2010 : Debug: require_strong = no Fri May 14 19:59:04 2010 : Debug: with_ntdomain_hack = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_unix Fri May 14 19:59:04 2010 : Debug: Module: Instantiating unix Fri May 14 19:59:04 2010 : Debug: unix { Fri May 14 19:59:04 2010 : Debug: radwtmp = "/home/test/freeradius-2.1.8/var/log/radius/radwtmp" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_eap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap Fri May 14 19:59:04 2010 : Debug: eap { Fri May 14 19:59:04 2010 : Debug: default_eap_type = "md5" Fri May 14 19:59:04 2010 : Debug: timer_expire = 60 Fri May 14 19:59:04 2010 : Debug: ignore_unknown_eap_types = no Fri May 14 19:59:04 2010 : Debug: cisco_accounting_username_bug = no Fri May 14 19:59:04 2010 : Debug: max_sessions = 4096 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-md5 Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-leap Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-gtc Fri May 14 19:59:04 2010 : Debug: gtc { Fri May 14 19:59:04 2010 : Debug: challenge = "Password: " Fri May 14 19:59:04 2010 : Debug: auth_type = "PAP" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-tls Fri May 14 19:59:04 2010 : Debug: tls { Fri May 14 19:59:04 2010 : Debug: rsa_key_exchange = no Fri May 14 19:59:04 2010 : Debug: dh_key_exchange = yes Fri May 14 19:59:04 2010 : Debug: rsa_key_length = 512 Fri May 14 19:59:04 2010 : Debug: dh_key_length = 512 Fri May 14 19:59:04 2010 : Debug: verify_depth = 0 Fri May 14 19:59:04 2010 : Debug: pem_file_type = yes Fri May 14 19:59:04 2010 : Debug: private_key_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/server.pem" Fri May 14 19:59:04 2010 : Debug: certificate_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/server.pem" Fri May 14 19:59:04 2010 : Debug: CA_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/ca.pem" Fri May 14 19:59:04 2010 : Debug: private_key_password = "whatever" Fri May 14 19:59:04 2010 : Debug: dh_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/dh" Fri May 14 19:59:04 2010 : Debug: random_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/random" Fri May 14 19:59:04 2010 : Debug: fragment_size = 1024 Fri May 14 19:59:04 2010 : Debug: include_length = yes Fri May 14 19:59:04 2010 : Debug: check_crl = no Fri May 14 19:59:04 2010 : Debug: cipher_list = "DEFAULT" Fri May 14 19:59:04 2010 : Debug: make_cert_command = "/home/test/freeradius-2.1.8/etc/raddb/certs/bootstrap" Fri May 14 19:59:04 2010 : Debug: cache { Fri May 14 19:59:04 2010 : Debug: enable = no Fri May 14 19:59:04 2010 : Debug: lifetime = 24 Fri May 14 19:59:04 2010 : Debug: max_entries = 255 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-ttls Fri May 14 19:59:04 2010 : Debug: ttls { Fri May 14 19:59:04 2010 : Debug: default_eap_type = "md5" Fri May 14 19:59:04 2010 : Debug: copy_request_to_tunnel = no Fri May 14 19:59:04 2010 : Debug: use_tunneled_reply = no Fri May 14 19:59:04 2010 : Debug: virtual_server = "inner-tunnel" Fri May 14 19:59:04 2010 : Debug: include_length = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-peap Fri May 14 19:59:04 2010 : Debug: peap { Fri May 14 19:59:04 2010 : Debug: default_eap_type = "mschapv2" Fri May 14 19:59:04 2010 : Debug: copy_request_to_tunnel = no Fri May 14 19:59:04 2010 : Debug: use_tunneled_reply = no Fri May 14 19:59:04 2010 : Debug: proxy_tunneled_request_as_eap = yes Fri May 14 19:59:04 2010 : Debug: virtual_server = "inner-tunnel" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-mschapv2 Fri May 14 19:59:04 2010 : Debug: mschapv2 { Fri May 14 19:59:04 2010 : Debug: with_ntdomain_hack = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_realm Fri May 14 19:59:04 2010 : Debug: Module: Instantiating suffix Fri May 14 19:59:04 2010 : Debug: realm suffix { Fri May 14 19:59:04 2010 : Debug: format = "suffix" Fri May 14 19:59:04 2010 : Debug: delimiter = "@" Fri May 14 19:59:04 2010 : Debug: ignore_default = no Fri May 14 19:59:04 2010 : Debug: ignore_null = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_files, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_files Fri May 14 19:59:04 2010 : Debug: Module: Instantiating files Fri May 14 19:59:04 2010 : Debug: files { Fri May 14 19:59:04 2010 : Debug: usersfile = "/home/test/freeradius-2.1.8/etc/raddb/users" Fri May 14 19:59:04 2010 : Debug: acctusersfile = "/home/test/freeradius-2.1.8/etc/raddb/acct_users" Fri May 14 19:59:04 2010 : Debug: preproxy_usersfile = "/home/test/freeradius-2.1.8/etc/raddb/preproxy_users" Fri May 14 19:59:04 2010 : Debug: compat = "no" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking session {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_radutmp Fri May 14 19:59:04 2010 : Debug: Module: Instantiating radutmp Fri May 14 19:59:04 2010 : Debug: radutmp { Fri May 14 19:59:04 2010 : Debug: filename = "/home/test/freeradius-2.1.8/var/log/radius/radutmp" Fri May 14 19:59:04 2010 : Debug: username = "%{User-Name}" Fri May 14 19:59:04 2010 : Debug: case_sensitive = yes Fri May 14 19:59:04 