September 2014 - Freeradius-Users - lists.freeradius.org

Re: Beginner need help
by Himanshu Pandey 22 Sep '14

22 Sep '14

Hi, I modified users configuration file and radiusd.conf. I have attached radiusd.conf file. Please tell me what shall I not modify in radiusd.conf file. Actually I did some modifications in radiusd.conf file since I was getting some error in starting the radius server. Please help. Regards,Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Mon, 22 Sep 2014 17:28:24 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Beginner need help Himanshu Pandey wrote: > WARNING: Empty authorize section.  Using default return values. > ERROR: No authenticate method (Auth-Type) found for the request: > Rejecting the user > Failed to authenticate the user.  You edited the configuration files and broke the server.  Don't do that.  Use the default configuration.  IT WORKS. > rad_recv: Access-Request packet from host 127.0.0.1 port 45789, id=134, > length=77 > Attr-1 = 0x74657374696e67 > Attr-2 = 0xc0f304d7505a307640e393d9f8f2778a > Attr-4 = 0x7f000001 > Attr-5 = 0x00000714 > Attr-80 = 0x6ae5985f22e2b42ff6127ba33df73a62  That's entirely wrong.  You've put a lot of work into destroying the server configuration.  I don't understand why people do this.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Beginner need help
by A.L.M.Buxey＠lboro.ac.uk 22 Sep '14

22 Sep '14

Hi, > WARNING: Empty authorize section. Using default return values. you've edited config files from the default install? there are only 2 files you need to edit from an install to get the basic stuff working users file clients.conf file butchering other files will only lead you to failure until you understand more about the server and how parts of it operate alan

1 0

Re: Beginner need help
by Alan DeKok 22 Sep '14

22 Sep '14

Himanshu Pandey wrote: > WARNING: Empty authorize section. Using default return values. > ERROR: No authenticate method (Auth-Type) found for the request: > Rejecting the user > Failed to authenticate the user. You edited the configuration files and broke the server. Don't do that. Use the default configuration. IT WORKS. > rad_recv: Access-Request packet from host 127.0.0.1 port 45789, id=134, > length=77 > Attr-1 = 0x74657374696e67 > Attr-2 = 0xc0f304d7505a307640e393d9f8f2778a > Attr-4 = 0x7f000001 > Attr-5 = 0x00000714 > Attr-80 = 0x6ae5985f22e2b42ff6127ba33df73a62 That's entirely wrong. You've put a lot of work into destroying the server configuration. I don't understand why people do this. Alan DeKok.

1 0

Reference ${thread[pool].max_servers} not found
by Haviaras Kostas 22 Sep '14

22 Sep '14

Hello, I need your help about the error I am getting, when I configure the sql in my Freeradius server 3.0.4: The error I am getting is: command: sudo freeradius -X Output: freeradius: FreeRADIUS Version 3.0.4, for host i686-pc-linux-gnu, built on Sep 22 2014 at 10:14:56 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/sql No such configuration item thread[pool].max_servers /etc/freeradius/sql[178]: Reference "${thread[pool].max_servers}" not found Errors reading or parsing /etc/freeradius/radiusd.conf Thanks for your attention and time

