September 2010 - Freeradius-Users - lists.freeradius.org

FW: Session Resumption fails
by Panagiotis Georgopoulos 05 Oct '10

05 Oct '10

Hello all, I am resending this to the list as the debugging output was more than 100KB and the message was rejected. Alexander who was copied in my email, kindly provided feedback already. In short, "use_tunneled_reply = yes" should be able to solve the problem with session resumption in FR 2.1.10, although I understand that break the end client's privacy as it reveals its identity to the NAS. When I test it I'll get back to you as I am guessing this interests more people. Cheers, Panos Debug output here : http://pastebin.com/7u1tjbYE > -----Original Message----- > From: Panagiotis Georgopoulos [mailto:panos@comp.lancs.ac.uk] > Sent: Friday, September 24, 2010 04:17 > To: 'FreeRadius users mailing list'; 'Alexander Clouter' > Subject: RE: Session Resumption fails > > Hi Alexander, all > > Thanks a lot for your reply, it helped my understanding of what is > occurring. Please see below for my comments. > > > > > Panagiotis Georgopoulos <panos(a)comp.lancs.ac.uk> wrote: > > > > > > I have a client machine that authenticates to FreeRadius using > > > EAP-TTLS over Access_Point_1 just fine. When I roam the client to > > > Access_Point_2 and tries to authenticate again to FreeRadius, > > > session resumption seems to be failing with the following error. > > > > > > [snipped] > > > > > > One thing to note on the above is that there is no cached > > information, > > > which seems strange as the client was authenticated some minutes > > > over Access_Point_1. The other thing is that user authentication > > > fails completely and the client resides to restart EAP-TTLS from the > > > start that finishes successfully. > > > > > The session cache stores what is in the *reply* packet of the inner > > request (if that makes sense). > > > > In your eap.conf file, you refer to a virtual server to palm off > > requests to once the EAP layer has been peeled off. In that virtual > > server say in the authorize{} section: > > ---- > > update reply { > > User-Name := "%{request:User-Name}" > > } > > ---- > > > > Now you will find on resumption the username appears magically; > > session resumption is a feature of SSL/TLS and so the user-name is not > > accessible; hence the need to dig into the cache. > > > > I also recommend that you also do: > > ---- > > update outer.request { > > User-Name := "%{request:User-Name}" > > } > > ---- > > I am afraid your suggestion though to add the above in my inner-tunnel virtual > server didn't solve the problem. After having searched the archives of the > list, I found out that this is an OpenSSL bug and there is a fix in FreeRadius > 2.1.10 for it. > > I just compiled 2.1.10 and I verify that I don't see resuming sessions failing > with this no information in the cache : > > Info: [ttls] Skipping Phase2 due to session resumption > Info: [ttls] WARNING: No information in cached session! > > However, I am not seeing the correct behaviour either :-/ > > I am seeing the server adding information in the cache : > > - Debug: SSL: adding session > 1d6029bbddba233cd443d692b968df093237d9ad982f9ccc8a2defcd3edeb243 to cache > - Info: [ttls] (other): SSL negotiation finished successfully > - Debug: SSL Connection Established > > .. but it *never* says that it tries to e.g. skip phase 2 and try resumption > (as I was seeing with FR 2.1.8). > > However in some occasions it says : > > - Info: [ttls] WARNING: No information to cache: session caching will be > disabled for this session. > - Debug: SSL: Removing session > 69c204b29e84878591c19645ed74c1ff4b656c30f66adad78d268df65d2e1d14 from the > cache > > Does anyone have any pointers/suggestions? Anyone who managed to do session > resumption with 2.1.10? > > Thanks a lot in advance, > Panos > > > Ps. By the way, you can find attached my radiusd debugging output with a > client trying to authenticate over different NASs. All authentications > succeed, and info in the cache is stored, but FR never resumes a session. > (nb. in the attached debug, I am restarting my NASs first before the client > starts roaming from one NAS to the other using EAP-TTLS) >

2 8

unlang post-auth group-name
by Cameron Wood 02 Oct '10

02 Oct '10

Hi I'm trying to obtain the Group-Name for the requested user and use it with unlang in the Post-Auth section of my sites-available/default config. This hasn't work thus far, and I have tried a number of other ideas, such as getting it whilst in the Authorize section and creating new variable to hold it there and then referencing that, but still with no success. Can someone tell me how I can accomplish this, below is a snippet of my config so you can see what I am trying to accomplish, any help would be greatly appreciated. post-auth { > switch "%{client:vendor}" { > > case adva { > switch "%{Group-Name}" { > > case net_ro { > update reply { > ADVA-UUM-User-Level := "Monitor" > } > } > > case net_rw { > update reply { > ADVA-UUM-User-Level := "Admin" > } > } > > case net_su { > update reply { > ADVA-UUM-User-Level := "Root" > } > } > } > } > > case cisco { > ... > } > > case netscreen { > ... > } > } > } > Cheers Cam. --

