July 2013 - Freeradius-Users - lists.freeradius.org

NAS Config
by E Y 25 Jul '13

25 Jul '13

Hi All! I've 2 nas servers. And each one has it's own users. I don't want to allow NAS-1's accounts from NAS-2. So i guess i want grouping. I'm using Postgresql configuration. Is it possibleto make this with postgresql?

1 0

omnisniff
by Arran Cudbard-Bell 24 Jul '13

24 Jul '13

shinyhead:freeradius-server-master arr2036$ /usr/local/freeradius/bin/radsniff -i en0 -i lo0 Sniffing on (en0 lo0) (1) Access-Request Id 151 lo0:127.0.0.1:54458 -> 127.0.0.1:1812 +0.000 User-Name = 'foo' User-Password = 'bar' NAS-IP-Address = 192.168.146.1 NAS-Port = 0 Message-Authenticator = 0x4734507141d494e4ef857134b4e54bba (2) Access-Reject Id 151 lo0:127.0.0.1:1812 -> 127.0.0.1:54458 +1.002 Reply-Message = 'Foo bar' Reply-Message = 'Foo bar foo' (3) Access-Request Id 38 en0:192.168.0.1:54065 -> 192.168.0.1:1812 +12.192 User-Name = 'foo' User-Password = 'bar' NAS-IP-Address = 192.168.146.1 NAS-Port = 0 Message-Authenticator = 0x59098b50968999437cf3fb0d6b10ef50 shinyhead:freeradius-server-master arr2036$ /usr/local/freeradius/bin/radsniff -xx Defaulting to capture on all interfaces Sniffing with options: Device(s) : [en0 fw0 en1 p2p0 lo0] PCAP filter : [udp port 1812 or 1813 or 3799] RADIUS secret : [testing123] Failed opening pcap handle: p2p0: You don't have permission to capture on that device ((no devices found) /dev/bpf4: Permission denied) Failed opening pcap handle: lo0: You don't have permission to capture on that device ((no devices found) /dev/bpf4: Permission denied) Sniffing on (en0 fw0 en1) shinyhead:freeradius-server-master arr2036$ /usr/local/freeradius/bin/radsniff -i en2 -i en1 -xx Sniffing with options: Device(s) : [en2 en1] PCAP filter : [udp port 1812 or 1813 or 3799] RADIUS secret : [testing123] radsniff: Failed opening pcap handle for en2 en2: No such device exists (BIOCSETIF failed: Device not configured) Exiting.. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

