- Freeradius-Users - lists.freeradius.org

Trying to wrap my head around FreeRadius config
by Moe, John 21 Jul '11

21 Jul '11

Hello, all Apologies in advance if this isn't the right forum for this, or if it's already been answered somewhere, and my Google-fu just isn't up to the task. Please point me in the right direction if either is the case. I've managed to get a FreeRadius instance up that will authenticate a user's logon into a HP ProCurve switch against our Active Directory using PAP. I'm now trying to get PCs to authenticate to that switch using 802.1x/PEAP-MSCHAPv2. In trying to get this step working, I'm trying to understand how all the various config files and modules all fit together, so that I can understand how to properly setup FreeRadius. I've read through the config files and the Wiki pages, but I'm still not entirely clear that I understand it all, so I'm hoping someone can correct me if I'm on the wrong track. The process below is based on the default install that came with my distro (Gentoo), in case it differs from other distros. The config I'm currently using has been modified from this, of course, but as I'm more interested right now in how it fits together, I figured I'd start with the default config. 1) When a RADIUS request gets received by the server, it first looks up the device in the clients.conf file. If it doesn't exist there, it ignores the request (with a message being logged saying it ignored the request). 2) If it has the client listed in clients.conf, it then runs the request through the sites-enabled/default file. That file seems to say, starting with the authorize section, run it through the preprocess module, then chap, mschap, suffix, eap, unix, files, expiration, logintime and finally, pap. This is where things start to get a bit blurry for me. I understand that the preprocess module is rlm_preprocess, and that the config lives in modules/preprocess, where I can read a description of that module and what it does. Likewise for chap and mschap. However, suffix doesn't appear to be a module; where'd this come from, and what does it do? There also appear to be some modules in /usr/lib64/rlm_* that appear to have neither a man page, nor a config file in the modules directory, nor any sort of description in the Configuration Files section of the Wiki page. 3) The chap, mschap and eap modules seem to all look at the request and decide if the request is using any of these. If so, they add "Auth-Type := <one of them>" to the config item list. The eap module isn't configured under the modules directory, but in the root directory in eap.conf, the others in their respective file in the modules directory. 4) Given the information in the config items, it tries match the request against the unix and files modules, and add/modify config items appropriately. The "files" module is configured by default to read in the entries from the users file, where I should add "DEFAULT" entries to match the various types of authentication and authorization I'm trying to configure. In there, if it matches against any ruleset, it adds the reply items to the request. 5) It then runs the config items against the expiration and logintime modules, which checks the Expiration attribute and some Time attributes for authorization limitations. 6) It finally runs it through the PAP module to see if it's a PAP request, and adds "Auth-Type := PAP" to the config items. Where do the rest of the attributes that get sent with the packet get added to the config item list? Does that happen first? Does that happen later? Or is the incoming request with all its attributes immediately turned into a list of config items? None of the modules listed seem to say they parse the request and add the request's attributes to the config items. After all this, it then runs through the authenticate section of the sites-enable/default file, where it does the user/password checking: 1) It checks to see if the Auth-Type is PAP, CHAP, or MS-CHAP, and then runs them through the appropriate module. 2) It runs the request through the unix module 3) It runs it through the eap module (again, configured in eap.conf) At some point, (I believe in both the authorize and authentication sections, in the eap module), if it finds that a request is using PEAP, it does much the same thing again, but runs the inner "data/packet/encryption/not sure what to call it here" through the sites-enabled/inner-tunnel file, with sections set up similarly to the sites-enabled/default file. Then there are the session and post-auth sections, that I haven't even begun to look into yet; I hope to shortly. I'm skipping the accounting and proxy sections as for the moment, I'm just trying to get RADIUS authentication and authorization working, no accounting or proxying happening. Any assistance would be appreciated. John H. Moe Network Support - Hatch IT HATCH Tel: +61 (7) 3166 7777 Direct: +61 (7) 3166 7684 Fax: +61 (7) 3368 3754 Mobile: +61 438 772 425 61 Petrie Terrace, Brisbane, Queensland Australia 4011 ***************************** NOTICE - This message from Hatch is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential or proprietary. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. By communicating with us via e-mail, you accept such risks.� When addressed to our clients, any information, drawings, opinions or advice (collectively, "information") contained in this e-mail is subject to the terms and conditions expressed in the governing agreements.� Where no such agreement exists, the recipient shall neither rely upon nor disclose to others, such information without our written consent.� Unless otherwise agreed, we do not assume any liability with respect to the accuracy or completeness of the information set out in this e-mail.� If you have received this message in error, please notify us immediately by return e-mail and destroy and delete the message from your computer.

