- Freeradius-Users - lists.freeradius.org

MySQL Fail Over Error When 1 DB is Down
by Det Det 30 Aug '11

30 Aug '11

Hi there, I can't get FreeRADIUS to ignore error and continue processing when 1 DB is down even when it can connect to the other DB. Below is my config. # radiusd.conf instantiate { ... redundant redundant_sql { sql1 sql2 handled } } modules { ... $INCLUDE sql1.conf $INCLUDE sql2.conf } # sql1.conf sql sql1 { database = "mysql" … } # sql2.conf sql sql2 { ... database = "mysql" } # sites-enabled/default authorize { redundant_sql } accounting { redundant_sql } session { redundant_sql } post-auth { redundant_sql Post-Auth-Type REJECT { redundant_sql attr_filter.access_reject } } bregards, det

4 7

Re: Delivery Delayed: Re: Delivery Delayed: Access-Reject in freeradius
by saeed1803 29 Aug '11

29 Aug '11

Alan DeKok wrote: >The last few lines contain a *CLEAR* description of the problem, and >how to solve it. i can not find the problem and how to solve it (im very amateur)...... Please refer me to main line Sameh Attia wrote: >I believe that you placed it after the DEFAULT section. Move it above DEFAULT and test again. i moved test Cleartext-Password := "test" above DEFAULT and test again, but not solve problem Aceror wrote: >Hi!! >check this out! >http://www.chillispot.info/FAQ.html#mozTocId608628 hi i cant find pptp-conntrack-nat patch for debian squeeze thanks a lot my friends On Mon, Aug 29, 2011 at 8:37 PM, <postmaster(a)eci.local> wrote: > *Delivery is delayed to these recipients or distribution lists:* > > tim(a)velociter.net > > Subject: Re: Delivery Delayed: Access-Reject in freeradius > > This message has not yet been delivered. Microsoft Exchange will continue > to try delivering the message on your behalf. > > Delivery of this message will be attempted until 8/31/2011 5:05:40 AM > (GMT-08:00) Pacific Time (US & Canada). Microsoft Exchange will notify you > if the message can't be delivered by that time. > ------------------------------ > Sent by Microsoft Exchange Server 2007 > > Original-Recipient: rfc822;tim(a)eci.local > Final-Recipient: rfc822;tim(a)velociter.net > Action: delayed > Status: 4.4.7 > Diagnostic-Code: smtp;400 4.4.7 Message delayed > Will-Retry-Until: Wed, 31 Aug 2011 05:05:40 -0700 > > >

