July 2010 - Freeradius-Users - lists.freeradius.org

dyndns ff 1.1.7
by Tokie 16 Jul '10

16 Jul '10

Hi all, it's possible use dyndns in clients.conf with fr 1.1.7-0?? I have error every time that ip address change. I read many quests on internet but i don't find fixes. Could help me set "hostname_lookups = yes"?? Otherwise, it's possible check by nas-id?? My nas is mikrotik. Thanks Tokie

3 2

Passwd module problem
by Peter Bates 16 Jul '10

16 Jul '10

Hello all... I'm running FR 2.1.9 compiled from source on Debian Linux and using the passwd module for a couple of things. I have one instance called 'mac-auth', configured in modules/mac-auth as: passwd mac-auth { filename = ${confdir}/mac-auth format = "*User-Name:=Tunnel-Private-Group-Id" delimiter = "," } That works fine - the username is mapped to a VLAN-id (as per similar examples in mac2ip and mac2vlan included in the distribution). I also have modules/switch-auth, which contains: passwd switch-auth { filename = ${confdir}/switch-auth format = "*NAS-IP-Address:=Tunnel-Private-Group-Id" delimiter = "," } However, this never matches and the module always returns 'notfound': +- entering group post-auth {...} ++[switch-auth] returns notfound I am calling the module in post-auth but as the 'mac-auth' instance works fine I'm at a loss as to why the other one is failing. -- Peter Bates, Network Support & Development Officer Goldsmiths, University of London New Cross, London SE14 6NW. Telephone: 020 7919 7082

2 1

Retry delay and retry count when proxying requests
by Murray Long 16 Jul '10

16 Jul '10

Hi all, Does anyone know how to set the retry_count and retry_delay values for home servers? Thanks, -Murray

2 8

Backslash issue during AD authetication
by Jevos, Peter 16 Jul '10

16 Jul '10

HI I'd like to autheticate cisco vpn clients against the freeradius and AD Prompt for the vpn client should be domainame\username. In my smb.conf is as the delimiter: winbind separator = \\ ( because backslash is special character, I had to use twice ) This command works: /usr/bin/ntlm_auth --request-nt-key --username=domainame\\username --password=password NT_STATUS_OK: Success (0x0) When i test through radtest it doesn't work : neither radtest domainame\\username password localhost 0 testing123 , or radtest domainame\\\username password localhost 0 testing123, or radtest domainame\username password localhost 0 testing123 However, when i tried to autheticate through vpn cisco client , the string domainame\\username will pass. How can I force freradius to authenticate through domainame\username Thanks Pet

2 2

how to configure Cisco vpn clients againts freeradius
by Jevos, Peter 16 Jul '10

16 Jul '10

Hi I installed the Freeradius and I'd like to authenticate cisco vpn clients against AD Clients are autheticated thorugh domainame\username and password and they need to be a members of the AD group I have already running AD authentication but with the access to the router ( priv level 15 ) What shoud I set in the users file ? My current seetings is: Users: user Auth-Type := ntlm_auth Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" Mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{%{mschap:NT-Domain}:-DOMAINNAME} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Then I added another ntlm authentication for the VPN Cisco clients: ntlm_auth2 = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain:} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of='SOMEDOMAIN+domain users'" And I added this lines into users file: DEFAULT Huntgroup-Name == "vpn" Auth-Type := ntlm_auth2 Huntgroup file: vpn NAS-IP-Address == x.x.x.x , NAS-Port-Type == "Virtual" But it doesn't work When I run command "ntlm_auth --request-nt-key --username=MYNAME --require-membership-of='SOMEDOMAIN+domain users'" , it works Can somebody help me how should look Users file Thanks