6 26

Freeradius + EAP_TLS + Cisco AP
by Esteban TALAVERA 01 Oct '10

01 Oct '10

Hi I configured a freeradius server with EAP_TLS to authenticate clients that connects to Cisco AP. When I run freeradius -X I got a lot of activity output but the client is still trying to authenticate I post last lines from the server's output I see the port of Access-request es 1645 but I did configure 1812 in both server and Cisco AP The line "[tls] eaptls_process returned 13 " means something wrong? What should be the correct output when successful authentication occurs? Thanks ==== rad_recv: Access-Request packet from host 192.168.X.X port 1645, id=51, length=143 User-Name = "etalaveran" Framed-MTU = 1400 Called-Station-Id = "aca0.16ba.89f2" Calling-Station-Id = "0021.63ca.fdbe" Service-Type = Login-User Message-Authenticator = 0x32824bc17cf2b4b4920577cc57e00177 EAP-Message = 0x020700060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 285 NAS-Port-Id = "285" State = 0x732b0744702c0abef63c2dd8a2b9de35 NAS-IP-Address = 192.168.1.82 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "etalaveran", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry etalaveran at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 51 to 192.168.X.X port 1645 EAP-Message = 0x0108000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x732b074477230abef63c2dd8a2b9de35 Finished request 19. Going to the next request Waking up in 4.8 seconds. Cleaning up request 15 ID 47 with timestamp +117 Cleaning up request 16 ID 48 with timestamp +117 Cleaning up request 17 ID 49 with timestamp +117 Cleaning up request 18 ID 50 with timestamp +117 Cleaning up request 19 ID 51 with timestamp +117 Ready to process requests. ================= -- *Esteban Talavera*

3 7

Radius+Ldap:Allow the same host in multiple vlans
by Ramon Escriba 01 Oct '10

01 Oct '10

Hi I'm trying to organize my net using 802.1x able switches with freeradius 2.1.1+Openldap2-2.4+OpenSuse11.1 The system is running, at least @ test level but not yet deployed, but I reach a cross road and finally I've to choose. Or having one ldap subtree per vlan, filled with all host that bellong to this one, or store inside the host attributes all vlans it's allowed or may get in. The first "road" it's the one I've working actually, because I don't know how to implement the second, the elegant one. I have multiple devices that may belong to multiple vlans, so I shall have duplicated hosts, which I don't like @ all. In order to keep things easy I only use mac-"authentication", later 802.1x EAP wit user+pass ( EAP Mschapv2 or TTLS). The idea is to declare in one single place the vlans one host may be able to connect, from the first top priority vlan to try up to the last option.. Well, I'm using the radiusprofile attribute radiusTunnelGroupId to store the Vlan name or tag. If I set one host/user with the next "vlan tag" attributes: Uid=John.Cleese,ou=People,ou=Radius,xxxxxxxxxxxxxx ... radiusTunnelGroupId: 666 (Mad Scientist) radiusTunnelGroupId: 128 (Nut Engineers) radiusTunnelGroupId: 256 (Nerd IT guys) radiusTunnelGroupId: 51 ( blackhole control) ... userPassword XXXXXXXXXXXXXXXXX Or Uid=<mac-address>,ou=Devices,ou=Radius,xxxxxxxxxxxxxx cn: stupid.device.001 ... radiusTunnelGroupId: 666 (Mad scientist) radiusTunnelGroupId: 999 (FusionCore) ... The host/user, may have rights to connect to those vlans, from let say top prority (666) to the lesser one (51) [ldap attribute order], in the first case, and only 666 or 999 in the second. Some areas are restrited so only the ones with physical access may get connection to the right vlan. The problem is how may I configure radius so it may choose the "correct" vlan. Or try one and if not possible keep trying until no more choices are available. I also have "hungroups", but I realized, if I'm not wrong, that freeradius only gets the first match, never tries the others, so: BlackHoleCore NAS-IP-Address == 10.0.0.1 VacuumCleaner NAS-IP-Address == 10.0.0.1 CoffeeMachine NAS-IP-Address == 10.0.0.1 When in freeradius "users" file I try "DEFAULT Huntgroup-Name == CoffeeMachine, Auth-Type = LDAPCoffee" it will never get in, because NAS-IP 10.0.0.1 will always match BlackHoleCore, never the others.( It's ok?? Or I'm wrong or may I have to change something to get/force/allow multiple target??) A "problem" I found,I'm a newby in radius, is that I'm not able to choose between the diferent vlans, as radius always try to match first value of multivaluated attributes (radiusTunnelGroupId). I'm wrong again? Freeradius send the ACK-OK to the NAS-switch with the target Vlan for this device. If the "sent" vlan is not extended to that switch-NAS there fails silently( @ least seems so in Extreme networks), so the device is not connected. I was trying to use the "checkval" module, but I don't know it's the way it was thinked off. As far as I undertand I can not use it, maybe I'm wrong again. There's any elegant way to do it? Is that aproach, try the "next vlan" if exists @ ldap, possible, how? Many Thanks.

