- Freeradius-Users - lists.freeradius.org

Re: Pre release of 2.1.12
by ironrake＠yahoo.com 05 Sep '11

05 Sep '11

It is running on one of my production servers. So far no problems, but it has only run for q few hours. Sent from Verizon Wireless

5 13

Conditional Dynamic VLAN
by joaocdc＠gmail.com 05 Sep '11

05 Sep '11

Hello Guys, I need the following in a wireless environment, using 802.1X authentication based on LDAP, need to do dynamic VLAN assignment. Need to consult an LDAP attribute, and from this attribute to determine which VLAN to send to my wireless controler. I need something like this: ... if ( habitantWirelessActive == FALSE ){ update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 100 } }else{ update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 30 } } ... habitantWirelessActive the attribute is the LDAP, each user has this attribute in a Boolean set to TRUE or FALSE. How can I make this check? Another question is about where I make this verification, the correct location is the session post-auth? I thank the attention. João -- João Paulo de Lima Barbosa

1 0

Pre release of 2.1.12
by Alan DeKok 05 Sep '11

05 Sep '11

I've put some pre releases of 2.1.12 on the web site: http://git.freeradius.org/pre/ Please let me know if there are any problems. If not, this can become 2.1.12. Alan DeKok.

9 13

Mac OSX FreeRadius EAP Authentication making progress - But still not there
by DavidS 05 Sep '11