1 0

Realm parsing and \r => =0D
by Rich Graves 29 Aug '11

29 Aug '11

I've got freeradius-2.1.10-5.el6.x86_64 on fully patched RHEL6.1. PEAP+MSCHAPv2 for wireless 802.1x, intending to federate with eduroam. Within a day, I had the configuration I wanted, or so I thought. Empty stanzas for realms user(a)carleton.edu, ADS\user, and bare username get authenticated with mschapv2. Otherwise, regex realm *(a)*.* gets routed to the eduroam upstream radius hierarchy. I configured bufffered-sql for logging. It all "works." Except... I noticed that my entries appeared in SQL-land as ADS=0Dgraves. So, it seems that the ADS\ realm is recognized (successfully authenticated locally, not sent to eduroam), but not stripped. Worse, the \r in ADS\rgraves is interpreted as a carriage return by the time it gets to SQL-User-Name. I guess my conclusion is that I am very confused about where realms get configured, and which entries in the example config files are examples and which are metareferences to other code. Is the "realm ntdomain" that appears in modules/realm, with a commented-out reference in sites-available/default, an example of handling an example NT Domain named "ntdomain," or is it a directive analogous to format = suffix? I was sure of the former, but am less sure now. "suffix" is overloaded as both a format type and as a example realm that happens to be of type suffix, right? I'm pretty sure that I need ADS, carleton.edu, and null to be recognized in proxy.conf, to distinguish what goes to inner-tunnel from what does to eduroam upstream; and I am pretty sure that I need carleton.edu stripped in or before inner-tunnel. MSCHAPv2 will accept both ADS\username and username, so it's not critical to strip the former. However, it seems critical that ADS\ be stripped or more thoroughly escaped before or during transformation of sql_user_name to SQL-User-Name, because rendering ADS\rgraves as ADS=0Dgraves is just wrong. I am also very confused about whether and where I want "ignore-null = yes." It's mentioned in the shipped modules/realms but not in proxy.conf. The realm stanzas I have thus far are below. inner-tunnel, default, and buffered-sql are pretty much as shipped, except for the obvious DB configuration. realm ADS { format = prefix delimiter = '\\' accthost = LOCAL authhost = LOCAL } realm carleton.edu { format = suffix delimiter = "@" accthost = LOCAL authhost = LOCAL } realm "~.*\\..*" { { format = suffix delimiter = "@" accthost = eduroam1.ns.utk.edu authhost = eduroam1.ns.utk.edu secret = notpostedhere nostrip } # This could probably just be realm NULL realm DEFAULT { type = radius accthost = LOCAL authhost = LOCAL } At the point where I realized I was turning things on and off just to see if radiusd -X would run, I decided that I should stick with clear, simple things like sendmail.cf, and ask for pointers. -- Rich Graves http://claimid.com/rcgraves Carleton.edu Sr UNIX and Security Admin CMC135: 507-222-7079 Cell: 952-292-6529

3 4

Access-Reject in freeradius
by saeed1803 29 Aug '11

29 Aug '11

I hope you can help. I am having some problems running with Radius Authentication. The radius server is running on a debian server. I have added some users: test Cleartext-Password := "test" i can do radtest and ntrping test and it is successful but my user cannot connect with vpn connection and receive error 691. Is this the problem and if so how might i fix it? Any help is greatly appreciated saeed FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "testnet" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 36827, id=186, length=66 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" Calling-Station-Id = "192.168.56.101" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 186 to 127.0.0.1 port 36827 Waking up in 4.9 seconds. Cleaning up request 0 ID 186 with timestamp +182 Ready to process requests.

4 6

Freeradius proxy - Fortigate - Cisco ACS
by Ole Bobakke 29 Aug '11

29 Aug '11

Hi. We have this setup today. Fortigate FW - running SSL vpn portal, users are authenticated towards a Cisco ACS radius server. We only use one vdom ( virtual firewall) but we have a plan to create a portal to every co companies. So I created two new vdom on the fortigate called, : ompa and tampa and gave them ssl portal. - https://ompa.corp.com and https://tampa.corp.com Both of them use the Cisco ACS to authenticate users, so at this point the same username can login to both SSL portals, this is no good :-( Then I tried to add a fortigate VSA to the Cisco ACS server, so when user pet(a)ompa.corp.com login to https://tampa.corp.com , ACS server retun "Fortinet-Vdom-Name = ompa" to the fortigate, and I was looking forward to see the ompa portal but i got tampa. So Fortigate just ignore the VSA from the ACS . Fortigate radius impementation seems to be braindead :-( I did some sniffing, and it seems that *fortigate* return Fortinet-Vdom-Name= ompa when you use https://ompa.corp.com, and Fortinet-Vdom-Name= tampa when you use https://tampa.corp.com. So we need to have some checking on the radiusserver, to verify user realm vs what fortigate retuns. Cisco ACS server doesn't support this type of checking. Now I have installed a freeradius and it does proxy towards the ACS from Fortigate FW, but I need some help to configure this checking, could rlm do this stuff? if user pet(a)ompa.corp.com login to tampa, and Fortigate return Fortinet-Vdom-Name= tampa it should *not* get access, but if it retun Fortinet-Vdom-Name= ompa it should get access. Ole

