October 2011 - Freeradius-Users - lists.freeradius.org

FW: "authentication" sub in perl
by Alex rsm 04 Oct '11

04 Oct '11

Ok, openSLL is installed on my server. No more issue on EAP. However, my debug line in sub authenticate still is not being called: #example.pl # Function to handle authorize sub authorize { print "TEST-authorize: username=$RAD_REQUEST{'User-Name'}\n"; # For debugging purposes only # &log_request_attributes; # Here's where your authorization code comes # You can call another function from here: &test_call; return RLM_MODULE_OK; } # Function to handle authenticate sub authenticate { print "TEST-authenticate\n"; # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } and here is the debug: Cleaning up request 9 ID 9 with timestamp +7 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.31 port 50071, id=19, length=169 User-Name = "abc" NAS-IP-Address = 10.0.0.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000801616263 Message-Authenticator = 0xb952dcdfcec1e39a79c029ccdc94c2ca +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "abc", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> abc [sql] sql_set_user escaped user --> 'abc' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abc' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'abc' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 [sql] User abc not found ++[sql] returns notfound TEST-authorize: username=abc rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0xb952dcdfcec1e39a79c029ccdc94c2ca rlm_perl: Added pair User-Name = abc rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x0200000801616263 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 10.0.0.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 19 to 10.0.0.31 port 50071 EAP-Message = 0x0101001604108bc56309ea2103957c2aee6450696f68 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2c81558c2c8051de6687486c2848c067 Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.31 port 50071, id=20, length=185 User-Name = "abc" NAS-IP-Address = 10.0.0.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x2c81558c2c8051de6687486c2848c067 Message-Authenticator = 0x959b11a51401f767f5b52bc58298d730 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "abc", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [sql] expand: %{User-Name} -> abc [sql] sql_set_user escaped user --> 'abc' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'abc' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'abc' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 [sql] User abc not found ++[sql] returns notfound TEST-authorize: username=abc rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair State = 0x2c81558c2c8051de6687486c2848c067 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x959b11a51401f767f5b52bc58298d730 rlm_perl: Added pair User-Name = abc rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x020100060319 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = NAK rlm_perl: Added pair NAS-IP-Address = 10.0.0.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 20 to 10.0.0.31 port 50071 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2c81558c2d834cde6687486c2848c067 Finished request 11. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.31 port 50071, id=21, length=315 User-Name = "abc" NAS-IP-Address = 10.0.0.