September 2010 - Freeradius-Users - lists.freeradius.org

detail logging not right with IPv6 clients
by Alan Buxey 15 Sep '10

15 Sep '10

hi, believe I have found a small bugette in FreeRADIUS. Although I'm posting to the list to ensure I'm not just being silly or if there is another way to get the result. whilst our config has been tweaked to local requirements, we are running the pretty much standard detail.log module which dumps auth log etc into a subdirectory of the radius log directory eg radacct/127.0.0.1/auth-log-XXXXXXXX or such however, this only works when the client is using IPv4. when the client is using IPv6 then this directory is not made and therefore no nice detail logs are kept for those things...(well, they are, but read on......) ( and its not quite true in our case as we ALSO use another detail module and the buffered-sql virtual server..thanks very much, we are saved. ) however, I'm concerned for those who dont tweak and this 'out of box' detail.log should work..... obviously, its to do with the fact it uses %{Client-IP-Address} as part of the detailfile construction as the logs show: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct//auth-detail-20100914 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct//reply-detail-20100914 and thus all of the detail logs for ANY IPv6 client get munged into the top level directory. alan

2 2

Failed default PAP and PEAP in CentOS
by Javier Richard Quinto Ancieta 14 Sep '10

14 Sep '10

CentOS 5.4 installing freeradius from the default base repository freeradius-1.1.3-1.5.el5_4 If I add, to the top of /etc/raddb/users: bob Cleartext-Password := "hello" Then when I attempt to start freeradius I get: /etc/raddb/users[1]: Parse error (check) for entry bob: Unknown attribute "Cleartext-Password" But I added to the top of /etc/raddb/users of the next way: user User-Password == "pass" Auth-Type := EAP And It's Ok. Now I updated the freeradius to version 2 and I did the same configuration, now I have in users file user Cleartext-Password := "pass" And I do radiusd -X and It's Ok But when I added to the top of /etc/raddb/users of the next way: userY User-Password == "passY" Auth-Type := Local I have the next fail: [root@73 raddb]# radiusd -X FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 200.37.45.97 { require_message_authenticator = no secret = "inictel" shortname = "AP-RADIUS" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/radiuskeycert.pem" certificate_file = "/etc/raddb/certs/radiuskeycert.pem" CA_file = "/etc/raddb/certs/cacert.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Enter PEM pass phrase: Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 52849, id=171, length=58 User-Name = "userYY" User-Password = "passYY" NAS-IP-Address = 0.0.0.73 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "userYY", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> userYY attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 171 to 127.0.0.1 port 52849 Waking up in 4.9 seconds. -- Quinto Ancieta Javier Richard jquinto(a)inictel-uni.edu.pe, richardqa(a)gmail.com telf: 9931-78569-5213902-3461808-533 Remember: Nothing is impossible, because the dreams of yesterday are the hopes of today and tomorrow can become a reality.

3 2

Freeradius + MySql + Wireless Clients without certificates
by Esteban TALAVERA 14 Sep '10

14 Sep '10

Hi I´ll like to know if there is a way to configurates a Radius server + Mysql to authenticate Wireless clients via a Cisco AP without certificates (EAP TLS), only a username and password Thanks -- *Esteban Talavera*

5 10

passing VLAN tag to clients
by matteo＠crs4.it 14 Sep '10

14 Sep '10

Hello, I'm using Freeradius 2.1.8 on Fedora 13 with EAP-TTL and PAP with inner authentication with OpenLDAP as backend. Everything is working fine, but the problem is that I haven't an OpenLDAP "Radius oriented", that is there is no VLAN info in my LDIFs. So, is there a way, external to the authentication process, to pass the vlan tag to the clients so that the ports they're attached to might join the correct vlan? Thanks a lot ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Details of attrbiutes in SQL Table
by Robin 14 Sep '10

14 Sep '10

Hi, I already installed & run FreeRADIUS in my server successfully (FreeRADIUS with CenterOS, Mikrotik RouterOS). I knew usage of some attributes in SQL tables. For example, Insert into TABLE radgroupcheck, add a group name and attribute - Simultaneous-Use:=1 to limit only 1 user to login. Etc. In wiki or manuals or configuration files (sql.conf/dialup.conf/scheme.sql), I haven’t found details of instructions, how many attributes can be used and how do it write? I wish to know how to do, for example as below: - How to add a record to “radreply” table to set any attributes? (ex. Set timeout length to user) - How to add a record to “”radcheck” table to set any attributes? (ex. Set poolname to user) …. Thank you very much! Robin

