- Freeradius-Users - lists.freeradius.org

CVE-2012-2110
by Brian Julin 19 Apr '12

19 Apr '12

A cursory look suggests we may use some of the effected codepaths in CVE-2012-2110 (http://lists.grok.org.uk/pipermail/full-disclosure/2012-April/086585.html) and given that FreeRADIUS often deals with certificates from sources that are not under direct control of administrators (dot1x clients, federation servers, etc.) this might be worth a news page post. -- Brian S. Julin Network Administrator Clark University

2 1

ldap redundant-load-balance issue
by Tobias Hachmer 19 Apr '12

19 Apr '12

Hello list, I'm testing FreeRADIUS ldap authentication and ldap authorization, in the default server config I defined: authorize { ... redundant-load-balance { ldap1 ldap2 ldap3 } # Allow only members of AD-Group "cn=radius.users,ou=Groups,dc=test,dc=local" ! if(Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") { ...several Ldap-Group queries to decide which attributes will be returned } ... } authenticate { ... Auth-Type LDAP { redundant-load-balance { ldap1 ldap2 ldap3 } } ... } The three ldap modules are well configured, I hope so. See freeradius -X output below. During FreeRADIUS performance test as described in /usr/share/doc/freeradius/performance-testing.gz I noticed that FR does for the ldap-group query above (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") no load-balancing or fall-through to other ldap modules. Every time only ldap module ldap3 is taken to do this ldap-group query. When I disable the nic of the ldap server referenced in ldap module ldap3 and authenticate with an existing user in AD I get an Access-Accept but without the return RADIUS Attributes I configured for special ldap-group membership inside the nested if bracket. No fail-over to the other ldap modules happens, although the other two ldap servers are up and running and reachable. Why FR doesn't load balance for this ldap-query? Thanks in advance, Tobias Hachmer Output of freeradius -X is a lot: root@asaradius1:/etc/freeradius# freeradius -X FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Oct 24 2011 at 15:27:27 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/ldap2 including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/ldap1 including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ldap3 including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/status including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/control-socket main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client Test1 { ipaddr = 192.168.72.11 netmask = 32 require_message_authenticator = no secret = "testing123" shortname = "Test" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/sites-enabled/default modules { Module: Creating Auth-Type = LDAP Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating module "ldap1" from file /etc/freeradius/modules/ldap1 ldap ldap1 { server = "ldaps://testwdc1.test.local" port = 636 password = "abc321!" identity = "cn=Free RADIUS,cn=Users,dc=test,dc=local" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/freeradius/certs/cacert.pem" require_cert = "allow" } basedn = "ou=Frankfurt,dc=test,dc=local" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xc9fae0 Module: Instantiating module "ldap2" from file /etc/freeradius/modules/ldap2 ldap ldap2 { server = "ldaps://testwdc2.test.local" port = 636 password = "abc321!" identity = "cn=Free RADIUS,cn=Users,dc=test,dc=local" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/freeradius/certs/cacert.pem" require_cert = "demand" } basedn = "ou=Frankfurt,dc=test,dc=local" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xca2090 Module: Instantiating module "ldap3" from file /etc/freeradius/modules/ldap3 ldap ldap3 { server = "ldaps://testwdc3.test.local" port = 636 password = "abc321!" identity = "cn=Free RADIUS,cn=Users,dc=test,dc=local" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/freeradius/cacert.pem" require_cert = "demand" } basedn = "ou=Frankfurt,dc=test,dc=local" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap3-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap3-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap3 rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xca4640 Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/freeradius/modules/detail.log detail auth_log { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_always Module: Instantiating module "reject" from file /etc/freeradius/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server status { # from file /etc/freeradius/sites-enabled/status modules { Module: Creating Autz-Type = Status-Server Module: Checking authorize {...} for more modules to load Module: Instantiating module "ok" from file /etc/freeradius/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" uid = "freerad" gid = "freerad" mode = "rw" } } listen { type = "status" ipaddr = 127.0.0.1 port = 18120 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "adminsecret" } } ... adding new socket proxy address * port 44399 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on status address 127.0.0.1 port 18120 as server status Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=155, length=52 User-Name = "fkd" User-Password = "hhbea" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:47 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for fkd [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> fkd [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=fkd) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] attempting LDAP reconnection [ldap1] (re)connect to ldaps://testwdc1.test.local, authentication 0 [ldap1] setting TLS CACert File to /etc/freeradius/certs/cacert.pem [ldap1] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc1.test.local [ldap1] waiting for bind result ... [ldap1] Bind was successful [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=fkd) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> fkd expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=fkd) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> fkd attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 155 to 192.168.72.11 port 52586 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=106, length=53 User-Name = "vfyg" User-Password = "aiuqnb" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:48 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for vfyg [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> vfyg [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=vfyg) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] attempting LDAP reconnection [ldap2] (re)connect to ldaps://testwdc2.test.local, authentication 0 [ldap2] setting TLS CACert File to /etc/freeradius/certs/cacert.pem [ldap2] setting TLS Require Cert to demand [ldap2] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc2.test.local [ldap2] waiting for bind result ... [ldap2] Bind was successful [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=vfyg) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> vfyg expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=vfyg) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> vfyg attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 106 to 192.168.72.11 port 52586 Finished request 1. Going to the next request Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=2, length=55 User-Name = "daboib" User-Password = "tqfblh" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:49 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap3] performing user authorization for daboib [ldap3] expand: %{Stripped-User-Name} -> [ldap3] ... expanding second conditional [ldap3] expand: %{User-Name} -> daboib [ldap3] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=daboib) [ldap3] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed [ldap3] search failed [ldap3] ldap_release_conn: Release Id: 0 +++[ldap3] returns fail [ldap1] performing user authorization for daboib [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> daboib [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=daboib) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=daboib) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> daboib expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=daboib) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> daboib attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 2 to 192.168.72.11 port 52586 Finished request 2. Going to the next request Waking up in 1.