July 2010 - Freeradius-Users - lists.freeradius.org

thanks
by Johnny R 30 Jul '10

30 Jul '10

Hi List, Just want to thank U all & the development team for your support. Especially Alan. In fact, finally my infrastructure has been implemented( just following the daily thread): 1/- CP ----- AAA Serv ----- OpenLDAP serv --- MySQL Serv --- SendMail (it was dedicated for 802.11i using open source software) 2/ OpenVPN serv -AAA serv - OpenLDAP serv - MySQL Serv --- SendMail Email, and SMS notifications is sent to admin if someone is trying or already connected ...(Nagios) Thank U all. All The Best. -- ----------------------------------------------------------------- |JJohnny RANDRIAMAMPIONONA | | Phone: +212663682554 | | National School of Applied Sciences | | 1818 TANGIER 90000 | |----------------------------------------------------------------|

1 0

Freeradius AS DHCP + rlm_perl
by Urazaev Vadim 30 Jul '10

30 Jul '10

Hi everybody. FreeRadius ver. 2.1.10 from git My problem is string : ======================= ++[perl] returns reject ======================== from radiusd -X debug The last strings in perl script that executed : &radiusd::radlog(L_ERR, " --- RLM_MODULE_OK ---".RLM_MODULE_OK."----") if $DEBUG; return RLM_MODULE_OK; As you can see from output radiusd -X log message --- RLM_MODULE_OK --- then I`m expected some thing like that ++[perl] returns ok I think maybe it`s because I`m using wrong return code and tried to return 3 , but it didn`t help. Please give me advice. Thanks. radiusd -X output is : FreeRADIUS Version 2.1.10, for host i386-unknown-freebsd7.2, built on Jul 30 2010 at 11:27:44 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/dhcp main { user = "freeradius" group = "freeradius" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.9" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server dhcp { modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Checking dhcp DHCP-Release {...} for more modules to load Module: Instantiating handled always handled { rcode = "handled" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Inform {...} for more modules to load Module: Checking dhcp (null) {...} for more modules to load /usr/local/etc/raddb/sites-enabled/dhcp[156]: No name specified for Post-Auth-Type block } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "dhcp" ipaddr = 192.168.40.5 port = 67 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on dhcp address 192.168.40.5 port 67 as server dhcp Listening on proxy address * port 1814 Ready to process requests. Received DHCP-Discover of id d52ca059 from 192.168.40.17:68 to 192.168.40.5:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 3576471641 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 192.168.40.17 DHCP-Client-Hardware-Address = 00:19:db:ee:ce:a6 DHCP-Message-Type = DHCP-Discover DHCP-Requested-IP-Address = 192.168.1.122 DHCP-Hostname = "urazaev-laptop" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = DHCP-NTP-Servers DHCP-Relay-Circuit-Id = 0x000400010101 DHCP-Relay-Remote-Id = 0x0006001ee5d09d87 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} expand: %{Packet-Dst-IP-Address} -> 192.168.40.5 ++[reply] returns noop rlm_perl: --- START --- rlm_perl: --- Circuit-ID Found: 0x000400010101 rlm_perl: --- Switch: 192.168.40.17, Vlan: 1, Port: 1, UIP: 0.0.0.0, UMAC: 00:19:db:ee:ce:a6 --- rlm_perl: --- DHCP-Packet-Type: DHCP-Discover rlm_perl: --- Searching for possible ips in DB --- rlm_perl: --- Found 1 possible ips in DB rlm_perl: --- Found only one possible IP for this port in DB --- rlm_perl: --- IP: 10.128.0.244 MASK: 255.255.255.0 GW: 10.128.0.1 --- rlm_perl: --- RAD_REPLY Formed. --- rlm_perl: --- RLM_MODULE_OK ---2---- rlm_perl: Added pair DHCP-Your-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Relay-Circuit-Id = 0x000400010101 rlm_perl: Added pair DHCP-Message-Type = DHCP-Discover rlm_perl: Added pair DHCP-Hop-Count = 1 rlm_perl: Added pair DHCP-Relay-Remote-Id = 0x0006001ee5d09d87 rlm_perl: Added pair DHCP-Number-of-Seconds = 0 rlm_perl: Added pair DHCP-Client-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Gateway-IP-Address = 192.168.40.17 rlm_perl: Added pair DHCP-Hardware-Type = Ethernet rlm_perl: Added pair DHCP-Flags = 0 rlm_perl: Added pair DHCP-Hardware-Address-Length = 6 rlm_perl: Added pair DHCP-Hostname = urazaev-laptop rlm_perl: Added pair DHCP-Opcode = Client-Message rlm_perl: Added pair DHCP-Transaction-Id = 3576471641 rlm_perl: Added pair DHCP-Client-Hardware-Address = 00:19:db:ee:ce:a6 rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Subnet-Mask rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Broadcast-Address rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Time-Offset rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Router-Address rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name-Server rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Search rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Hostname rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Classless-Static-Route rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NTP-Servers rlm_perl: Added pair DHCP-Server-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Requested-IP-Address = 192.168.1.122 rlm_perl: Added pair DHCP-Your-IP-Address = 10.128.0.244 rlm_perl: Added pair DHCP-DHCP-Server-Identifier = 192.168.40.5 rlm_perl: Added pair DHCP-Subnet-Mask = 255.255.255.0 rlm_perl: Added pair DHCP-Domain-Name-Server = 195.64.148.2 rlm_perl: Added pair DHCP-Server-IP-Address = 192.168.40.5 rlm_perl: Added pair DHCP-IP-Address-Lease-Time = 120 rlm_perl: Added pair DHCP-Router-Address = 10.128.0.1 ++[perl] returns reject } # server dhcp Finished request 0. Cleaning up request 0 ID -718495655 with timestamp +2 Going to the next request Ready to process requests.