1 0

Re: use freeRadius client to connect a java application
by Noura Kossentini 14 Sep '10

14 Sep '10

Hi I proposed to use TinyRadius but they refused it. they consider it (contamination risk AND the IPR risk ) So they opt to FreeRadius Client. It's a C library, had to be used from a Java application, it would need to be called either via JNI, or simply linked into a small C main program and then spawned from Java as an external process. I'm a beginner in c development [?]. someone can help me to do this?? thanks in advance 2010/8/31 Michael Lecuyer <mjl(a)iterpacis.org> > Sorry, I was looking at the client in the freeradius server source. > > Now I'm looking at the same source you are looking at. > > > On 2010-08-31 4:37 AM, Noura Kossentini wrote: > >> i downloaded freeradius-client-1.1.6 and in radiusclient.c I found this >> copyright >> >> /* >> * Copyright (c) 2004 Maxim Sobolev <sobomax(a)FreeBSD.org> >> * All rights reserved. >> * >> * Redistribution and use in source and binary forms, with or without >> * modification, are permitted provided that the following conditions >> * are met: >> * 1. Redistributions of source code must retain the above copyright >> * notice, this list of conditions and the following disclaimer. >> * 2. Redistributions in binary form must reproduce the above copyright >> * notice, this list of conditions and the following disclaimer in the >> * documentation and/or other materials provided with the distribution. >> * >> >> Please send me the link to download free radius client you speak about >> >> In this case (radiusclient is a BSD copyright) can I use JNI?? and how? >> >> thanks >> >> 2010/8/30 Michael Lecuyer <mjl(a)iterpacis.org <mailto:mjl@iterpacis.org>> >> >> >> So our production must be supported on all platforms so I think >> that >> using JNI is the good solution. >> >> >> The radius client is not written in a form suitable for JNI. That is >> to say its not modular in the sense most Java programs are. The >> main() function is the only way to call radclient. The radclient >> main() sets all the internal structures up based on the command line >> arguments. >> >> I've just noticed that the FreeRadius radclient.c is released as the >> GNU General Public License which you can't use with your product. >> You might go with tinyradius (LGPL). There are probably other free >> RADIUS clients written in other languages (python, perl). >> >> /* >> * radclient.c General radius packet debug tool. >> * >> * Version: $Id$ >> * >> * This program is free software; you can redistribute it and/or >> modify >> * it under the terms of the GNU General Public License as >> published by >> * the Free Software Foundation; either version 2 of the License, or >> * (at your option) any later version. >> >> >> On 2010-08-30 8:45 AM, Noura Kossentini wrote: >> >> Hi >> >> Thanks for your detailed answer. >> So our production must be supported on all platforms so I think >> that >> using JNI is the good solution. >> Please can you help me on how to use the JNI with freeradius >> client?? >> >> thanks >> >> >> 2010/8/27 Michael Lecuyer <mjl(a)iterpacis.org >> <mailto:mjl@iterpacis.org> <mailto:mjl@iterpacis.org >> >> <mailto:mjl@iterpacis.org>>> >> >> >> The radclient is limited to CHAP, PAP, and Digest >> authentication >> methods. It can send MSCHAP and MSCHAPV2 if you write the >> code to >> build the request (NT-Response & Challenge) and so on (not >> trivial >> to get right). >> >> Otherwise you can direct your attributes to send to the >> Runtime.exec() >> >> Here's some example code for running the radclient: >> >> import java.io.*; >> >> public class RunRadClient >> { >> public static void main(String[] a) >> { >> try { >> RunRadClient t = new RunRadClient(); >> t.go(a); >> } catch (Exception e) { >> e.printStackTrace(); >> } >> } >> >> private void go(String[] a) throws Exception >> { >> >> try { >> //./radclient -c 2 -i 23 -s -x -f /tmp/radattr >> 192.168.1.187 auth axltest >> String path = >> "/usr/src/freeradius/src/main/radclient"; >> >> String[] cmd = { >> path, >> "-c", "1", // Send on packet. >> "-i", "22", // Packet id (change this each time) >> "-s", // Display summary information. >> "192.168.1.187", // Server >> "auth", // Authentication packet. >> "axltest" // Secret >> }; >> >> // Attributes: >> StringBuffer sb = new StringBuffer(); >> sb.append("NAS-IP-Address=192.168.1.187\n"); >> sb.append("NAS-Port =1\n"); >> sb.append("User-Name=michael\n"); >> sb.append("Chap-Password=test\n"); >> >> Process p = Runtime.getRuntime().exec(cmd); >> >> // For our purposes stdin, stdout, and >> stderr are >> reversed in sense because >> // they relate to the exec'd process. >> BufferedReader stderr = new BufferedReader( new >> InputStreamReader(p.getErrorStream())); >> BufferedReader stdout = new BufferedReader( new >> InputStreamReader(p.getInputStream())); >> BufferedWriter stdin = new BufferedWriter( new >> OutputStreamWriter(p.getOutputStream())); >> >> // Build the attributes as a StringBuilder >> and write >> them to stdout. >> stdin.write(sb.toString(), 0, sb.length()); >> stdin.flush(); >> stdin.close(); >> >> p.waitFor(); >> int exitValue = p.exitValue(); >> if (exitValue != 0) >> { >> System.out.println("Error running >> command, >> exit = " + exitValue); >> } >> String line; >> while ((line = stdout.readLine()) != null) >> { >> System.out.println(line); >> } >> } catch (Exception e) { >> System.err.println("Exec failed" + >> e.getMessage()); >> e.printStackTrace(); >> } >> >> } >> } >> >> The result is this, which must be parsed to extract any >> response >> attributes and to get the packet status. >> >> Sending Access-Request of id 100 to 192.168.1.187 port 1812 >> NAS-IP-Address = 192.168.1.187 >> NAS-Port = 1 >> User-Name = "michael" >> CHAP-Password = 0x64234c1d14fde1c04c8590c13b8c9aa181 >> rad_recv: Access-Accept packet from host 192.168.1.187 port >> 1812, >> id=100, length=85 >> Reply-Message = "Howdy." >> Cisco-Attr-0 = 0x683332332d63757272656e63793d555344 >> Cisco-Attr-0 = 0x436973636f2d586d69742d526174653d3939 >> Framed-IP-Address = 192.123.231.123 >> >> Total approved auths: 1 >> Total denied auths: 0 >> Total lost auths: 0 >> >> >> >> >> On 2010-08-27 9:24 AM, Noura Kossentini wrote: >> >> Hi >> >> thanks for quick answer. >> Can you help me on how to use JNI with freeradius client?? >> >> >> 2010/8/27 Michael Lecuyer <mjl(a)iterpacis.org >> <mailto:mjl@iterpacis.org> >> <mailto:mjl@iterpacis.org <mailto:mjl@iterpacis.org>> >> <mailto:mjl@iterpacis.org <mailto:mjl@iterpacis.org> >> >> <mailto:mjl@iterpacis.org <mailto:mjl@iterpacis.org>>>> >> >> >> >> You have two methods: JNI (Java native interface) to >> call the >> Freeradius client or purchase a very good Java >> RADIUS Client API >> from AXLRadius.com >> >> >> On 2010-08-27 7:05 AM, Noura Kossentini wrote: >> >> Hi, >> >> In our company it's forbidden to use products >> with GPL >> License. >> So I ca >> not use Jradius client to connect my client >> application to a >> radius server. >> >> Since that FreeRadius is distributed under BSD, >> it's >> allowed to >> me to >> use this library. >> >> My queqtion is can you help me on how can I >> connect and >> authenticate my >> java application to a radius server using >> FreeRadius >> client?? >> >> Thanks in advance >> >> Regards >> Noura >> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> >> >> >> >> >> >