3 2

Re: Beginner need help
by Himanshu Pandey 22 Sep '14

22 Sep '14

Hi, I am getting the following error: WARNING: Empty authorize section.  Using default return values.ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the userFailed to authenticate the user. Here is the debug log: FreeRADIUS Version 2.2.0, for host x86_64-redhat-linux-gnu, built on Dec 15 2012 at 00:26:26Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ...including configuration file /etc/raddb/radiusd.confincluding configuration file /etc/raddb/proxy.confincluding configuration file /etc/raddb/clients.confincluding files in directory /etc/raddb/modules/including configuration file /etc/raddb/modules/ldapincluding configuration file /etc/raddb/modules/inner-eapincluding configuration file /etc/raddb/modules/digestincluding configuration file /etc/raddb/modules/checkvalincluding configuration file /etc/raddb/modules/dynamic_clientsincluding configuration file /etc/raddb/modules/echoincluding configuration file /etc/radd! b/modules/expirationincluding configuration file /etc/raddb/modules/etc_groupincluding configuration file /etc/raddb/modules/pamincluding configuration file /etc/raddb/modules/opendirectoryincluding configuration file /etc/raddb/modules/sradutmpincluding configuration file /etc/raddb/modules/attr_filterincluding configuration file /etc/raddb/modules/mschapincluding configuration file /etc/raddb/modules/chapincluding configuration file /etc/raddb/modules/exprincluding configuration file /etc/raddb/modules/counterincluding configuration file /etc/raddb/modules/ippoolincluding configuration file /etc/raddb/modules/cuiincluding configuration file /etc/raddb/modules/attr_rewriteincluding configuration file /etc/raddb/modules/detailincluding configuration file /etc/raddb/modules/radrelayincluding configuration file /etc/raddb/modules/rediswhoincluding configuration file /etc/raddb/modules/preprocessincluding configuration file /etc/raddb/modules/ntlm_authincluding configuration f! ile /etc/raddb/modules/krb5including configuration file /etc/raddb/mod ules/smbpasswdincluding configuration file /etc/raddb/modules/filesincluding configuration file /etc/raddb/modules/realmincluding configuration file /etc/raddb/modules/sqlcounter_expire_on_loginincluding configuration file /etc/raddb/modules/sohincluding configuration file /etc/raddb/modules/wimaxincluding configuration file /etc/raddb/modules/linelogincluding configuration file /etc/raddb/modules/alwaysincluding configuration file /etc/raddb/modules/papincluding configuration file /etc/raddb/modules/smsotpincluding configuration file /etc/raddb/modules/logintimeincluding configuration file /etc/raddb/modules/dhcp_sqlippoolincluding configuration file /etc/raddb/sql/mysql/ippool-dhcp.confincluding configuration file /etc/raddb/modules/mac2vlanincluding configuration file /etc/raddb/modules/otpincluding configuration file /etc/raddb/modules/redisincluding configuration file /etc/raddb/modules/radutmpincluding configuration file /etc/raddb/modules/detail.example.comincluding c! onfiguration file /etc/raddb/modules/replicateincluding configuration file /etc/raddb/modules/execincluding configuration file /etc/raddb/modules/passwdincluding configuration file /etc/raddb/modules/acct_uniqueincluding configuration file /etc/raddb/modules/mac2ipincluding configuration file /etc/raddb/modules/cacheincluding configuration file /etc/raddb/modules/sql_logincluding configuration file /etc/raddb/modules/perlincluding configuration file /etc/raddb/modules/detail.logincluding configuration file /etc/raddb/modules/unixincluding configuration file /etc/raddb/modules/policyincluding configuration file /etc/raddb/eap.confincluding configuration file /etc/raddb/policy.confmain { allow_core_dumps = no}including dictionary file /etc/raddb/dictionarymain { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/! usr/local/var/log/radius/radacct" hostname_lookups = no max_request_ti me = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4  coa { irt = 2 mrt = 16 mrc = 5 mrd = 30  } } home_server_pool my_auth_failover { type = fail-ov! er home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" }radiusd: #### Instantiating modules #### instantiate { }radiusd: #### Loading Virtual Servers ####server { # from file /etc/raddb/radiusd.conf modules { } # modules} # serverradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0}listen { type = "acct" ipaddr = * port = 0} ... adding new socket proxy address * port 58346Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host 127.0.0.1 port 45789, id=134, length=77 Attr-1 = 0x74657374696e67 Attr-2 = 0xc0f304d7505a307640e393d9f8f2778a Attr-4 = 0x7f000001 ! Attr-5 = 0x00000714 Attr-80 = 0x6ae5985f22e2b42ff6127ba33df73a62  WARNING: Empty authorize section.  Using default return values.ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the userFailed to authenticate the user.  WARNING: Unprintable characters in the password.  Double-check the shared secret on the server and the NAS!Delaying reject of request 0 for 1 secondsGoing to the next requestWaking up in 0.9 seconds.Sending delayed reject for request 0Sending Access-Reject of id 134 to 127.0.0.1 port 45789Waking up in 4.9 seconds.Cleaning up request 0 ID 134 with timestamp +248Ready to process requests. Please help. Regards,Himanshu From: Amit Linux <amitbutere64(a)gmail.com> Sent: Mon, 22 Sep 2014 16:01:44 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Beginner need help Hi Himanshu,I believe radtest and radclient totally different utility for different purpose. Plus use should post debug output and config you using. RegardsAmit B.HTH Sent from my iPhone On 22-Sep-2014, at 14:42, "Himanshu  Pandey" <pandey_himanshu80(a)rediffmail.com> wrote: Hi, My freeradius server is up and running and then I tried to execute the test with a following command: radtest testing password localhost 0 testing123 But I am getting error:radclient:: Unknown attribute "User-Name" requires a hex string, not "testing"radclient: Nothing to send. Please help to resolve the same. Regards,Sonu From: A.L.M.Buxey(a)lboro.ac.uk Sent: Mon, 22 Sep 2014 14:17:00 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Beginner need help Hi, > Now I want to test this client (I have already installed freeradius server on the same LINUX PC and this server proved to be working). there are various client testing tools with the main freeradius server package - also eapol_test from the wpa_supplicant package is very useful! > The only useful information on the freeradius client is > > radiusclient [-f config_file] [-p nas_port] [-s | [-a] a1=v1 [a2=v2[...[aN=vN]...]]] -f the config file - theres one supplied...should be in your /etc directory now. then you feed it a list of VSA/TLV values. not as friendly as eg eapol_test or radclient alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More >- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Beginner need help
by Amit Linux 22 Sep '14