2 2

unlang and 1st of 4 ldap source fail
by Gary Prosser 30 Jul '10

30 Jul '10

Hi I am using FreeRADIUS Version 2.0.4 On failure of the first of 4 ldap sources the freeradius server does not continue to the next source but reports 'failed'. In radiusd.conf modules I have defined 4 ldap items ldap ldap1 { server = "192.168.4.250" identity = "cn=LDAPBIND,cn=Users,dc=public,dc=trinity-bris,dc=ac,dc=uk" password = * basedn = "OU=Students,DC=PUBLIC,DC=trinity-bris,DC=ac,DC=uk" filter = "(samAccountName= %{%{Stripped-User-Name}:-%{User-Name}})" access_attr = "samAccountName" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 3 } ldap ldap2 { [relevant config] } ldap ldap3 { [relevant config] } ldap ldap4{ [relevant config] } in authorise I have authorize { preprocess chap mschap suffix ldap1 if(notfound || fail){ ldap3 if(notfound || fail){ ldap2 if(notfound || fail){ ldap4 } } } files pap } and in authenticate I have authenticate { ldap1 ldap2 ldap3 ldap4 chap } My ldap1 source is down yet server does not continue to next, ldap3 etc but simply reports failed. Prior to ldap source ldap1 going offline all worked as expected ie finding valid logins in ldap3 or ldap2 or ldap4 Is my unlang incorrect ? Thanks, Gary - IT Manager Trinity College, Bristol (http://www.trinity-bris.ac.uk) To ensure you receive email from Trinity College into your inbox, please add @trinity-bris.ac.uk to your email safe list (also known as whitelist).

3 4

Re: Freeradius-Users Digest, Vol 63, Issue 108
by Gilbert Lo 30 Jul '10

30 Jul '10

Thank you for your message. I am away until Aug 9. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