3 3

MSCHAPv2 authentication failure
by Tekán Dávid 23 Jul '13

23 Jul '13

Hi All! I'm trying to set up a radius server to guide our users network usage. We have wifi as well, so i want to expand it to the wifi as well (using WPA2 Enterprise). To autenticate users connecting the network by ethernet cable, i use the latest coovachilli. I've set up radius and coovachilli on an arch linux successfully, except this wifi thing. Don't want to store cleartext password, so i created for every user an NT-Password as well beyond the MD5-Password, and it appears in the sql database as well (also checked the queries when it queries the rad_check table, it's there in the response as well). Even so i can not authenticate through the wifi. I get the following error message: [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: tekan [mschap] Client is using MS-CHAPv2 for tekan, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect (where tekan is my username) Thanks for all the help. David Here is the debug output: FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on May 29 2013 at 13:37:32 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/bin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/bin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing12345lot" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing1234" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "mysqluser" password = "mysqlpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to mysqluser@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 35118 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 49575, id=6, length=274 ChilliSpot-Version = "1.3.0" ChilliSpot-Attr-10 = 0x00000001 Event-Timestamp = "Jul 23 2013 20:57:54 UTC" User-Name = "nagy" Acct-Input-Octets = 855677 Acct-Output-Octets = 20842716 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 12030 Acct-Output-Packets = 37913 Acct-Session-Time = 601 Acct-Status-Type = Interim-Update Acct-Session-Id = "51eeeadb00000001" Framed-IP-Address = 192.168.100.3 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" Calling-Station-Id = "1C-75-08-B4-42-19" Called-Station-Id = "00-40-F6-F4-78-B9" NAS-IP-Address = 192.168.100.1 NAS-Identifier = "coova-ethernet-gateway" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,NAS-Identifier = "coova-ethernet-gateway",NAS-IP-Address = 192.168.100.1,Acct-Session-Id = "51eeeadb00000001",User-Name = "nagy"' [acct_unique] Acct-Unique-Session-ID = "401c3b4e3e417d51". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "nagy", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 127.0.0.1 [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/detail-20130723 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/detail-20130723 [detail] expand: %t -> Tue Jul 23 20:57:54 2013 ++[detail] returns ok [sql] expand: %{User-Name} -> nagy [sql] sql_set_user escaped user --> 'nagy' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 855677 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 20842716 [sql] expand: UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET framedipaddress = '192.168.100.3', acctsessiontime = '601', acctinputoctets = '0' << 32 | '855677', acctoutputoctets = '0' << 32 | '20842716' WHERE acctsessionid = '51eeeadb00000001' AND username = 'nagy' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> nagy attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 6 to 127.0.0.1 port 49575 Finished request 0. Cleaning up request 0 ID 6 with timestamp +13 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=9, length=149 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0201000a0174656b616e Message-Authenticator = 0x74f2a23e0efbd596db9c8712ee4ced8a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> tekan [sql] sql_set_user escaped user --> 'tekan' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tekan' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tekan' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tekan' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing MD5-Password from hex encoding [pap] Normalizing NT-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 9 to 192.168.100.4 port 59530 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9552d45f8e6a9a19172d4579 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=10, length=276 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0202007719800000006d160301006801000064030151eed211accf0864fcb8b39a825ae49641bb7e43dd57df56e364b89f2a622a47000018002f00350005000ac013c014c009c00a003200380013000401000023ff010001000000000a000800000574656b616e000a0006000400170018000b00020100 State = 0x9550cd8c9552d45f8e6a9a19172d4579 Message-Authenticator = 0x349a1c35365086d9c6cbbfbceef4f81f # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 119 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 109 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0068], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 10 to 192.168.100.4 port 59530 EAP-Message = 0x0103040019c0000008a216030100310200002d030151eeee5481af0d5b5e49ce65aab34183983afc2da92ac1e38209011ca3dc17b900002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3133303732323230313435395a170d3134303732323230313435395a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100f3138819749fb34501718b226ac9c29d33efb4206a0060e884926e18f3ea76afd80dd3852665426eeb039e912636a2bb8f7a45dbc0c5a3 EAP-Message = 0xaebf396985dbb38f95dfab77a17f8264fe5f55cd9dd16ffd5b05de1b834193626d50c117c23f6b96b47d60fad7757c18634dd24c6726d123343a8fc0aa0b2c90952ebf0bcd68b8d8906a2cff460fe3ecb20c8441c0aa738c2fba5a8cf424124a591b34cf86fd41e289629977dceb66cd902eefec2a8ec2cdda95b8cae9420dd0adbc6285faa37c084bd19fad6ba5a5910cf2e24ef51ea7fc5288105b6bd638a6a67cbab03f7ad1914185822415e4189bb10c884728a31b0ddf13e33dc1679887be54165e39f67835cf0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101008115 EAP-Message = 0xb5dfe0713eaa778d594a54fbb3ab57c65e243a0ec601c38533adcbb743d7a5651bf1625a0d1cf117ebb85ce3d0002b6141491baff90c188af98b13296d02fa94264d66a661b5493211dd07da1926f4bf738ebeea4eed0185963a75fd061d11caacfd0c66139544fa7b95a77145fc0f892a2ec02c9ad47043984af14974e775d974066232d4b66381ad23254e10888750367fc75fff4930004af99ffcdbc2db18b50abceb2e81f124c740f4e2543996ac18e6a672e905f7add6067ad070a58a148c04535739c347e7637c0149a4f807b37585c37e945b4c39baff3a2e1dc4326bfeb848f6ec0db6aa2563dd0e29b2c7b56a20dc7df95cc4b7dfef8e3040 EAP-Message = 0x430004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9453d45f8e6a9a19172d4579 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=11, length=163 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020300061900 State = 0x9550cd8c9453d45f8e6a9a19172d4579 Message-Authenticator = 0x764a1b01cfc2738d9f4b22c7975e8cf5 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 11 to 192.168.100.4 port 59530 EAP-Message = 0x010403fc1940a0030201020209008b0a144c177cb35a300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3133303732323230313435395a170d3134303732323230313435395a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a5045c77e7376fb64bd52e8ddc7237973900a5ad0dd834dde5d52a6b700066bb7a96aca47699bcf07e782ef22376ee2c4c7a53d18382d8177ed4594bddd6a75e2ee6dfb090ff4b23147da061d84d4abf66ce1e04d55029e297b27788b77e483bdf910dd0a889e2c9 EAP-Message = 0xc6d236d0b410e36ee7f57c9f46c25a14603e27bd8affa283096b412d22b5f4b332f2df42fbeb4ee961330b30219e30a3b9899f981f8fbde38f606038e485c66b2f8e638f38f385901d5229e96df3fe2ee0046dede758bd6835f6301c3fd7093101314303ced4494b608726891c6fec1daa70b69b57283177d3889d2b12a1fb7424562545cec9f03a8d871adfa0e9f4ebce7eadf4d63db0c10203010001a381fb3081f8301d0603551d0e04160414ecb56a1a8838bd28a42b03b33044e9e4f0b79bea3081c80603551d230481c03081bd8014ecb56a1a8838bd28a42b03b33044e9e4f0b79beaa18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f726974798209008b0a144c177cb35a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000bfeef64ab7090233c532fe9bed5aebdffb829b7b7a95f5a530690d26f0257aa701336c8473bc2fbf7b881559d5f05765b82fec4cbc14e9afeda93662483549edcc74b75a4f2e98f7af99b EAP-Message = 0x7a899513f02eee8d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9754d45f8e6a9a19172d4579 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=12, length=163 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020400061900 State = 0x9550cd8c9754d45f8e6a9a19172d4579 Message-Authenticator = 0xed2c7e720d2ff37a680c8764d0085af1 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 12 to 192.168.100.4 port 59530 EAP-Message = 0x010500bc1900524850bd91f0f353667ded00ee4fd56038083131481f03bd38d9df265be4cd56c6cea6707bf99285b0374d8472ecb954719200667e2a3e1770b4c9651930e71eb40e006c6d40550766156e12430e3158a2c03025276821ce2afc0433bbc3578bdbf8982cb50e526369d1c34a2ad254df4ecc3bc5b913884276813a2f334142a9b0679a3f41e786416c0e4daca2b73cf5987cbbb7e97414b9f46d53b9fb352d76d46694349c887d9e2564d02f1516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9655d45f8e6a9a19172d4579 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=13, length=495 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0205015019800000014616030101061000010201005a5dfb280f1795a8ade5ff313c5dceeb885143c734af8bb3169437323b116563b0f3400c3ecda0472771dff3881a245527570ad026aca60d34cd051a99ac1d0887499fc9f8d6382dc098490ad9a4f6ae8b15f13df85966af24cb8046d654c717584c656a08d7790ab9c55651fbcf0cb9c052031504774070290a4ab02de31c5557d6fe32293c6497bcefc500503afa4cf57ce9f8fc89e83463749b77ff19d34c3276698e601c0c653de4543af92a498b3e41b9e2353ae3deff74005454e4d1d7da725d6876185941078f0b3a8d2b9fdb649655582a3ce25954342c10eb8326afbcf26f84d5b80ae8 