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008819800000007e16030100790100007503014e8a158f57cc1fc7dc587b4d0f71db7fe7535bd8d558d366554b98ffea94d54e00003ac00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a0009000300080033003900160015001401000012000a00080006001700180019000b00020100 State = 0x2c81558c2d834cde6687486c2848c067 Message-Authenticator = 0xbc890b747815cfe2a522b36ce4298072 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "abc", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 136 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 126 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0079], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 035d], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 21 to 10.0.0.31 port 50071 EAP-Message = 0x010303a01900160301002a0200002603014e8a15900e786bf596f3aacf0a8613466bde700fd2039caa47f40e4e6ff7eebf00002f00160301035d0b0003590003560003533082034f308202b8020900c4503b0d3db1eb6a300d06092a864886f70d01010505003081eb310b3009060355040613025858312a3028060355040813215468657265206973206e6f2073756368207468696e67206f757473696465205553311330110603550407130a45766572797768657265310e300c060355040a13054f434f5341313c303a060355040b13334f666669636520666f7220436f6d706c69636174696f6e206f66204f74686572776973652053696d706c65 EAP-Message = 0x20416666616972733120301e060355040313176c61622d7375706572686f73742e62686e69732e6e6574312b302906092a864886f70d010901161c726f6f74406c61622d7375706572686f73742e62686e69732e6e6574301e170d3130303432323230333833355a170d3130303532323230333833355a3081eb310b3009060355040613025858312a3028060355040813215468657265206973206e6f2073756368207468696e67206f757473696465205553311330110603550407130a45766572797768657265310e300c060355040a13054f434f5341313c303a060355040b13334f666669636520666f7220436f6d706c69636174696f6e206f66 EAP-Message = 0x204f74686572776973652053696d706c6520416666616972733120301e060355040313176c61622d7375706572686f73742e62686e69732e6e6574312b302906092a864886f70d010901161c726f6f74406c61622d7375706572686f73742e62686e69732e6e657430819f300d06092a864886f70d010101050003818d0030818902818100a8095e7a92fe7feabe7940d9ba51310a55bba6c96949d67a1798a515961ab951cfe04d4234251d36e6854920ced26224b1d6ae09fa4e793c14d464b53e2faa9606b4f785c63f270a3c1a18fee3abfc1985e86e19d86fbe775c6171c952b3bd88dc6659099d07a84ac6d360d7cd23745031635d9093ea91d4 EAP-Message = 0x8108b36edcb15eb10203010001300d06092a864886f70d0101050500038181002ac5e5a95601c5d650cf06ab8b89bde90ff4435de070cb80076e7f0e25411dc2826996807af37acccfe9ada9a1f41c90be7301fda6bf6f1e9282c57e4a4923ae6c33b827032b0691cf516299f084f128c6631e3e80a6b7e77bc214ee36b3861a39819fae257557a2a023482750e50a19755919348bcb32d83e6cf0be37e0281716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2c81558c2e824cde6687486c2848c067 Finished request 12. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.0.0.31 port 50071, id=22, length=387 User-Name = "abc" NAS-IP-Address = 10.0.0.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300d01980000000c61603010086100000820080371b287b2a288bb51773c591b925c51dc9dd35e78e31ca6572ba50103ff255b33f8f8d50222d2a360a84f9a626651502fce20b21dd5fd14a59094f2b1655bb2a2d11332b186fc5a94438859f67ec287724f63519e5cc82820cf91b5a9a9c4c26f33e31a74bddb88d1cb3b0b64ebf82e98fa1c5d1bd12b88a6774889fd868140d14030100010116030100304dcd33a4d2301013eb09a3e10798b8b1f5a6321a50a5b0ca6bd7c16c43fa7f1a4d442c1d5b5ab7421a7aa42b715abce2 State = 0x2c81558c2e824cde6687486c2848c067 Message-Authenticator = 0xa0a47b0b334f107a54ff4e9abac2969a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "abc", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 22 to 10.0.0.31 port 50071 EAP-Message = 0x0104004119001403010001011603010030b7da9f1ff65aa82945313f6e0b13f88565316368755ae23680a9a60583941b0aacfc3e71103a1e5eec9da651ae5a9d2d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2c81558c2f854cde6687486c2848c067 Finished request 13. Going to the next request Waking up in 4.6 seconds. > Date: Mon, 3 Oct 2011 18:55:42 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > To: alex-rsm(a)hotmail.com > Subject: Re: "authentication" sub in perl > > Hi, > > hint: https://help.ubuntu.com/community/OpenSSL > > > alan