22 Sep '14

Hi Himanshu, I believe radtest and radclient totally different utility for different purpose. Plus use should post debug output and config you using. Regards Amit B. HTH Sent from my iPhone > On 22-Sep-2014, at 14:42, "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> wrote: > > Hi, > > My freeradius server is up and running and then I tried to execute the test with a following command: > > radtest testing password localhost 0 testing123 > > But I am getting error: > radclient:: Unknown attribute "User-Name" requires a hex string, not "testing" > radclient: Nothing to send. > > Please help to resolve the same. > > Regards, > Sonu > > From: A.L.M.Buxey(a)lboro.ac.uk > Sent: Mon, 22 Sep 2014 14:17:00 > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Beginner need help > Hi, > > > Now I want to test this client (I have already installed freeradius server on the same LINUX PC and this server proved to be working). > > there are various client testing tools with the main freeradius server package - also eapol_test from the > wpa_supplicant package is very useful! > > > The only useful information on the freeradius client is > > > > radiusclient [-f config_file] [-p nas_port] [-s | [-a] a1=v1 [a2=v2[...[aN=vN]...]]] > > -f the config file - theres one supplied...should be in your /etc directory now. then you feed it a list of VSA/TLV values. > > not as friendly as eg eapol_test or radclient > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > Get your own FREE website, FREE domain & FREE mobile app with Company email. > Know More > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius-Users Digest, Vol 113, Issue 86
by KAVYA PRABHAKAR 22 Sep '14