FreeRADIUS as dhcp
by Urazaev Vadim 30 Jul '10

30 Jul '10

Hello all. I tried to configure freeradius to operate as dhcp server and reach the point from where I can`t proceed. the version of freeradius is 2.1.9 I have two situation 1. DHCP Discover packet comes from client who directly connected to network which freerasdius listen on. 2. DHCP Discover packet comes from relaying agent (Switch Linksys SPS224G4) Then I see in debug (radiusd -xxX) something like that In first case : ---------------- Received DHCP-Discover of id 359f8b7a from 0.0.0.0:68 to 0.0.0.0:6701 01 06 00 35 9f 8b 7a 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 7f 5f ff bf 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 37 0f 01 02 03 06 0c 0f 1c 1d 1f 21 28 29 2a 2c 2d ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending DHCP-Offer of id 359f8b7a from 0.0.0.0:67 to 255.255.255.255:680: 02 01 06 00 35 9f 8b 7a 00 00 00 00 00 00 00 00 16: 00 00 00 00 c0 a8 28 05 00 00 00 00 00 10 7f 5f 32: ff bf 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 02 01 04 ff ff ff 00 03 04 c0 a8 28 05 06 256: 08 c2 40 94 02 c3 40 94 01 33 04 00 01 51 80 36 272: 04 c0 a8 28 05 ff 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================= In second case I can see only DHCP Discover It seems like freeradius just ignores the packets that was relayed ================================================================= Received DHCP-Discover of id 12019719 from 192.168.40.17:68 to 0.0.0.0:6701 01 06 01 12 01 97 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a8 28 11 00 19 db ee ce a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 3d 07 01 00 19 db ee ce a6 52 12 01 06 00 04 00 01 01 01 02 08 00 06 00 1e e5 d0 9d 87 ff ================================================= Please give me a kick in right direction. ================================================= Full Output radiusd -X Thu Jul 29 16:24:58 2010 : Info: FreeRADIUS Version 2.1.9, for host i386-portbld-freebsd7.2, built on Jul 27 2010 at 08:03:44 Thu Jul 29 16:24:58 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Thu Jul 29 16:24:58 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Thu Jul 29 16:24:58 2010 : Info: PARTICULAR PURPOSE. Thu Jul 29 16:24:58 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Thu Jul 29 16:24:58 2010 : Info: GNU General Public License v2. Thu Jul 29 16:24:58 2010 : Info: Starting - reading configuration files ... Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Thu Jul 29 16:24:58 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Thu Jul 29 16:24:58 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/dhcp Thu Jul 29 16:24:58 2010 : Debug: main { Thu Jul 29 16:24:58 2010 : Debug: user = "freeradius" Thu Jul 29 16:24:58 2010 : Debug: group = "freeradius" Thu Jul 29 16:24:58 2010 : Debug: allow_core_dumps = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Thu Jul 29 16:24:58 2010 : Debug: main { Thu Jul 29 16:24:58 2010 : Debug: prefix = "/usr/local" Thu Jul 29 16:24:58 2010 : Debug: localstatedir = "/var" Thu Jul 29 16:24:58 2010 : Debug: logdir = "/var/log" Thu Jul 29 16:24:58 2010 : Debug: libdir = "/usr/local/lib/freeradius-2.1.9" Thu Jul 29 16:24:58 2010 : Debug: radacctdir = "/var/log/radacct" Thu Jul 29 16:24:58 2010 : Debug: hostname_lookups = no Thu Jul 29 16:24:58 2010 : Debug: max_request_time = 30 Thu Jul 29 16:24:58 2010 : Debug: cleanup_delay = 5 Thu Jul 29 16:24:58 2010 : Debug: max_requests = 1024 Thu Jul 29 16:24:58 2010 : Debug: pidfile = "/var/run/radiusd/radiusd.pid" Thu Jul 29 16:24:58 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Thu Jul 29 16:24:58 2010 : Debug: debug_level = 0 Thu Jul 29 16:24:58 2010 : Debug: proxy_requests = yes Thu Jul 29 16:24:58 2010 : Debug: log { Thu Jul 29 16:24:58 2010 : Debug: stripped_names = no Thu Jul 29 16:24:58 2010 : Debug: auth = yes Thu Jul 29 16:24:58 2010 : Debug: auth_badpass = no Thu Jul 29 16:24:58 2010 : Debug: auth_goodpass = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: security { Thu Jul 29 16:24:58 2010 : Debug: max_attributes = 200 Thu Jul 29 16:24:58 2010 : Debug: reject_delay = 1 Thu Jul 29 16:24:58 2010 : Debug: status_server = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Thu Jul 29 16:24:58 2010 : Debug: proxy server { Thu Jul 29 16:24:58 2010 : Debug: retry_delay = 5 Thu Jul 29 16:24:58 2010 : Debug: retry_count = 3 Thu Jul 29 16:24:58 2010 : Debug: default_fallback = no Thu Jul 29 16:24:58 2010 : Debug: dead_time = 120 Thu Jul 29 16:24:58 2010 : Debug: wake_all_if_all_dead = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: home_server localhost { Thu Jul 29 16:24:58 2010 : Debug: ipaddr = 127.0.0.1 Thu Jul 29 16:24:58 2010 : Debug: port = 1812 Thu Jul 29 16:24:58 2010 : Debug: type = "auth" Thu Jul 29 16:24:58 2010 : Debug: secret = "testing123" Thu Jul 29 16:24:58 2010 : Debug: response_window = 20 Thu Jul 29 16:24:58 2010 : Debug: max_outstanding = 65536 Thu Jul 29 16:24:58 2010 : Debug: require_message_authenticator = no Thu Jul 29 16:24:58 2010 : Debug: zombie_period = 40 Thu Jul 29 16:24:58 2010 : Debug: status_check = "status-server" Thu Jul 29 16:24:58 2010 : Debug: ping_interval = 30 Thu Jul 29 16:24:58 2010 : Debug: check_interval = 30 Thu Jul 29 16:24:58 2010 : Debug: num_answers_to_alive = 3 Thu Jul 29 16:24:58 2010 : Debug: num_pings_to_alive = 3 Thu Jul 29 16:24:58 2010 : Debug: revive_interval = 120 Thu Jul 29 16:24:58 2010 : Debug: status_check_timeout = 4 Thu Jul 29 16:24:58 2010 : Debug: irt = 2 Thu Jul 29 16:24:58 2010 : Debug: mrt = 16 Thu Jul 29 16:24:58 2010 : Debug: mrc = 5 Thu Jul 29 16:24:58 2010 : Debug: mrd = 30 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: home_server_pool my_auth_failover { Thu Jul 29 16:24:58 2010 : Debug: type = fail-over Thu Jul 29 16:24:58 2010 : Debug: home_server = localhost Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: realm example.com { Thu Jul 29 16:24:58 2010 : Debug: auth_pool = my_auth_failover Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: realm LOCAL { Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Loading Clients #### Thu Jul 29 16:24:58 2010 : Debug: client localhost { Thu Jul 29 16:24:58 2010 : Debug: ipaddr = 127.0.0.1 Thu Jul 29 16:24:58 2010 : Debug: require_message_authenticator = no Thu Jul 29 16:24:58 2010 : Debug: secret = "testing123" Thu Jul 29 16:24:58 2010 : Debug: nastype = "other" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Instantiating modules #### Thu Jul 29 16:24:58 2010 : Debug: instantiate { Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_exec Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating exec Thu Jul 29 16:24:58 2010 : Debug: exec { Thu Jul 29 16:24:58 2010 : Debug: wait = no Thu Jul 29 16:24:58 2010 : Debug: input_pairs = "request" Thu Jul 29 16:24:58 2010 : Debug: shell_escape = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_expr Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating expr Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_expiration Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating expiration Thu Jul 29 16:24:58 2010 : Debug: expiration { Thu Jul 29 16:24:58 2010 : Debug: reply-message = "Password Has Expired " Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_logintime Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating logintime Thu Jul 29 16:24:58 2010 : Debug: logintime { Thu Jul 29 16:24:58 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Thu Jul 29 16:24:58 2010 : Debug: minimum-timeout = 60 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Loading Virtual Servers #### Thu Jul 29 16:24:58 2010 : Debug: server inner-tunnel { Thu Jul 29 16:24:58 2010 : Debug: modules { Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_pap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating pap Thu Jul 29 16:24:58 2010 : Debug: pap { Thu Jul 29 16:24:58 2010 : Debug: encryption_scheme = "auto" Thu Jul 29 16:24:58 2010 : Debug: auto_header = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_chap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating chap Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_mschap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating mschap Thu Jul 29 16:24:58 2010 : Debug: mschap { Thu Jul 29 16:24:58 2010 : Debug: use_mppe = yes Thu Jul 29 16:24:58 2010 : Debug: require_encryption = no Thu Jul 29 16:24:58 2010 : Debug: require_strong = no Thu Jul 29 16:24:58 2010 : Debug: with_ntdomain_hack = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_unix Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating unix Thu Jul 29 16:24:58 2010 : Debug: unix { Thu Jul 29 16:24:58 2010 : Debug: radwtmp = "/var/log/radwtmp" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_eap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap Thu Jul 29 16:24:58 2010 : Debug: eap { Thu Jul 29 16:24:58 2010 : Debug: default_eap_type = "md5" Thu Jul 29 16:24:58 2010 : Debug: timer_expire = 60 Thu Jul 29 16:24:58 2010 : Debug: ignore_unknown_eap_types = no Thu Jul 29 16:24:58 2010 : Debug: cisco_accounting_username_bug = no Thu Jul 29 16:24:58 2010 : Debug: max_sessions = 4096 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-md5 Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-leap Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-gtc Thu Jul 29 16:24:58 2010 : Debug: gtc { Thu Jul 29 16:24:58 2010 : Debug: challenge = "Password: " Thu Jul 29 16:24:58 2010 : Debug: auth_type = "PAP" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-tls Thu Jul 29 16:24:58 2010 : Debug: tls { Thu Jul 29 16:24:58 2010 : Debug: rsa_key_exchange = no Thu Jul 29 16:24:58 2010 : Debug: dh_key_exchange = yes Thu Jul 29 16:24:58 2010 : Debug: rsa_key_length = 512 Thu Jul 29 16:24:58 2010 : Debug: dh_key_length = 512 Thu Jul 29 16:24:58 2010 : Debug: verify_depth = 0 Thu Jul 29 16:24:58 2010 : Debug: pem_file_type = yes Thu Jul 29 16:24:58 2010 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Thu Jul 29 16:24:58 2010 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Thu Jul 29 16:24:58 2010 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Thu Jul 29 16:24:58 2010 : Debug: private_key_password = "whatever" Thu Jul 29 16:24:58 2010 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Thu Jul 29 16:24:58 2010 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Thu Jul 29 16:24:58 2010 : Debug: fragment_size = 1024 Thu Jul 29 16:24:58 2010 : Debug: include_length = yes Thu Jul 29 16:24:58 2010 : Debug: check_crl = no Thu Jul 29 16:24:58 2010 : Debug: cipher_list = "DEFAULT" Thu Jul 29 16:24:58 2010 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Thu Jul 29 16:24:58 2010 : Debug: cache { Thu Jul 29 16:24:58 2010 : Debug: enable = no Thu Jul 29 16:24:58 2010 : Debug: lifetime = 24 Thu Jul 29 16:24:58 2010 : Debug: max_entries = 255 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-ttls Thu Jul 29 16:24:58 2010 : Debug: ttls { Thu Jul 29 16:24:58 2010 : Debug: default_eap_type = "md5" Thu Jul 29 16:24:58 2010 : Debug: copy_request_to_tunnel = no Thu Jul 29 16:24:58 2010 : Debug: use_tunneled_reply = no Thu Jul 29 16:24:58 2010 : Debug: virtual_server = "inner-tunnel" Thu Jul 29 16:24:58 2010 : Debug: include_length = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-peap Thu Jul 29 16:24:58 2010 : Debug: peap { Thu Jul 29 16:24:58 2010 : Debug: default_eap_type = "mschapv2" Thu Jul 29 16:24:58 2010 : Debug: copy_request_to_tunnel = no Thu Jul 29 16:24:58 2010 : Debug: use_tunneled_reply = no Thu Jul 29 16:24:58 2010 : Debug: proxy_tunneled_request_as_eap = yes Thu Jul 29 16:24:58 2010 : Debug: virtual_server = "inner-tunnel" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-mschapv2 Thu Jul 29 16:24:58 2010 : Debug: mschapv2 { Thu Jul 29 16:24:58 2010 : Debug: with_ntdomain_hack = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authorize {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_realm Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating suffix Thu Jul 29 16:24:58 2010 : Debug: realm suffix { Thu Jul 29 16:24:58 2010 : Debug: format = "suffix" Thu Jul 29 16:24:58 2010 : Debug: delimiter = "@" Thu Jul 29 16:24:58 2010 : Debug: ignore_default = no Thu Jul 29 16:24:58 2010 : Debug: ignore_null = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_files, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_files Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating files Thu Jul 29 16:24:58 2010 : Debug: files { Thu Jul 29 16:24:58 2010 : Debug: usersfile = "/usr/local/etc/raddb/users" Thu Jul 29 16:24:58 2010 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Thu Jul 29 16:24:58 2010 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Thu Jul 29 16:24:58 2010 : Debug: compat = "no" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking session {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_radutmp Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating radutmp Thu Jul 29 16:24:58 2010 : Debug: radutmp { Thu Jul 29 16:24:58 2010 : Debug: filename = "/var/log/radutmp" Thu Jul 29 16:24:58 2010 : Debug: username = "%{User-Name}" Thu Jul 29 16:24:58 2010 : Debug: case_sensitive = yes Thu Jul 29 16:24:58 2010 : Debug: check_with_nas = yes Thu Jul 29 16:24:58 2010 : Debug: perm = 384 Thu Jul 29 16:24:58 2010 : Debug: callerid = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-auth {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_attr_filter Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating attr_filter.access_reject Thu Jul 29 16:24:58 2010 : Debug: attr_filter attr_filter.access_reject { Thu Jul 29 16:24:58 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Thu Jul 29 16:24:58 2010 : Debug: key = "%{User-Name}" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } # modules