April 2015 - Freeradius-Users - lists.freeradius.org

authentication question
by john espiro 16 Apr '15

16 Apr '15

I installed my certs on my Android phones... it asked for the password for the key, andI was off... just set it to 802.1x TLS and it worked. Now, on my Nook Color, I was able to add my cert, but this time, it only let me choose 802.1x EAP. That's fine I thought, but then it was looking for a username/password for a user in my MySQL database on the radius server. That's fine with me too, but I am trying to understand why that one device was the only one that wanted a username/password.

1 0

Alternative to ClientLogin for Google Apps authentication?
by Daniel Smith 16 Apr '15

16 Apr '15

Hi, My organization has a FreeRADIUS server set up to authenticate wifi users with their Google Apps email address and generated app password. It accepts them over EAP in plain text and then runs them against the ClientLogin API in a perl script. Google has deprecated ClientLogin and is cutting it off in April this year. I have consulted with a couple cloud radius providers and they say they can keep this system working as it currently does - users create a Google app password, sign into the WiFi network with it, and they get on the network. This is ideal since we can just direct our existing server's IP to the cloud provider, and our hundreds of clients keep working without a single change. Is there any way FreeRADIUS can authenticate against Google with an app password, without ClientLogin being around anymore? I looked into OAuth2 but it looks like that will require all existing clients to manually sign in again and change details, since it'll require interaction to create the first refresh token. A horrifying other option is to start caching user's passwords on the radius server as they are successfully authenticated, so that we have their working config stored, then when Google cuts off the API we authenticate users against a local database of those stored passwords, manually adding/disabling new/old ones for any user changes. Ugly, insecure, and broken. Any advice? Thanks, Dan

3 7

FreeRadius 3.0.3 instantly segfaults (SLES11SP3)
by Thomas Stather 16 Apr '15

16 Apr '15

Hi I am in the process of setting up a mac auth configuration but when i tried to start i instantly get a segfault. The OS is SLES11SP3, the version pulled from the Software repository is 3.0.3 Heres the output: radius1:/etc/raddb/mods-enabled # radiusd -X radiusd: FreeRADIUS Version 3.0.3, for host x86_64-suse-linux-gnu, built on May 26 2014 at 23:41:11 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/pap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/filter including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/macauthtest main { security { allow_core_dumps = no } } main { name = "radiusd" Segmentation fault Is there anything i can do to troubleshoot this? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

6 9

DHCP-Hostname + module/dhcp
by Jorge Pereira 15 Apr '15

15 Apr '15

Hi, I have searched about the modules/dhcp and i know that don't have many information about that... only the example in [1] wasn't enough for understand and uses it. btw, in my env i receive during "Access-Request" all packets sent from the UE to my BRAS (Alcatel 7750) like the packet below. Alc-ToServer-Dhcp-Options = 0x350103 Alc-ToServer-Dhcp-Options = 0x37090103060f775ffc2c2e Alc-ToServer-Dhcp-Options = 0x390205dc Alc-ToServer-Dhcp-Options = 0x3d0701facafaca0002 Alc-ToServer-Dhcp-Options = 0x3204c0a87b0b Alc-ToServer-Dhcp-Options = 0x3604c0a87bfe Alc-ToServer-Dhcp-Options = 0x0c0d4a6f7267652d50657265697261 the point is: someone here could give me some suggestion about the best way to parse this informations? e.g: The last item is the "hostname" of client (0x0c=12 as described in the rfc[2]) Maybe the module can't be the best solution for this and thinking something like a foreach() the list and fill in the fields. in this case DHCP-Hostname.... it's possible? someone have suggestions? [1] http://freeradius.org/features/dhcp.html [2] https://www.ietf.org/rfc/rfc2132.txt - section 3.14 warm regards, -- Jorge Pereira

2 4

problems with CoA post-proxy & switch
by Jorge Pereira 15 Apr '15

15 Apr '15

Hi, I am trying to use the below configuration, but never is reached... someone have suggestions? 87 post-proxy { 88 switch &proxy-reply:Packet-Type { 89 case CoA-ACK { 90 ok 91 } 92 93 case CoA-NAK { 94 # the NAS didn't like the CoA request 95 ok 96 } 97 98 case Disconnect-ACK { 99 ok 100 } 101 102 case Disconnect-NAK { 103 # the NAS didn't like the Disconnect request 104 ok 105 } 106 107 # Invalid packet type. This shouldn't happen. 108 case { 109 ok 110 #fail 111 } 112 } 113 114 # 115 # These methods are run when there is NO response 116 # to the request. 117 # 118 Post-Proxy-Type Fail-CoA { 119 ok 120 } 121 } -- Jorge Pereira