2 10

Getting groups to work, from a group file
by Madsen.Jan JMD 16 Jul '10

16 Jul '10

Hello FreeRadius users I'm trying to get some group stuff working in freeradius I want to check a group file for witch group a user is member off, and after that send specific commands back to the radius client, on behalf of witch group the client is a member of. I can't get freeradius to do the correct check on my Group variable in my users file, and I can't figure out what I'm missig or what I'm doing wrong. I have done the following Added my group file to the passwd module passwd groups { filename = /etc/freeradius/radius-groups format = "Group:::*,User-Name" hashsize = 0 delimiter = : ignorenislike = yes allowmultiplekeys = yes } My group file looks like this wcs-superadmin:x:1:admin wcs-monitors:x:2:jmd I have done the following in my users file to send the specific data back to the radius client where my check relies on what the Group variable contains. DEFAULT NAS-IP-Address == 172.31.254.4, Group == "wcs-superadmin" Cisco-AVPair += 'Wireless-WCS:role0=SuperUsers', Cisco-AVPair += 'Wireless-WCS:task0=Users and Groups', Cisco-AVPair += 'Wireless-WCS:task1=Audit Trails' DEFAULT NAS-IP-Address == 172.31.254.4, Group == "wcs-monitors" Cisco-AVPair += 'Wireless-WCS:task0=Users and Groups', Cisco-AVPair += 'Wireless-WCS:task1=Audit Trails' When I run a debug I get the following information rad_recv: Access-Request packet from host 127.0.0.1 port 33646, id=62, length=55 User-Name = "jmd" User-Password = "password" NAS-IP-Address = 172.31.254.4 NAS-Port = 0 Thu Jul 15 09:09:10 2010 : Info: +- entering group authorize {...} Thu Jul 15 09:09:10 2010 : Info: ++[preprocess] returns ok Thu Jul 15 09:09:10 2010 : Info: [kmdov3] Added crypt-Password: 'crpyt-password' to config_items Thu Jul 15 09:09:10 2010 : Info: ++[kmdov3] returns ok Thu Jul 15 09:09:10 2010 : Info: [groups] Added Group: 'wcs-monitors' to config_items Thu Jul 15 09:09:10 2010 : Info: ++[groups] returns ok Thu Jul 15 09:09:10 2010 : Info: ++[chap] returns noop Thu Jul 15 09:09:10 2010 : Info: ++[mschap] returns noop Thu Jul 15 09:09:10 2010 : Info: [suffix] No '@' in User-Name = "jmd", looking up realm NULL Thu Jul 15 09:09:10 2010 : Info: [suffix] No such realm "NULL" Thu Jul 15 09:09:10 2010 : Info: ++[suffix] returns noop Thu Jul 15 09:09:10 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Jul 15 09:09:10 2010 : Info: ++[eap] returns noop Thu Jul 15 09:09:10 2010 : Info: ++[files] returns noop Thu Jul 15 09:09:10 2010 : Info: ++[expiration] returns noop Thu Jul 15 09:09:10 2010 : Info: ++[logintime] returns noop Thu Jul 15 09:09:10 2010 : Info: ++[pap] returns updated Thu Jul 15 09:09:10 2010 : Info: Found Auth-Type = PAP Thu Jul 15 09:09:10 2010 : Info: +- entering group PAP {...} Thu Jul 15 09:09:10 2010 : Info: [pap] login attempt with password "password" Thu Jul 15 09:09:10 2010 : Info: [pap] Using CRYPT encryption. Thu Jul 15 09:09:10 2010 : Info: [pap] User authenticated successfully Thu Jul 15 09:09:10 2010 : Info: ++[pap] returns ok Thu Jul 15 09:09:10 2010 : Info: +- entering group post-auth {...} Thu Jul 15 09:09:10 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 62 to 127.0.0.1 port 33646 Thu Jul 15 09:09:10 2010 : Info: Finished request 1. As you can see the Group: variable is set to 'wcs-monitors' witch is the group jmd is member off. But i never sends the correct data back from the users file. Howto do that ? Best regards Jan Madsen ________________________________________________________________________ __________________ KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. www.kmd.dk www.kundenet.kmd.dk www.organisator.dk www.kmdinternational.com Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig besked herom og slette den. If you received this e-mail by mistake, please notify me and delete it. Thank you. ________________________________________________________________________ __________________ KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. www.kmd.dk www.kundenet.kmd.dk www.organisator.dk www.kmdinternational.com Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig besked herom og slette den. If you received this e-mail by mistake, please notify me and delete it. Thank you.