05 Sep '11

Hi all I am still determined to make this work and have now reinstalled everything to start again with prior lessons learned. However - I am still unable to authenticate wireless clients by PEAP or TTLS MSCHAPv2 on a cisco access point (IP=192.168.0.98) with radius running on a MAC OSX server (IP=192.168.0.90) NOW Radtest works fine returning rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=237, length=20 AND if clients authenticate using only one protocol LEAP or TLS alone then authentication is also successful and an IP address assigned But if the client machine has protocols for authentication as TLS PEAP TTLS and EAP-FAST then the authentication fails with output as below Your help/insight would be greatly appreciated Thanks RADIUSD -X output during failed authentication by a client machine user name BBB password bbb1 (As mentioned: Cisco access point IP=192.168.0.98 and freeradius running on a MAC OSX server IP=192.168.0.90) rad_recv: Access-Request packet from host 192.168.0.98 port 1645, id=216, length=129 User-Name = "BBB" Framed-MTU = 1400 Called-Station-Id = "0023.331c.9680" Calling-Station-Id = "9027.e4f9.25b0" Service-Type = Login-User Message-Authenticator = 0x97a3bddfd63906e3230b58166cccdbd3 EAP-Message = 0x0201000801424242 NAS-Port-Type = Wireless-802.11 NAS-Port = 2113 NAS-Port-Id = "2113" NAS-IP-Address = 192.168.0.98 NAS-Identifier = "ap1250" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry BBB at line 1 ++[files] returns ok rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.0.98 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. ++[opendirectory] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 216 to 192.168.0.98 port 1645 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8da1c3b98da3d6d5f63e6480350916ec Finished request 63. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.98 port 1645, id=217, length=303 User-Name = "BBB" Framed-MTU = 1400 Called-Station-Id = "0023.331c.9680" Calling-Station-Id = "9027.e4f9.25b0" Service-Type = Login-User Message-Authenticator = 0x90d79354ab3708574c402c920154a72e EAP-Message = 0x020200a415800000009a16030100950100009103014e644aee06b1089ec2d1b1077222c6bb2c8d08967a8f07d3c2260773e8342cea000056c00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a00170019000101000012000a00080006001700180019000b00020100 NAS-Port-Type = Wireless-802.11 NAS-Port = 2113 NAS-Port-Id = "2113" State = 0x8da1c3b98da3d6d5f63e6480350916ec NAS-IP-Address = 192.168.0.98 NAS-Identifier = "ap1250" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 164 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 154 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0095], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 217 to 192.168.0.98 port 1645 EAP-Message = 0x0103040015c00000089b160301002a0200002603014e644aee10bdb60175c5117db3847fb794d60733f2c59fca91d5975050c9126400002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3131303930353030353832335a170d3132303930343030353832335a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a109405f25ca3b79e92c7801522fdd70caaa0b59075649db3171741ef29502438b01f69a6a9689972a67c2b00d8c20eeaabd3e07e00fae0a0946ac7e6c18 EAP-Message = 0xa543830a284f122814970db75cab444c8e2a6d857f8cdfacfbd6e38a268d1f3309a9f81d0ee86a856790beccd992c6e4ffe767a6a58aa2cfe00ddfc7710f621d73ff60599540f36dc9c45984dd58a2686858f81b00954cf1912236c1790c7a537de0c2534f79db99adcc65f999c5228ca865db465702dcc737416064f85e7c042f3c6499256a973106c8be19c1c1f62c19fa9ce2ac5e10fc945da5f4b09d9d41bee647544de173ac682fa789c814197d37ba7dd7d5abb655453b2a1ab9f0a7c9d6470203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100172dacb8d429d1ff6e EAP-Message = 0x0025c67c6a98a08669f0b27cd7c7fc4c3216b71902917801755db94ef25728746e66c6d92973e0281b2050c717be87ccf1beeff37ae8d0c62389e2ec23f360934efe09aed67aa355f69330b38178ec7ef5c267000d83d09cf07bd23c26608a7e73ecd38b01d8c7f1572f197f226d1cff0f3bd7ff8fcc15bdd69e784812a508a1e6ad66ab1ce1bb73201755aa7458e2dca57fff5b0cb98c30946e4f887cdccfaca32ed4c8c9a3d081fab7c0170412dc42cb557a2fd8b868f906bd354e85e16e63a0f6401210c2738a6589c7f39aced44d424bb96d78955e3f9f13d85b579a864a7853c5b7a081ea078bf344a6b8ff93b1ef5d99a6579c4a0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8da1c3b98ca2d6d5f63e6480350916ec Finished request 64. