July 2011 - Freeradius-Users - lists.freeradius.org

Problem with module and users file
by Jean Carlos Oliveira Guandalini 20 Jul '11

20 Jul '11

Hello, i'm using backcounter (rlm_backcounter) module. This module set a attribute and this attribute is compared in USERS file. Freeradius version 2.1.11. users file: DEFAULT Monthly-Time-Exceeded == 1 Framed-Pool = "exceeded", Fall-Through = Yes The problem is what the freeradius never match with this entry in users file. In the source code of rlm_backcounter this lines are used to create a attribute: vp = radius_paircreate(request, &request->reply->vps, data->overvap_attr, PW_TYPE_INTEGER); vp->vp_integer = 1; The module is running, see the logs: Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#615) backcounter_authorize(): resetting user 'prepago' counter Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#653) backcounter_authorize(): using resetval defined in radreply: 0 Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#780) backcounter_authorize(): user prepago is over limit - adding 'Monthly-Time-Exceeded' attribute Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#788) backcounter_authorize(): data->overvap_attr = 3102 Wed Jul 20 11:06:26 2011 : Debug: rlm_sql (sql): Released sql socket id: 1 Wed Jul 20 11:06:26 2011 : Info: ++[time-limit] returns ok Wed Jul 20 11:06:26 2011 : Info: [files] users: Matched entry DEFAULT at line 144 Wed Jul 20 11:06:26 2011 : Info: ++[files] returns ok Is there some setting that needs to be made to accept this attribute? *** I used this module with freeradius-1.1.8 without problems, but we need running in freeradius-2.x Thanks Jean

1 0

Freeradius error with eap authentication
by DENJEAN Didier 20 Jul '11

20 Jul '11

Hi, I have some problems with Freeradius and EAP I use freeradius version 2.1.11 on debian 5 When I start the radius server in debug mode (radiusd -xX), there are no error (file debug1.txt) When eduroam server enable connexion on your freeradius server, I have some errors (file debug2.txt) Could you help me? Best regards Didier Denjean Administrateur Systèmes et Réseaux AMUE Montpellier 34 rue Henri Nogueres 34090 MONTPELLIER 04 99 77 30 11

2 1

freeradius 2.1.11 crashes on reload/HUP
by Gary T. Giesen 18 Jul '11

18 Jul '11

Since I upgraded to 2.1.11, freeradius is crashing occasionally on HUP/reload. It's really strange, it doesn't happen every time, and when it does happen, it takes like 5-10 minutes after the process is reloaded before it happens. I've tried to get core dumps, but have been unsuccessful. Can someone give me some pointers on how to troubleshoot this issue? Thanks, GG

2 2

Duplicate virtual server "xxx" always hits on HUP
by Bjørn Mork 18 Jul '11

18 Jul '11

After upgrading to 2.1.11 I've noticed that I always get a "Duplicate virtual server" error when HUPing the server. This is obviously a result of the change in commit 5a710e98 but I have no idea how to fix it. Steps to recreate from a fresh and default FreeRADIUS 2.1.11 installation: 1) start the server with default configuration 2) kill -HUP <pid> The server will complain about one of the virtual servers being a duplicate, listing the exact same config line for both defintions: Duplicate virtual server "inner-tunnel" in file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 and file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 This will always be the "inner-tunnel" virtual server with the default configuration. I guess that's a result of the name hashing. Full debug output from "radiusd -X" follows below Bjørn FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Jun 30 2011 at 09:09:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/proxy.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/clients.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/linelog including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/perl including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/echo including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/policy including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/passwd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/counter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pam including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/checkval including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/redis including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ldap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/replicate including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ippool including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/always including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/soh including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/cui including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/wimax including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/otp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/policy.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/huntgroups" hints = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/users" acctusersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 61812 } listen { type = "acct" ipaddr = * port = 61813 } listen { type = "control" listen { socket = "/usr/local/tmp/fr-20110630/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 45444 Listening on authentication address * port 61812 Listening on accounting address * port 61813 Listening on command file /usr/local/tmp/fr-20110630/usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 61814 Ready to process requests. Ready to process requests. Received HUP signal. HUP - Re-reading configuration files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/proxy.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/clients.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/linelog including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/perl including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/echo including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/policy including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/passwd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/counter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pam including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/checkval including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/redis including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ldap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/replicate including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ippool including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/always including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/soh including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/cui including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/wimax including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/otp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/policy.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/default HUP - loading modules Module: Trying to reload module "pap" pap { encryption_scheme = "auto" auto_header = no } Module: Reloaded module "pap" Module: Trying to reload module "suffix" realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Reloaded module "suffix" Module: Trying to reload module "files" files { usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/users" acctusersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Reloaded module "files" Module: Trying to reload module "attr_filter.access_reject" attr_filter attr_filter.access_reject { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } Module: Reloaded module "attr_filter.access_reject" Module: Trying to reload module "attr_filter.accounting_response" attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Reloaded module "attr_filter.accounting_response" Module: Trying to reload module "radutmp" radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Reloaded module "radutmp" Module: Trying to reload module "detail" detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Reloaded module "detail" Module: Trying to reload module "mschap" mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Reloaded module "mschap" radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server Duplicate virtual server "inner-tunnel" in file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 and file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 Ready to process requests.