2 2

cidr cast
by Peter Balsianok 15 Apr '15

15 Apr '15

Hi, May i use cid cast also for NAP-IP-Address ? if (<cidr>&NAS-IP-Address == 192.168.0.0/24) { update request { } >From change log 3.0.x: One useful thing which i'm not sure Alan has implemented yet is: if (<cidr>&Framed-IP-Address == 192.168.0.0/24) { } I

5 6

unlang
by Peter Balsianok 15 Apr '15

15 Apr '15

Hi, I have following unlang code in the preacct section update request { Calling-Station-Id := "%{%{string:Class}:-%{Calling-Station-Id}}" } If my packet does not contain Class attribut, i expect that Calling-Station-Id will not change. (0) Received Accounting-Request Id 109 from 127.0.0.1:55999 to 127.0.0.1:1813 length 429 (0) NAS-Port-Type = Virtual (0) Framed-Pool = 'BDSLpool' (0) Acct-Input-Octets-64 = 135967391 (0) Called-Station-Id = 'orangenet' (0) Acct-Status-Type = Interim-Update (0) Connect-Info = '1000000000/1000000000' (0) Acct-Output-Packets = 1476063 (0) Framed-IP-Netmask = 255.255.255.255 (0) NAS-IP-Address = 213.151.237.216 (0) Acct-Output-Octets = 1196651182 (0) Qos-Policing-Profile-Name = 'in512K' (0) Acct-Session-Time = 2400 (0) Medium-Type = DSL (0) User-Name = '0200000005(a)orangenet.sk' (0) NAS-Identifier = 'N-001-BA-BAS-10' (0) Framed-IP-Address = 178.143.0.156 (0) Acct-Input-Packets = 514504 (0) Acct-Output-Octets-64 = 1196651182 (0) Acct-Input-Octets = 135967391 (0) Acct-Session-Id = 'FF10FFFF58000253-4F01A67C' (0) Acct-Output-Gigawords = 0 (0) Service-Type = Framed-User (0) Acct-Update-Reason = AAA-LOAD-ACCT-PERIODIC (0) Acct-Authentic = RADIUS (0) NAS-Port-Id = 'L2TP LNS 595' (0) Qos-Metering-Profile-Name = 'down12288K' (0) Acct-Input-Packets-64 = 514504 (0) Context-Name = 'INET' (0) Calling-Station-Id = '421905000001' (0) Framed-Protocol = PPP (0) Event-Timestamp = 'Jan 2 2012 14:23:41 CET' (0) Acct-Tunnel-Connection = 'LNS1:4945:9576' (0) Acct-Input-Gigawords = 0 (0) Qos-Policy-Queuing = 'pwfq12288K' (0) NAS-Port = 2432696915 (0) Acct-Output-Packets-64 = 1476063 (0) # Executing section preacct from file ../../raddb/auth/sites-enabled/default (0) preacct { (0) [preprocess] = ok ... (0) update request { (0) EXPAND %{%{string:Class}:-%{Calling-Station-Id}} (0) --> (0) Calling-Station-Id := "" ... But Calling-Station-Id is empty. Thank you for help.

3 2

What can be defined in sites-enable/a_site
by James Sumners 14 Apr '15

14 Apr '15

It seems that in addition to virtual server blocks I can also define global clients in a site file. I'd really like to contain all of the configuration specific to my site in one file, including modules. But it doesn't seem like I can define global modules in a site file. Is this correct? I can't find any description of what is actually allowed in such a file; just a description of what is allowed in a virtual server block.