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.98 port 1645, id=218, length=145 User-Name = "BBB" Framed-MTU = 1400 Called-Station-Id = "0023.331c.9680" Calling-Station-Id = "9027.e4f9.25b0" Service-Type = Login-User Message-Authenticator = 0xbc49acdf46e9f7392e95984b40d81b60 EAP-Message = 0x020300061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 2113 NAS-Port-Id = "2113" State = 0x8da1c3b98ca2d6d5f63e6480350916ec NAS-IP-Address = 192.168.0.98 NAS-Identifier = "ap1250" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 218 to 192.168.0.98 port 1645 EAP-Message = 0x0104040015c00000089b00ce558c5613e23e34300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303930353030353832335a170d3132303930343030353832335a308193310b3009060355040613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d587b88ec0b9cd885aa0e746855a0dfd9e022630cca789c7d74147c0d47f126f5bb2beccfd886811782b65af565946b5e8391c975faf0ec63e923f67922bf34c402a64765ab21ebd5daeeb8b5ec2d38c358f7f31f4afe42835dfb6e7ad418575c12bb8bb5ebeff32ffe654 EAP-Message = 0xda315990bea2ebf04a490269e79b617434dd6a4f028ad10c37f4117a52530ba5c1f16955db65ac3ae29b28edc5686f63aef4253fdc42423845687567dca3244a3573ab3ee1821fb63b889defb0411b4162f370d54049cb89e10323d038eee8900ee0ce36f9e06b5fdd6069a0798a50c358c532d592b224d3ce37f2497d653aebd10961d10de6764462f09cb2c2aa4013c99f11b8930203010001a381fb3081f8301d0603551d0e041604143814889e8f16c470dabd8d16540c6e06dd7ca86f3081c80603551d230481c03081bd80143814889e8f16c470dabd8d16540c6e06dd7ca86fa18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ce558c5613e23e34300c0603551d13040530030101ff300d06092a864886f70d010105050003820101005a445d2e471625992a0cd0df69008711b837412cbc11949a2b90e0835110517611a3fdc1924c0d74e9d39ed41867e5cd71080c731960fbe76b0b0065b4916af05175e76d024f60a79738b89fc4ff EAP-Message = 0x2531435e631293fe8f22a8f6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8da1c3b98fa5d6d5f63e6480350916ec Finished request 65. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.98 port 1645, id=219, length=145 User-Name = "BBB" Framed-MTU = 1400 Called-Station-Id = "0023.331c.9680" Calling-Station-Id = "9027.e4f9.25b0" Service-Type = Login-User Message-Authenticator = 0x3e9c1e4acb4032de610b2c4a82aba6b6 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-Port = 2113 NAS-Port-Id = "2113" State = 0x8da1c3b98fa5d6d5f63e6480350916ec NAS-IP-Address = 192.168.0.98 NAS-Identifier = "ap1250" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 219 to 192.168.0.98 port 1645 EAP-Message = 0x010500b915800000089bb26c65dacb431b1c9e0bfb29f9c9c6093ad5e41ec29944e45c69e9cf6cf8b39a3613e540936f8023b928f6f3ac38f59688f9e6a0dee8b38ee2862e95785746880fc99058dc8ab6d2b2cff4db790b57df6a0c4bb9d0ef97b15d074e29ba4b403cf2247359aea0e458bf607002d5c1f030dca9b48b1d06b2f75f30de0c9c2062788c8491e6b2376dc9c321ebaf0d97a06ffd0286fc9d247c10ddd30ba03480eb32341a5d3eac2a16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8da1c3b98ea4d6d5f63e6480350916ec Finished request 66. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.98 port 1645, id=220, length=477 User-Name = "BBB" Framed-MTU = 1400 Called-Station-Id = "0023.331c.9680" Calling-Station-Id = "9027.e4f9.25b0" Service-Type = Login-User Message-Authenticator = 0x1190157aa20ebeb87d3147073d614d51 EAP-Message = 0x0205015015800000014616030101061000010201005be8e37164b0394eda3c8aeffe0e90be053dd55d7371c0146e5e18c69de2a989e4566d073ecd5bb91873428e36ff5d4538af1e276f507648ede7c14e1d0513e9c869f0a49a756303420f3d3efbab64ca606ab79741fe099ee94f70f4601e22697d2f828480d2c211cd880122530ba52eabc60f6ace0c3d1eee2cb2b999d8f58a3bb5f16fe8828e83c07d09194add2c8fb1b7af0817555935d36c681f35b548272f36a71bf12c5b018fe729343fc0bc7f82269e92465479623e489d757f4c8b9cf5b30f21b11fb2066a1eacc8376ff307027de1bc21a87187c49c7c25fdf77253e9382c4cc8b36186 EAP-Message = 0x5846b663d4b689d55d3a34912da4f9b07698a4e7da5e89a21403010001011603010030bab04f465e9d3b4200b1d2dbd55e6bd2c728eb97cbcdd3fc27104654a546dc22944b34d7d482e18fde0a9f549f5f2253 NAS-Port-Type = Wireless-802.11 NAS-Port = 2113 NAS-Port-Id = "2113" State = 0x8da1c3b98ea4d6d5f63e6480350916ec NAS-IP-Address = 192.168.0.98 NAS-Identifier = "ap1250" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 326 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 220 to 192.168.0.98 port 1645 EAP-Message = 0x0106004515800000003b14030100010116030100306ab6b04c46449e888999e0d67e6802fcc2af216d8ae3cf79da88145abde2d0c862be1b0c5b718ea7130475602d2da362 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8da1c3b989a7d6d5f63e6480350916ec Finished request 67. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.98 port 1645, id=221, length=282 User-Name = "BBB" Framed-MTU = 1400 Called-Station-Id = "0023.331c.9680" Calling-Station-Id = "9027.e4f9.25b0" Service-Type = Login-User Message-Authenticator = 0xb51cd376eef22ef1c49d4fa5a7c152e4 EAP-Message = 0x0206008f15800000008517030100809a51884eec0939c80d25cd8f66f9aa09b30e09516ed867243f5da7517a06d3ec10d3c3e05ea2491639ed7f39ab6f6bb9fac90194776d2a6fc02931d3d8554cb846633873d91fe7f19b76131480b45c539a5fe13bff09e99c51ebc3b177231511591184727a6e1a807c35725ceca270a9bec5f71b58523c674f36cd40837a7954 NAS-Port-Type = Wireless-802.11 NAS-Port = 2113 NAS-Port-Id = "2113" State = 0x8da1c3b989a7d6d5f63e6480350916ec NAS-IP-Address = 192.168.0.98 NAS-Identifier = "ap1250" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 143 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 133 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "BBB" MS-CHAP-Challenge = 0xdc44c3a996092783c753386d277c0fdb MS-CHAP2-Response = 0xea00f4a1a00dccebf6c1cd99ed1aecd987d2000000000000000031f407ff2772ee33933baa13615e7b06d0bd4f9e2f68f374 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "BBB" MS-CHAP-Challenge = 0xdc44c3a996092783c753386d277c0fdb MS-CHAP2-Response = 0xea00f4a1a00dccebf6c1cd99ed1aecd987d2000000000000000031f407ff2772ee33933baa13615e7b06d0bd4f9e2f68f374 FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[unix] returns updated [suffix] No '@' in User-Name = "BBB", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry BBB at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for BBB with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BBB [mschap] mschap2: dc [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b172f4e6d5a13aa3 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=31f407ff2772ee33933baa13615e7b06d0bd4f9e2f68f374 [2011/09/04 21:07:10, 0, pid=1176] /SourceCache/samba/samba-235.7/samba/source/utils/ntlm_auth.c:get_winbind_domain(146) could not obtain winbind domain name! Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\352E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> BBB attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 68 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 68 Sending Access-Reject of id 221 to 192.168.0.98 port 1645 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 63 ID 216 with timestamp +907 Cleaning up request 64 ID 217 with timestamp +907 Cleaning up request 65 ID 218 with timestamp +907 Cleaning up request 66 ID 219 with timestamp +907 Cleaning up request 67 ID 220 with timestamp +907 Waking up in 1.0 seconds. Cleaning up request 68 ID 221 with timestamp +907 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Mac-OSX-FreeRadius-EAP-Authenticati… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

