June 2011 - Freeradius-Users - lists.freeradius.org

Re: Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory
by John 27 Jul '11

27 Jul '11

I attached the captured packets. Please open it with wireshark. The password from OD is “********”. It is neither cleartext password nor encrypted password. --- 10年3月18日，周四, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: Re: Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年3月18日,周四,下午7:01 I configured the LDAP module talks to Open Directory, based on the debug looks the password fetched from OD, but the authentication always failed. Is there any guide for freeRADIUS+ldap+OD integrating? I setup freeRADIUS talks to OpenLDAP, it works well. Can OD return cleartext password like OpenLDAP do? John. --- 10年3月15日，周一, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年3月15日,周一,下午12:59 John wrote: > Hello, > We want to setup freeRADIUS with Peap/MSCHAPv2 talk to Apple Open > Directory. I found this option 'use_open_directory'. But looks we need > to install freeRADIUS on the same machine with Open > Directory.(https://lists.freeradius.org/pipermail/freeradius-users/2010-Feb… > > Do we have to run freeRADIUS on the same machine with OpenDirectory? Yes. > Is > there a work-around that we can run freeRADIUS seperate from OpenDirectory? OpenDirectory is an LDAP server. Configure that way in FreeRADIUS. It might work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----下面为附件内容----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Duplicate virtual server "xxx" always hits on HUP
by Bjørn Mork 18 Jul '11

18 Jul '11

After upgrading to 2.1.11 I've noticed that I always get a "Duplicate virtual server" error when HUPing the server. This is obviously a result of the change in commit 5a710e98 but I have no idea how to fix it. Steps to recreate from a fresh and default FreeRADIUS 2.1.11 installation: 1) start the server with default configuration 2) kill -HUP <pid> The server will complain about one of the virtual servers being a duplicate, listing the exact same config line for both defintions: Duplicate virtual server "inner-tunnel" in file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 and file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 This will always be the "inner-tunnel" virtual server with the default configuration. I guess that's a result of the name hashing. Full debug output from "radiusd -X" follows below Bjørn FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Jun 30 2011 at 09:09:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/proxy.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/clients.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/linelog including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/perl including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/echo including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/policy including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/passwd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/counter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pam including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/checkval including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/redis including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ldap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/replicate including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ippool including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/always including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/soh including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/cui including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/wimax including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/otp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/policy.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/huntgroups" hints = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/users" acctusersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 61812 } listen { type = "acct" ipaddr = * port = 61813 } listen { type = "control" listen { socket = "/usr/local/tmp/fr-20110630/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 45444 Listening on authentication address * port 61812 Listening on accounting address * port 61813 Listening on command file /usr/local/tmp/fr-20110630/usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 61814 Ready to process requests. Ready to process requests. Received HUP signal. HUP - Re-reading configuration files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/proxy.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/clients.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/linelog including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/perl including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/echo including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/policy including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/passwd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/counter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pam including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/checkval including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/redis including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ldap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/replicate including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ippool including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/always including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/soh including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/cui including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/wimax including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/otp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/policy.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/default HUP - loading modules Module: Trying to reload module "pap" pap { encryption_scheme = "auto" auto_header = no } Module: Reloaded module "pap" Module: Trying to reload module "suffix" realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Reloaded module "suffix" Module: Trying to reload module "files" files { usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/users" acctusersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Reloaded module "files" Module: Trying to reload module "attr_filter.access_reject" attr_filter attr_filter.access_reject { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } Module: Reloaded module "attr_filter.access_reject" Module: Trying to reload module "attr_filter.accounting_response" attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Reloaded module "attr_filter.accounting_response" Module: Trying to reload module "radutmp" radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Reloaded module "radutmp" Module: Trying to reload module "detail" detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Reloaded module "detail" Module: Trying to reload module "mschap" mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Reloaded module "mschap" radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server Duplicate virtual server "inner-tunnel" in file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 and file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 Ready to process requests.

3 7

How to setup Freeradius
by Gilmour, Scott 14 Jul '11

14 Jul '11

I have been able to install freeradius using the Synaptic Package Manager. I installed these two packages openssl and the freeradius. I have also installed certificates. I have been able to get everything to work with freeradius except PEAP and TLS. Do I need to install other packages or do anything else in order to get PEAP and TLS to work? Thanks Scott

9 23

Re: Wiki - Once upon a time there was documentation
by Nonny Mouse 12 Jul '11

12 Jul '11

I can confirm that some Wiki pages are blank (waiting to be edited). I checked, and they don't appear to be on the to-do list for conversion. Instead, it brings it up as a "Create New Page" dialog. I'm willing to help out with them, but need to create an account and review the stylesheets/directives for Restructured Text/Markdown first. Also, unlike other mailing lists I've used, I can't seem to figure out how to use the web interface to reply within an existing thread (I'm a new user, so I can't respond to the original mail or digest). We are planning to deploy FreeRadius within the next month, so I'm doing my homework first. I appreciate all the resources you do have available so far. http://wiki.freeradius.org/Mac-Auth http://wiki.freeradius.org/%23Is+there+a+way+to+bind+FreeRADIUS+to+a+specif… http://bugs.freeradius.org/show_bug.cgi?id=207 (This is a broken link from http://wiki.freeradius.org/FAQ, which also has some minor grammatical errors I'd be happy to fix). http://wiki.freeradius.org/SNMP http://wiki.freeradius.org/MIB http://wiki.freeradius.org/Framed-IP-Netmask http://wiki.freeradius.org/%23Why+do+Acct-Input-Octets+and+Acct-Output-Octe…

7 8

Default tables
by Luke Hammond 11 Jul '11

11 Jul '11

Sorry if this question is deemed as bein g silly, but i cant find a straight answer for this anywhere.. What are the default tables that are installed with FreeRADIUS when i use MySQL for the database?