2 3

Re: Delivery Delayed: Access-Reject in freeradius
by saeed1803 29 Aug '11

29 Aug '11

Alan DeKok wrote: > Where? In which part of the "users" file. yes > Read the debug log you posted. The answer is there. I'm amateur, so I can not understand debug log. Please explain to me. thanks a lot On Mon, Aug 29, 2011 at 4:07 PM, <postmaster(a)eci.local> wrote: > *Delivery is delayed to these recipients or distribution lists:* > > tim(a)velociter.net > > Subject: Access-Reject in freeradius > > This message has not yet been delivered. Microsoft Exchange will continue > to try delivering the message on your behalf. > > Delivery of this message will be attempted until 8/31/2011 12:32:15 AM > (GMT-08:00) Pacific Time (US & Canada). Microsoft Exchange will notify you > if the message can't be delivered by that time. > ------------------------------ > Sent by Microsoft Exchange Server 2007 > > Original-Recipient: rfc822;tim(a)eci.local > Final-Recipient: rfc822;tim(a)velociter.net > Action: delayed > Status: 4.4.7 > Diagnostic-Code: smtp;400 4.4.7 Message delayed > Will-Retry-Until: Wed, 31 Aug 2011 00:32:15 -0700 > > >

1 0

Mac OXS Server version of FreeRadius Error
by DavidS 29 Aug '11

29 Aug '11

Hi All I hope you can help. I am having some problems running with Radius Authentication. The radius server is running on a Mac OSX server (ie a version of Freeradius I believe). I have a cisco Acess Point (1250 series) and want to use the Radius server to Authenticate EAP for WiFI users. I have added some users dsaw Cleartext-Password := "XXXXX" test Cleartext-Password := "test" And Clients (as shown in full listing below) However while users can Authenticate with LEAP no other EAP version Authenticates The Mac OSX Server terminal output to radiusd -s -X ends with Failed binding to socket: Address already in use /private/etc/raddb/radiusd.conf[242]: Error binding to port for 0.0.0.0 port 1812 Is this the problem and if so how might i fix it? Any help is greatly appreciated David server10:~ root# radiusd -s -X FreeRADIUS Version 2.1.3, for host i386-apple-darwin10.0, built on Apr 11 2011 at 17:19:07 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /private/etc/raddb/radiusd.conf including configuration file /private/etc/raddb/proxy.conf including configuration file /private/etc/raddb/clients.conf including files in directory /private/etc/raddb/modules/ including configuration file /private/etc/raddb/modules/acct_unique including configuration file /private/etc/raddb/modules/always including configuration file /private/etc/raddb/modules/attr_filter including configuration file /private/etc/raddb/modules/attr_rewrite including configuration file /private/etc/raddb/modules/chap including configuration file /private/etc/raddb/modules/checkval including configuration file /private/etc/raddb/modules/counter including configuration file /private/etc/raddb/modules/detail including configuration file /private/etc/raddb/modules/detail.example.com including configuration file /private/etc/raddb/modules/detail.log including configuration file /private/etc/raddb/modules/digest including configuration file /private/etc/raddb/modules/echo including configuration file /private/etc/raddb/modules/etc_group including configuration file /private/etc/raddb/modules/exec including configuration file /private/etc/raddb/modules/expiration including configuration file /private/etc/raddb/modules/expr including configuration file /private/etc/raddb/modules/files including configuration file /private/etc/raddb/modules/inner-eap including configuration file /private/etc/raddb/modules/ippool including configuration file /private/etc/raddb/modules/krb5 including configuration file /private/etc/raddb/modules/ldap including configuration file /private/etc/raddb/modules/linelog including configuration file /private/etc/raddb/modules/logintime including configuration file /private/etc/raddb/modules/mac2ip including configuration file /private/etc/raddb/modules/mac2vlan including configuration file /private/etc/raddb/modules/mschap including configuration file /private/etc/raddb/modules/opendirectory including configuration file /private/etc/raddb/modules/pam including configuration file /private/etc/raddb/modules/pap including configuration file /private/etc/raddb/modules/passwd including configuration file /private/etc/raddb/modules/perl including configuration file /private/etc/raddb/modules/policy including configuration file /private/etc/raddb/modules/preprocess including configuration file /private/etc/raddb/modules/radutmp including configuration file /private/etc/raddb/modules/realm including configuration file /private/etc/raddb/modules/smbpasswd including configuration file /private/etc/raddb/modules/sql_log including configuration file /private/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /private/etc/raddb/modules/sradutmp including configuration file /private/etc/raddb/modules/unix including configuration file /private/etc/raddb/modules/wimax including configuration file /private/etc/raddb/eap.conf including configuration file /private/etc/raddb/sql.conf including configuration file /private/etc/raddb/sql/sqlite/dialup.conf including configuration file /private/etc/raddb/sql/mysql/counter.conf including configuration file /private/etc/raddb/policy.conf including files in directory /private/etc/raddb/sites-enabled/ including configuration file /private/etc/raddb/sites-enabled/default including configuration file /private/etc/raddb/sites-enabled/inner-tunnel including dictionary file /private/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/private/var" logdir = "/private/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/private/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/private/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client ap1250 { ipaddr = 192.168.0.98 netmask = 32 require_message_authenticator = no secret = "TEST" shortname = "ap1250" nastype = "cisco" } client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localtest" login = "test" password = "test" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_sqlite" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/private/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 0 rlm_sql_sqlite: sqlite3_step = 101 rlm_sql_sqlite: sqlite3_finalize() = 0 rlm_sql (sql): Released sql socket id: 4 } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" use_open_directory = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/private/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.key.pem" certificate_file = "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.cert.pem" CA_file = "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.chain.pem" private_key_password = "Apple:UseCertAdmin" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/private/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } rlm_eap: Getting private key passphrase using command "/usr/sbin/certadmin --get-private-key-passphrase "/etc/certificates/eo11.net.32F996A897D33C23D8C652B022E96A44E350F98A.key.pem"" rlm_eap: Password from command = "DD562BC8-164C-4A2F-86F4-8F9AC4EBCB16" Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/private/etc/raddb/users" acctusersfile = "/private/etc/raddb/acct_users" preproxy_usersfile = "/private/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/private/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/private/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_opendirectory Module: Instantiating opendirectory Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/private/etc/raddb/huntgroups" hints = "/private/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/private/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/private/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to socket: Address already in use /private/etc/raddb/radiusd.conf[242]: Error binding to port for 0.0.0.0 port 1812 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Mac-OXS-Server-version-of-FreeRadiu… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