EAP-Message = 0x87f47cb42c8d3e273e8481da71c978a1285fc17c74722443140301000101160301003070c212bd71bf6b6ce508d64d822b7ead252aef9f3135896956c06e75937003832de4d5455f3772286a38ac1a3f3dc3e6 State = 0x9550cd8c9655d45f8e6a9a19172d4579 Message-Authenticator = 0x2d6950c2deaab6daac8dd6821a55eeb6 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 13 to 192.168.100.4 port 59530 EAP-Message = 0x01060041190014030100010116030100305b62b5bccbb14577b88278b070a841464c3e25ef44694fca6fe44f6e69f85c65d833cbef94098804f60e07467ceeae7d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9156d45f8e6a9a19172d4579 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=14, length=163 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020600061900 State = 0x9550cd8c9156d45f8e6a9a19172d4579 Message-Authenticator = 0xddca15f37b96d1edebc2a84ea608ee97 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 14 to 192.168.100.4 port 59530 EAP-Message = 0x0107002b190017030100208424fd2cc36ee2a4ac2ca80499f3bb840cd92b1b0c5e36fd783a2c7fd34ea4ed Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9057d45f8e6a9a19172d4579 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=15, length=200 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0207002b19001703010020c5792c60009bdd43ab421cf37e99006ebab251937087629f8afc1f899c4b4f1a State = 0x9550cd8c9057d45f8e6a9a19172d4579 Message-Authenticator = 0x698013a66b5b768fc10ee6e15a46a030 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - tekan [peap] Got inner identity 'tekan' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0207000a0174656b616e server { [peap] Setting User-Name to tekan Sending tunneled request EAP-Message = 0x0207000a0174656b616e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tekan" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0108001f1a0108001a104317c136ed5a65f8736827154fca6a6374656b616e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaf106397af187901c667c3fb1e38a818 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0108001f1a0108001a104317c136ed5a65f8736827154fca6a6374656b616e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaf106397af187901c667c3fb1e38a818 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 15 to 192.168.100.4 port 59530 EAP-Message = 0x0108003b190017030100301723c552fbee5328f87a1ff19edf739a0c46fb73641dc745a592e6aa41b65cf7050fc5333809f74c94da69debf3d8250 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9358d45f8e6a9a19172d4579 Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=16, length=264 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0208006b190017030100602dc435ce9f9671b48b822083442e2ebdd7f45d82e8e62662df976e62584ebecca2e574cd333e59118e115e72e7b9c914d810bb8a06e3414c417533b84f201e140a6778e5b1ad283dc574e101b03db46c27ed4618d3a8252be0bb534cb92ebe9f State = 0x9550cd8c9358d45f8e6a9a19172d4579 Message-Authenticator = 0x540be6c03bf110629b7e93348eae6b32 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800401a0208003b31316511e6c3b9bed9310dbef27c845dd60000000000000000750858aee46d3dfc21674410104fe7a8573a6e60393da8050074656b616e server { [peap] Setting User-Name to tekan Sending tunneled request EAP-Message = 0x020800401a0208003b31316511e6c3b9bed9310dbef27c845dd60000000000000000750858aee46d3dfc21674410104fe7a8573a6e60393da8050074656b616e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tekan" State = 0xaf106397af187901c667c3fb1e38a818 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: tekan [mschap] Client is using MS-CHAPv2 for tekan, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 16 to 192.168.100.4 port 59530 EAP-Message = 0x0109002b190017030100208783f46b053c2e9776899492fff989a6b0845bf00061852092ad733d2171d389 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9550cd8c9259d45f8e6a9a19172d4579 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.100.4 port 59530, id=17, length=200 User-Name = "tekan" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "A0-F3-C1-F2-E8-2A:LOT-NET" Calling-Station-Id = "00-24-D6-51-C4-E8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209002b1900170301002073ebd931e2f2e7fc1ddbb6b6a75f46601434f5f540e50519517e8fa934279a51 State = 0x9550cd8c9259d45f8e6a9a19172d4579 Message-Authenticator = 0x1f5c81ca00c43d77d45c3983666d9645 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tekan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tekan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 17 to 192.168.100.4 port 59530 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds.