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=79, length=52 User-Name = "qyc" User-Password = "bpd" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:51 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for qyc [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> qyc [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=qyc) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=qyc) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> qyc expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=qyc) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> qyc attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 79 to 192.168.72.11 port 52586 Finished request 3. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=160, length=52 User-Name = "xlb" User-Password = "shu" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:52 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for xlb [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> xlb [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=xlb) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=xlb) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> xlb expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=xlb) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> xlb attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Cleaning up request 0 ID 155 with timestamp +57 Sending delayed reject for request 4 Sending Access-Reject of id 160 to 192.168.72.11 port 52586 Waking up in 1.0 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=4, length=54 User-Name = "vxtva" User-Password = "rafjwdr" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:53 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for vxtva [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> vxtva [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=vxtva) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=vxtva) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> vxtva expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=vxtva) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> vxtva attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 4 to 192.168.72.11 port 52586 Finished request 5. Going to the next request Cleaning up request 1 ID 106 with timestamp +58 Waking up in 1.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=173, length=54 User-Name = "nquna" User-Password = "hffe" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:54 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for nquna [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> nquna [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=nquna) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=nquna) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> nquna expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=nquna) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> nquna attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 173 to 192.168.72.11 port 52586 Finished request 6. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=115, length=57 User-Name = "vlsagjxx" User-Password = "hihmb" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:55 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for vlsagjxx [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> vlsagjxx [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=vlsagjxx) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=vlsagjxx) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> vlsagjxx expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=vlsagjxx) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> vlsagjxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Cleaning up request 2 ID 2 with timestamp +59 Sending delayed reject for request 7 Sending Access-Reject of id 115 to 192.168.72.11 port 52586 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=90, length=54 User-Name = "bcrtp" User-Password = "ficei" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:56 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for bcrtp [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> bcrtp [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=bcrtp) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=bcrtp) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> bcrtp expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=bcrtp) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bcrtp attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 90 to 192.168.72.11 port 52586 Finished request 8. Going to the next request Cleaning up request 3 ID 79 with timestamp +61 rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=176, length=54 User-Name = "dkova" User-Password = "skmlqw" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:57 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for dkova [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> dkova [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=dkova) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=dkova) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> dkova expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=dkova) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> dkova attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 176 to 192.168.72.11 port 52586 Finished request 9. Going to the next request Cleaning up request 4 ID 160 with timestamp +62 rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=106, length=54 User-Name = "fnenl" User-Password = "kjbjclqw" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:58 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for fnenl [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> fnenl [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=fnenl) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=fnenl) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> fnenl expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=fnenl) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> fnenl attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 10 for 1 seconds Going to the next request Cleaning up request 5 ID 4 with timestamp +63 Sending delayed reject for request 10 Sending Access-Reject of id 106 to 192.168.72.11 port 52586 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=54, length=53 User-Name = "txhj" User-Password = "qdmjrgrm" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:05:59 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap3] performing user authorization for txhj [ldap3] expand: %{Stripped-User-Name} -> [ldap3] ... expanding second conditional [ldap3] expand: %{User-Name} -> txhj [ldap3] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=txhj) [ldap3] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed [ldap3] search failed [ldap3] ldap_release_conn: Release Id: 0 +++[ldap3] returns fail [ldap1] performing user authorization for txhj [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> txhj [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=txhj) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=txhj) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> txhj expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=txhj) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> txhj attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 54 to 192.168.72.11 port 52586 Finished request 11. Going to the next request Cleaning up request 