- Freeradius-Users - lists.freeradius.org

Re: Rewriting wimax calling-station-id with perl
by James T. Mugauri 07 Oct '11

07 Oct '11

Hi, All Thanks a bunch for this. I have tested both the ubuntu and CentOS/RedHat variants successfully on separate machines, integrated with postgresql. (The mysql was a typo incited by a previous install of freeradius-mysql). Ironically, i also managed to build deb packages from the 2.1.12 git source separately which included wimax, mysql and postgresql modules. Thanks, in particular, to Fajar for taking the time to update the ppa. Cheers, JamesTM Irrationally held truths may be more harmful than reasoned errors. - Thomas H. Huxley On 10/07/2011 10:13 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Of course there are. In RHEL5 the package is called freeradius2 and is > prebuilt with wimax an mysql. The current version is 2.1.7, but if you > wait a little while for the 5.8 update the latest 2.1.12 will be available. > -- John Dennis <jdennis(a)redhat.com> On 10/07/2011 10:13 AM, freeradius-users-request(a)lists.freeradius.org wrote: > I've updated the package on > https://launchpad.net/~freeradius/+archive/stable (the update is > Natty-only for now), which adds freeradius-experimental package. It > has rlm_wimax, rlm_sql_sqlite, rlm_caching, and more. If you're still > having problem compiling yourself and don't mind using unsupported > ppa, you can use that. > > -- Fajar

1 0

Authentication with different port and users
by Alan Kong 07 Oct '11

07 Oct '11

Hi, I used to have freeradius(old version) installed on Solaris and have 2 separate processes listening on port 1812 and 1645. They authenticate 2 groups of different users. I upgraded and installed freeradius 2.1.11 on CentOS 5.6. According to radiusd.conf, I could get freeradius listen on different ports. Can I config the ports authenticate different groups of users using "/etc/passwd"? Thank you. Regards Alan

2 1

Debug mode doesn't start
by andreapepa 07 Oct '11

07 Oct '11

http://freeradius.1045715.n5.nabble.com/file/n4879265/proxy.conf proxy.conf hi all, After some modification to the proxy.conf freeradius doesn't start anymore terminating without errors or messages what is going wrong?: root@host:/etc/freeradius# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/postgresql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 512000 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server rad161auth { ipaddr = 172.25.200.161 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool f3_auth_pool { home_server = rad161auth } home_server rad161acct { ipaddr = 172.25.200.161 port = 1813 type = "acct" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool f3_acct_pool { home_server = rad161acct } realm testrealm.it { auth_pool = f3_auth_pool acct_pool = f3_acct_pool } home_server_pool my_auth_failover { type = fail-over home_server = localhost } root@host:/etc/freeradius# -- View this message in context: http://freeradius.1045715.n5.nabble.com/Debug-mode-doesn-t-start-tp4879265p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Re: Rewriting wimax calling-station-id with perl
by James T. Mugauri 06 Oct '11

06 Oct '11

Hi, Apologies for the late response. Our mail system went down at a terrible time! > From: Johan Meiring<jmeiring(a)pcservices.co.za> > Subject: Re: Rewriting wimax calling-station-id with perl > Which version of debian do you need packages for? I am trying to install it on ubuntu 11.04 server. If there are rpm packages suitable for CentOS 5.x prebuilt with wimax and mysql, i would take that! With respect to Alan's observation: > But why worry about a "deb" package? Just install it from source. > That works. > Alan DeKok. Installing from source also dies when I make with the same libtool error on my ubuntu server 11.04 install. I know i have to add 'rlm_wimax' to src/modules/stable to have it compile, but the Make fails with or without this entry. Adding the suggestive -DIE_LIBTOOL_DIE to CFLAGS makes no difference Regards JamesTM

