September 2010 - Freeradius-Users - lists.freeradius.org

Re: Strange problem regarding PPTP and FreeRADIUS
by Ali Majdzadeh 12 Sep '10

12 Sep '10

Edvin, Hi Thanks for your response. FreeRADIUS is running on Debian Lenny and PopTop Server is running on a RedHat-based distribution. By the way, in pptpd's logs, I mentioned the following: /etc/radiusclient/radiusclient.conf: line 16: unrecognized keyword: radius_deadtime I know that pppd uses radius.so plugin to perform PAP, CHAP, MS-CHAP and MS-CHAPv2 authentication against a RADIUS server. Might this be the issue? Warm Regards Ali Majdzadeh Kohbanani 2010/9/12 Edvin Seferovic | Kolpinghaus St.Pölten <edvin.seferovic(a)kolp.at> > Might this be a PopTop issue? What platform are you using? > > >Please note those two highlighted lines, the User-Name is "\000ila" while > what I have used as the username is "ali". Also, NAS-IP-Address is somehow > >encrypted. > >I searched a lot, but I could not find any similar problem. Any ideas? > > Regards, > E.S. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 2

Strange problem regarding PPTP and FreeRADIUS
by Ali Majdzadeh 12 Sep '10

12 Sep '10

Hello All I have configured PopTop server to work with FreeRADIUS. pptpd is configured to use mschap-v2 and mppe-128 and I have enabled the corresponding module in FreeRADIUS. When I turn on the debugging mode of FreeRADIUS, I get the following: rad_recv: Access-Request packet from host 192.168.1.15 port 55483, id=227, length=153 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "\000ila" MS-CHAP-Challenge = 0x78b650db2a6af8bc8bc3435c7a385905 MS-CHAP2-Response = 0x6e009982bf378318ac706da61a063b70682d0000000000000000e3dbbe517ba9dc7a18dfe5660208bdc1f370b5d7836516f8 NAS-IP-Address = 0x0f01a8c0e85adab7e41be2bf081ce2bfb005dab7e41be2bf32 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Please note those two highlighted lines, the User-Name is "\000ila" while what I have used as the username is "ali". Also, NAS-IP-Address is somehow encrypted. I searched a lot, but I could not find any similar problem. Any ideas? Warm Regards Ali Majdzadeh Kohbanani

3 3

Ignoring EAP-Type/tls because we do not have OpenSSL support.
by Douglas Caro 10 Sep '10

10 Sep '10

Hi, In #freeradius -X, I have those messages: Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. I've researched on the subject, but I didn't find anything. Linux Debian Lenny Freeradius 2.0.4 Thanks Douglas

5 5

Re: Freeradius-Users Digest, Vol 65, Issue 43
by Douglas Caro 10 Sep '10

10 Sep '10

Thanks for all, but it didn't work... #dpkg -l |grep freer ii freeradius 2.1.8+dfsg-1~bpo50+1 a high-performance and highly configurable R ii freeradius-common 2.1.8+dfsg-1~bpo50+1 FreeRADIUS common files ii freeradius-dialupadmin 2.1.8+dfsg-1~bpo50+1 set of PHP scripts for administering a FreeR ii freeradius-ldap 2.1.8+dfsg-1~bpo50+1 LDAP module for FreeRADIUS server ii freeradius-mysql 2.1.8+dfsg-1~bpo50+1 MySQL module for FreeRADIUS server ii freeradius-postgresql 2.1.8+dfsg-1~bpo50+1 PostgreSQL module for FreeRADIUS server ii freeradius-utils 2.1.8+dfsg-1~bpo50+1 FreeRADIUS client utilities ii libfreeradius-dev 2.1.8+dfsg-1~bpo50+1 FreeRADIUS shared library development files ii libfreeradius2 2.1.8+dfsg-1~bpo50+1 FreeRADIUS shared library # freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. The messages keep appearing Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Thanks Douglas