6 15

FreeRadius - LDAP
by m4xmr 21 Jul '11

21 Jul '11

Hello, I'm trying to make working LDAP as authentication backend for RADIUS. I verified that the data are right and the query to LDAP is properly working if I use ldapsearch. I experience this "rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=78, length=20" when I try from radtest ... This is the output of radiusd in debug-mode: rad_recv: Access-Request packet from host 127.0.0.1:59221, id=78, length=60 User-Name = "ldapuser" User-Password = "121212" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser radius_xlat: '(uid=ldapuser)' radius_xlat: 'dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=ldapuser) rlm_ldap: Added password 121212 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user ldapuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "ldapuser" with password "121212" rlm_ldap: user DN: uid=ldapuser,ou=People,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=ldapuser,ou=People,dc=example,dc=com/121212 to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 2 modcall: leaving group LDAP (returns reject) for request 2 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [ldapuser] (from client localhost port 2) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... I hope, someone could help me... I'm totally in stuck. Regards, Max -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-LDAP-tp4615085p4615085.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

TTLS use_tunneled_reply and Mac OSX
by Scott Armitage 20 Jul '11

20 Jul '11

Hi, I have noticed that when authenticating using TTLS/MSCHAPv2 that the outer-identity is used in the RADIUS reply packet even if the use_tunneled_reply is set to yes for TTLS in eap.conf Does anyone know the reason for this? Thanks Scott Armitage

3 6

Problem with module and users file
by Jean Carlos Oliveira Guandalini 20 Jul '11

20 Jul '11

Hello, i'm using backcounter (rlm_backcounter) module. This module set a attribute and this attribute is compared in USERS file. Freeradius version 2.1.11. users file: DEFAULT Monthly-Time-Exceeded == 1 Framed-Pool = "exceeded", Fall-Through = Yes The problem is what the freeradius never match with this entry in users file. In the source code of rlm_backcounter this lines are used to create a attribute: vp = radius_paircreate(request, &request->reply->vps, data->overvap_attr, PW_TYPE_INTEGER); vp->vp_integer = 1; The module is running, see the logs: Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#615) backcounter_authorize(): resetting user 'prepago' counter Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#653) backcounter_authorize(): using resetval defined in radreply: 0 Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#780) backcounter_authorize(): user prepago is over limit - adding 'Monthly-Time-Exceeded' attribute Wed Jul 20 11:06:26 2011 : Debug: rlm_backcounter/time-limit: (rlm_backcounter.c#788) backcounter_authorize(): data->overvap_attr = 3102 Wed Jul 20 11:06:26 2011 : Debug: rlm_sql (sql): Released sql socket id: 1 Wed Jul 20 11:06:26 2011 : Info: ++[time-limit] returns ok Wed Jul 20 11:06:26 2011 : Info: [files] users: Matched entry DEFAULT at line 144 Wed Jul 20 11:06:26 2011 : Info: ++[files] returns ok Is there some setting that needs to be made to accept this attribute? *** I used this module with freeradius-1.1.8 without problems, but we need running in freeradius-2.x Thanks Jean

1 0

Freeradius error with eap authentication
by DENJEAN Didier 20 Jul '11

20 Jul '11

Hi, I have some problems with Freeradius and EAP I use freeradius version 2.1.11 on debian 5 When I start the radius server in debug mode (radiusd -xX), there are no error (file debug1.txt) When eduroam server enable connexion on your freeradius server, I have some errors (file debug2.txt) Could you help me? Best regards Didier Denjean Administrateur Systèmes et Réseaux AMUE Montpellier 34 rue Henri Nogueres 34090 MONTPELLIER 04 99 77 30 11

2 1

freeradius 2.1.11 crashes on reload/HUP
by Gary T. Giesen 18 Jul '11

18 Jul '11

Since I upgraded to 2.1.11, freeradius is crashing occasionally on HUP/reload. It's really strange, it doesn't happen every time, and when it does happen, it takes like 5-10 minutes after the process is reloaded before it happens. I've tried to get core dumps, but have been unsuccessful. Can someone give me some pointers on how to troubleshoot this issue? Thanks, GG

