March 2011 - Freeradius-Users - lists.freeradius.org

testing which client initiated request ? Client-shortname ... FreeRADIUS-Client-Shortname
by Robert Roll 30 Mar '11

30 Mar '11

I'd like to test and see which particular client was responsible for a request. I found two attributes Client-Shortname and FreeRADIUS-Client-Shortname, but when I try and use this in unlang they do not seem to have values ? Any suggestions... Thanks, Robert

3 5

Error: Exec-Program: Permission Denied when running via service start
by Christopher Athans 29 Mar '11

29 Mar '11

Greetings all, I've been racking my brains out trying to solve/debug the following issue, hopefully someone can provide a new perspective. I've implemented mOTP as en external authentication program by defining it in radiusd.conf with a Program = "/etc/raddb/otpverify.sh" statement. As I said, it does indeed work properly, except, when I start the radiusd server up as a daemon via init.d radiusd -X - Works properly service radiusd start or /etc/init.d/radiusd start FAILS sh /etc/init.d/radiusd start Works When it works properly, I get proper Accept Replys. When it 'fails', its due to not being able to execute the script and this is logged in radius.log Error: Exec-Program: FAILED to execute /etc/raddb/otpverify.sh: Permission denied In all the above scenarios, I was root when executing the statements. I am *not* in a chroot jail, all the necessary directories are read/write by user 'radiusd' which is what the process is running as. I'm also using the init.d script that came with the CentOS package. My linux platform and freeradius information is as follows: CentOS 5.5 - 2.6.18-194.32.1.el5 #1 SMP x86_64 GNU/Linux running FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu. Thanks for any assistance with this.

3 5

Mac Auth and post-auth logging to SQL
by Jason Antman 29 Mar '11

29 Mar '11

Hello, I'm running FreeRADIUS 2.1.7 on CentOS 5, and trying to configure MAC Auth Bypass. I got everything functioning correctly using the Mac-Auth Wiki page as a guide, including placement of the actual CSID authentication code in the post-auth section. However, I just enabled SQL in the post-auth section, and everything is getting logged to SQL with reply Access-Accept, even if it matched the "reject" statement. It seems to me that it's pretty logical that post-auth would be entered with Auth-Type == Access-Accept, the SQL log would happen, and *then* the "reject" statement would get executed. What I don't understand is why I shouldn't move the actual authentication (authorized_macs.authorize) to the auth { } section, or else how I go about logging rejected requests. Any advice or guidance would be greatly appreciated. Thanks, Jason Antman -- Jason Antman System Administrator Rutgers University OIT Central Systems & Services / NetOps Office: 732-445-6363 Cell: 732-983-7256 jantman(a)oit.rutgers.edu