2 2

Login Incorrect !
by Paulo Maia 14 Sep '10

14 Sep '10

Hi guys , Im trying to authenticate freeradius against passwd , but i keep getting Login Incorrect error , im doing EAP/PEAP mschapv2 I dont know what im missing I can perform a radtest with sucess . Here is the ouput rad_recv: Access-Request packet from host 192.168.0.1 port 2048, id=187, length=232 User-Name = "momo" NAS-Port = 0 Called-Station-Id = "00-22-B0-45-DF-69:SapoNet" Calling-Station-Id = "00-22-FB-73-31-DA" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02080050190017030100201c877f9482d13faf8e1619e14f1e0d909fa7983b184bb9f05c95a6cb6a845796170301002049a23598867fa02bfcf83108e8cb2130d7ebda59dd41304c300ea048c8bfa68d State = 0xad18a6f8aa10bf33ac12d56bfa8b4024 Message-Authenticator = 0xc8a9f7c084d0b839d9340a38c5e328aa +- entering group authorize {...} ++[preprocess] returns ok ++[unix] returns updated [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [momo/<via Auth-Type = EAP>] (from client SapoNet port 0 cli 00-22-FB-73-31-DA) Delaying reject of request 26 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 26 Sending Access-Reject of id 187 to 192.168.0.1 port 2048 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.0 seconds. Here is the conf main { user = "root" group = "root" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.1 { require_message_authenticator = no secret = "teste123" shortname = "SapoNet" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } } # modules } # serverlisten { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. Hope somebody can help me out ! Thanks , radiusd: #### Opening IP addresses and Ports #### Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 dh_key_length = 512 verify_depth = 0 radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients ####