6 ID 173 with timestamp +64 Cleaning up request 7 ID 115 with timestamp +65 rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=59, length=54 User-Name = "nhgwh" User-Password = "qmbtw" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:06:01 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for nhgwh [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> nhgwh [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=nhgwh) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=nhgwh) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> nhgwh expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=nhgwh) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> nhgwh attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 12 for 1 seconds Going to the next request Cleaning up request 8 ID 90 with timestamp +66 Sending delayed reject for request 12 Sending Access-Reject of id 59 to 192.168.72.11 port 52586 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=11, length=55 User-Name = "kaiaur" User-Password = "chdyo" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:06:02 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap1] performing user authorization for kaiaur [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> kaiaur [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=kaiaur) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=kaiaur) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> kaiaur expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=kaiaur) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> kaiaur attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 11 to 192.168.72.11 port 52586 Finished request 13. Going to the next request Cleaning up request 9 ID 176 with timestamp +67 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=160, length=54 User-Name = "kmvbu" User-Password = "uegu" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:06:03 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap3] performing user authorization for kmvbu [ldap3] expand: %{Stripped-User-Name} -> [ldap3] ... expanding second conditional [ldap3] expand: %{User-Name} -> kmvbu [ldap3] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=kmvbu) [ldap3] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed [ldap3] search failed [ldap3] ldap_release_conn: Release Id: 0 +++[ldap3] returns fail [ldap1] performing user authorization for kmvbu [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> kmvbu [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=kmvbu) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=kmvbu) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> kmvbu expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=kmvbu) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> kmvbu attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 160 to 192.168.72.11 port 52586 Finished request 14. Going to the next request Cleaning up request 10 ID 106 with timestamp +68 rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=61, length=54 User-Name = "aydps" User-Password = "cnx" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:06:05 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for aydps [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> aydps [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=aydps) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=aydps) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> aydps expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=aydps) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aydps attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 61 to 192.168.72.11 port 52586 Finished request 15. Going to the next request Cleaning up request 11 ID 54 with timestamp +69 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=184, length=54 User-Name = "jiumn" User-Password = "qwdwmc" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:06:06 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap2] performing user authorization for jiumn [ldap2] expand: %{Stripped-User-Name} -> [ldap2] ... expanding second conditional [ldap2] expand: %{User-Name} -> jiumn [ldap2] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=jiumn) [ldap2] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap2] ldap_get_conn: Checking Id: 0 [ldap2] ldap_get_conn: Got Id: 0 [ldap2] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=jiumn) [ldap2] object not found [ldap2] search failed [ldap2] ldap_release_conn: Release Id: 0 +++[ldap2] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> jiumn expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=jiumn) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jiumn attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 184 to 192.168.72.11 port 52586 Finished request 16. Going to the next request Cleaning up request 12 ID 59 with timestamp +71 rad_recv: Access-Request packet from host 192.168.72.11 port 52586, id=86, length=55 User-Name = "anolpf" User-Password = "phxf" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.72.11/auth-detail-20120419 [auth_log] expand: %t -> Thu Apr 19 13:06:07 2012 ++[auth_log] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [ldap3] performing user authorization for anolpf [ldap3] expand: %{Stripped-User-Name} -> [ldap3] ... expanding second conditional [ldap3] expand: %{User-Name} -> anolpf [ldap3] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=anolpf) [ldap3] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed [ldap3] search failed [ldap3] ldap_release_conn: Release Id: 0 +++[ldap3] returns fail [ldap1] performing user authorization for anolpf [ldap1] expand: %{Stripped-User-Name} -> [ldap1] ... expanding second conditional [ldap1] expand: %{User-Name} -> anolpf [ldap1] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=anolpf) [ldap1] expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local [ldap1] ldap_get_conn: Checking Id: 0 [ldap1] ldap_get_conn: Got Id: 0 [ldap1] performing search in ou=Frankfurt,dc=test,dc=local, with filter (sAMAccountName=anolpf) [ldap1] object not found [ldap1] search failed [ldap1] ldap_release_conn: Release Id: 0 +++[ldap1] returns notfound ++- redundant-load-balance group redundant-load-balance returns notfound ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") [ldap3] Entering ldap_groupcmp() expand: ou=Frankfurt,dc=test,dc=local -> ou=Frankfurt,dc=test,dc=local expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> anolpf expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=anolpf) [ldap3] ldap_get_conn: Checking Id: 0 [ldap3] ldap_get_conn: Got Id: 0 [ldap3] attempting LDAP reconnection [ldap3] (re)connect to ldaps://testwdc3.test.local, authentication 0 [ldap3] setting TLS CACert File to /etc/freeradius/cacert.pem [ldap3] setting TLS Require Cert to demand [ldap3] bind as cn=Free RADIUS,cn=Users,dc=test,dc=local/abc321! to ldaps://testwdc3.test.local [ldap3] cn=Free RADIUS,cn=Users,dc=test,dc=local bind to ldaps://testwdc3.test.local failed: Can't contact LDAP server [ldap3] (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed [ldap3] ldap_release_conn: Release Id: 0 ? Evaluating (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE ++? if (Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") -> FALSE [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ++[expiration] returns noop ++[logintime] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> anolpf attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 86 to 192.168.72.11 port 52586 Finished request 17. Going to the next request Cleaning up request 13 ID 11 with timestamp +72 Waking up in 0.9 seconds. Cleaning up request 14 ID 160 with timestamp +73 Waking up in 1.0 seconds. Cleaning up request 15 ID 61 with timestamp +75 Waking up in 1.0 seconds. Cleaning up request 16 ID 184 with timestamp +76 Waking up in 1.9 seconds. Cleaning up request 17 ID 86 with timestamp +77 Ready to process requests.