3 2

Radius client redundance
by oleaweel 03 Oct '11

03 Oct '11

Hi, We have configured EAP-PEAP with freeradius, and forward MS-CHAP-V2 request to a Microsoft NPS server. This works fine, but we now want to implement one more Microsoft NPS server, so how do we define a second radius client. So that if the first one fails, it will automatically try the next ? We have configured the following: clients.conf client merucontroller01 { ipaddr = xxx.xxx.xxx.1 secret = secretkey nastype = other require_message_authenticator = no } proxy.conf realm DEFAULT { authhost = xxx.xxx.xxx.1:1812 accthost = xxx.xxx.xxx.1:1813 secret = secretkey } So could i just add another ip here xxx.xxx.xxx.2 in both ? Thanks for reply. Regards Ole -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-client-redundance-tp4822209p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

LDAP server
by Esdras Caleb Oliveira Silva 03 Oct '11

03 Oct '11

How i can made a autentication in LDAP server?? What i need? -- (Você irá para o céu ou não? Acesse www.BoaPessoa.com.br já para saber!) "Não se VAI à Igreja. Se É Igreja."

1 0

Re: "authentication" sub in perl
by Alan Buxey 03 Oct '11

03 Oct '11

Yes yes, you've just confirmed what I said. I know you built it without openssl support...I was giving you advice on how to spot it, so that you can verify all is okay after you've installed the required development packages for openssl on your platform....and Google can help you with that. alan -- Message may be brief as it has been sent from my mobile

1 0

"authentication" sub in perl
by Alex rsm 03 Oct '11

03 Oct '11

Hi, I am trying to call an external perl function within "authentication" sub" - functions are uncommented in modules/perl file ... func_authenticate = authenticate func_authorize = authorize ... - subs are modified in /raddb/example.pl sub authenticate{ print "TEST1\n"; } sub authenticate { print "TEST2\n"; /usr/local/etc/raddb/test.pl; } When freeradius receives a REQUEST, only "authenticate" sub is called and not "authenticate" sub. How can I enable "authenticate" to be called when a REQUEST is arrived? Here is the debug log: ali@lab-openser01:~$ sudo radiusd -X FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Sep 29 2011 at 14:33:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default.orig main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.10.10.31 { require_message_authenticator = no secret = "testing123" shortname = "ba20-seansdesk" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /usr/local/etc/raddb/modules/perl perl { module = "/usr/local/etc/raddb/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 41951 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.31 port 50032, id=27, length=169 User-Name = "ali" NAS-IP-Address = 10.10.10.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000801616c69 Message-Authenticator = 0x95bea57fa05d627496b0475c57d1b6a8 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ali", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry ali at line 207 ++[files] returns ok TEST1 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x95bea57fa05d627496b0475c57d1b6a8 rlm_perl: Added pair User-Name = ali rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x0200000801616c69 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 10.10.10.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Cleartext-Password = abc123 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 27 to 10.10.10.31 port 50032 EAP-Message = 0x0101001604107e5377146691b447d19cd03c54d1c0fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbb8cb579bb8db14c50324b609a9d0c10 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.31 port 50032, id=28, length=185 User-Name = "ali" NAS-IP-Address = 10.10.10.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "5C-59-48-F0-34-8B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xbb8cb579bb8db14c50324b609a9d0c10 Message-Authenticator = 0x7aa56761fec9870d04367ba196e039b4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ali", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry ali at line 207 ++[files] returns ok TEST1 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair State = 0xbb8cb579bb8db14c50324b609a9d0c10 rlm_perl: Added pair Calling-Station-Id = 5C-59-48-F0-34-8B rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x7aa56761fec9870d04367ba196e039b4 rlm_perl: Added pair User-Name = ali rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x020100060319 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = NAK rlm_perl: Added pair NAS-IP-Address = 10.10.10.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Cleartext-Password = abc123 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type PEAP [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ali attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 28 to 10.10.10.31 port 50032 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 27 with timestamp +29 Waking up in 1.0 seconds. Cleaning up request 1 ID 28 with timestamp +29 Ready to process requests. Thanks, ASM

4 11

Virtual server basic proxy configuration?
by John Douglass 03 Oct '11

03 Oct '11

Freeradius gurus, I have looked over the documentation and searched for examples and haven't found anything concrete that I feel will solve my configuration. Perhaps someone has implemented this or can offer up some advice on how to approach this. Basically wanting to create a virtual server listening on port 1818 that simply proxies ALL AUTH requests to radius1.gatech.edu port 1812. I am used to the virtual-server configuration as I have multiple radius based services running on different ports, but am not sure how to only proxy those entries on that particular virtual server and not the other virtual servers I have running on this server. At a first read/glance, it looks like the proxy settings might apply to all virtual servers instead of just the one on port 1818 that I am defining. From reading "proxy.conf" would I just define something like: home_server radius1 { type = auth ipaddr = 10.10.10.10 port = 1818 secret = testing123 } Now...I am not sure how to apply this to a single virtual server. All I really want to do is redirect the requests and respond. Any tips would be appreciated, - John Douglass, Georgia Institute of Technology

