- Freeradius-Users - lists.freeradius.org

CISCO Freeradius Qouta
by Student University 07 Aug '11

07 Aug '11

Hi , Can any one please point me of how i can configure cisco freeradius prepaid billing and download capping . Best Regards ,,, Lily

3 3

Certificate problems? Freeradius 2.1.10 on Debian squeeze
by John Dunning 05 Aug '11

05 Aug '11

Greetings all, We've been running freeradius 1.x on Debian Lenny for some time with great success authenticating against Novell eDirectory/LDAP. Our Linux guru has moved on to exciting new opportunities and while the rest of us are decent at linux we're certainly missing his input here :) We're trying to update the system to Squeeze and move from eDirectory to Active Directory authentication to stay more easily within the debian package scope. I think I largely have the system setup to do EAP-TLS/PEAP/MS-CHAPv2 with Windows 7 supplicant but for some reason I can't seem to get the EAP-TLS tunnel to fire up. I've tried going through http://wiki.freeradius.org/Certificate_Compatibility with the delivered certs (which are evidently supposed to be compatible) but I seem to be missing something. I've got NTLM_AUTH working correctly (once I actually get that far), so I'm hoping that if I can get this cert issue figured out I'll be good to go. Using a Cisco AIR1220 AP and have tried both Windows 7 and android supplicants and get the same problem (see -X log below). Thanks in advance!! JD FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.45.0.11 { require_message_authenticator = no secret = "foobar21" shortname = "4404-mgmt.wsc.edu" } client 10.47.249.248 { require_message_authenticator = no secret = "foobarness" shortname = "WsC_Test" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs/demoCA" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/freeradius/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=AD --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca451c31ca4605d06e0c9d5ff0a7f534 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 8 with timestamp +13 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xca451c31ca4605d0 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2bf8e8132bfbf120b4d5c62002395e36 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 8 with timestamp +18 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2bf8e8132bfbf120 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9188c59f918bdc2d1221f68a8a03e034 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 8 with timestamp +23 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x9188c59f918bdc2d did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc5d30e4fc5d01719fb9e549c1d6ae390 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 8 with timestamp +29 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xc5d30e4fc5d01719 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests.

2 1

Fwd: Authentication failure issue
by fieldpeak 05 Aug '11

05 Aug '11

Hello Friends, I met a issue regarding password/authentication with FreeRadius, Could anybody help for the issue, Thanks! User-Password = "?\210\365@\263\t\306\343\243iT?\311C\t\002" [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user The details in below mails. Regards, Charles Forwarded conversation Subject: Authentication failure issue ------------------------ From: *fieldpeak* <fieldpeak(a)gmail.com> Date: 2011/8/4 To: freeradius-users(a)lists.freeradius.org Dear Friends, I'm trying integrate Freeswitch with Freeradius, I met below issue, can anyone help, thanks in adance. Freeradius server log: rad_recv: Access-Request packet from host 127.0.0.1 port 52684, id=49, length=111 User-Name = "1001" User-Password = "?\210\365@\263\t\306\343\243iT?\311C\t\002" Called-Station-Id = "888" h323-conf-id = "749d2b5a-16ad-48e4-af58- 24011949d1b5" Calling-Station-Id = "1001" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20110803 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20110803 [auth_log] expand: %t -> Wed Aug 3 12:06:33 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1001", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> 1001 [sql] sql_set_user escaped user --> '1001' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1001' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1001' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User 1001 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1001 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 49 to 127.0.0.1 port 52684 Waking up in 4.9 seconds. Cleaning up request 8 ID 49 with timestamp +7674 Ready to process requests. WARNING! No "known good" password found for the user Regards, Charles ---------- From: *fieldpeak* <fieldpeak(a)gmail.com> Date: 2011/8/4 To: freeradius-users(a)lists.freeradius.org Hello Gurus, I've double checked the shared secret on both server and NAS are the same, the problem still exist, it trouble me a few days, can anyone kindly help? nas: /usr/local/etc/radiusclient/servers localhost/localhost testing123 server: /usr/local/etc/raddb/clients.conf secret = testing123