3 3

password in EAP request
by Alex rsm 06 Oct '11

06 Oct '11

Hi, In example.pl perl script $RAD_REQUEST{'User-Name'} returns the username of the EAP request message. How can I get the password of the EAP request? $RAD_REQUEST{'User-Password'} won't return the password. rad_recv: Access-Request packet from host 24.26.79.31 port 50168, id=207, length=185 User-Name = "test" NAS-IP-Address = 10.0.0.31 NAS-Identifier = "belair" NAS-Port = 0 Called-Station-Id = "00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x" Calling-Station-Id = "00-26-4A-FC-EB-B2" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xce81437fce8047c9464d6ff62d386d00 Message-Authenticator = 0x5feafac09a6cce51d36958efc628f397 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 209 ++[files] returns ok User-Name=test User-password= rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: State = 0xce81437fce8047c9464d6ff62d386d00 rlm_perl: RAD_REQUEST: Calling-Station-Id = 00-26-4A-FC-EB-B2 rlm_perl: RAD_REQUEST: Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: RAD_REQUEST: Message-Authenticator = 0x5feafac09a6cce51d36958efc628f397 rlm_perl: RAD_REQUEST: User-Name = test rlm_perl: RAD_REQUEST: NAS-Identifier = belair rlm_perl: RAD_REQUEST: EAP-Message = 0x020100060319 rlm_perl: RAD_REQUEST: Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: RAD_REQUEST: EAP-Type = NAK rlm_perl: RAD_REQUEST: NAS-IP-Address = 10.0.0.31 rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: Framed-MTU = 1400 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair State = 0xce81437fce8047c9464d6ff62d386d00 rlm_perl: Added pair Calling-Station-Id = 00-26-4A-FC-EB-B2 rlm_perl: Added pair Called-Station-Id = 00-0D-67-12-15-80:SSO_BelAir-PMIP-8021x rlm_perl: Added pair Message-Authenticator = 0x5feafac09a6cce51d36958efc628f397 rlm_perl: Added pair User-Name = test rlm_perl: Added pair NAS-Identifier = belair rlm_perl: Added pair EAP-Message = 0x020100060319 rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b rlm_perl: Added pair EAP-Type = NAK rlm_perl: Added pair NAS-IP-Address = 10.0.0.31 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled

7 9

Trapeze dictionary enhancement proposal
by Fred 06 Oct '11

06 Oct '11

he all, Here is some possible enhancement on dictionary.trapeze +# +# For use with FreeRadius and Trapeze Networks MSS software 1.1 +# or greater. +# +# For assistance, email support(a)trapezenetworks.com. +# +# $Id$ +# +# +VENDOR Trapeze 14525 -ATTRIBUTE Trapeze-VLAN-Name 1 string -ATTRIBUTE Trapeze-Mobility-Profile 2 string -ATTRIBUTE Trapeze-Encryption-Type 3 string -ATTRIBUTE Trapeze-Time-Of-Day 4 string -VENDORATTR 14525 Trapeze-SSID 5 string -VENDORATTR 14525 Trapeze-End-Date 6 string -VENDORATTR 14525 Trapeze-Start-Date 7 string -VENDORATTR 14525 Trapeze-URL 8 string -VENDORATTR 14525 Trapeze-User-Group-Name 9 string -VENDORATTR 14525 Trapeze-Qos-Profile 10 string -VENDORATTR 14525 Trapeze-Simultaneous-Logins 11 string -VENDORATTR 14525 Trapeze-COA-Replace-Username 12 string -VENDORATTR 14525 Trapeze-Audit 13 string +# Attributes for MSS 1.1 and later + +BEGIN-VENDOR Trapeze + +ATTRIBUTE Trapeze-VLAN-Name 1 string +ATTRIBUTE Trapeze-Mobility-Profile 2 string +ATTRIBUTE Trapeze-Encryption-Type 3 string +ATTRIBUTE Trapeze-Time-Of-Day 4 string + +# New attributes for MSS 3.0 and later + +ATTRIBUTE Trapeze-SSID 5 string +ATTRIBUTE Trapeze-End-Date 6 string +ATTRIBUTE Trapeze-Start-Date 7 string +ATTRIBUTE Trapeze-URL 8 string + +END-VENDOR Trapeze Best regards, Fred MAISON