run more than one radius on single machine
by waq 05 Sep '11

05 Sep '11

Dear, Its my requirement to run more than one radius on a single machine can anybody help me how to achieve this I am using CentOS 5.5 64bit, Oracle 10.2.0 , Freeradius 2.1.10 -- View this message in context: http://freeradius.1045715.n5.nabble.com/run-more-than-one-radius-on-single-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: which one to use - Radgroupcheck or Radgroupreply
by Lucio Godoy 04 Sep '11

04 Sep '11

Thank you very much My biggest wish is make sure of the Acct-Interim-Interval feature Thanks Lucio -----Original Message----- From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Date: Sun, 4 Sep 2011 12:45:02 To: <freeradius-users(a)lists.freeradius.org> Subject: Re: which one to use - Radgroupcheck or Radgroupreply On 4 Sep 2011, at 14:28, Lucio Godoy wrote: Hi All; I am using chillispor on a router with dd-wrt and I wanted to use the follwoing parameters, but dont know where to load them in my Freeradius Mysql config, pls: Session-Timeout = 3600 Idle-Timeout = 600 Acct-Interim-Interval = 60 WISPr-Redirection-URL = http://www.google.com/ WISPr-Bandwidth-Max-Up = 12800 WISPr-Bandwidth-Max-Down = 25600 And also if i should use = or any other opertator pls? radreply, and either = or := operators. -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org <mailto:a.cudbardb@freeradius.org> RADIUS - Half the complexity of Diameter