radmin del client error
by tohaikmeng 29 Aug '11

29 Aug '11

Hello, I tried using radmin to delete a client that was added dynamically via "add client file alex.conf". alex.conf contains the following content. client 192.168.168.111 { secret = secret } however, i experience the following error. Can you show me the correct del command for this? radmin> show client list 192.168.169.86 192.168.169.74 192.168.169.123 192.168.168.111 radmin> del client ipaddr 192.168.168.111 ERROR: Must specify <ipaddr> radmin> del client ipaddr <ipaddr> 192.168.168.111 ERROR: Client 192.168.168.111 was not dynamically defined. Your help is greatly appreciated. -- View this message in context: http://freeradius.1045715.n5.nabble.com/radmin-del-client-error-tp4725176p4… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 38

Delegated-IPv6-Prefix
by Dmitry Kozlov 28 Aug '11

28 Aug '11

Hello. I'm trying to include Delegated-IPv6-Prefix attribute to reply, here is contents of radreply table: id | username | attribute | op | value ----+----------+-----------------------+----+------------------------------------------------------------------------------------------------------------------------ 19 | test | Delegated-IPv6-Prefix | = | fc00:1:2:2::/64 But it rejects Access-Request and writes to log: rlm_sql: Failed to create the pair: Invalid octet string "fc00:1:2:2::/64" for attribute name "Delegated-IPv6-Prefix" By the way it successfully replies with Framed-IPv6-Prefix which is ipv6prefix type too. So how can I pass Delegated-IPv6-Prefix ?

2 2

Re: Time and traffic limits
by Dmitry Kozlov 28 Aug '11

28 Aug '11

Hi! >rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" freeradius doesn't now such attribute, if you want to limit maximum session time use Session-Timeout attribute for it.

1 0