22 Sep '14

Hi, "If you check rad client from remote machine the case will be different." I have binded my Radius client ip and port in clients.conf and in radiusd.conf. My radius server and client is present in two different PCs. Will that be a prob? Now in debug mode log looks like this: Cleaning up request 33 ID 108 with timestamp 541fd188 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.253.6.11:1645, id=1, length=53 NAS-IP-Address = 11.6.253.10 User-Name = "raduser" User-Password = "k\014%\220\2779\213\203\307\030\222\364\004qM\223" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 34 modcall[authorize]: module "preprocess" returns ok for request 34 radius_xlat: '../var/log/radius/radacct/ 10.253.6.11/auth-detail-20140922.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.log expands to ../var/log/radius/radacct/10.253.6.11/auth-detail-20140922.l modcall[authorize]: module "auth_log" returns ok for request 34 modcall[authorize]: module "chap" returns noop for request 34 modcall[authorize]: module "mschap" returns noop for request 34 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 34 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 34 users: Matched entry DEFAULT at line 170 modcall[authorize]: module "files" returns ok for request 34 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 34 modcall: leaving group authorize (returns ok) for request 34 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [raduser/k\014%\220\2779\213\203\307\030\222\364\004qM\223] (from client private-network-3 port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 34 for 1 seconds Finished request 34 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 1 to 10.253.6.11 port 1645 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.253.6.11:1645, id=1, length=53 Sending duplicate reply to client private-network-3:1645 - ID: 1 Re-sending Access-Reject of id 1 to 10.253.6.11 port 1645 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 34 ID 1 with timestamp 541fd3a6 Nothing to do. Sleeping until we see a request. Thanks, Kavya On Mon, Sep 22, 2014 at 1:57 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Beginner need help (Himanshu Pandey) (KAVYA PRABHAKAR) > 2. Re: Beginner need help (Himanshu Pandey) (Amit Linux) > 3. 3.0.4: proxy-to-vserver and proxied post-auth? (Stefan Winter) > 4. Re: Beginner need help (Himanshu Pandey) (A.L.M.Buxey(a)lboro.ac.uk) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 22 Sep 2014 13:10:54 +0530 > From: KAVYA PRABHAKAR <kavyamelinmaneprabhakar(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Beginner need help (Himanshu Pandey) > Message-ID: > <CANpdVrz8yFuvUP55vtjdiX0hBRq6RQQ5wajb94LsJ=- > 2XWHYxw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I am beginner. I installed Freeradius in my windows PC. > With default configuration it works as expected. > > Now I have a RADIUS client which will send request to server and I want > server to authenticate the same. > > I should be changing users.conf > > raduser User-Password == "Password" > where User-name = "raduser" and Password = "Password" > > I will have to change clients.conf as well. > > client <ipaddr/mask>{ > secret = secret > shortname = client name # what is the significance of shortname > } > > In radiusd.conf, I have changed to which Ip and port RADIUS server has to > listen to. (optional) > > After doing respective changes, I will execute following command: > > radtest raduser Password 10.253.6.11 1812 Password > > The result is as follows: > > C:\FreeRADIUS.net\bin>radclient.exe -d ..\etc\raddb -f radtest.txt -x -s > 127.1 au > th testing123 > Sending Access-Request of id 108 to 127.0.0.1 port 1812 > User-Name = "testuser" > User-Password = "testpw" > NAS-IP-Address = 127.0.0.1 > NAS-Port = 123 > rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=108, length=20 > > Total approved auths: 1 > Total denied auths: 0 > Total lost auths: 0 > > Here I would like to know why am I getting reply from 127.0.0.1 when I have > explicitly asked to receive from 10.253.6.11 > > PFA the debug log. > > Thanks in advance, > Kavya >

3 2

Re: Beginner need help
by Himanshu Pandey 22 Sep '14

22 Sep '14

Hi, My freeradius server is up and running and then I tried to execute the test with a following command: radtest testing password localhost 0 testing123 But I am getting error:radclient:: Unknown attribute "User-Name" requires a hex string, not "testing"radclient: Nothing to send. Please help to resolve the same. Regards,Sonu From: A.L.M.Buxey(a)lboro.ac.uk Sent: Mon, 22 Sep 2014 14:17:00 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Beginner need help Hi, > Now I want to test this client (I have already installed freeradius server on the same LINUX PC and this server proved to be working). there are various client testing tools with the main freeradius server package - also eapol_test from the wpa_supplicant package is very useful! > The only useful information on the freeradius client is > > radiusclient [-f config_file] [-p nas_port] [-s | [-a] a1=v1 [a2=v2[...[aN=vN]...]]] -f the config file - theres one supplied...should be in your /etc directory now. then you feed it a list of VSA/TLV values. not as friendly as eg eapol_test or radclient alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Beginner need help
by Frank Wei 22 Sep '14

22 Sep '14

Hi, I'm brand new to FreeRadius and just installed server 2.2.5. I have followed the wiki instruction (basic Configuration section) to do the simple test. The only thing I added is to add Testing Cleartext-Password := "password" in the /raddb/users Here is the debug information I had when I run Radtesting testing password localhost 0 testing123 rad_recv: Access-Request packet from host 127.0.0.1 port 32775, id=195, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x024f3a845461e5597651150741f365fd # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 195 to 127.0.0.1 port 32775 Waking up in 4.9 seconds. Cleaning up request 2 ID 195 with timestamp +530 Could anybody help to me to explain why it was rejected? (it looks like a no "known good" password issue but I don't know why) Great thanks, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

4 11

Re: Beginner need help
by A.L.M.Buxey＠lboro.ac.uk 22 Sep '14

22 Sep '14

Hi, > I am very new to freeradius. On running radiusd -X I get "radiusd: Cannot > get ID for group radiusd: No such file or directory" > Can you please suggest how to resolve this. not a freeradius question - this is unix 101 - your config says to run the server as user radiusd and group radiusd - but your OS hasnt got that group defined. check eg /etc/group file and make the required change alan

1 0