5 20

regexp in huntgroup
by Peter Balsianok 14 Apr '15

14 Apr '15

Hi, I have configuration file (huntgroup): LNS NAS-IP-Address =~ /^213\.151\.231\./ LNS NAS-IP-Address =~ /^213\.151\.232\./ LNS NAS-IP-Address == 213.151.235.230 Why freeradius does not set Huntgroup-Name to LNS (based on first regexp if NAS-IP-Address=213.151.231.112) ? If i use LNS NAS-IP-Address == 213.151.231.112, freeradius sets Huntgroup-Name correct. Debug output: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /app/radius/freeradius-3.0.7/share/freeradius/dictionary including dictionary file /app/radius/freeradius-3.0.7/share/freeradius/dictionary.dhcp including dictionary file /app/radius/freeradius-3.0.7/share/freeradius/dictionary.vqp including dictionary file ../../raddb/auth/dictionary including configuration file ../../raddb/auth/radiusd.conf including configuration file ../../raddb/auth/templates.conf including configuration file ../../raddb/auth/proxy.conf including configuration file ../../raddb/auth/clients.conf including files in directory ../../raddb/auth/mods-enabled/ including configuration file ../../raddb/auth/mods-enabled/realm including configuration file ../../raddb/auth/mods-enabled/files including configuration file ../../raddb/auth/mods-enabled/unpack including configuration file ../../raddb/auth/mods-enabled/attr_filter including configuration file ../../raddb/auth/mods-enabled/chap including configuration file ../../raddb/auth/mods-enabled/expr including configuration file ../../raddb/auth/mods-enabled/linelog including configuration file ../../raddb/auth/mods-enabled/pap including configuration file ../../raddb/auth/mods-enabled/detail including configuration file ../../raddb/auth/mods-enabled/preprocess including configuration file ../../raddb/auth/mods-enabled/always including files in directory ../../raddb/auth/policy.d/ including configuration file ../../raddb/auth/policy.d/nas including configuration file ../../raddb/auth/policy.d/operator-name including configuration file ../../raddb/auth/policy.d/username including configuration file ../../raddb/auth/policy.d/cui including configuration file ../../raddb/auth/policy.d/dhcp including configuration file ../../raddb/auth/policy.d/filter including configuration file ../../raddb/auth/policy.d/abfab-tr including configuration file ../../raddb/auth/policy.d/eap including configuration file ../../raddb/auth/policy.d/accounting including configuration file ../../raddb/auth/policy.d/control including configuration file ../../raddb/auth/policy.d/canonicalization including configuration file ../../raddb/auth/policy.d/debug including files in directory ../../raddb/auth/sites-enabled/ including configuration file ../../raddb/auth/sites-enabled/default main { name = "radiusd" prefix = "/app/radius/freeradius-3.0.7" localstatedir = "/app/radius/freeradius-3.0.7/var" sbindir = "/app/radius/freeradius-3.0.7/sbin" logdir = "/app/radius/freeradius-3.0.7/var/log/radius" run_dir = "/app/radius/freeradius-3.0.7/var/run/radiusd" libdir = "/app/radius/freeradius-3.0.7/lib" radacctdir = "/app/radius/freeradius-3.0.7/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/app/radius/freeradius-3.0.7/var/run/radiusd/radiusd.pid" checkrad = "/app/radius/freeradius-3.0.7/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### ... radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } ... Found debugger attached radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_realm # Instantiating module "IPASS" from file ../../raddb/auth/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file ../../raddb/auth/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file ../../raddb/auth/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file ../../raddb/auth/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_files # Instantiating module "files" from file ../../raddb/auth/mods-enabled/files files { filename = "../../raddb/auth/mods-config/files/authorize" usersfile = "../../raddb/auth/mods-config/files/authorize" acctusersfile = "../../raddb/auth/mods-config/files/accounting" preproxy_usersfile = "../../raddb/auth/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file ../../raddb/auth/mods-config/files/authorize [../../raddb/auth/mods-config/files/authorize]:182 Cistron compatibility checks for entry DEFAULT ... [../../raddb/auth/mods-config/files/authorize]:189 Cistron compatibility checks for entry DEFAULT ... [../../raddb/auth/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file ../../raddb/auth/mods-config/files/authorize [../../raddb/auth/mods-config/files/authorize]:182 Cistron compatibility checks for entry DEFAULT ... [../../raddb/auth/mods-config/files/authorize]:189 Cistron compatibility checks for entry DEFAULT ... [../../raddb/auth/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file ../../raddb/auth/mods-config/files/accounting reading pairlist file ../../raddb/auth/mods-config/files/pre-proxy # Loaded module rlm_unpack # Instantiating module "unpack" from file ../../raddb/auth/mods-enabled/unpack # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file ../../raddb/auth/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "../../raddb/auth/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ../../raddb/auth/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file ../../raddb/auth/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "../../raddb/auth/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ../../raddb/auth/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file ../../raddb/auth/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "../../raddb/auth/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file ../../raddb/auth/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file ../../raddb/auth/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "../../raddb/auth/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file ../../raddb/auth/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file ../../raddb/auth/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "../../raddb/auth/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file ../../raddb/auth/mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file ../../raddb/auth/mods-enabled/chap # Loaded module rlm_expr # Instantiating module "expr" from file ../../raddb/auth/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /��a��" } # Loaded module rlm_linelog # Instantiating module "linelog" from file ../../raddb/auth/mods-enabled/linelog linelog { filename = "/app/radius/freeradius-3.0.7/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file ../../raddb/auth/mods-enabled/linelog linelog log_accounting { filename = "/app/radius/freeradius-3.0.7/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Instantiating module "log_acct_bras" from file ../../raddb/auth/mods-enabled/linelog linelog log_acct_bras { filename = "/app/radius/freeradius-3.0.7/var/log/radius/bdsl-%D.log" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Instantiating module "log_acct_common" from file ../../raddb/auth/mods-enabled/linelog linelog log_acct_common { filename = "/app/radius/freeradius-3.0.7/var/log/radius/common-%D.log" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_pap # Instantiating module "pap" from file ../../raddb/auth/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_detail # Instantiating module "detail" from file ../../raddb/auth/mods-enabled/detail detail { filename = "/app/radius/freeradius-3.0.7/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file ../../raddb/auth/mods-enabled/preprocess preprocess { huntgroups = "../../raddb/auth/mods-config/preprocess/huntgroups" hints = "../../raddb/auth/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file ../../raddb/auth/mods-config/preprocess/huntgroups reading pairlist file ../../raddb/auth/mods-config/preprocess/hints # Loaded module rlm_always # Instantiating module "reject" from file ../../raddb/auth/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file ../../raddb/auth/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file ../../raddb/auth/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file ../../raddb/auth/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file ../../raddb/auth/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file ../../raddb/auth/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file ../../raddb/auth/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file ../../raddb/auth/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file ../../raddb/auth/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file ../../raddb/auth/radiusd.conf } # server server default { # from file ../../raddb/auth/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 44433 Ready to process requests (0) Received Accounting-Request Id 230 from 127.0.0.1:42714 to 127.0.0.1:1813 length 278 (0) NAS-Port-Type = ISDN (0) Acct-Status-Type = Interim-Update (0) Connect-Info = '4294967295/0' (0) Acct-Output-Packets = 55646737 (0) NAS-IP-Address = 213.151.231.112 (0) Acct-Output-Octets = 2287091997 (0) Acct-Session-Time = 4044432 (0) User-Name = 'foo(a)orangenet.sk' (0) Acct-Input-Packets = 35210049 (0) Acct-Input-Octets = 2507619532 (0) Acct-Session-Id = '01F157C4' (0) Acct-Output-Gigawords = 17 (0) Service-Type = Framed-User (0) Acct-Authentic = RADIUS (0) NAS-Port-Id = 'Uniq-Sess-ID21041' (0) Calling-Station-Id = '#FINT_C210_01#90847724# Slot:205,Port:25,VPI:1,VCI:32' (0) Framed-Protocol = PPP (0) Acct-Input-Gigawords = 0 (0) NAS-Port = 41041 (0) Acct-Delay-Time = 0 (0) # Executing section preacct from file ../../raddb/auth/sites-enabled/default (0) preacct { (0) preprocess: EXPAND /^213\.151\.231\./ (0) preprocess: --> /^213\.151\.231\./ (0) preprocess: EXPAND /^213\.151\.232\./ (0) preprocess: --> /^213\.151\.232\./ (0) [preprocess] = ok .... (0) [detail] = ok (0) if (&Huntgroup-Name) { (0) if (&Huntgroup-Name) -> FALSE (0) if (&Huntgroup-Name) { ... Thank you