2 1

RE: Ldap query in FR3
by Franks Andy (RLZ) IT Systems Engineer 23 Jul '13

23 Jul '13

Good man Cheers Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 23 July 2013 20:19 To: FreeRadius users mailing list Subject: Re: Ldap query in FR3 Fixed. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Ldap query in FR3
by Franks Andy (RLZ) IT Systems Engineer 23 Jul '13

23 Jul '13

Thanks Arran, Phil. But, segv : (0) files : expand: "DC=SATH,DC=nhs,DC=uk" -> 'DC=SATH,DC=nhs,DC=uk' (0) files : Performing search in 'DC=SATH,DC=nhs,DC=uk' with filter '(&(cn=I made this group up)(objectClass=Group)(member=CN\3dRSH-AF7\2cOU\3dRSH\2cOU\3dAdministrat ive\2cOU\3dSATHComputers\2cDC\3dSATH\2cDC\3dnhs\2cDC\3duk))' (0) files : Waiting for search result... (0) files : Search returned no results Program received signal SIGSEGV, Segmentation fault. 0x00007ffff1ba333e in rlm_ldap_search (inst=0x8b3bb0, request=0x9abe60, pconn=0x7fffffffcee8, dn=0x7fffffffc670 "DC=SATH,DC=nhs,DC=uk", scope=2, filter=0x7fffffffc260 "(&(cn=I made this group up)(objectClass=Group)(member=CN\\3dRSH-AF7\\2cOU\\3dRSH\\2cOU\\3dAdmini strative\\2cOU\\3dSATHComputers\\2cDC\\3dSATH\\2cDC\\3dnhs\\2cDC\\3duk)) ", attrs=0x0, result=0x0) at src/modules/rlm_ldap/ldap.c:725 725 *result = our_result; (gdb) bt #0 0x00007ffff1ba333e in rlm_ldap_search (inst=0x8b3bb0, request=0x9abe60, pconn=0x7fffffffcee8, dn=0x7fffffffc670 "DC=SATH,DC=nhs,DC=uk", scope=2, filter=0x7fffffffc260 "(&(cn=I made this group up)(objectClass=Group)(member=CN\\3dRSH-AF7\\2cOU\\3dRSH\\2cOU\\3dAdmini strative\\2cOU\\3dSATHComputers\\2cDC\\3dSATH\\2cDC\\3dnhs\\2cDC\\3duk)) ", attrs=0x0, result=0x0) at src/modules/rlm_ldap/ldap.c:725 #1 0x00007ffff1ba752a in rlm_ldap_check_groupobj_dynamic (inst=0x8b3bb0, request=0x9abe60, pconn=0x7fffffffcee8, check=0x9831f0) at src/modules/rlm_ldap/groups.c:497 #2 0x00007ffff1b9e5e1 in rlm_ldap_groupcmp (instance=0x8b3bb0, request=0x9abe60, thing=0x9ac130, check=0x9831f0, check_pairs=0x9831f0, reply_pairs=0x9ac050) at src/modules/rlm_ldap/rlm_ldap.c:414 #3 0x00007ffff7589036 in radius_callback_compare (req=0x9abe60, request=0x9ac130, check=0x9831f0, check_pairs=0x9831f0, reply_pairs=0x9ac050) at src/main/valuepair.c:334 #4 0x00007ffff7589484 in paircompare (request=0x9abe60, req_list=0x9ac130, check=0x9831f0, rep_list=0x9ac050) at src/main/valuepair.c:587 #5 0x00007fffee8c8bfc in file_common (inst=0x982750, request=0x9abe60, filename=0x7fffee8c96f0 "users", ht=0x983150, request_pairs=0x9ac130, reply_pairs=0x9ac050) at src/modules/rlm_files/rlm_files.c:433 #6 0x00007fffee8c8e12 in mod_authorize (instance=0x982750, request=0x9abe60) at src/modules/rlm_files/rlm_files.c:480 #7 0x0000000000423506 in call_modsingle (component=1, sp=0x992a90, request=0x9abe60) at src/main/modcall.c:311 #8 0x0000000000424e0b in modcall (component=1, c=0x991270, request=0x9abe60) at src/main/modcall.c:796 #9 0x00000000004210ba in indexed_modcall (comp=1, idx=0, request=0x9abe60) at src/main/modules.c:790 #10 0x0000000000422dfa in process_authorize (autz_type=0, request=0x9abe60) at src/main/modules.c:1672 #11 0x000000000040cf92 in rad_authenticate (request=0x9abe60) at src/main/auth.c:409 #12 0x0000000000432ce6 in request_running (request=0x9abe60, action=1) at src/main/process.c:1185 #13 0x0000000000431f40 in request_queue_or_run (request=0x9abe60, process=0x432c1c <request_running>) at src/main/process.c:828 #14 0x00000000004333b0 in request_receive (listener=0x9aaa80, packet=0x9abc50, client=0x861fd0, fun=0x40cdc2 <rad_authenticate>) at src/main/process.c:1377 #15 0x0000000000414a45 in auth_socket_recv (listener=0x9aaa80) at src/main/listen.c:1449 #16 0x00000000004393e4 in event_socket_handler (xel=0x994be0, fd=30, ctx=0x9aaa80) at src/main/process.c:3484 #17 0x00007ffff736944e in fr_event_loop (el=0x994be0) at src/lib/event.c:415 #18 0x000000000043a711 in radius_event_process () at src/main/process.c:4273 #19 0x00000000004283f9 in main (argc=2, argv=0x7fffffffe678) at src/main/radiusd.c:474 (gdb) Sorry ! Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 23 July 2013 18:22 To: FreeRadius users mailing list Subject: Re: Ldap query in FR3 On 23 Jul 2013, at 17:52, Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > On 23/07/13 17:19, Franks Andy (RLZ) IT Systems Engineer wrote: >> This will probably be obvious, but I can't see it! > > Looks like a bug - the code here: > > https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/ rlm_ldap/groups.c#L495 > > ...passes NULL for the "result" argument to rlm_ldap_search, which means this code: > > https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/ rlm_ldap/ldap.c#L679 > > ...doesn't get run, so 0 results is "ok". Nice catch. Fixed. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Authorization failed in cisco switch
by Alan Buxey 23 Jul '13