3 5

pfSense with freeRadius and CHAP
by Mark 06 Oct '11

06 Oct '11

Hi all, I have a weird problem, as you can see in the log below the client can successfully authenticate once and after that fails. The network structure is: 1) pfSense with freeRadius as firewall, authentication and accounting server 2) A HP ProCurve 2626 with MAC based port access 3) A wireless access point Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 2048 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.2.1 IP address [10.0.2.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded Counter counter: filename = "/usr/local/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 1317852000 [2011-10-06 00:00:00] Module: Instantiated counter (daily) counter: filename = "/usr/local/etc/raddb/db.weekly" counter: key = "User-Name" counter: reset = "weekly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Weekly-Session-Time" counter: check-name = "Max-Weekly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Weekly-Session-Time is number 1832 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 1318111200 [2011-10-09 00:00:00] Module: Instantiated counter (weekly) counter: filename = "/usr/local/etc/raddb/db.monthly" counter: key = "User-Name" counter: reset = "monthly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Monthly-Session-Time" counter: check-name = "Max-Monthly-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Monthly-Session-Time is number 1834 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 1320098400 [2011-10-31 23:00:00] Module: Instantiated counter (monthly) counter: filename = "/usr/local/etc/raddb/db.forever" counter: key = "User-Name" counter: reset = "never" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Forever-Session-Time" counter: check-name = "Max-Forever-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Forever-Session-Time is number 1836 rlm_counter: Current Time: 1317844840 [2011-10-05 22:00:40], Next reset 0 [2011-10-05 22:00:00] Module: Instantiated counter (forever) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.2.1:1812 Listening on accounting 10.0.2.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.2.2:1024, id=55, length=197 Framed-MTU = 1480 NAS-IP-Address = 10.0.2.2 NAS-Identifier = "Melkweg-0" User-Name = "00026f898b62" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1d-b3-2f-3f-3f" Calling-Station-Id = "00-02-6f-89-8b-62" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x36a38cdd1a470aebb4c6e8887360fb3fc9 Message-Authenticator = 0xdefb1131a6c68c375b062393ad67c22d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00026f898b62", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00026f898b62 at line 1 modcall[authorize]: module "files" returns ok for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "00026f898b62" with CHAP password rlm_chap: Using clear text password "00026f898b62" for user 00026f898b62 authentication. rlm_chap: chap user 00026f898b62 authenticated succesfully modcall[authenticate]: module "chap" returns ok for request 0 modcall: leaving group CHAP (returns ok) for request 0 Processing the session section of radiusd.conf modcall: entering group session for request 0 radius_xlat: '/var/log/radutmp' modcall[session]: module "radutmp" returns ok for request 0 modcall: leaving group session (returns ok) for request 0 Login OK: [00026f898b62/<CHAP-Password>] (from client Switch1 port 1 cli 00-02-6f-89-8b-62) Sending Access-Accept of id 55 to 10.0.2.2 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 55 with timestamp 4e8cb778 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.2.2:1024, id=56, length=197 Framed-MTU = 1480 NAS-IP-Address = 10.0.2.2 NAS-Identifier = "Melkweg-0" User-Name = "00026f898b64" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1d-b3-2f-3f-3f" Calling-Station-Id = "00-02-6f-89-8b-64" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x37fe6aa7c21b09f9fff29122501809899b Message-Authenticator = 0x4aad343a1934af2951356edec927fd4e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "00026f898b64", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "weekly" returns noop for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "monthly" returns noop for request 1 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "forever" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 1 rlm_chap: login attempt by "00026f898b64" with CHAP password rlm_chap: Could not find clear text password for user 00026f898b64 modcall[authenticate]: module "chap" returns invalid for request 1 modcall: leaving group CHAP (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [00026f898b64/<CHAP-Password>] (from client Switch1 port 1 cli 00-02-6f-89-8b-64) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 56 to 10.0.2.2 port 1024 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 56 with timestamp 4e8cb7b6 Nothing to do. Sleeping until we see a request. Attached are the radiusd.conf and users file, please help me out… Yours sincerely, Mark van Beek

2 1

mschap group restriction
by das-ich 06 Oct '11

06 Oct '11

Hi all! How it is possible to add restriction on group at mschap? Just --require-membership-of=GROUP-NAME not working Thanks for the answer.

1 0

Mac access mixed ldap access same NAS
by Alejandro Gandara 06 Oct '11

06 Oct '11

Hi list, does someone know if Its possible mix MAC auth with ldap AUTH in the same NAS. I mean, I have multiple connection to one NAS but a few users will access through mac address, and others will access trhough auth ldap + passwords. Nowadays Ive configured ldap access but I dont know how to configure freeradius to allow connect a few users(16-20) trhough mac auth. As always thanks you very much for your time and peacence. Regards, Alejandro Gándara Junior System Administrator

3 2

MySQL and FreeRADIUS environment
by tonimanel 06 Oct '11

06 Oct '11

Hi everybody, In my company we are thinking to implement a FreeRADIUS server with MySQL on Linux. We need to duplicate FreeRADIUS service because we think that this is a critical service for us but the authentication process only could be done with the master server(FreeRADIUS and MySQL service, both in only one server). For the other hand, if we want to replicate the data base servers, we would have to synchronize two database servers but we would not know wich would be the best solution, cluster or synchronize. Maybe we will not to need a MySQL cluster service and we will need two servers only. First with master FreeRADIUS service and master MySQL service and the second with slave FreeRADIUS service and slave MySQL service. What do you think about the best solution to implement this environment? I hope your answer. Thank you very much. Regards, -- View this message in context: http://freeradius.1045715.n5.nabble.com/MySQL-and-FreeRADIUS-environment-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 18