3 7

num_answers_to_alive
by Stefan Winter 05 Aug '11

05 Aug '11

Hi, the configuration of 2.1.10 has the parameter num_answers_to_alive in proxy.conf. Looking at the source code, I found that instead, in realms.c, the config option num_pings_to_alive is used. num_answers is read from the config, but never referenced. If that's the case, then the config option in proxy.conf should be changed to be num_pings_to_alive, otherwise people will likely fail to tweak the value. Speaking of tweaking the value, I also found if (home->num_pings_to_alive < 3) home->num_pings_to_alive = 3; if (home->num_pings_to_alive > 10) home->num_pings_to_alive = 10; The documentation says that 3..10 are *useful* ranges, but doesn't mention that everything else is forbidden. In particular, I would like to use 1, not 3. The idea is: the server was dead before, but now it managed to send a reply back - so it must have been fixed. I would like to mark it alive immediately. Is that unreasonable? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 3

Virtual Servers, the Realms Module, and Proxying
by Jacob Dawson 04 Aug '11

04 Aug '11

Our goal here is to use a variety of virtual servers in our FreeRADIUS instance to allow us to isolate handling of a variety of different sorts of users. As such, there's a fair bit of proxying going on, but much is just going to the virtual servers, and we'd like to be able to use the behavior of the realms module to make this work for us. Unfortunately, I haven't seen any way to get some of those attributes that the Realm module inserts to continue through after being proxied, as they're 'internal' attributes and not wire attributes. I'd like for the Stripped-User-Name and Realm attributes to be available to the far side of the proxy (so I send it from the default virtual server to, say, the generic_realm virtual server), so that it can make decisions based on that information. I obviously can't use the realms module for parsing again in the first layer of virtual server, as I'll just end up creating a loopback on itself, but at the same time, I'd like to avoid having to do all that parsing and thinking in unlang. Since there seems to be some special config for virtual servers, is there any way to achieve this behavior (not stripping the 'internal' attributes when proxying to virtual servers) without a patch? It seems to be consistent with the idea behind virtual servers, but I may be misinterpreting it. Thoughts? I feel like we're trying a little too hard to get what we want, here, but I'm not seeing how to do it the 'right' way. Jacob M. Dawson Network Research Engineer Virginia Tech --- For context: I have an arbitrary number of FreeRADIUS servers providing my AAA service. I have an arbitrary number of NASs all talking to the FreeRADIUS servers, and they all provide the same suite of services to all possible users, so I can't do this proxying based on what client it comes in on (like this page suggests: http://freeradius.org/features/virtual_servers.html) My realm module is short and sweet: realm suffix { format = suffix delimiter = "@" ignore_null = yes } realm prefix { format = prefix delimiter = "\\" } I have the following virtual servers linked in sites-enabled: ad.vt.edu default ed.vt.edu generic-realm proxy-inner-tunnel ad.vt.edu is to handle our Domain users ed.vt.edu is to handle folks authenticating against our Enterprise Directory default is, of course, where they come in to start with generic-realm is intended to handle people who come in with SOME non-vt realm. Could be guests (authenticated against our AAA-related database, access via the sql module), could be eduroam folks. proxy-inner-tunnel is used largely by the ad.vt.edu module to handle proxying the MS-CHAPv2 part of PEAP to our IAS machines. default is simple: authorize { update request{ User-Name := "%{tolower:%{User-Name}}" } preprocess auth_log chap mschap perl suffix prefix eap { ok = return } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } ldap eap } <other stanzas don't seem relevant> In proxy, we defined these home_servers: home_server ed.vt.edu { type = auth ipaddr = 127.0.0.1 port = 1816 secret = <redacted> } home_server ad.vt.edu { type = auth ipaddr = 127.0.0.1 port = 1815 secret = <redacted> } home_server generic_realm { type = auth ipaddr = 127.0.0.1 port = 1817 secret = <redacted> } home_server_pool ad_virtual_pool { home_server = ad.vt.edu } home_server_pool ed_virtual_pool { home_server = ed.vt.edu } home_server_pool generic_virtual_pool { home_server = generic_realm } realm "~HOKIES" { auth_pool = ad_virtual_pool nostrip } realm "DomainUser" { auth_pool = HOKIES_authen nostrip } realm "~.*w2k\\.vt\\.edu$" { auth_pool = ad_virtual_pool nostrip } realm "~vt.edu$" { auth_pool = ed_virtual_pool } realm LOCAL { } realm NULL { auth_pool = ed_virtual_pool } realm DEFAULT { auth_pool = generic_virtual_pool } Our virtual servers then start off like this, and then include the usual appropriate stanzas: listen { ipaddr = 127.0.0.1 port = 1815 type = auth } client 127.0.0.1 { secret = <redacted> }