3 7

"radiusd -X" read my sql database but not "freeradius -X"
by schnoocats 18 Jul '11

18 Jul '11

Hello everybody, as part of my studies I try to set up a radius server with a mysql database. I have a wifi access point defined as a client (172.16.140.87) in a NAS table inside my radius database. Everything works perfectly when i test with the tool "radiusd -X" ! But when i use the tool "freeradius -X" it does not connect to the database, so it will not read the client and therefore I 'have a great "Ignoring request to authentication address * port 1812 from 172.16.140.87 port 59129 unknown customer." when i test. What the differences between this 2 tools ? What can i do for solve my problem because by default the daemon is freeradius and it ignores my requests... Greetings -- View this message in context: http://freeradius.1045715.n5.nabble.com/radiusd-X-read-my-sql-database-but-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 10

LDAP Not working properly
by vijaysingh 18 Jul '11

18 Jul '11

Hi, I am new user and using Freeradius first time. I have followed http://www.perkinsblog.net/blog/index.php/2010/02/freeradius-and-windows-ad/ I want to authenticate freeradius with my active directory. I want to assign Prev level 15 to Active directory user who are member of group CiscoAdmin and prev level 1 to member of CiscoOpetator. Freeradius is able to authenticate individual active directoty user, but when I configure LDAP group in users file it is not working. Logs are afollowing :- rad_recv: Access-Request packet from host 172.17.3.210 port 1645, id=177, length=82 NAS-IP-Address = 172.17.3.210 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "vijay.singh" Calling-Station-Id = "172.17.27.9" User-Password = "Password" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "vijay.singh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [files] expand: OU=Servers,dc=kochar,dc=com -> OU=Servers,dc=kochar,dc=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> vijay.singh [files] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=vijay.singh)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.17.3.223:389, authentication 0 [ldap] bind as CN=ADS Admin,OU=Servers,DC=kochar,DC=com/Password to 172.17.3.223:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in OU=Servers,dc=kochar,dc=com, with filter (&(sAMAccountName=vijay.singh)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=group)(member=%Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in OU=Servers,dc=kochar,dc=com, with filter (&(cn=CiscoAdminLr)(|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=Vijay Singh,OU=Servers,DC=kochar,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for vijay.singh [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> vijay.singh [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=vijay.singh)) [ldap] expand: OU=Servers,dc=kochar,dc=com -> OU=Servers,dc=kochar,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in OU=Servers,dc=kochar,dc=com, with filter (&(sAMAccountName=vijay.singh)) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user vijay.singh authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "vijay.singh" with password "Password" [ldap] user DN: CN=Vijay Singh,OU=Servers,DC=kochar,DC=com [ldap] (re)connect to 172.17.3.223:389, authentication 1 [ldap] bind as CN=Vijay Singh,OU=Servers,DC=kochar,DC=com/Password to 172.17.3.223:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user vijay.singh authenticated succesfully ++[ldap] returns ok expand: Host %n% -> Host 172.17.3.210% Login OK: [vijay.singh] (from client Kipl Asr Network port 1 cli 172.17.27.9) Host 172.17.3.210% # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 177 to 172.17.3.210 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +12 Ready to process requests. Can anyone help to get autheticattion working with active directory group? -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-Not-working-properly-tp4593327… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

vlan ldap radiusd
by Serge van Namen 18 Jul '11

18 Jul '11

Hi, I'm working on a proof-of-concept for 802.1x and dynamic vlan's on switches. All this works perfectly with user@realm, but now I want to read the vlan ID from a ldap attribute and then send the radius request with that value in "Tunnel-Private-Group-ID". Can anyone give me a bump in the right direction? Yours, Serge

3 9

radius.log test?
by OzSpots - Carl Sawers 18 Jul '11

18 Jul '11

Hi all, I have suddenly started seeing this in the radius.log ( 2.2) Mon Jul 18 11:36:23 2011 : Auth: Login incorrect: [TEST/<+\253\362\023\213\223-~\272\257]$\003\033\211] (from client localhost port 0) All seems well besides this. It started happening a day ago every 30 seconds. Anyone understand what this is? Regards Carl