Thu Jul 29 16:24:58 2010 : Debug: } # server Thu Jul 29 16:24:58 2010 : Debug: server dhcp { Thu Jul 29 16:24:58 2010 : Debug: modules { Thu Jul 29 16:24:58 2010 : Debug: Module: Checking dhcp DHCP-Discover {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_always, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_always Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating ok Thu Jul 29 16:24:58 2010 : Debug: always ok { Thu Jul 29 16:24:58 2010 : Debug: rcode = "ok" Thu Jul 29 16:24:58 2010 : Debug: simulcount = 0 Thu Jul 29 16:24:58 2010 : Debug: mpp = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking dhcp DHCP-Request {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking dhcp (null) {...} for more modules to load Thu Jul 29 16:24:58 2010 : Error: /usr/local/etc/raddb/sites-enabled/dhcp[156]: No name specified for Post-Auth-Type block Thu Jul 29 16:24:58 2010 : Debug: } # modules Thu Jul 29 16:24:58 2010 : Debug: } # server Thu Jul 29 16:24:58 2010 : Debug: server { Thu Jul 29 16:24:58 2010 : Debug: modules { Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authorize {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_preprocess Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating preprocess Thu Jul 29 16:24:58 2010 : Debug: preprocess { Thu Jul 29 16:24:58 2010 : Debug: huntgroups = "/usr/local/etc/raddb/huntgroups" Thu Jul 29 16:24:58 2010 : Debug: hints = "/usr/local/etc/raddb/hints" Thu Jul 29 16:24:58 2010 : Debug: with_ascend_hack = no Thu Jul 29 16:24:58 2010 : Debug: ascend_channels_per_line = 23 Thu Jul 29 16:24:58 2010 : Debug: with_ntdomain_hack = no Thu Jul 29 16:24:58 2010 : Debug: with_specialix_jetstream_hack = no Thu Jul 29 16:24:58 2010 : Debug: with_cisco_vsa_hack = no Thu Jul 29 16:24:58 2010 : Debug: with_alvarion_vsa_hack = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking preacct {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_acct_unique Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating acct_unique Thu Jul 29 16:24:58 2010 : Debug: acct_unique { Thu Jul 29 16:24:58 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking accounting {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_detail Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating detail Thu Jul 29 16:24:58 2010 : Debug: detail { Thu Jul 29 16:24:58 2010 : Debug: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" Thu Jul 29 16:24:58 2010 : Debug: header = "%t" Thu Jul 29 16:24:58 2010 : Debug: detailperm = 384 Thu Jul 29 16:24:58 2010 : Debug: dirperm = 493 Thu Jul 29 16:24:58 2010 : Debug: locking = no Thu Jul 29 16:24:58 2010 : Debug: log_packet_header = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating attr_filter.accounting_response Thu Jul 29 16:24:58 2010 : Debug: attr_filter attr_filter.accounting_response { Thu Jul 29 16:24:58 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" Thu Jul 29 16:24:58 2010 : Debug: key = "%{User-Name}" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking session {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-auth {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: } # modules Thu Jul 29 16:24:58 2010 : Debug: } # server Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "auth" Thu Jul 29 16:24:58 2010 : Debug: ipaddr = * Thu Jul 29 16:24:58 2010 : Debug: port = 0 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "acct" Thu Jul 29 16:24:58 2010 : Debug: ipaddr = * Thu Jul 29 16:24:58 2010 : Debug: port = 0 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "control" Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: socket = "/var/run/radiusd/radiusd.sock" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "dhcp" Thu Jul 29 16:24:58 2010 : Debug: ipaddr = * Thu Jul 29 16:24:58 2010 : Debug: port = 67 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Listening on authentication address * port 1812 Thu Jul 29 16:24:58 2010 : Debug: Listening on accounting address * port 1813 Thu Jul 29 16:24:58 2010 : Debug: Listening on command file /var/run/radiusd/radiusd.sock Thu Jul 29 16:24:58 2010 : Debug: Listening on dhcp address * port 67 as server dhcp Thu Jul 29 16:24:58 2010 : Debug: Listening on proxy address * port 1814 Thu Jul 29 16:24:58 2010 : Info: Ready to process requests. Received DHCP-Discover of id 12019719 from 192.168.40.17:68 to 0.0.0.0:6701 01 06 01 12 01 97 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a8 28 11 00 19 db ee ce a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 3d 07 01 00 19 db ee ce a6 52 12 01 06 00 04 00 01 01 01 02 08 00 06 00 1e e5 d0 9d 87 ff