3 3

Help: There is a way to make radius let all clients autenticate?
by Rodrigo Yoshioka 04 Aug '11

04 Aug '11

Hi Friends, I'd like some help with the following situation:- I have an infraestruture with about 2.000 clients, autenticating on a radius server, which is fed by an third-part CRM. Although the radius is working to autenticating people, it isn´t having the expected performance. Due to that We will change hardware and software, but we have to do this in a produce environment. In order to avoid trouble and get a lot of clients not autenticating, during the process of changes, there is a way to make radius allow all clients autenticate with a default bandwidth and configuration, but not checking MAC or username and password? Thanks

2 1

Forwarding Accounting Packets
by Tonna, Andrew, VF-MT 04 Aug '11

04 Aug '11

Hi I am trying to set up the radius server so that it forwards all accounting packet to a remote radius server without having to wait for reply. I set it up using the copy-acct-to-home-server, proxy.conf and detail files in the modules directory. I've got one problem however, whenever the remote radius server becomes unavailable and then comes back up, my radius server stop forwarding and never marks it as alive again. At this point the remote server is marked as zombie, and remains marked as zombie indefinitely, even when it becomes reachable. I am using FreeRadius 2.1.7 with the following parameters for the home server in the proxy.conf file: response_window = 8 zombie_period = 40 revive_interval = 120 status_check = none With these parameters I'm understanding that if the local radius server doesn't receive an accounting response from the remote server before 8 seconds then it will mark it as a zombie, after a further 40 seconds it should mark it as dead. Then after 120 seconds it should mark it alive again, however I never see it being marked as alive again. Is there something I'm doing wrong? Or an alternate option? Thanks and regards, Andrew ------------------------------------------------------------------------------------- Vodafone ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

4 7

Change my submission
by aceror 04 Aug '11

04 Aug '11

I will like to receive individuals email from this list but how??

3 2

Implementing SQL Insert/logging for SoH.
by Palmer J.D.F. 04 Aug '11

04 Aug '11

Hi, Further to my last foray onto the list regarding SoH, I'm looking to commit the returned SoH info to the radius database using FreeRADIUS' sql connection. I could be well off target here, but please humour me, so far I have... Created a table 'radsoh', and declared this inside sql.conf. Added a query (soh_query) to dialup.conf, at present this simply just inserts User-Name to the table. Declared soh_query in rlm_sql/conf.h Declared soh_query in the 'module_config' section of rlm_sql.c Declared a function, rlm_sql_soh, which is essentially a copy of rlm_sql_postauth into rlm_sql.c. Added rlm_sql_soh to the export section of rlm_sql.c. It compiles and runs, but here is where I run out of ideas. Presuming I'm on the right track, what else is required to enable the query, and how would I make the call to execute the query? Ideally the call should be made from the with SoH virtual server defined in raddb/sites-enabled. Thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