3 2

Rlm_ldap Login withount a identity
by Esdras Caleb Oliveira Silva 03 Oct '11

03 Oct '11

My LDAP server requires autentication, but for security reasson I cant let a user with permission to read all data from outher to made the bind for radius. Studing the log and using radiusd in debug mod I discovered if I let the identity and password in black the raius try log with the login and password provide by the user of radius, and it binds, but afther it also tryes retrive the user info with the user login, what fails. There is a way to do the login with LDAP without the identity or password? Using the information provide by the user to try bind in LDAP and if bind is sucessufull the RADIUS autenticates?? Sorry bad English Esdras Caleb -- (Você irá para o céu ou não? Acesse www.BoaPessoa.com.br já para saber!) "Não se VAI à Igreja. Se É Igreja."

1 0

rlm_ldap patch for access_attr_deny_value
by Fred 03 Oct '11

03 Oct '11

Hi all, This patch is an attempt to have a more generic custom access_attr support, by introducing a new ldap module configuration parameter named "access_attr_deny_value" allowing to check arbitrary access_attr attribute value to reject user. Without this patch, configured access_attr attribute is checked against a static,(hard-coded) "FALSE" value. With this patch, rlm_ldap module user can configure not only custom access_attr attribute, but also custom access_attr_deny_value value to control user lock status. Default value remains FALSE, to maintain backward compatibility. This patch has been made because if, for example, inetUserStatus is used at ldap server level to control lock user status, this control is done by ldap server when user tries to bind to the ldap. >From freeradius point of view, if ldap bind is not done for any reason (e.I. because radiusd received a MSCHAP challenge, and just replayed MSCHAP using ntPassword or lmPassword retrieved during author) , ldap server will not have occation to reject the user at binding, so radiusd has to do the job himself for inetUserStatus to be honored. If radiusd does not do the job, only ldap-binded user will be rejected (by ldap) but non-binded user will be accepted, thus making ldap settings disabling the user with inetUserStatus set to "inactive" will not be honored at radius level and user will be unexpectedly accepted. For example, ${confdir}/modules/ldap : access_attr = inetUserStatus # OID 2.16.840.1.113730.3.1.692 access_attr_deny_value = "inactive" With this setup, if inetUSerStatus is set to inactive in ldap directory for a particular user, this user will be rejected early during authorization. Best regards, Fred MAISON ############################################### diff -u ./src/freeradius-server/src/modules/rlm_ldap/rlm_ldap.c ./Documents/Radius/Freeradius/freeradius-server-2.1.12/src/modules/rlm_ldap/rlm_ldap.c --- ./src/freeradius-server/src/modules/rlm_ldap/rlm_ldap.c 2011-09-20 14:11:34.000000000 +0200 +++ ./Documents/Radius/Freeradius/freeradius-server-2.1.12/src/modules/rlm_ldap/rlm_ldap.c 2011-09-29 17:39:32.000000000 +0200 @@ -146,6 +146,7 @@ char *default_profile; char *profile_attr; char *access_attr; + char *access_attr_deny_value; char *passwd_hdr; char *passwd_attr; int auto_header; @@ -304,6 +305,8 @@ offsetof(ldap_instance,access_attr), NULL, NULL}, {"access_attr_used_for_allow", PW_TYPE_BOOLEAN, offsetof(ldap_instance,default_allow), NULL, "yes"}, + {"access_attr_deny_value", PW_TYPE_STRING_PTR, + offsetof(ldap_instance,access_attr_deny_value), NULL, "FALSE"}, {"chase_referrals", PW_TYPE_BOOLEAN, offsetof(ldap_instance,chase_referrals), NULL, NULL}, {"rebind", PW_TYPE_BOOLEAN, @@ -1405,8 +1408,8 @@ if (inst->access_attr) { if ((vals = ldap_get_values(conn->ld, msg, inst->access_attr)) != NULL) { if (inst->default_allow){ - RDEBUG("checking if remote access for %s is allowed by %s", request->username->vp_strvalue, inst->access_attr); - if (!strncmp(vals[0], "FALSE", 5)) { + RDEBUG("checking if remote access for user %s is %s by %s", request->username->vp_strvalue, inst->access_attr_deny_value, inst->access_attr); + if (!strncmp(vals[0], inst->access_attr_deny_value, sizeof(inst->access_attr_deny_value))) { RDEBUG("dialup access disabled"); snprintf(module_fmsg,sizeof(module_fmsg)," [%s] Access Attribute denies access", inst->xlat_name); module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ); ###############################################