23 Jul '13

>now i can logon into the switch but i can with all USERS. Yes. Because that's how you have configured it. You've set the DEFAULT to have those abilities. I would recommend reading freeradius resources and buy a book to discover/understand policies, groups etc alan

1 0

Ldap query in FR3
by Franks Andy (RLZ) IT Systems Engineer 23 Jul '13

23 Jul '13

This will probably be obvious, but I can't see it! I'm using several instances of ldap to do some load balancing so I've got ldap1, ldap2, ldap3 etc. I know in 3 that we need to reference the instance explicitly in the users files for groups, e.g. DEFAULT ldap1-ldap-group == "group name" But unlike 2, I can't actually make this fail. It always comes back with "user found". I've tried to trim the config right down but it's still failing to report that the user is missing.. Instantiation / config for ldap : # Instantiating module "ldap1" from file /usr/local/etc/raddb/mods-enabled/ldap ldap ldap1 { server = "10.128.176.40" port = 389 password = *** identity = "cn=LDAPQuery,OU=SpecialUsers,OU=SATHUsers,DC=SATH,DC=nhs,DC=uk" user { filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{mschap:User-Name}})" scope = "sub" base_dn = "DC=SATH,DC=nhs,DC=uk" access_positive = yes } group { filter = "(objectClass=Group)" scope = "sub" base_dn = "DC=SATH,DC=nhs,DC=uk" name_attribute = "cn" membership_filter = "(member=%{control:Ldap-UserDn})" cacheable_name = no cacheable_dn = no } In the users files I have DEFAULT ldap1-Ldap-Group == "I made this group up" In operation, everything seems to expand ok: .. (1) files : Searching for user in group "I made this group up" rlm_ldap (ldap1): Reserved connection (4) (1) files : Using user DN from request "CN=Franks Andy (RLZ) IT Systems Engineer,OU=RSHUsers,OU=SATHUsers,DC=SATH,DC=nhs,DC=uk" (1) files : Checking for user in group objects (1) files : expand: "(&(cn=I made this group up)(objectClass=Group)(member=%{control:Ldap-UserDn}))" -> '(&(cn=I made this group up)(objectClass=Group)(member=CN\3dFranks Andy \28RLZ\29 IT Systems Engineer\2cOU\3dRSHUsers\2cOU\3dSAT$ (1) files : expand: "DC=SATH,DC=nhs,DC=uk" -> 'DC=SATH,DC=nhs,DC=uk' (1) files : Performing search in 'DC=SATH,DC=nhs,DC=uk' with filter '(&(cn=I made this group up)(objectClass=Group)(member=CN\3dFranks Andy \28RLZ\29 IT Systems Engineer\2cOU\3dRSHUsers\2cOU\3dSATHUsers\2cDC\3dSATH\2cDC\3dnhs\2cDC\3d uk)$ (1) files : Waiting for search result... (1) files : User found in group object .. ..but the user is always found. All user based operations work fine. Not found is returned if the user isn't in ldap etc. I'm stumped. I've tried various filter combinations etc, but the group doesn't even exist, and even if I reference a group that does exist which doesn't contain the user, it returns found... Version 2 didn't seem to have the same behaviour. Thanks Andy