3 2

How to determine packet-type in proxy-reply
by Chidanand Gangur 14 Sep '10

14 Sep '10

Hi, I am using freeRADIUS verison 2.1.9. I am trying to add some attribute in proxy-reply, I want to do it only if it is Access-Accept packet. I am trying to achieve it using unlang. I have tried following options and none of them have worked if (%{proxy-reply:Packet-Type} == 2) { } if(proxy-reply:Packet-Type == "Access-Accept"){ } if(reply:Packet-Type == "Access-Accept"{ } if(proxy-reply:Packet-Type == "2"){ } Tue Sep 14 06:34:14 2010 : Info: +- entering group post-proxy {...} Tue Sep 14 06:34:14 2010 : Info: ++? if (proxy-reply:Packet-Type == "2") Tue Sep 14 06:34:14 2010 : Info: (Attribute proxy-reply:Packet-Type was not found) I have read there is meta-attribute as Packet-Type but do not know how to access it, please point me to document which explains meta-attribute or suggest me how do I access packet-type -- Chidanand Gangur Pune.

2 3

interpret check-Item and change reply-item to set VLAN
by Michael Bathe 14 Sep '10

14 Sep '10

Hallo Liste, is there any how_to or solution to interpret the ldap checkItem and change the replyItem (I think in inner-tunnel)? f.e.: If the checkItem match one of 'sec11', 'Sec11', 'SEC11'... the replyItem should be set to '111'. ldap.attrmap: checkItem Tunnel-Private-Group-Id sectionNetwork replyItem Tunnel-Private-Group-Id sectionNetwork the following in users file wont work: DEFAULT Tunnel-Private-Group-Id == "sec11" Tunnel-Private-Group-Id=111, Reply-Message += "changed " DEFAULT Auth-Type == EAP Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Reply-Message += "Access success for %{User-Name}.", Fall-Through = no I use FreeRADIUS Version 2.1.6, for host i386-pc-solaris2.8, openLDAP, 802.1x with mschapv2. This works fine for me. radiusd -X output: ... rlm_ldap: performing search in dc=domain,dc=de, with filter (uid=user) checking if remote access for user is allowed by uid looking for check items in directory... rlm_ldap: sectionNetwork -> Tunnel-Private-Group-Id:0 == "sec11" rlm_ldap: sambaNTPassword -> NT-Password == <removed> rlm_ldap: sambaLMPassword -> LM-Password == <removed> looking for reply items in directory... rlm_ldap: sectionNetwork -> Tunnel-Private-Group-Id:0 = "sec11" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ... ++[eap] returns ok } # server inner-tunnel Got tunneled reply code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Got tunneled reply RADIUS code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user" Tunneled authentication was successful. SUCCESS Saving tunneled attributes for later ++[eap] returns handled ... Sending Access-Accept of id 131 to 10.0.0.12 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Reply-Message = "Access success for user." Tunnel-Private-Group-Id:0 = "sec11" User-Name = "user" MS-MPPE-Recv-Key = 0x611ed2d5955bded1d3302045c5930fd4aad610a0b6f5aa1045ba0477f12b7eee MS-MPPE-Send-Key = 0xc38e1cad9590596e3902a46a40706ad8bde70f05bde110698b631b503c00f51b EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. ... thanks and beste Gruesse Michael

3 3

a lot of memory inuse
by Strong, Mark 14 Sep '10

14 Sep '10

Hi Guys, I have free radius 2.1.6, and it has quite a chunk of memory inuse at the moment, are there any known issues with this version and memory leaks? It's running on CentOS 4.7 32 bit, compiled with this version of MySQL 5.0.20a-0.rhel4 (which isn't standard on CentOS 4.7). I started with this source rpm freeradius-2.1.6-2.fc10.src.rpm And has handled 430,000 requests since it started approx one month ago. Regards Mark Strong

1 0