1 1

Ubuntu client always connect to wlan even if it is not allowed by Freeradius
by PROST Frédéric 03 Oct '11

03 Oct '11

Hello, I set up Freeradius 2.1.11 to authenticate against ActiveDirectory (with ntlm) after having validated the mac Address (with mac-auth), for a wireless Lan (Netgear WPAN320). Everything is working fine on Windows but I have a problem with workstation on Ubuntu 11.04 : on the first connection, everything is working fine : it checks if the MAC address and login/password are correct and allow connection or not. But if the connection is correct at the first time and if I then change one of those parameters (ie, disable MAC address on the radius server or change login on my Ubuntu workstation), I can still connect to my WLAN. The only way to correct this problem is to physically switch off and on the wlan card on Ubuntu workstation. It seems that it has a kind of cache but I can't determine where and how to disable it (on my Radius server). Here is a freeradius log extract of the first connection where we can see that it checks the MAC address Mon Oct 3 11:55:51 2011 : Info: ++- entering policy rewrite.calling_station_id {...} Mon Oct 3 11:55:51 2011 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) Mon Oct 3 11:55:51 2011 : Info: ?? Evaluating (Calling-Station-Id) -> TRUE Mon Oct 3 11:55:51 2011 : Info: expand: %{Calling-Station-Id} -> 00-18-DE-55-61-7F Mon Oct 3 11:55:51 2011 : Info: expand: policy.mac-addr -> policy.mac-addr Mon Oct 3 11:55:51 2011 : Info: expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ Mon Oct 3 11:55:51 2011 : Info: ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Mon Oct 3 11:55:51 2011 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Mon Oct 3 11:55:51 2011 : Info: +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} Mon Oct 3 11:55:51 2011 : Info: expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-18-DE-55-61-7F Mon Oct 3 11:55:51 2011 : Info: expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-18-de-55-61-7f Mon Oct 3 11:55:51 2011 : Info: ++++[request] returns ok Mon Oct 3 11:55:51 2011 : Info: ++++[updated] returns updated Mon Oct 3 11:55:51 2011 : Info: +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated Mon Oct 3 11:55:51 2011 : Info: +++ ... skipping else for request 11: Preceding "if" was taken Mon Oct 3 11:55:51 2011 : Info: ++- policy rewrite.calling_station_id returns updated Mon Oct 3 11:55:51 2011 : Info: [authorized_macs] expand: %{Calling-Station-ID} -> 00-18-de-55-61-7f Mon Oct 3 11:55:51 2011 : Info: [authorized_macs] users: Matched entry 00-18-de-55-61-7f at line 2 Mon Oct 3 11:55:51 2011 : Info: ++[authorized_macs] returns ok Mon Oct 3 11:55:51 2011 : Info: ++? if (!ok) Mon Oct 3 11:55:51 2011 : Info: ? Evaluating !(ok) -> FALSE Mon Oct 3 11:55:51 2011 : Info: ++? if (!ok) -> FALSE Mon Oct 3 11:55:51 2011 : Info: ++? if (!EAP-Message) Mon Oct 3 11:55:51 2011 : Info: ? Evaluating !