4 6

Authentication problems
by pessimist 19 Apr '12

19 Apr '12

I've been trying to update from freeradius ver 1.1.3 to freeradius 2.1.9 and can't get past the authentication failure shown in the log below. I thought I had made the neessary changes to the database but clearly not. Can't see where to go from here. Any help would be much appreciated. radius=# select * radius-# from radcheck radius-# where radius-# username = 'ABC' radius-# ; id | username | attribute | op | value ------+----------+--------------------+----+------- 5220 | ABC | Simultaneous-Use | := | 1 5219 | ABC | Cleartext-Password | := | 123 radius=# select * radius-# from radusergroup radius-# ; username | groupname | priority ----------+-----------+---------- PW | dynamic | 0 CB | dynamic | 0 ABC | dynamic | 0 FreeRADIUS Version 2.1.9, for host i386-redhat-linux-gnu, built on May 24 2010 at 16:22:24 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.5.0/24 { require_message_authenticator = no secret = "testing123" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.241 port 2053, id=160, length=226 ChilliSpot-Version = "1.0.11" User-Name = "ABC" CHAP-Challenge = 0x014f905c247fbaff1c852626260eae46 CHAP-Password = 0x00d5bd4083f746f787200a86229bcda7a2 NAS-IP-Address = 192.168.69.1 Service-Type = Login-User Framed-IP-Address = 192.168.69.132 Calling-Station-Id = "00-19-7D-6A-E7-67" Called-Station-Id = "00-1A-70-89-4F-EC" NAS-Identifier = "nas01" Acct-Session-Id = "4f8c231f00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Logoff-URL = "http://192.168.69.1:3990/logoff" Message-Authenticator = 0xecf023c0d37b8e6451f63af3277a6882 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "ABC", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "ABC" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ABC attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 160 to 192.168.5.241 port 2053 Waking up in 4.9 seconds. Cleaning up request 0 ID 160 with timestamp +16 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-problems-tp5644080p5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

Duplicate Radius Packets to another server
by Nasser Heidari 19 Apr '12

19 Apr '12

3 2

Configuring Freeradius with LDAP
by Wassim Zaarour 19 Apr '12

19 Apr '12

Hi List, I have installed freeradius 2.1.12, and it's working well. Now I need to configure it to authenticate with LDAP (Sun Directory Server) but I can't seem to find which file to configure in raddb, I can't find it in radiusd.conf I appreciated any help on this. Wassim C. Zaarour Systems & Network Engineer