2 2

pap or chap authentication with MS AD Backend
by Sallee, Stephen (Jake) 30 Jul '10

30 Jul '10

Could someone please point me to a good how-to that will explain how to get either pap or chap running using Microsoft AD as a backend? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 2

Grouping similar users to profiles
by Natr Brazell 29 Jul '10

29 Jul '10

I am looking for information on grouping users into profiles/groups. I've searched around the FAQ's and docs but not finding a clear picture. I've found how to associate a user with a group of NAS's. . Here's the scenario. There is a specfic VSA from Juniper called Juniper-Local-User-Name. This gets mapped to a locally defined profile on the NAS. In the users file I have the following: bob.smith Juniper-Local-User-Name = "tier3", mary.jane Juniper-Local-User-Name = "tier3", bobby.sue Juniper-Local-User-Name = "tier3", Furthermore there is other VSA's such as the Juniper-Allow-Commands and Juniper-Deny-Commands. So I can do things like: billy.bob Juniper-Local-User-Name = "tier2", Juniper-Deny-Commands "(show system alarms)|(show system software)" john.doe Juniper-Local-User-Name = "tier2", Juniper-Deny-Commands "(show system alarms)|(show system software)" So to the point, rather than defining each user with the same parameters every time, can I create a group, for instance TIER3, and associate User-Name's above to the group. And if so how or point me to some specific examples. I am using LDAP also so if there is an LDAP solution same question. Howto?

2 4

LDAP authentication problem
by Sallee, Stephen (Jake) 29 Jul '10

29 Jul '10

I have correctly configured the LDAP module (I think...) but when I try to authenticate a user I get an error saying the user cannot be found. I have attached the debug output. I have tried turning the "follow referrals" and "rebind" vars on and off but I get the same outcome. At first, I was getting a timeout error but I increased the timeouts and fixed that. I know the user is correct. Here is the LDAP string for the user: LDAP://CN=dspam,OU=InformationTechnology,OU=UsersByDepartment,OU=Adminis trative,DC=umhb,DC=edu Any ideas? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

Passing variables from inner tunnel
by newtownz 29 Jul '10

29 Jul '10

Hi, I'm trying to pass the value of LDAP-UserDn from the inner-tunnel to the default server. I have read unlang and also tried many combinations including update outer.control from the inner tunnel and nothing worked... Here is a debug output where we can see that the User-Dn get expanded correctly in the tunnel but is empty in the default server. ++[eap] returns ok +- entering group post-auth {...} expand: %{control:LDAP-UserDn} -> cn=aruba,ou=etudiant,o=org Exec-Program output: etudiant Exec-Program-Wait: plaintext: etudiant Exec-Program: returned: 0 ++[reply] returns noop ++[outer.control] returns noop } # server inner-tunnel .... .... [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop expand: %{control:LDAP-UserDn} -> PHP Notice: Undefined offset: 0 in /etc/freeradius/scripts/php3 on line 4 Exec-Program output: dewor Exec-Program-Wait: plaintext: dewor Exec-Program: returned: 0 Thanks Jean -- View this message in context: http://old.nabble.com/Passing-variables-from-inner-tunnel-tp29279811p292798… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 10

Prevent Interim-Update packets being proxied
by Murray Long 29 Jul '10

29 Jul '10

Hi all, I would like to be able to prevent Interim-Update accounting packets for a realm from being proxied. Start and Stop packets need to be proxied, but the Interim-Updated should only be handled locally. Is this possible with freeradius? Many Thanks, Murray

2 1