3 6

Default ldap fallthrough but no Auth-Type set
by Harry Hoffman 01 Oct '10

01 Oct '10

Hi All, I'm running freeradius 2.1.8 on a Redhat 5.x box. We're setup to authenticate against LDAP and AD using the how-tos and wiki on the freeradius website. Users might be in LDAP, or AD, or both. I've stuck with the default config and enabled both ldap and ntlm_auth (after making sure that both sources can authenticate per the docs). Both sources of authentication work. It seems that when enabling the ldap module, it become the default if nothing else sets the Auth-Type. Now I'm trying to walk through the exercise of getting AD auth to work if a user is present in AD, or getting LDAP auth to work if the user is present in LDAP. In the authorize { ... } section of sites-enabled/default I have the following: ntlm_auth ldap { notfound = return } In the authenticate { ... } section of sites-enabled/default I have the following Auth-Type: # ntlm_auth authentication. Auth-Type ntlm_auth { ntlm_auth } Auth-Type LDAP { group{ ldap{ reject = 1 ok = return } ntlm_auth{ reject = 1 ok = return } } } If the user has a entry in the LDAP database then the Auth-Type is set to LDAP and the authorization jumps to Auth-Type LDAP and goes through the groups stanza trying to authenticate to ldap or ntlm_auth. However if the user is not in LDAP then it seems as though Auth-Type is never set so the default authentication is attempted via ldap, which fails. I don't understand why it doesn't try the Auth-Type LDAP definition. Everywhere I read, the docs say not to specifically set Auth-Type but to let the server figure it out. So, how do I let the server figure out that the Auth-Type should be ntlm_auth when the authorize { ... } section matches ntlm_auth? rad_recv: Access-Request packet from host 127.0.0.1 port 55874, id=200, length=63 User-Name = "admin" User-Password = "password" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20100930 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m %d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20100930 [auth_log] expand: %t -> Thu Sep 30 10:32:05 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "admin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "admin", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=admin [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok [ldap] performing user authorization for admin [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> admin [ldap] expand: (&(uid= %{%{Stripped-User-Name}:-%{User-Name}})(!(inetCOS=802.1x_disabled))) -> (&(uid=admin)(!(inetCOS=802.1x_disabled))) [ldap] expand: ou=People,dc=ip-solutions,dc=net,o=internet -> ou=People,dc=ip-solutions,dc=net,o=internet [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.ip-solutions.net:389, authentication 0 [ldap] starting TLS [ldap] bind as / to ldap.ip-solutions.net:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=ip-solutions,dc=net,o=internet, with filter (&(uid=admin)(!(inetCOS=802.1x_disabled))) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect ( [ldap] User not found): [admin] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 200 to 127.0.0.1 port 55874 Waking up in 4.9 seconds. Cleaning up request 0 ID 200 with timestamp +3 Ready to process requests. Cheers, Harry

2 1

vmps switch-port shutdown
by Habegger Lukas, ERZ-AZD-AID-NOC 01 Oct '10

01 Oct '10

hi I try to shutdown (errdisabled) a port of a cisco3560 with the vmps-shutdown response. i use freeradius 2.1.10 and rlm_perl. Could someone tell me how the response should look like. so fare i have: $RAD_REPLY{'VMPS-Packet-Type'} = "VMPS-Join-Response"; $RAD_REPLY{'VMPS-Error-Code'} = "VMPS-Shutdown"; $RAD_REPLY{'VMPS-Sequence-Number'} = $RAD_REQUEST{'VMPS-Sequence-Number'}; i can set the vlan on a port for a specific mac but the port does not go to errdisabled when i use the above. Thanks for help Lukas

2 1

choose proxy based on AD
by David McPike 30 Sep '10

30 Sep '10

Hello All, We are in the process of migrating users from one AD tree to another. The migrated accounts will exist in both AD directories for a while (usernames will not change) and I need to be able to choose a radius server based on an LDAP group membership. I have this working fine for cases where users do not supply a realm but I am not sure of the best way to do this for users that do supply an ntdomain-style realm. In the new domain, no one requires a realm (need to strip if the user has already been migrated), while the old domain has several child domains. I am using FR 2.1.10. I was not successful trying to change the proxy server after one had already been chosen. I tried to remove the Realm attribute in the authorize section but the request still went to the initially chosen radius pool. I tried stripping the realm manually prior to realm processing in authorize {} but have not been successful yet. I am using a simple regex like this: if (User-Name =~ /^[A-z]+\\(.*)/) { update request { Stripped-User-Name := "%{1}" } } This always fails for 'radtest realm\\user'. Am I missing something or is there a more elegant way to accomplish this? Thanks very much, David