(EAP-Message) -> FALSE Here is the Freeradius log file for the second connection, after disable MAC Address and restarted FreeRadius (it connects directly without checking MAC address) : rad_recv: Accounting-Request packet from host 192.168.2.15 port 32847, id=2, length=152 Acct-Session-Id = "4E8592C9-00000140" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "salons" NAS-IP-Address = 192.168.2.15 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "20-4E-7F-3C-EF-00:mdwifi" Calling-Station-Id = "00-18-DE-55-61-7F" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Mon Oct 3 11:50:16 2011 : Info: # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default Mon Oct 3 11:50:16 2011 : Info: +- entering group preacct {...} Mon Oct 3 11:50:16 2011 : Info: ++[preprocess] returns ok Mon Oct 3 11:50:16 2011 : Info: [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.2.15,NAS-IP-Address = 192.168.2.15,Acct-Session-Id = "4E8592C9-00000140",User-Name = "salons"' Mon Oct 3 11:50:16 2011 : Info: [acct_unique] Acct-Unique-Session-ID = "94477ec3eb897dd7". Mon Oct 3 11:50:16 2011 : Info: ++[acct_unique] returns ok Mon Oct 3 11:50:16 2011 : Info: [suffix] No '@' in User-Name = "salons", looking up realm NULL Mon Oct 3 11:50:16 2011 : Info: [suffix] No such realm "NULL" Mon Oct 3 11:50:16 2011 : Info: ++[suffix] returns noop Mon Oct 3 11:50:16 2011 : Info: ++[files] returns noop Mon Oct 3 11:50:16 2011 : Info: # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default Mon Oct 3 11:50:16 2011 : Info: +- entering group accounting {...} Mon Oct 3 11:50:16 2011 : Info: [detail] expand: %{Packet-Src-IP-Address} -> 192.168.2.15 Mon Oct 3 11:50:16 2011 : Info: [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.15/detail-20111003 Mon Oct 3 11:50:16 2011 : Info: [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.15/detail-20111003 Mon Oct 3 11:50:16 2011 : Info: [detail] expand: %t -> Mon Oct 3 11:50:16 2011 Mon Oct 3 11:50:16 2011 : Info: ++[detail] returns ok Mon Oct 3 11:50:16 2011 : Info: ++[unix] returns ok Mon Oct 3 11:50:16 2011 : Info: [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp Mon Oct 3 11:50:16 2011 : Info: [radutmp] expand: %{User-Name} -> salons Mon Oct 3 11:50:16 2011 : Info: ++[radutmp] returns ok Mon Oct 3 11:50:16 2011 : Info: ++[exec] returns noop Mon Oct 3 11:50:16 2011 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> salons Mon Oct 3 11:50:16 2011 : Debug: attr_filter: Matched entry DEFAULT at line 12 Mon Oct 3 11:50:16 2011 : Info: ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 2 to 192.168.2.15 port 32847 Mon Oct 3 11:50:16 2011 : Info: Finished request 1. Mon Oct 3 11:50:16 2011 : Info: Cleaning up request 1 ID 2 with timestamp +17 Mon Oct 3 11:50:16 2011 : Debug: Going to the next request Mon Oct 3 11:50:16 2011 : Info: Ready to process requests. Do you have any idea of how to correct this ? Thank you very much, Regards, Fred

4 3

FW: Radius Server Doesn't Communicate AP
by Alejandro Moreno 03 Oct '11

03 Oct '11

Hi my problem is that im trying to communicate my radius server with the access point that i already configured and already added to the clients list and still doesn't work! i've been in all the forums about freeradius and i've read all the documentation of freeradius but nothing solve thisim really frustrated about this so i'd really appreciate it if someone could help me thank u

8 25