3 4

Freeradius 2.1.10: authentication (uid and password) or (macaddress) in LDAP
by Maciej Łukasz Wojszkun 11 Jul '11

11 Jul '11

Hello, somebody can tell me how I should configure freeradius to authenticate in order (all is in openldap): check mac-address in ldap if exist authenticate computer else authenticate with uid/password or try authenticate using macaddress if rejected - try authenticate via uid/password -- Regards Maciej Łukasz Wojszkun [MWO]

2 2

rlm_sql: "NUMERIC VALUE OUT OF RANGE" error
by Vegard Svanberg 07 Jul '11

07 Jul '11

Freeradius 2.1.0. I have a NAS which sends a NAS-Port-Id attribute in the range 2147483648..2164260863. PostgreSQL doesn't like the query Freeradius performs. It's choking when trying to insert for instance '2163214239::integer' into the radacct table. $ select 2163214239::integer; ERROR: integer out of range Example: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('80f0079f', '5c9f0b7076dcc9c0', 'username', NULLIF('', ''), '1.2.3.4', 2163214239::integer, 'Wireless-802.11', ('2008-09-26 09:52:52'::timestamp - '1'::interval - '3382'::interval), ('2008-09-26 09:52:52'::timestamp - '1'::interval), NULLIF('3382', '')::bigint, '', '', (('0'::bigint << 32) + '57743'::bigint), (('0'::bigint << 32) + '294709'::bigint), 'hotspot', 'XX:XX:XX:XX:XX:XX', 'Lost-Service', '', '', NULLIF('192.168.12.94', '')::inet, 0) rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error integer out of range rlm_sql_postgresql: Postgresql Fatal Error: [22003: NUMERIC VALUE OUT OF RANGE] Occurred!! [sql] Couldn't insert SQL accounting STOP record - ERROR: integer out of range rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Quick fixes...? -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

6 6

how to use groups within freeradius
by Ken Felix 04 Jul '11

04 Jul '11

Can anybody post a simple howto with regards to using groups within freeradius? What we would like todo is restricted some user from logging into various firewalls. I've created usergroups and defined mysql> select * from usergroup ; +------------------+-------------+----------+ | UserName | GroupName | priority | +------------------+-------------+----------+ | | login users | 1 | | asa1.test | adminasa | 1 | | test.user | Login users | 1 | +------------------+-------------+----------+ and mysql> select * from radgroupcheck ; +----+-----------+----------------+----+----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+----------------+ | 1 | adminasa | NAS-IP-Address | == | 10.252.128.11 | | 2 | adminasa | NAS-IP-Address | == | 10.252.253.199 | | 3 | adminasa | NAS-IP-Address | == | 10.250.32.68 | | 4 | adminasa | NAS-IP-Address | == | 10.250.32.69 | | 5 | adminasa | NAS-IP-Address | == | 10.254.32.68 | | 6 | adminasa | NAS-Identifier | == | 10.252.128.11 | +----+-----------+----------------+----+----------------+ 6 rows in set (0.00 sec) debug shows the following; Sending Access-Reject of id 10 to 10.159.103.154 port 1812 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.252.128.11:1025, id=40, length=67 User-Name = "asa1.test" User-Password = "33333333333330" NAS-IP-Address = 10.252.128.11 NAS-Port = 43 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "chap" returns noop for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "asa1.test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 18 modcall[authorize]: module "files" returns notfound for request 18 radius_xlat: 'asa1.test' rlm_sql (sql): sql_set_user escaped user --> 'asa1.test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'asa1.test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'asa1.test' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'asa1.test' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'asa1.test' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'asa1.test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 18 modcall: leaving group authorize (returns ok) for request 18 auth: type Crypt Login OK: [asa1.test] (from client SBBC port 43) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 18 rlm_sql (sql): Processing sql_postauth radius_xlat: 'asa1.test' rlm_sql (sql): sql_set_user escaped user --> 'asa1.test' radius_xlat: 'INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT into radacct (UserName, NASIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, CallingStationId, AcctTerminateCause, NASIdentifier) values ('asa1.test', '10.252.128.11', NOW(), NOW(), '0', 'Local', '', 'Access-Accept', '') rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 18 modcall: leaving group post-auth (returns ok) for request 18 Sending Access-Accept of id 40 to 10.252.128.11 port 1025 Service-Type = Dialout-Framed-User Finished request 18 Going to the next request So I need some starting point of what/where to look at. Thanks

3 3

AUTO: Neal Howard is out of the office (returning 07/05/2011)
by Neal.Howard＠wichitafallstx.gov 30 Jun '11

30 Jun '11

1 0

./configure/make in subdir?
by Phil Mayers 30 Jun '11

30 Jun '11

Does anyone know if it's possible to persuade ./configure to work from within subdirs? I keep flipping back and forth between master and v2.1.x and it would be nice to be able to re-use builds without having to have two git repos & associated hassles. I've seen syntax like this work on some projects. git checkout v2.1.x cd build-v21x ../configure --prefix=/opt/fr21x make make install cd .. git checkout master cd master ../configure --prefix=/opt/frmaster make make install ...but this seems to fail on (the accursed!) libltdl subdir "configure" which is apparently jumping back up into the top-level source directory. I suspect it would similarly fail on the module configure scripts too.

2 2