3 7

rml_perl is not adding attributes to Access-accept
by Igor Xpinha 03 Aug '11

03 Aug '11

I'm new to FreeRADIUS and was initially exploring simple things, such as add attributes to an Access-Accept message. My problem is that the perl script is not being able to access (ie print) values from RAD_REQUEST nor add pairs to RAD_REPLY. The following script: *********** start of example.pl script *********** # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA # # Copyright 2002 The FreeRADIUS server project # Copyright 2002 Boian Jordanov <bjordanov(a)orbitel.bg> # # # Example code for use with rlm_perl # # You can use every module that comes with your perl distribution! # # If you are using DBI and do some queries to DB, please be sure to # use the CLONE function to initialize the DBI connection to DB. # use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; # This is hash wich hold original request from radius my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. my %RAD_REPLY; #This is for check items my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { # For debugging purposes only &log_request_attributes; # Here's where your authorization code comes # You can call another function from here: &test_call; return RLM_MODULE_OK; } # Function to handle authenticate sub authenticate { # For debugging purposes only &log_request_attributes; print "***** testing auth\n"; print $RAD_REQUEST{'User-Name'}; print "\n ******\n"; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } # Function to handle preacct sub preacct { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { print "***** accounting\n"; # For debugging purposes only &log_request_attributes; # You can call another subroutine from here &test_call; return RLM_MODULE_OK; } sub accounting_start { print "***** accounting_start\n"; return RLM_MODULE_OK; } sub accounting_stop { print "***** accounting_stop\n"; return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle pre_proxy sub pre_proxy { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_proxy sub post_proxy { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_auth sub post_auth { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here &radiusd::radlog(1, "Auth: RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } *********** end of example.pl script *********** with freeradius -X i get: ****** start of debugging info ****** rlm_perl: Auth: RAD_REQUEST: = rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = XXXXXXXX rlm_perl: Added pair Called-Station-Id = XXXXXXXXXX rlm_perl: Added pair X-Ascend-Send-Auth = Send-Auth-PAP rlm_perl: Added pair Framed-Protocol = GPRS-PDP-Context rlm_perl: Added pair User-Name = XXXXXXXXXXXX rlm_perl: Added pair User-Password = 1z1z1z rlm_perl: Added pair NAS-IP-Address = 192.168.18.1 rlm_perl: Added pair NAS-Port = 60000 rlm_perl: Added pair NAS-Port-Id = GGSN rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok Found Auth-Type = Perl # Executing group from file /etc/freeradius/sites-enabled/default +- entering group Perl {...} ***** testing auth ****** rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = XXXXXXXXX rlm_perl: Added pair Calling-Station-Id = XXXXXXXXXXX rlm_perl: Added pair X-Ascend-Send-Auth = Send-Auth-PAP rlm_perl: Added pair Framed-Protocol = GPRS-PDP-Context rlm_perl: Added pair User-Name = XXXXXXXX rlm_perl: Added pair User-Password = XXXXXXXX rlm_perl: Added pair NAS-Port = 60000 rlm_perl: Added pair NAS-IP-Address = 192.168.18.1 rlm_perl: Added pair NAS-Port-Id = GGSN rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 60 to 192.168.18.1 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 60 with timestamp +9 Ready to process requests. ****** end of debugging info ****** What I was expecting? I was expecting that the Access-Accept would have printed: print "***** testing auth\n"; print $RAD_REQUEST{'User-Name'}; print "\n ******\n"; But, as you see, it only printed: print "***** testing auth\n"; print "\n ******\n"; I was also expecting the Access-Accept to have: $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; But... it didn't happen as you can see. Version of FreeRADIUS: Tue Aug 2 16:55:46 2011 : Info: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Perl version: This is perl, v5.10.1 (*) built for x86_64-linux-gnu-thread-multi PS: I was able with users to add the desired attributes. Thank you for any help and best regards, FishSemXpinha

2 1