2 4

DHCP support in freeradius
by Kanwar Ranbir Sandhu 15 Jul '10

15 Jul '10

Hi All, I've read the dhcp config examples in the freeradius package. That means I've also seen the warnings about not actually using it because it's not ready. Oddly, I've find threads in this list about DHCP support in freeradius working just fine. So, which is it? Is the freeradius DHCP support usable or should I still stay away? Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.32.14-127.fc12.x86_64 x86_64 GNU/Linux 17:17:03 up 19 days, 8:04, 7 users, load average: 0.13, 0.10, 0.09

3 3

About rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
by Aziz YÜCELEN 15 Jul '10

15 Jul '10

Hi I setup a freeradius server with mysql and configure both freeradius and mysql configurations. I add a user to radius database and run "freeradius -X" and radtest deneme2 1 x.x.x.x:1812 0 123456 but I have a rejecting error Sending Access-Request of id 255 to 10.1.1.37 port 1812 User-Name = "deneme2" User-Password = "1" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 10.1.1.37 port 1812, id=255, length=20 and freeradius -X output is here.Please help me.Thanks. FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.1.1.252/24 { require_message_authenticator = no secret = "123456" shortname = "BIMAP" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gig! awords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%! {Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input! -Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.37 port 53548, id=255, length=59 User-Name = "deneme2" User-Password = "1" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "deneme2", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [deneme2/1] (from client BIMAP port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> deneme2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 255 to 10.1.1.37 port 53548 Waking up in 4.9 seconds. Cleaning up request 0 ID 255 with timestamp +1169 Ready to process requests. _________________________________________________________________ Windows Live Hotmail: Arkadaşlarınız Facebook'taki güncellemelerinizi doğrudan Hotmail®'den alır. http://www.microsoft.com/windows/windowslive/see-it-in-action/social-networ…

2 2

RE: Freeradius2 and Samba3x
by freeradius＠corwyn.net 15 Jul '10

15 Jul '10

At 11:47 AM 7/14/2010, you wrote: > > Sending Access-Accept of id 225 to 10.4.1.2 port 2452 > > Reply-Message := "Authorized Users Only" > > MS-CHAP2-Success = > > 0x01533d3333394446363039333941453431374638353333384143443632443 > > 9374137343844413541313936 > > MS-MPPE-Recv-Key = 0xd81d386eb6bd95dcd85badccd21036b4 > > MS-MPPE-Send-Key = 0x1415b0a4e0f2d9063a9b0d0e92e2869b > > MS-MPPE-Encryption-Policy = 0x00000001 > > MS-MPPE-Encryption-Types = 0x00000006 > > Wed Jul 14 11:18:38 2010 : Info: Finished request 8. > > Wed Jul 14 11:18:38 2010 : Debug: Going to the next request > > Wed Jul 14 11:18:38 2010 : Debug: Waking up in 4.9 seconds. > > Wed Jul 14 11:18:43 2010 : Info: Cleaning up > > request 8 ID 225 with timestamp +665 > > Wed Jul 14 11:18:43 2010 : Info: Ready to process requests. > > > > Any ideas? > >Any ideas about what - the server returned Access-Accept?? Is this >not what you wanted? What problem are you trying to solve? That my VPN session still doesn't establish. I get back that the user can't be authenticated. rick >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Freeradius kerberos
by Thiago Gonzaga B. Galvão 14 Jul '10

14 Jul '10

Hi guys, I have the following situation on my network... I have an Openldap server working as well, and it stores all my users informations... I configure a Kerberos server to use this openldap as a backend... We would like to implement an Single Sign On to our "web intranet" using kerberos tickets... The user will authenticates onto a freeradius server, it will refer to external source kerberos, and kerberos will be configured with openldap backend (the openldap server that i have). Is it possible??? Instead of freeradius directly authenticates to ldap, it would pass by kerberos, and kerberos communicates with openldap... if userame/passwork ok, the user will be authenticated and receive a kerberos's ticket... And my clients are mostly windows... Is it possible with this scenario that I want, windows clients get kerberos tickets to make a Single Sign On, on my web intranet? Regards, Thiago

5 8