3 2

RE: Ldap query in FR3
by Franks Andy (RLZ) IT Systems Engineer 23 Jul '13

23 Jul '13

Ah, Thanks Phil. I'll have to get out the "teach yourself C in half an hour" book! Maybe one of the friendly devs will have a fix.. :-) Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 23 July 2013 17:53 To: freeradius-users(a)lists.freeradius.org Subject: Re: Ldap query in FR3 On 23/07/13 17:19, Franks Andy (RLZ) IT Systems Engineer wrote: > This will probably be obvious, but I can't see it! Looks like a bug - the code here: https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/ rlm_ldap/groups.c#L495 ...passes NULL for the "result" argument to rlm_ldap_search, which means this code: https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/ rlm_ldap/ldap.c#L679 ...doesn't get run, so 0 results is "ok". - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

[ANN] Version 3.0.0-rc0
by Arran Cudbard-Bell 23 Jul '13

23 Jul '13

We are now in feature freeze for 3.0. The configuration format and behaviour for 3.0 will be stable between now and the final release. If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic behaviour changes you notice. To provide a single point to test against, the release_3_0_0_rc0 tag has been created. Features and behaviours changes since release_3_0_0_beta1: * Empty xlat expansions are no longer substituted with "_". * Empty string expansions are no longer treated as failures, though actual failures and invalid operations will continue to bubble up and be translated into return codes. This is a change from 2.x.x where they were ignored. * Update sections support both types of exec, those which use the output of the program to create an attribute value, and those which use the output to create multiple value pairs. * Config item names have now been unified. In most cases the server will tell you the new name of the config item. * rlm_ldap now only registers LDAP-Group for the default instance. It used to register it for every instance which caused inconsistent behaviour. * New raddb structure. See raddb/README.rst for details. * Support for ${.:instance} which returns the instance name of a section and ${.:name} which returns the name of a section. Useful when used with relative paths. * Add support for bulk loading dynamic clients from LDAP. * Don't re-add default symlinks in raddb/sites-enabled/ raddb/mods-enabled/ Bug fixes: * Attribute instance selection [<n>] [#] [*] have been re-added to the xlat parser. * PCRE headers and libraries are now detected in a wider range of locations. * Symbols for PCRE drop in functions are now used in preference to posix functions, previously they weren't and this caused segfaults. * Fixes in the FreeTDS driver to avoid double frees. * Fix list to list copies in update sections. * Fix exec in update statements. * Fix use of double quoted strings in radclient -f files. * Many packaging fixes and cleanups. * Send Access-Rejects when using radsec. * Various radsec fixes to avoid crashes. * -HUP now works again. * Don't wait on execs to finish if they're marked as wait = 'no'. * Remove support for ranges in comparisons with NAS-Port-ID, these were broken, duplicative, and caused crashes. * Don't crash when parsing 64bit integer values from text * Expand ${...} before parsing conditions * Fix foreach * Be more lenient about MS-CHAP identity mismatches. The tarball is available here: https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_0_beta1… Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

8 44

Authorization failed in cisco switch
by Marco Aresu 23 Jul '13

23 Jul '13

Hi All i am getting some problem with authorization in free radius i configured the users file as below : DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15", When i try to login into a switch i receive the errore : Authorization Failed and during the debug i ve got : # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [++[reply_log] returns ok ++[exec] returns noop Can someone help me? thanks Marco Aresu

5 10