2 1

Beginner Question: "Hotspot Login Failed"
by Sean Wingert 10 Sep '10

10 Sep '10

Hi All, In my testing lab (yes, I'm new to FreeRadius), usernames entered (e.g. with attribute User-Password in sql radcheck table) via my NAS (dd-wrt with Chillispot) refuse to authenticate (error below), whereas attribute=Auth-Type (what DaloRadius calls a "PIN") works fine. I'm using the packaged MySQL (5.0.51a-24+lenny3) with FreeRadius (2.0.4+dfsg-6)and freeradius-dialupadmin (2.0.4+dfsg-6) on Debian Lenny, along with Daloradius 0.9-8 for GUI frontend. Below is the Daloradius-populated mysql table (again, only 4321 works fine, regardless of password entered): +----+----------+--------------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------------------------------+ | 9 | aaa | MD5-Password | := | 47bce5c74f589f4867dbd57e9ca9f808 | | 7 | 123 | User-Password | := | 123 | | 8 | 4321 | Auth-Type | := | Accept | | 10 | bbb | SHA1-Password | := | bbb | | 11 | ccc | CHAP-Password | := | ccc | | 12 | eee | Cleartext-Password | := | eee | +----+----------+--------------------+----+----------------------------------+ 6 rows in set (0.00 sec) ================================== Debug output of working connection ================================== rad_recv: Access-Request packet from host 192.168.0.72 port 2112, id=0, length=191 User-Name = "4321" User-Password = "\223=\0322\343\233\361a\365\323\320\333_\245×¼" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Identifier = "1" Acct-Session-Id = "4c890e8900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x468b4f124525571d6d37d6d1ec69cbdd WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '4321' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '4321' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '4321' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [4321/\223=\0322\343\233\361a\365\323\320\333_\245×¼] (from client Subnet port 0 cli C4-17-FE-1C-5C-9D) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{User-Password} -> =93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '4321', '=93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC', 'Access-Accept', '2010-09-09 08:36:57') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '4321', '=93=3D=1A2=E3=9B=F1a=F5=D3=D0=DB_=A5=D7=BC', 'Access-Accept', '2010-09-09 08:36:57') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.0.72 port 2112 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.0.72 port 2110, id=8, length=125 Acct-Status-Type = Start User-Name = "4321" Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "1" Framed-IP-Address = 192.168.182.3 Acct-Session-Id = "4c890e8900000000" +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.0.72,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c890e8900000000",User-Name = "4321"' rlm_acct_unique: Acct-Unique-Session-ID = "d3e9d3ef96f2f8d9". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.72/detail-20100909 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.72/detail-20100909 expand: %t -> Thu Sep 9 08:36:57 2010 ++[detail] returns ok ++[unix] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 4321 ++[radutmp] returns ok expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{Acct-Delay-Time} -> expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('4c890e8900000000', 'd3e9d3ef96f2f8d9', '4321', '', '0.0.0.0', '0', 'Wireless-802.11', '2010-09-09 08:36:57', NULL, '0', '', '', '', '0', '0', '00-24-A5-6F-81-0A', 'C4-17-FE-1C-5C-9D', '', '', '', '192.168.182.3', '0', '0', '') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok expand: %{User-Name} -> 4321 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 8 to 192.168.0.72 port 2110 Finished request 2. Cleaning up request 2 ID 8 with timestamp +2711 Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +2711 Ready to process requests. ================================== debug output of broken connection ================================== rad_recv: Accounting-Request packet from host 192.168.0.72 port 2110, id=9, length=173 Acct-Status-Type = Stop User-Name = "4321" Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "1" Framed-IP-Address = 192.168.182.3 Acct-Session-Id = "4c890e8900000000" Acct-Input-Octets = 436077 Acct-Output-Octets = 4958088 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 3923 Acct-Output-Packets = 6229 Acct-Session-Time = 863 Acct-Terminate-Cause = User-Request +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.0.72,NAS-IP-Address = 0.0.0.0,Acct-Session-Id = "4c890e8900000000",User-Name = "4321"' rlm_acct_unique: Acct-Unique-Session-ID = "d3e9d3ef96f2f8d9". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "4321", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.0.72/detail-20100909 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.72/detail-20100909 expand: %t -> Thu Sep 9 08:51:21 2010 ++[detail] returns ok ++[unix] returns ok expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> 4321 ++[radutmp] returns ok expand: %{User-Name} -> 4321 rlm_sql (sql): sql_set_user escaped user --> '4321' expand: %{Acct-Input-Gigawords} -> 0 expand: %{Acct-Input-Octets} -> 436077 expand: %{Acct-Output-Gigawords} -> 0 expand: %{Acct-Output-Octets} -> 4958088 expand: %{Acct-Delay-Time} -> expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2010-09-09 08:51:21', acctsessiontime = '863', acctinputoctets = '0' << 32 | '436077', acctoutputoctets = '0' << 32 | '4958088', acctterminatecause = 'User-Request', acctstopdelay = '0', connectinfo_stop = '' WHERE acctsessionid = '4c890e8900000000' AND username = '4321' AND nasipaddress = '0.0.0.0' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok expand: %{User-Name} -> 4321 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 9 to 192.168.0.72 port 2110 Finished request 0. Cleaning up request 0 ID 9 with timestamp +9 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.72 port 2112, id=0, length=190 User-Name = "123" User-Password = "\236\326v\220t\221ê P\277\307;?\025`" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "C4-17-FE-1C-5C-9D" Called-Station-Id = "00-24-A5-6F-81-0A" NAS-Identifier = "1" Acct-Session-Id = "4c891e9900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xdc1dfade75373068738e32d415253503 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "123", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> 123 rlm_sql (sql): sql_set_user escaped user --> '123' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '123' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '123' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '123' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "?Öv?t?ê?P¿Ç;??`" rlm_pap: Using clear text password "123" rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [123/\236\326v\220t\221ê?P\277\307;?\025`] (from client Subnet port 0 cli C4-17-FE-1C-5C-9D) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 0 to 192.168.0.72 port 2112 Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +34 Ready to process requests. This message is intended only for the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited, and you are requested to return the original message to the sender.