3 6

Question about rlm-unix authentication
by James S. Smith 30 Sep '10

30 Sep '10

I'm trying to get FreeRadius to authenticate against the local server's usernames and passwords. I have a fresh installation and I've confirmed that authentication is working with a test entry in the /etc/raddb/users file. I've also tested authentication from another system and it works too. I then try to authentication against a unix account I have on the system ("testrad"). It comes back as "Access-Reject", which seems to suggest it tried to look for the user account and felt it wasn't there and in the radiusd -X the unix module reports "notfound". I've confirmed I can log in via Unix with this account, so it definitely works. I also made a test program that makes the same calls as rlm_unix and it was able to successfully lookup the user account. Could this be a problem with the CentOS package of FreeRadius? Anyone else had this problem? [root@todcsvnm01 ~]# radtest testing password 127.0.0.1 0 testing123 Sending Access-Request of id 232 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=232, length=20 [root@todcsvnm01 ~]# radtest testrad 74828752 127.0.0.1 0 testing123 Sending Access-Request of id 176 to 127.0.0.1 port 1812 User-Name = "testrad" User-Password = "74828752" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=176, length=20 [root@todcsvnm01 ~]# radiusd -X FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Mar 31 2010 at 00:14:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/passwd.rpmsave including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 52413, id=232, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry testing at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "password" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 232 to 127.0.0.1 port 52413 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 232 with timestamp +34 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 43090, id=176, length=59 User-Name = "testrad" User-Password = "74828752" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testrad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testrad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 176 to 127.0.0.1 port 43090 Waking up in 4.9 seconds. Cleaning up request 1 ID 176 with timestamp +69 Ready to process requests. James S. Smith Network Architect WIND Mobile 207 Queen's Quay West, Suite 710 Toronto, ON M5J 1A7 Direct: 416-640-9792 Fax: 416-987-1203 www.windmobile.ca www.twitter.com/WINDmobile www.facebook.com/WINDmobile The Power of Conversation This message contains confidential information and is intended only for the individual named. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Fwd: FreeRadius + VSA
by Noura Kossentini 30 Sep '10

30 Sep '10

---------- Forwarded message ---------- From: Noura Kossentini <kossentini.noura(a)gmail.com> Date: 2010/9/29 Subject: FreeRadius + VSA To: freeradius-users-owner(a)lists.freeradius.org Hi how can I add a VSA to freeRadius server?? thanks

3 5

RE: New Install Problems
by Scott Miller 30 Sep '10

30 Sep '10

>> Scott Miller wrote: >> Wondering if you happen to have a solution or work-around? >> > > >$ ./configure --disable-libltdl-install --with-system-libtool > > That *may* work. > > The longer-term fix is removing libltdl && libtool entirely. Modern >systems all have sane compilers && link systems. The intermediate layer >of insanity added by those tools is no longer necessary. > > Alan DeKok. > When configure with this: ./configure --disable-libltdl-install --with-system-libtool Make (don't even get to "make install" yet) I get this: gmake[4]: Entering directory `/home/scott/freeradius-server-2.1.10/src/main' /usr/bin/libtool --mode=link gcc -export-dynamic -dlopen self \ -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo stats.lo session.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo evaluate.lo vmps.lo detail.lo \ /home/scott/freeradius-server-2.1.10/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread \ -lcrypt /home/scott/freeradius-server-2.1.10/libltdl/libltdl.la -lcrypto -lssl -lcrypto libtool: link: rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT libtool: link: (cd .libs && gcc -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fPIC -c -fno-builtin "radiusdS.c") libtool: link: rm -f ".libs/radiusdS.c" ".libs/radiusd.nm" ".libs/radiusd.nmS" ".libs/radiusd.nmT" libtool: link: gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/scott/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /home/scott/freeradius-server-2.1.10/libltdl/.libs/libltdl.so -ldl -lssl -lcrypto -Wl,-rpath -Wl,/usr/local/lib .libs/modules.o: In function `setup_modules': /home/scott/freeradius-server-2.1.10/src/main/modules.c:1372: undefined reference to `lt_preloaded_symbols' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/home/scott/freeradius-server-2.1.10/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/home/scott/freeradius-server-2.1.10/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/scott/freeradius-server-2.1.10/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/home/scott/freeradius-server-2.1.10' make: *** [all] Error 2

2 1