2 2

how to get this logentry correct
by Cor Bosman 17 Jul '11

17 Jul '11

Hey all, ive set up a radius daemon to verify OTPs. It's all working just fine, except for the log entries on failure to give the correct OTP. Here is the virtual server ive set up: server oath { client XXXXXXXX { secret = XXXXXXXXXX shortname = oath } listen { type = auth ipaddr = * port = 4000 } listen { type = acct ipaddr = * port = 4001 } authorize { preprocess if (!("%{request:User-Password}" =~ /^[0-9]{10,10}$/)) { update control { Auth-Type := Reject } } else { files } } accounting { radutmp exec } post-auth { exec } } The actual OTP script is run from the users file, as per the directions of the script author. DEFAULT Auth-Type = Accept Exec-Program-Wait = "/usr/sbin/multiotp -log %{User-Name} %{User-Password}", Reply-Message = "Hello, %{User-Name}" This works fine. If I give the correct pin+OTP I can login, and wrong one I cant. Freeradius -X on wrong OTP says: server oath { # Executing section authorize from file /etc/freeradius/sites-enabled/oath +- entering group authorize {...} ++[preprocess] returns ok ++? if (!("%{request:User-Password}" =~ /^[0-9]{10,10}$/)) expand: %{request:User-Password} -> 1234383980 ?? Evaluating ("%{request:User-Password}" =~ /^[0-9]{10,10}$/) -> TRUE ? Converting !TRUE -> FALSE ++? if (!("%{request:User-Password}" =~ /^[0-9]{10,10}$/)) -> FALSE ++- entering else else {...} [files] users: Matched entry DEFAULT at line 203 [files] expand: /usr/sbin/multiotp -log %{User-Name} %{User-Password} -> /usr/sbin/multiotp -log cor XXXXXXXX [files] expand: Hello, %{User-Name} -> Hello, cor +++[files] returns ok ++- else else returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [cor] (from client oath port 10) # Executing section post-auth from file /etc/freeradius/sites-enabled/oath +- entering group post-auth {...} Exec-Program output: Exec-Program: returned: 26 [exec] Login incorrect (external check said so) ++[exec] returns reject } # server oath Sending Access-Reject of id 151 to 194.109.42.42 port 42619 Reply-Message = "Hello, cor" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 151 with timestamp +6 Im using 'exec' in post-auth to use the return code of the script to reject the login. I dont know of another way to do this. Unfortunately this does mean that im seeing this in syslog: Jul 17 20:55:58 otpauth1 freeradius[24891]: Login OK: [cor] (from client oath port 10) Is there a way to have freeradius properly give a login rejected msg in syslog? Regards, Cor

2 2

dynamic clients
by YvesDM 17 Jul '11

17 Jul '11

Hi, I try to configure dynamic clients on FR2.1.8. I use as good as default configuration in my testing. Somehow it always looks at FreeRADIUS-Client-Virtual-Server = "something" even the dynamic_client_server is defined in client dynamic. As I understand it right, it shouldn't look at that directive as long as dynamic_client_server is defined in client dynamic On the other hand debugs shows the nas (192.168.2.47) was added. # Define a network where clients may be dynamically defined. client dynamic { ipaddr = 192.168.2.0 netmask = 24 dynamic_clients = dynamic_client_server lifetime = 86400 } configuration of dynamic_client_server is default, so untouched. I 'm sure I'm doing something wrong, but have no idea, any pointers? thx Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.47 port 2056, id=29, length=310 server dynamic_client_server { rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 } # server dynamic_client_server - Added client 192.168.2.47 with shared secret testing123 rad_recv: Access-Request packet from host 192.168.2.47 port 2056, id=29, length=310 ChilliSpot-Version = "1.0.13-svn" User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.2.47 Service-Type = Login-User Framed-IP-Address = 10.0.1.1 Calling-Station-Id = "1C-4B-D6-6E-EB-83" Called-Station-Id = "00-1C-10-91-5A-11" NAS-Identifier = "siTEST" Acct-Session-Id = "4e22be2d00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=SI,SI" WISPr-Location-Name = "SI_Hotspot" WISPr-Logoff-URL = "http://10.0.0.1:3660/logoff" Message-Authenticator = 0x2ccd7c5de5d37864d350617fc6d3f8f0 server something { No such virtual server something } # server something Using Post-Auth-Type Reject No such virtual server something Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 29 to 192.168.2.47 port 2056 Waking up in 4.9 seconds. Cleaning up request 0 ID 29 with timestamp +7 Ready to process requests.

2 2