3 3

rlm_ippool does not create DB and IDX files
by rogiermulder 18 Apr '12

18 Apr '12

I have a working freeradius installation (v2.1.10, Ubuntu package) with rlm_ippool working like a charm. Now I'm installing a new server (CentOS 6) with the freeradius (v2.1.10) installed as package. It install the rlm_ippool.so module so I assume ippool supprot is compiled in. I've copied the radiusd.conf, modules/ippool and users file from the old (working) server to my new on. When I start radiusd, no DB and IDX files for the pools are created. The old server howerver, does create these files using the same config files. When I 'strace' radiusd at startup, I see that it opens and reads modules/ippool. radiusd.conf: prefix = / exec_prefix = ${prefix} sysconfdir = ${prefix}/etc raddbdir = ${sysconfdir}/radius db_dir = ${raddbdir} modules/ippool: ippool m2m.sycada.vodafone.de_pool { range-start = 10.242.128.0 range-stop = 10.242.255.254 netmask = 255.255.0.0 cache-size = 32768 session-db = ${raddbdir}/db.m2m.sycada.vodafone.de_pool ip-index = ${raddbdir}/idx.m2m.sycada.vodafone.de_pool override = no maximum-timeout = 0 key = "%{Calling-Station-ID}" users: DEFAULT Service-Type == Framed-User MS-Primary-DNS-Server += 172.17.98.22, MS-Secondary-DNS-Server += 172.17.98.24, Fall-Through = Yes myuid Cleartext-Password := "secret", Called-Station-Id == "m2m.sycada.vodafone.de", Pool-Name := "m2m.sycada.vodafone.de_pool" Session-Timeout <= 604800 /usr/sbin/radius -X: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jul 19 2011 at 10:16:18 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/" localstatedir = "//var" logdir = "//var/log/radius" libdir = "//lib" radacctdir = "//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "//var/run/radiusd/radiusd.pid" checkrad = "//sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "//var/log/radius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } listen { type = "control" listen { socket = "//var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file //var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. I can not see any difference in the freeradius config. Anby help is greatly appreciated! Rogier Mulder -- View this message in context: http://freeradius.1045715.n5.nabble.com/rlm-ippool-does-not-create-DB-and-I… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Freeradius with Cisco Wireless Controller
by Martin Silvero 18 Apr '12

18 Apr '12

Hi, I use freeradius with cisco access point and vlans assignment, work fine but now I try to use Cisco Wireless Controller and the vlan assignment dont work. Can you help me? I send the logs: Many thanks! Log without acces points and wireless controller: .... server inner-tunnel { +- entering group authorize {...} ++[preprocess] returns ok ++? if (!Huntgroup-Name) ? Evaluating !(Huntgroup-Name) -> TRUE ++? if (!Huntgroup-Name) -> TRUE ++- entering if (!Huntgroup-Name) {...} +++[reply] returns ok ++- if (!Huntgroup-Name) returns ok ++? if (Huntgroup-Name == "list") (Attribute Huntgroup-Name was not found) .... dont check groups. Log with acces points only: server inner-tunnel { +- entering group authorize {...} ++[preprocess] returns ok ++? if (!Huntgroup-Name) ? Evaluating !(Huntgroup-Name) -> FALSE ++? if (!Huntgroup-Name) -> FALSE ++? if (Huntgroup-Name == "list") ? Evaluating (Huntgroup-Name == "list") -> TRUE ++? if (Huntgroup-Name == "list") -> TRUE ++- entering if (Huntgroup-Name == "list") {...} +++? if (Ldap-Group == "WIFI-Direccion") rlm_ldap: Entering ldap_groupcmp() .... In this case check each group The config is the same. freeradius work with cisco wireless controller? Thanks!

3 2

Re: Freeradius with Cisco Wireless Controller
by Alan Buxey 18 Apr '12

18 Apr '12

Those logs don't show anything useful. Cisco wireless controllers work fine with freeradius, we've been using them since day 1 with our FR through the years. What attributes are you sending and is the WLAN configured for vlan override if you are assigning vlan by FR? alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

Auth-Type Fall-Through & ldap timeouts
by Tobias Hachmer 18 Apr '12

18 Apr '12

Hello list, I'm using a sql database for authorization and ldap for authentication. For fail-over reasons I want to authenticate against user-password information stored in my sql database if my ldap servers are not available (all ldap modules return fail). For authentication I configured: Auth-Type LDAP { redundant-load-balance { ldap1 ldap2 ldap3 } if(fail) { pap } } So I set the network interfaces of my ldap servers manually to down and startet testing. But the timeouts for every ldap module are too big (circa 50 seconds). I noticed the timeout directives in the ldap module. In all three ldap modules the net_timeout is set to "1". Question 1: How can I reduce these timeouts? Question 2: Can I check earlier my ldap servers are available and if not skip Auth-Type LDAP or setting Auth-Type to PAP? Question 3: Are there any other opportunities to do Auth-Type PAP if Auth-Type LDAP fails? Thanks in advance, Tobias Hachmer

3 6

Using DHCP
by Franz 18 Apr '12

18 Apr '12

Hi, I was wondering if when using DHCP with freeradius we can control the lease time depending on the group the user belongs to. Thanks, Franz

3 7