3 8

Re: EAP-TTLS Problem
by Usuário do Sistema 29 Mar '11

29 Mar '11

Are you using sql as users database ? I've done a FreeRadius for authentication my wireless users but I've used Ldap+Samba as users database. I have done EAP-TLS and everything worked. search for EAP-TLS in freeradius maillist and too for maiconlp. it's likely you will find my post. it's showing all step for create ldap + Samba. 2011/3/29 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. EAP-TTLS Problem (Milosh Droxy) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 29 Mar 2011 16:10:41 +0430 > From: Milosh Droxy <droxy.net(a)gmail.com> > Subject: EAP-TTLS Problem > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <AANLkTim1pbcg7w30RLQj-iMTW7BTVCxtHGN_Nc3xS6Rm(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi > > ok, I've been searching and testing for about a week now. I'm quite sure > I've read almost every topic related to my problem on this mailing-list and > others. and I was afraid to ask for help because I've never posted on a > mailing list or a forum and I was really afraid of Alan DeKoK. > The Problem: > I'm trying to use Freeradius to authenticate users using EAP-TTLS MSCHAP, > with no success. > I use "FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu". on a > Ubuntu 10.04 64bit Server. > I've used these devices as clients > two Ubiquiti devices (http://www.ubnt.com/nanobridge) (one as AP and one > as > client) > A TP-Link TL-WR542G as AP and my laptop (running ubuntu 10.10) as client. > (and an iPad) > (There were NO Windows XP in any of my tests, so it's not a Microsoft > issue) > > and I've used eapol_test, with successful results, the problem only shows > when I try to authenticate remotely. since the eapol_test results were fine > I wont post the output here. (or should I ?) > > and here is the output for when I try to authenticate remotely (the output > is exactly the same with any combination I've tried) > > FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Mar > 5 2011 at 07:22:25 > Starting - reading configuration files ... > including configuration file /usr/local/etc/raddb/radiusd.conf > including configuration file /usr/local/etc/raddb/proxy.conf > including configuration file /usr/local/etc/raddb/clients.conf > including files in directory /usr/local/etc/raddb/modules/ > including configuration file /usr/local/etc/raddb/modules/ntlm_auth > including configuration file /usr/local/etc/raddb/modules/sradutmp > including configuration file /usr/local/etc/raddb/modules/dynamic_clients > including configuration file /usr/local/etc/raddb/modules/realm > including configuration file /usr/local/etc/raddb/modules/attr_rewrite > including configuration file /usr/local/etc/raddb/modules/mac2vlan > including configuration file /usr/local/etc/raddb/modules/linelog > including configuration file /usr/local/etc/raddb/modules/logintime > including configuration file /usr/local/etc/raddb/modules/always > including configuration file /usr/local/etc/raddb/modules/mschap > including configuration file /usr/local/etc/raddb/modules/etc_group > including configuration file /usr/local/etc/raddb/modules/detail.log > including configuration file /usr/local/etc/raddb/modules/checkval > including configuration file /usr/local/etc/raddb/modules/ > detail.example.com > including configuration file /usr/local/etc/raddb/modules/expiration > including configuration file > /usr/local/etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /usr/local/etc/raddb/modules/policy > including configuration file /usr/local/etc/raddb/modules/inner-eap > including configuration file /usr/local/etc/raddb/modules/ippool > including configuration file /usr/local/etc/raddb/modules/passwd > including configuration file /usr/local/etc/raddb/modules/detail > including configuration file /usr/local/etc/raddb/modules/smbpasswd > including configuration file /usr/local/etc/raddb/modules/ldap > including configuration file /usr/local/etc/raddb/modules/unix > including configuration file /usr/local/etc/raddb/modules/chap > including configuration file /usr/local/etc/raddb/modules/preprocess > including configuration file /usr/local/etc/raddb/modules/files > including configuration file /usr/local/etc/raddb/modules/digest > including configuration file /usr/local/etc/raddb/modules/acct_unique > including configuration file /usr/local/etc/raddb/modules/attr_filter > including configuration file /usr/local/etc/raddb/modules/otp > including configuration file /usr/local/etc/raddb/modules/exec > including configuration file /usr/local/etc/raddb/modules/sql_log > including configuration file /usr/local/etc/raddb/modules/echo > including configuration file /usr/local/etc/raddb/modules/cui > including configuration file /usr/local/etc/raddb/modules/counter > including configuration file /usr/local/etc/raddb/modules/smsotp > including configuration file /usr/local/etc/raddb/modules/expr > including configuration file /usr/local/etc/raddb/modules/wimax > including configuration file /usr/local/etc/raddb/modules/perl > including configuration file /usr/local/etc/raddb/modules/pam > including configuration file /usr/local/etc/raddb/modules/radutmp > including configuration file /usr/local/etc/raddb/modules/opendirectory > including configuration file /usr/local/etc/raddb/modules/krb5 > including configuration file /usr/local/etc/raddb/modules/mac2ip > including configuration file /usr/local/etc/raddb/modules/pap > including configuration file /usr/local/etc/raddb/eap.conf > including configuration file /usr/local/etc/raddb/sql.conf > including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf > including configuration file /usr/local/etc/raddb/policy.conf > including files in directory /usr/local/etc/raddb/sites-enabled/ > including configuration file /usr/local/etc/raddb/sites-enabled/default > including configuration file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > including configuration file > /usr/local/etc/raddb/sites-enabled/control-socket > main { > allow_core_dumps = no > } > including dictionary file /usr/local/etc/raddb/dictionary > main { > prefix = "/usr/local" > localstatedir = "/usr/local/var" > logdir = "/usr/local/var/log/radius" > libdir = "/usr/local/lib" > radacctdir = "/usr/local/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = yes > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating module "exec" from file > /usr/local/etc/raddb/modules/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating module "expr" from file > /usr/local/etc/raddb/modules/expr > Module: Linked to module rlm_expiration > Module: Instantiating module "expiration" from file > /usr/local/etc/raddb/modules/expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating module "logintime" from file > /usr/local/etc/raddb/modules/logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { # from file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating module "pap" from file > /usr/local/etc/raddb/modules/pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating module "chap" from file > /usr/local/etc/raddb/modules/chap > Module: Linked to module rlm_mschap > Module: Instantiating module "mschap" from file > /usr/local/etc/raddb/modules/mschap > mschap { > use_mppe = yes > require_encryption = yes > require_strong = yes > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating module "unix" from file > /usr/local/etc/raddb/modules/unix > unix { > radwtmp = "/usr/local/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf > eap { > default_eap_type = "ttls" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 4096 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/usr/local/etc/raddb/mycerts" > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/mycerts/server_keycert.pem" > certificate_file = "/usr/local/etc/raddb/mycerts/server_keycert.pem" > private_key_password = "usetheserver" > dh_file = "/usr/local/etc/raddb/mycerts/dh" > random_file = "/usr/local/etc/raddb/mycerts/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/mycerts/bootstrap" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = yes > include_length = yes > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_realm > Module: Instantiating module "suffix" from file > /usr/local/etc/raddb/modules/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating module "files" from file > /usr/local/etc/raddb/modules/files > files { > usersfile = "/usr/local/etc/raddb/users" > acctusersfile = "/usr/local/etc/raddb/acct_users" > preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > compat = "no" > } > Module: Checking session {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating module "radutmp" from file > /usr/local/etc/raddb/modules/radutmp > radutmp { > filename = "/usr/local/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Linked to module rlm_attr_filter > Module: Instantiating module "attr_filter.access_reject" from file > /usr/local/etc/raddb/modules/attr_filter > attr_filter attr_filter.access_reject { > attrsfile = "/usr/local/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > } > } # modules > } # server > server { # from file /usr/local/etc/raddb/radiusd.conf > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_digest > Module: Instantiating module "digest" from file > /usr/local/etc/raddb/modules/digest > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating module "preprocess" from file > /usr/local/etc/raddb/modules/preprocess > preprocess { > huntgroups = "/usr/local/etc/raddb/huntgroups" > hints = "/usr/local/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Linked to module rlm_sql > Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf > sql { > driver = "rlm_sql_mysql" > server = "127.0.0.1" > port = "" > login = "radius" > password = "*************" > radius_db = "radius" > read_groups = yes > sqltrace = no > sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" > readclients = yes > deletestalesessions = yes > num_sql_socks = 5 > lifetime = 0 > max_queries = 0 > sql_user_name = "%{User-Name}" > default_user_profile = "" > nas_query = "SELECT id, nasname, shortname, type, secret, server FROM > nas" > authorize_check_query = "SELECT id, username, attribute, value, > op FROM radcheck WHERE username = > '%{SQL-User-Name}' ORDER BY id" > authorize_reply_query = "SELECT id, username, attribute, value, > op FROM radreply WHERE username = > '%{SQL-User-Name}' ORDER BY id" > authorize_group_check_query = "SELECT id, groupname, > attribute, Value, op FROM radgroupcheck WHERE > groupname = '%{Sql-Group}' ORDER BY id" > authorize_group_reply_query = "SELECT id, groupname, > attribute, value, op FROM radgroupreply WHERE > groupname = '%{Sql-Group}' ORDER BY id" > accounting_onoff_query = " UPDATE radacct > SET acctstoptime = '%S', acctsessiontime > = unix_timestamp('%S') - > unix_timestamp(acctstarttime), acctterminatecause = > '%{Acct-Terminate-Cause}', acctstopdelay = > %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND > nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= > '%S'" > accounting_update_query = " UPDATE radacct > SET framedipaddress = '%{Framed-IP-Address}', > acctsessiontime = '%{Acct-Session-Time}', > acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 > | > '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = > '%{%{Acct-Output-Gigawords}:-0}' << 32 | > '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = > '%{Acct-Session-Id}' AND username = > '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_update_query_alt = " INSERT INTO > radacct (acctsessionid, acctuniqueid, > username, realm, nasipaddress, > nasportid, nasporttype, acctstarttime, > acctsessiontime, acctauthentic, connectinfo_start, > acctinputoctets, acctoutputoctets, calledstationid, > callingstationid, servicetype, framedprotocol, > framedipaddress, acctstartdelay, > xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', > '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', > '%{NAS-Port-Type}', DATE_SUB('%S', > INTERVAL (%{%{Acct-Session-Time}:-0} + > %{%{Acct-Delay-Time}:-0}) SECOND), > '%{Acct-Session-Time}', '%{Acct-Authentic}', '', > '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' > << 32 | '%{%{Acct-Output-Octets}:-0}', > '%{Called-Station-Id}', '%{Calling-Station-Id}', > '%{Service-Type}', '%{Framed-Protocol}', > '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" > accounting_start_query = " INSERT INTO radacct > (acctsessionid, acctuniqueid, username, > realm, nasipaddress, nasportid, > nasporttype, acctstarttime, acctstoptime, > acctsessiontime, acctauthentic, connectinfo_start, > connectinfo_stop, acctinputoctets, acctoutputoctets, > calledstationid, callingstationid, acctterminatecause, > servicetype, framedprotocol, framedipaddress, > acctstartdelay, acctstopdelay, xascendsessionsvrkey) > VALUES ('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', > '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', > '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', > '%{Connect-Info}', '', '0', '0', > '%{Called-Station-Id}', '%{Calling-Station-Id}', '', > '%{Service-Type}', '%{Framed-Protocol}', > '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', > '%{X-Ascend-Session-Svr-Key}')" > accounting_start_query_alt = " UPDATE radacct SET > acctstarttime = '%S', acctstartdelay = > '%{%{Acct-Delay-Time}:-0}', connectinfo_start = > '%{Connect-Info}' WHERE acctsessionid = > '%{Acct-Session-Id}' AND username = > '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_stop_query = " UPDATE radacct SET > acctstoptime = '%S', acctsessiontime = > '%{Acct-Session-Time}', acctinputoctets = > '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = > '%{%{Acct-Output-Gigawords}:-0}' << 32 | > '%{%{Acct-Output-Octets}:-0}', acctterminatecause = > '%{Acct-Terminate-Cause}', acctstopdelay = > '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = > '%{Connect-Info}' WHERE acctsessionid = > '%{Acct-Session-Id}' AND username = > '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_stop_query_alt = " INSERT INTO radacct > (acctsessionid, acctuniqueid, username, realm, nasipaddress, > nasportid, nasporttype, acctstarttime, > acctstoptime, acctsessiontime, acctauthentic, > connectinfo_start, connectinfo_stop, acctinputoctets, > acctoutputoctets, calledstationid, callingstationid, > acctterminatecause, servicetype, framedprotocol, > framedipaddress, acctstartdelay, acctstopdelay) > VALUES ('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', > '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', > '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL > (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) > SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', > '', '%{Connect-Info}', > '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' > << 32 | '%{%{Acct-Output-Octets}:-0}', > '%{Called-Station-Id}', '%{Calling-Station-Id}', > '%{Acct-Terminate-Cause}', '%{Service-Type}', > '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', > '%{%{Acct-Delay-Time}:-0}')" > group_membership_query = "SELECT groupname FROM > radusergroup WHERE username = '%{SQL-User-Name}' ORDER > BY priority" > connect_failure_retry_delay = 60 > simul_count_query = "" > simul_verify_query = "SELECT