4 4

Help
by sandy.napoles＠eccmg.cupet.cu 14 Apr '15

14 Apr '15

Hello list, Iam using freeradius Versión: 2.1.12, and I have read some tutorial about freeradius + samba4 as active directory. when a user try to autenticate I have the follow logs....somebody can helpme. Ready to process requests. rad_recv: Access-Request packet from host 10.0.100.2 port 1060, id=0, length=181 Message-Authenticator = 0x87734694ee77d9806817c3a72bd970dd Service-Type = Framed-User User-Name = "yordan" Framed-MTU = 1488 Called-Station-Id = "00-23-CD-C3-BD-4E:TP-LINK_C3BD4E" Calling-Station-Id = "4C-BB-58-35-80-0E" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01796f7264616e NAS-IP-Address = 192.168.1.5 NAS-Port = 2 NAS-Port-Id = "STA port # 2" # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [ldap] performing user authorization for yordan [ldap] expand: (&(sAMAccountName=%{User-Name})) -> (&(sAMAccountName=yordan)) [ldap] expand: OU=Comercializadora,OU=CUPET,DC=eccmg,DC=cupet,DC=cu -> OU=Comercializadora,OU=CUPET,DC=eccmg,DC=cupet,DC=cu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.18.68.8:389, authentication 0 [ldap] bind as cn=openfire,OU=Administrador de Red,OU=Comercializadora,OU=CUPET,DC=eccmg,DC=cupet,DC=cu/open&^2017 to 172.18.68.8:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in OU=Comercializadora,OU=CUPET,DC=eccmg,DC=cupet,DC=cu, with filter (&(sAMAccountName=yordan)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user yordan authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [yordan/<no User-Password attribute>] (from client 10.0.100.0/24 port 2 cli 4C-BB-58-35-80-0E) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 10.0.100.2 port 1060 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +54 Ready to process requests.

3 3