1 0

which one to use - Radgroupcheck or Radgroupreply
by Lucio Godoy 04 Sep '11

04 Sep '11

Hi All; I am using chillispor on a router with dd-wrt and I wanted to use the follwoing parameters, but dont know where to load them in my Freeradius Mysql config, pls: Session-Timeout = 3600Idle-Timeout = 600 Acct-Interim-Interval = 60WISPr-Redirection-URL = http://www.google.com/ WISPr-Bandwidth-Max-Up = 12800WISPr-Bandwidth-Max-Down = 25600 And also if i should use = or any other opertator pls? Thanks lucio =========================================================== The Home CCTV Security System made easy! http://www.kaduco.com/our-list-products-services/cctv-security-camera-syste…

2 1

RE: How to update a MySql table after successfully WIFI
by 2394263740 04 Sep '11

04 Sep '11

Arran, </:includetail> Thanks a lot again.</:includetail> </:includetail> It works.</:includetail> </:includetail> As what you advised,</:includetail> </:includetail> 1. edit </:includetail>/usr/local/etc/raddb/sites-available/default, uncomment below sql line.</:includetail> post-auth {</:includetail> ...... #sql ......</:includetail> }</:includetail> 2. edit </:includetail>/usr/local/etc/raddb/sql/mysql/dialup.conf</:includetail> updae postauth_query defination.</:includetail> </:includetail> Very busy these days. So reply late.</:includetail> </:includetail> Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Fri, Sep 2, 2011 06:11 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 77, Issue 5 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. How to update a MySql table after successfully WIFI authentication? ( 2394263740 ) 2. Re: How to update a MySql table after successfully WIFI authentication? (Arran Cudbard-Bell) 3. Re: Example configuration that proxy PEAP MSCHAPv2 to an IAS server (Jacob Dawson) 4. Using encrypted passwords in users file (sundoo) 5. cisco 3825 authentication error (Dom) 6. Re: Using encrypted passwords in users file (Paul Bartell) 7. Re: Pre release of 2.1.12 (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Thu, 1 Sep 2011 22:29:11 +0800 From: " 2394263740 " <2394263740(a)qq.com> Subject: How to update a MySql table after successfully WIFI authentication? To: " freeradius-users " <freeradius-users(a)lists.freeradius.org> Message-ID: <tencent_3B36E2AF6F7D0370683C1EB1(a)qq.com> Content-Type: text/plain; charset="iso-8859-1" Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql I got a WIFI network, using one radius server. The whole thing works fine. I got a requirement, which is, after each successful WIFI connection, one record need be added into connectionlog table. CREATE TABLE connectionlog ( radacctid bigint(21) NOT NULL auto_increment, acctsessionid varchar(64) NOT NULL default '', acctuniqueid varchar(32) NOT NULL default '', username varchar(64) NOT NULL default '', groupname varchar(64) NOT NULL default '', realm varchar(64) default '', nasipaddress varchar(15) NOT NULL default '', nasportid varchar(15) default NULL, nasporttype varchar(32) default NULL, acctstarttime datetime NULL default NULL, acctstoptime datetime NULL default NULL, acctsessiontime int(12) default NULL, acctauthentic varchar(32) default NULL, connectinfo_start varchar(50) default NULL, connectinfo_stop varchar(50) default NULL, acctinputoctets bigint(20) default NULL, acctoutputoctets bigint(20) default NULL, calledstationid varchar(50) NOT NULL default '', callingstationid varchar(50) NOT NULL default '', acctterminatecause varchar(32) NOT NULL default '', servicetype varchar(32) default NULL, framedprotocol varchar(32) default NULL, framedipaddress varchar(15) NOT NULL default '', acctstartdelay int(12) default NULL, acctstopdelay int(12) default NULL, xascendsessionsvrkey varchar(10) default NULL, PRIMARY KEY (radacctid), KEY username (username), KEY framedipaddress (framedipaddress), KEY acctsessionid (acctsessionid), KEY acctsessiontime (acctsessiontime), KEY acctuniqueid (acctuniqueid), KEY acctstarttime (acctstarttime), KEY acctstoptime (acctstoptime), KEY nasipaddress (nasipaddress) ) ; Can you please kindly advise how to do this? Which file should be edited? Where is the context to put in the script? What is the script? Thanks! Tom -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011090…> ------------------------------ Message: 2 Date: Thu, 1 Sep 2011 16:36:40 +0200 From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Subject: Re: How to update a MySql table after successfully WIFI authentication? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <C781BD59-4F30-48C4-B6CC-FF4790379DE1(a)freeradius.org> Content-Type: text/plain; charset=iso-8859-1 Look in raddb/sql/mysql/dialup.conf The postauth query is the one you need to edit. Then uncomment the 'sql' module in raddb/sites-available/default post-auth { } -Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter ------------------------------ Message: 3 Date: Thu, 1 Sep 2011 10:40:18 -0400 From: Jacob Dawson <dawson(a)vt.edu> Subject: Re: Example configuration that proxy PEAP MSCHAPv2 to an IAS server To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <14B9C69C-CB59-4CA7-9F5B-39CD6C81404C(a)vt.edu> Content-Type: text/plain; charset=us-ascii It's largely successful, but as I mentioned in my note to this group from the 29th, I've run into problems with Windows clients having a disagreement with FreeRADIUS about the final stages of the PEAP-MSCHAPv2 conversation, after IAS has authenticated them successfully. - Jacob On 31 Aug 2011, at 16:32, Alan DeKok wrote: > > It really should work... it works for my tests. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Thu, 1 Sep 2011 08:57:14 -0700 (PDT) From: sundoo <sandu_nastas(a)yahoo.com> Subject: Using encrypted passwords in users file To: freeradius-users(a)lists.freeradius.org Message-ID: <1314892634927-4758890.post(a)n5.nabble.com> Content-Type: text/plain; charset=us-ascii Hello, I'm new to FreeRadius and to linux. Maybe this question will sound stupid, but I really need you help. I have a server running freeradius. These are some outputs of the configuration: *etc/freeradius/radiusd.conf* # passwd = /etc/passwd shadow = /etc/shadow # group = /etc/group */etc/freeradius/users* test1 Auth-Type := Crypt-Local, User-Password := "$1$NzW2iwkn$ygDcJgb4WhAEqQYfySFkj/" Service-Type = Administrative-User, Cajun-Service-Type := 3, */etc/shadow* test1:$1$cnEh49V6$Q.68mw.3P5rgmsfhbo/iC1:15217:0:99999:7::: I would like to change the password for the user test1. But in the users file I see only the encrypted password. Where is the original password stored ? How do I change it ? Thanks a lot for your help. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-encrypted-passwords-in-users-… Sent from the FreeRadius - User mailing list archive at Nabble.com. ------------------------------ Message: 5 Date: Thu, 01 Sep 2011 15:45:02 -0400 From: Dom <dversace(a)tekcorner.ca> Subject: cisco 3825 authentication error To: freeradius-users(a)lists.freeradius.org Message-ID: <4E5FE0BE.8010800(a)tekcorner.ca> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I am trying to terminate vpdn sessions through our cisco 3825 using freeradius. I am new to this whole process and I was hoping to get some assistance with the missing configuration. Below is the error message I am receiving when trying to authenticate via the router. rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=19, length=135 Framed-Protocol = PPP User-Name = "aewais(a)domain.com" User-Password = "password" Calling-Station-Id = "bas203300000455" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 532 NAS-Port-Id = "Uniq-Sess-ID532" Service-Type = Framed-User NAS-IP-Address = 64.34.66.5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "domain.com" for User-Name = "aewais(a)domain.com" [suffix] No such realm "domain.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 19 to 64.34.66.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 19 with timestamp +381 Ready to process requests. ------------------------------ Message: 6 Date: Thu, 1 Sep 2011 14:54:29 -0700 From: Paul Bartell <paul.bartell(a)gmail.com> Subject: Re: Using encrypted passwords in users file To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CAHXqhmh49eNKABTpwmv0Rb1+UX7WPMaN4UB0RQKiiGVSuGoDzg(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 that is the hashed password. You can change it by generating a hash of your new password... you would probably use crypt(3) to do that... The original password was never stored in cleartext form. You could store a cleartext password if you really wanted to, but that is less than secure. On Thu, Sep 1, 2011 at 8:57 AM, sundoo <sandu_nastas(a)yahoo.com> wrote: > > Hello, I'm new to FreeRadius and to linux. Maybe this question will sound > stupid, but I really need you help. > I have a server running freeradius. > These are some outputs of the configuration: > > *etc/freeradius/radiusd.conf* > # passwd = /etc/passwd > ?shadow = /etc/shadow > # group = /etc/group > > > */etc/freeradius/users* > test1 Auth-Type := Crypt-Local, User-Password := > "$1$NzW2iwkn$ygDcJgb4WhAEqQYfySFkj/" > ? ? ? ?Service-Type = Administrative-User, > ? ? ? ?Cajun-Service-Type := 3, > > */etc/shadow* > test1:$1$cnEh49V6$Q.68mw.3P5rgmsfhbo/iC1:15217:0:99999:7::: > > > I would like to change the password for the user test1. But in the users > file I see only the encrypted password. Where is the original password > stored ? > > How do I change it ? > > Thanks a lot for your help. > > -- > View this message in context: http://freeradius.1045715.n5.nabble.com/Using-encrypted-passwords-in-users-… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Random quote of the week/month/whenever i get to updating it: "Quis custodiet ipsos custodes?": "who shall watch the watchers themselves?" - Juvenal ------------------------------ Message: 7 Date: Thu, 1 Sep 2011 23:11:23 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Pre release of 2.1.12 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20110901221123.GF16795(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > it's now running on our most busy server. Both -X and > background-multithreaded do their usual job. I do not see any problems > so far. its on one of our production servers and on a couple of other systems. alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 77, Issue 5 *********************************************** </:includetail>