radacctid, acctsessionid, > username, nasipaddress, nasportid, > framedipaddress, callingstationid, > framedprotocol FROM > radacct WHERE username = > '%{SQL-User-Name}' AND acctstoptime IS NULL" > postauth_query = "INSERT INTO radpostauth > (username, pass, reply, authdate) VALUES > ( '%{User-Name}', > '%{%{User-Password}:-%{Chap-Password}}', > '%{reply:Packet-Type}', '%S')" > safe-characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" > } > rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and > linked > rlm_sql (sql): Attempting to connect to radius@127.0.0.1:/radius > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 > rlm_sql_mysql: Starting connect to MySQL server for #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 > rlm_sql_mysql: Starting connect to MySQL server for #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 > rlm_sql_mysql: Starting connect to MySQL server for #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 > rlm_sql_mysql: Starting connect to MySQL server for #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 > rlm_sql_mysql: Starting connect to MySQL server for #4 > rlm_sql (sql): Connected new DB handle, #4 > rlm_sql (sql): Processing generate_sql_clients > rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, > shortname, type, secret, server FROM nas > rlm_sql (sql): Reserving sql socket id: 4 > rlm_sql (sql): Read entry > nasname=10.10.10.145,shortname=ubnt,secret=testing > rlm_sql (sql): Adding client 10.10.10.145 (ubnt, server=<none>) to clients > list > rlm_sql (sql): Read entry nasname=10.10.10.89,shortname=AP,secret=testing > rlm_sql (sql): Adding client 10.10.10.89 (AP, server=<none>) to clients > list > rlm_sql (sql): Released sql socket id: 4 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating module "acct_unique" from file > /usr/local/etc/raddb/modules/acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, > NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating module "detail" from file > /usr/local/etc/raddb/modules/detail > detail { > detailfile = > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Instantiating module "attr_filter.accounting_response" from file > /usr/local/etc/raddb/modules/attr_filter > attr_filter attr_filter.accounting_response { > attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/usr/local/var/run/radiusd/radiusd.sock" > } > } > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file /usr/local/var/run/radiusd/radiusd.sock > Listening on authentication address 127.0.0.1 port 18120 as server > inner-tunnel > Listening on proxy address * port 1814 > Ready to process requests. > rad_recv: Access-Request packet from host 10.10.10.89 port 1060, id=0, > length=167 > Message-Authenticator = 0x811ce545876890cc89ddd343bcc3cca9 > Service-Type = Framed-User > User-Name = "test" > Framed-MTU = 1488 > Called-Station-Id = "D8-5D-4C-C2-A6-08:TEST" > Calling-Station-Id = "10-93-E9-1D-10-1B" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11g" > EAP-Message = 0x020000090174657374 > NAS-IP-Address = 192.168.1.5 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > # Executing section authorize from file > /usr/local/etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "test", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 0 length 9 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [sql] expand: %{User-Name} -> test > [sql] sql_set_user escaped user --> 'test' > rlm_sql (sql): Reserving sql socket id: 3 > [sql] expand: SELECT id, username, attribute, value, op FROM > radcheck WHERE username = '%{SQL-User-Name}' ORDER BY > id > -> SELECT id, username, attribute, value, op FROM > radcheck WHERE username = 'test' ORDER BY id > [sql] User found in radcheck table > [sql] expand: SELECT id, username, attribute, value, op FROM > radreply WHERE username = '%{SQL-User-Name}' ORDER BY > id > -> SELECT id, username, attribute, value, op FROM > radreply WHERE username = 'test' ORDER BY id > [sql] expand: SELECT groupname FROM radusergroup > WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT > groupname FROM radusergroup WHERE username = > 'test' ORDER BY priority > rlm_sql (sql): Released sql socket id: 3 > ++[sql] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 0 to 10.10.10.89 port 1060 > EAP-Message = 0x010100061520 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x829fae86829ebb1a8141bab516e87a11 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 10.10.10.89 port 1060, id=0, > length=167 > Sending duplicate reply to client AP port 1060 - ID: 0 > Sending Access-Challenge of id 0 to 10.10.10.89 port 1060 > Waking up in 1.8 seconds. > Cleaning up request 0 ID 0 with timestamp +11 > WARNING: > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > WARNING: !! EAP session for state 0x829fae86829ebb1a did not finish! > WARNING: !! Please read > http://wiki.freeradius.org/Certificate_Compatibility > WARNING: > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > Ready to process requests. > > thank you very much > P.S: please forgive my ignorance of the proper way of mailing or explaining > my problem. >