2010 : Debug: check_with_nas = yes Fri May 14 19:59:04 2010 : Debug: perm = 384 Fri May 14 19:59:04 2010 : Debug: callerid = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_attr_filter Fri May 14 19:59:04 2010 : Debug: Module: Instantiating attr_filter.access_reject Fri May 14 19:59:04 2010 : Debug: attr_filter attr_filter.access_reject { Fri May 14 19:59:04 2010 : Debug: attrsfile = "/home/test/freeradius-2.1.8/etc/raddb/attrs.access_reject" Fri May 14 19:59:04 2010 : Debug: key = "%{User-Name}" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } # modules Fri May 14 19:59:04 2010 : Debug: } # server Fri May 14 19:59:04 2010 : Debug: server { Fri May 14 19:59:04 2010 : Debug: modules { Fri May 14 19:59:04 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_preprocess Fri May 14 19:59:04 2010 : Debug: Module: Instantiating preprocess Fri May 14 19:59:04 2010 : Debug: preprocess { Fri May 14 19:59:04 2010 : Debug: huntgroups = "/home/test/freeradius-2.1.8/etc/raddb/huntgroups" Fri May 14 19:59:04 2010 : Debug: hints = "/home/test/freeradius-2.1.8/etc/raddb/hints" Fri May 14 19:59:04 2010 : Debug: with_ascend_hack = no Fri May 14 19:59:04 2010 : Debug: ascend_channels_per_line = 23 Fri May 14 19:59:04 2010 : Debug: with_ntdomain_hack = no Fri May 14 19:59:04 2010 : Debug: with_specialix_jetstream_hack = no Fri May 14 19:59:04 2010 : Debug: with_cisco_vsa_hack = no Fri May 14 19:59:04 2010 : Debug: with_alvarion_vsa_hack = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking preacct {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_acct_unique Fri May 14 19:59:04 2010 : Debug: Module: Instantiating acct_unique Fri May 14 19:59:04 2010 : Debug: acct_unique { Fri May 14 19:59:04 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking accounting {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_detail Fri May 14 19:59:04 2010 : Debug: Module: Instantiating detail Fri May 14 19:59:04 2010 : Debug: detail { Fri May 14 19:59:04 2010 : Debug: detailfile = "/home/test/freeradius-2.1.8/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Fri May 14 19:59:04 2010 : Debug: header = "%t" Fri May 14 19:59:04 2010 : Debug: detailperm = 384 Fri May 14 19:59:04 2010 : Debug: dirperm = 493 Fri May 14 19:59:04 2010 : Debug: locking = no Fri May 14 19:59:04 2010 : Debug: log_packet_header = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Instantiating attr_filter.accounting_response Fri May 14 19:59:04 2010 : Debug: attr_filter attr_filter.accounting_response { Fri May 14 19:59:04 2010 : Debug: attrsfile = "/home/test/freeradius-2.1.8/etc/raddb/attrs.accounting_response" Fri May 14 19:59:04 2010 : Debug: key = "%{User-Name}" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking session {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: } # modules Fri May 14 19:59:04 2010 : Debug: } # server Fri May 14 19:59:04 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: type = "auth" Fri May 14 19:59:04 2010 : Debug: ipaddr = * Fri May 14 19:59:04 2010 : Debug: port = 0 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: type = "acct" Fri May 14 19:59:04 2010 : Debug: ipaddr = * Fri May 14 19:59:04 2010 : Debug: port = 0 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: type = "control" Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: socket = "/home/test/freeradius-2.1.8/var/run/radiusd/radiusd.sock" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Listening on authentication address * port 1812 Fri May 14 19:59:04 2010 : Debug: Listening on accounting address * port 1813 Fri May 14 19:59:04 2010 : Debug: Listening on command file /home/test/freeradius-2.1.8/var/run/radiusd/radiusd.sock Fri May 14 19:59:04 2010 : Debug: Listening on proxy address * port 1814 Fri May 14 19:59:04 2010 : Info: Ready to process requests.

3 5

Free Radius testing....
by John Raja 16 May '10

16 May '10

Hi, I have installed freeradius server in centos. I am trying to test with below mentioned command i am getting the error output as given below , Please help me out... I have created the username in the user file "bob Cleartext-Password := "hello" *Command* # radtest bob bob localhost 1812 testing *Output* Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 radclient: no response from server for ID 147 socket 3 ************************************************************************************************************************************************ Regards, John Raja Network Engineer IP Extn : 500092 Te : 022-40609028 </pre><img src="http://www.5paisa.com/Logo-change-signature.gif"><p><small> Confidentiality & Disclaimer: This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mails are notencrypted and cannot be guaranteed to be secured or error-free as information could be intercepted, corrupted, lost, destroyed arrive late or incomplete, or contain viruses. The sender, which includes India Infoline Limited and its group companies, will not be liable for any errors or ommissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.</small>

3 2