1 0

rlm_eap: SSL error
by Chad Rebuck 03 Sep '11

03 Sep '11

Can someone point me in the right direction on figuring this out? I'm running Arch linux and I installed via "pacman -S freeradius". I didn't edit any config files yet. [root@pogo /]# uname -a Linux pogo 2.6.39-ARCH #2 PREEMPT Mon Jul 11 14:08:22 MDT 2011 armv5tel Feroceon 88FR131 rev 1 (v5l) Marvell SheevaPlug Reference Board GNU/Linux [root@pogo raddb]# radiusd -X FreeRADIUS Version 2.1.11, for host armv5tel-unknown-linux-gnu, built on Jul 15 2011 at 23:45:34 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[299]: Failed to load module "eap". /etc/raddb/sites-enabled/default[241]: Errors parsing authenticate section.

2 2

Question regarding multivalued attributes in control list.
by Olivier Beytrison 02 Sep '11

02 Sep '11

Hello, I'm trying since two week to do some multi-valued attribute checking on my radius infrastructure. I've been looking to checkval, using the "users" file and such but with no luck. I'm running two FR 2.1.10 on ubuntu for the eduroam project. The local authentication is made against an Novell eDirectory ldap server. I'm fetching a multi-valued attribute from the ldap into the control list, and based on its content, I set the correct Airespace-Interface-Name value. At the beginning I was using unlang to match the value, and it works perfectly since 90% of the people only have one attribute. But some people have multiple attributes. So far, that's what I've been using : In virtual server, at the end of authorize {} if (NAS-IP-Address =~ /160\.98\.156\..*/) { $INCLUDE ${confdir}/secure-hefr.policy } secure-hefr.policy content : if ( control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ ) { update reply { Airespace-Interface-Name := "wifi_eia-etu" } } elsif ( control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) { update reply { Airespace-Interface-Name := "wifi_eia-col" } } elsif { } [ ... ] Some debug from a user who is multi-valued : server eduroam-inner-tunnel-peap { # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam-inner-tunnel-peap +- entering group authorize {...} ++[mschap] returns noop [suffix] Looking up realm "hefr.ch" for User-Name = "didier.perroud(a)hefr.ch" [suffix] Found realm "hefr.ch" [suffix] Adding Realm = "hefr.ch" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 11 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/160.98.156.6/auth-detail-20110902 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/160.98.156.6/auth-detail-20110902 [auth_log] expand: %t -> Fri Sep 2 15:45:08 2011 ++[auth_log] returns ok [linelog] expand: %{Packet-Type} -> Access-Request [linelog] expand: %{%{Packet-Type}:-format} -> Access-Request [linelog] expand: /var/log/freeradius/linelog -> /var/log/freeradius/linelog [linelog] expand: Requested access: %{User-Name} -> Requested access: didier.perroud(a)hefr.ch ++[linelog] returns ok ++? if (User-Name =~ /(.*)@.*hefr.ch$/) ? Evaluating (User-Name =~ /(.*)@.*hefr.ch$/) -> TRUE ++? if (User-Name =~ /(.*)@.*hefr.ch$/) -> TRUE ++- entering if (User-Name =~ /(.*)@.*hefr.ch$/) {...} expand: %{1} -> didier.perroud +++[request] returns ok ++- if (User-Name =~ /(.*)@.*hefr.ch$/) returns ok ++[files] returns noop [ldap] performing user authorization for didier.perroud [ldap] expand: (uid=%{Stripped-User-Name}) -> (uid=didier.perroud) [ldap] expand: ou=courant,ou=people,o=hefr -> ou=courant,ou=people,o=hefr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=courant,ou=people,o=hefr, with filter (uid=didier.perroud) [ldap] Added the eDirectory password ******* in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] hessoRoleMemberKey -> HESSO-MEMBER-KEY == "RORG-HEFR-EIFR-TICO-TLCO-$-RSM" [ldap] hessoRoleMemberKey -> HESSO-MEMBER-KEY == "RORG-MASO-$-RCA" [ldap] hessoRoleMemberKey -> HESSO-MEMBER-KEY == "RACA-TICO-MSEI-MTIC-$-RCA" [ldap] looking for reply items in directory... [ldap] hessoRoleMemberKey -> Class = 0x524f52472d484546522d454946522d5449434f2d544c434f2d242d52534d [ldap] hessoRoleMemberKey -> Class = 0x524f52472d4d41534f2d242d524341 [ldap] hessoRoleMemberKey -> Class = 0x524143412d5449434f2d4d5345492d4d5449432d242d524341 [ldap] user didier.perroud authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop ++? if (NAS-IP-Address =~ /160\.98\.156\..*/) ? Evaluating (NAS-IP-Address =~ /160\.98\.156\..*/) -> TRUE ++? if (NAS-IP-Address =~ /160\.98\.156\..*/) -> TRUE ++- entering if (NAS-IP-Address =~ /160\.98\.156\..*/) {...} +++? if (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR-INTR-INFO-.-RSM/ ) ? Evaluating (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR-INTR-INFO-.-RSM/) -> FALSE +++? if (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR-INTR-INFO-.-RSM/ ) -> FALSE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ ) ? Evaluating (control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/) -> FALSE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ ) -> FALSE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) ? Evaluating (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/) -> TRUE +++? elsif (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) -> TRUE +++- entering elsif (control:HESSO-MEMBER-KEY =~ /RORG-HEFR-EIFR.*RSM$/ ) {...} We can see that it didn't match control:HESSO-MEMBER-KEY =~ /RORG-MASO.*RCA$/ while it has the correct value in the control list. How can I match this multi-valued attribute ? Regards, Olivier B. -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg

3 5