1 0

OT: JRadius client <-> Freeradius 2.1.10 PAP authentication
by Harry Hoffman 29 Mar '11

29 Mar '11

Hi All, If anyone is using JRadius client (especially via JASIG CAS) to authenticate to a freeradius server using PAP could you contact me offlist? Cheers, Harry

1 0

I need help
by Ossy Tony 29 Mar '11

29 Mar '11

Hi, I'm Tony. I'm running FreeRADIUS version 2.1.10. Each time i try to launch the radiusd daemon, it does not complete successfully and gives an error message "Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory" Please I need help on how to take care of this issue. Below is the radiusd daemon launch debug output; * * ossytony@ubuntu:/$ cd /etc//raddb/ ossytony@ubuntu:/etc/raddb$ sudo radiusd -X [sudo] password for ossytony: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Mar 27 2011 at 23:34:45 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.11.32.134 { require_message_authenticator = no secret = "419abcQam64" nastype = "other" login = "!root" password = "itsme0107" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory

3 2

EAP-TTLS Problem
by Milosh Droxy 29 Mar '11

29 Mar '11

Hi ok, I've been searching and testing for about a week now. I'm quite sure I've read almost every topic related to my problem on this mailing-list and others. and I was afraid to ask for help because I've never posted on a mailing list or a forum and I was really afraid of Alan DeKoK. The Problem: I'm trying to use Freeradius to authenticate users using EAP-TTLS MSCHAP, with no success. I use "FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu". on a Ubuntu 10.04 64bit Server. I've used these devices as clients two Ubiquiti devices (http://www.ubnt.com/nanobridge) (one as AP and one as client) A TP-Link TL-WR542G as AP and my laptop (running ubuntu 10.10) as client. (and an iPad) (There were NO Windows XP in any of my tests, so it's not a Microsoft issue) and I've used eapol_test, with successful results, the problem only shows when I try to authenticate remotely. since the eapol_test results were fine I wont post the output here. (or should I ?) and here is the output for when I try to authenticate remotely (the output is exactly the same with any combination I've tried) FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Mar 5 2011 at 07:22:25 Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/mycerts" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/mycerts/server_keycert.pem" certificate_file = "/usr/local/etc/raddb/mycerts/server_keycert.pem" private_key_password = "usetheserver" dh_file = "/usr/local/etc/raddb/mycerts/dh" random_file = "/usr/local/etc/raddb/mycerts/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/mycerts/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes include_length = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "127.0.0.1" port = "" login = "radius" password = "*************" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@127.0.0.1:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=10.10.10.145,shortname=ubnt,secret=testing rlm_sql (sql): Adding client 10.10.10.145 (ubnt, server=<none>) to clients list rlm_sql (sql): Read entry nasname=10.10.10.89,shortname=AP,secret=testing rlm_sql (sql): Adding client 10.10.10.89 (AP, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.89 port 1060, id=0, length=167 Message-Authenticator = 0x811ce545876890cc89ddd343bcc3cca9 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 Called-Station-Id = "D8-5D-4C-C2-A6-08:TEST" Calling-Station-Id = "10-93-E9-1D-10-1B" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090174657374 NAS-IP-Address = 192.168.1.5 NAS-Port = 1 NAS-Port-Id = "STA port # 1" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.10.10.89 port 1060 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x829fae86829ebb1a8141bab516e87a11 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.89 port 1060, id=0, length=167 Sending duplicate reply to client AP port 1060 - ID: 0 Sending Access-Challenge of id 0 to 10.10.10.89 port 1060 Waking up in 1.8 seconds. Cleaning up request 0 ID 0 with timestamp +11 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x829fae86829ebb1a did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. thank you very much P.S: please forgive my ignorance of the proper way of mailing or explaining my problem.

1 0

radwho shows only the last user logged.
by joaocdc＠gmail.com 28 Mar '11

28 Mar '11

Hello guys, I have a question. I'm using freeradius 2.1.10 on debian squezze. I am using multiple databases for authentication, in an LDAP, and SQL in another. Each using a different Realm. Regarding the authentication, everything is working normally. But when I try to check the server how many users are logged via the command radwho, it returns me only the last user who logged in, I think he should show everyone who is authenticated at this point right?? Regards. John -- João Paulo de Lima Barbosa Fone: (45) 9938-8399 Blog: http://joao.us Twitter: @joaocdc "O erro dos que tem poder é colocar barreiras para que ninguém os alcance, incentivando-nos a buscar todas as formas que encontramos para alcança-los."

3 8

configuring freeradius to use Ntlm_auth
by Raheel Itrat 28 Mar '11

28 Mar '11

Hi , I am following the link http://deployingradius.com/documents/configuration/active_directory.html to integrate AD with freeradius I have done configuration changes as per the attached files Now when i run the radtest radtest user password localhost 0 testing123 I get Accept reject. I have attached my debug output as well Any thoughts?

3 3

different pptpd policies per groups/users
by amir reza rahbaran 27 Mar '11

27 Mar '11

Hi everybody, I want to know if freeradius is able to have different pptpd policies per groups/users - one with encryption (require-mppe) and another without encryption (refuse-mppe) for instance? I use FreeRADIUS Version 2.1.8.1, pptpd v1.3.3 and pppd version 2.4.3 and Linux kernel 2.6.34.1. thank you in advance. -- Ya Mahdi

1 0