4 8

FreeRadius2+daloRAIUS mschap problem: No Cleartext-Password configured
by Denis Iskandarov 10 Sep '10

10 Sep '10

My setup: CentOS 5.5 x32 freeradius2-2.1.7-7.el5 mysql-5.0.77-4.el5_5.3 daloRADIUS 0.9-8 SVN (0.9.-9) used for 802.1x EAP-TLS and EAP-TTLS (maybe for peap in future as well) with Ubiquiti and Mikrotik network equipment setup works perfectly without sql with text conf files. when creating user in sql getting next error: (Output omitted) Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for ubnt123 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [ubnt123] (from client ubnt port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\223E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [ubnt123] (from client ubnt port 0 cli 00-15-6D-5A-4F-5E) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ubnt123 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds I found some topics in regarding this same error in different setups but nothing helped me me to solve this problem. Please help. Thanks in advance.

4 6

Radmin - hup query
by John Horne 10 Sep '10

10 Sep '10

Hello, Running Freeradius 2.1.10 on CentOS 5.5 I have been taking a quick look at the radmin 'hup' command. However, I am having a problem getting it to work: radmin -e hup ERROR: You do not have write permission. See "mode = rw" in /var/run/radiusd/radiusd.sock However, the socket file shows: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 Sep 10 04:02 /var/run/radiusd/radiusd.sock ls -ld /var/run/radiusd drwxr-xr-x 2 radiusd radiusd 4096 Sep 10 04:02 /var/run/radiusd If I run the radmin command as root or the radiusd user, I get the ERROR message. Additionally in the radius log file I see (when the radmin command is run): Fri Sep 10 12:59:28 2010 : Info: ... adding new socket command file /var/run/radiusd/radiusd.sock Fri Sep 10 12:59:28 2010 : Info: ... closing socket command file /var/run/radiusd/radiusd.sock I'm not sure what the first message means as the file already exists, and the second one says it is closing the socket, yet the socket file still exists (unless it literally means it is closing the socket but leaving the file there.) Any suggestions as to what is going on here? John. -- John Horne Tel: +44 (0)1752 587287 University of Plymouth, UK Fax: +44 (0)1752 587001

4 5

Restricting Clients and Users
by omega_one＠mail.com 10 Sep '10

10 Sep '10

Hi all. I need that: - system group A access only switch 1.1.1.1 and 1.1.1.2 - system group B access only switch 2.1.1.1 and 2.1.1.2 I created local group of users A and B and associated users /etc/raddb/clients.conf client 1.1.1.1 { secret = "xxx" shortname = switch nastype = cisco } client 1.1.1.2 { secret = "xxx" shortname = switch nastype = cisco } client 2.1.1.1 { secret = "xxx" shortname = switch nastype = cisco } client 2.1.1.2 { secret = "xxx" shortname = switch nastype = cisco } /etc/raddb/users DEFAULT Group == "A", Auth-Type := PAM Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Group == "B", Auth-Type := PAM Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Auth-Type := Reject How can i modify my configurations to let only A users to access switch 1.1.1.1/2 and B users access switch 2.1.1.1/2 ? Thanks. =

2 1

SQL Logging Access-Reject
by Kristoffer Milligan 10 Sep '10

10 Sep '10

Hello again list, I'm still working on my FreeRADIUS server in connection with 4Motion equipment from Alvarion. It's getting better and better and more integrated, but I still have a few quirks I need to work out. My main problem now is the logging part. In the post-auth section, I have added some SQL logging. I am logging Access-Accept and Access-Reject. My problem is that access-rejects are appearing scrambeled.. Example: | 50 | user1(a)mydomain.tld | | Access-Accept | 2010-09-10 10:53:36 | | 51 | =7Bam=3D1=7D917341235F4283123A58E52B623D2790(a)mydomain.tld | | Access-Reject | 2010-09-10 10:53:39 | | 52 | =7Bam=3D1=7AC00FA703F004Q25ED1EF4E3DCB5F4A2B(a)mydomain.tld | | Access-Reject | 2010-09-10 10:53:47 | | 53 | user2(a)mydomain.tld | | Access-Accept | 2010-09-10 10:53:58 | The SQL statement from sql_log module is: Post-Auth = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) VALUES \ ('%{SQL-User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" How can I log the tried username in cleartext? - Kristoffer Milligan

2 1

Re: Re: Re: Re: Re: FreeRADIUS with Samba3, AD(Samba4) and and Windows XP
by Бисер Миланов 10 Sep '10

10 Sep '10

Guys, anyone? Do you need more config info? Can you help?

1 0