2 2

Duplicate virtual server "xxx" always hits on HUP
by Bjørn Mork 18 Jul '11

18 Jul '11

After upgrading to 2.1.11 I've noticed that I always get a "Duplicate virtual server" error when HUPing the server. This is obviously a result of the change in commit 5a710e98 but I have no idea how to fix it. Steps to recreate from a fresh and default FreeRADIUS 2.1.11 installation: 1) start the server with default configuration 2) kill -HUP <pid> The server will complain about one of the virtual servers being a duplicate, listing the exact same config line for both defintions: Duplicate virtual server "inner-tunnel" in file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 and file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 This will always be the "inner-tunnel" virtual server with the default configuration. I guess that's a result of the name hashing. Full debug output from "radiusd -X" follows below Bjørn FreeRADIUS Version 2.1.11, for host x86_64-unknown-linux-gnu, built on Jun 30 2011 at 09:09:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/proxy.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/clients.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/linelog including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/perl including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/echo including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/policy including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/passwd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/counter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pam including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/checkval including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/redis including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ldap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/replicate including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ippool including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/always including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/soh including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/cui including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/wimax including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/otp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/policy.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/huntgroups" hints = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/users" acctusersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 61812 } listen { type = "acct" ipaddr = * port = 61813 } listen { type = "control" listen { socket = "/usr/local/tmp/fr-20110630/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 45444 Listening on authentication address * port 61812 Listening on accounting address * port 61813 Listening on command file /usr/local/tmp/fr-20110630/usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 61814 Ready to process requests. Ready to process requests. Received HUP signal. HUP - Re-reading configuration files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/proxy.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/clients.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/realm including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/logintime including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/exec including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/linelog including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/perl including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/echo including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/files including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/policy including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/passwd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expr including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/unix including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/counter including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/pam including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/checkval including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/redis including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/chap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ldap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/replicate including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/detail including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/ippool including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/always including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/soh including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/cui including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/expiration including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/mschap including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/digest including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/wimax including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/modules/otp including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/eap.conf including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/policy.conf including files in directory /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/default HUP - loading modules Module: Trying to reload module "pap" pap { encryption_scheme = "auto" auto_header = no } Module: Reloaded module "pap" Module: Trying to reload module "suffix" realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Reloaded module "suffix" Module: Trying to reload module "files" files { usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/users" acctusersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Reloaded module "files" Module: Trying to reload module "attr_filter.access_reject" attr_filter attr_filter.access_reject { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } Module: Reloaded module "attr_filter.access_reject" Module: Trying to reload module "attr_filter.accounting_response" attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/tmp/fr-20110630/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Reloaded module "attr_filter.accounting_response" Module: Trying to reload module "radutmp" radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Reloaded module "radutmp" Module: Trying to reload module "detail" detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Reloaded module "detail" Module: Trying to reload module "mschap" mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Reloaded module "mschap" radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server Duplicate virtual server "inner-tunnel" in file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 and file /usr/local/tmp/fr-20110630/usr/local/etc/raddb/sites-enabled/inner-tunnel:11 Ready to process requests.

3 7

"radiusd -X" read my sql database but not "freeradius -X"
by schnoocats 18 Jul '11

18 Jul '11

Hello everybody, as part of my studies I try to set up a radius server with a mysql database. I have a wifi access point defined as a client (172.16.140.87) in a NAS table inside my radius database. Everything works perfectly when i test with the tool "radiusd -X" ! But when i use the tool "freeradius -X" it does not connect to the database, so it will not read the client and therefore I 'have a great "Ignoring request to authentication address * port 1812 from 172.16.140.87 port 59129 unknown customer." when i test. What the differences between this 2 tools ? What can i do for solve my problem because by default the daemon is freeradius and it ignores my requests... Greetings -- View this message in context: http://freeradius.1045715.n5.nabble.com/radiusd-X-read-my-sql-database-but-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 10

LDAP Not working properly
by vijaysingh 18 Jul '11

18 Jul '11

Hi, I am new user and using Freeradius first time. I have followed http://www.perkinsblog.net/blog/index.php/2010/02/freeradius-and-windows-ad/ I want to authenticate freeradius with my active directory. I want to assign Prev level 15 to Active directory user who are member of group CiscoAdmin and prev level 1 to member of CiscoOpetator. Freeradius is able to authenticate individual active directoty user, but when I configure LDAP group in users file it is not working. Logs are afollowing :- rad_recv: Access-Request packet from host 172.17.3.210 port 1645, id=177, length=82 NAS-IP-Address = 172.17.3.210 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "vijay.singh" Calling-Station-Id = "172.17.27.9" User-Password = "Password" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "vijay.singh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [files] expand: OU=Servers,dc=kochar,dc=com -> OU=Servers,dc=kochar,dc=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> vijay.singh [files] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=vijay.singh)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.17.3.223:389, authentication 0 [ldap] bind as CN=ADS Admin,OU=Servers,DC=kochar,DC=com/Password to 172.17.3.223:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in OU=Servers,dc=kochar,dc=com, with filter (&(sAMAccountName=vijay.singh)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=group)(member=%Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in OU=Servers,dc=kochar,dc=com, with filter (&(cn=CiscoAdminLr)(|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=Vijay Singh,OU=Servers,DC=kochar,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for vijay.singh [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> vijay.singh [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=vijay.singh)) [ldap] expand: OU=Servers,dc=kochar,dc=com -> OU=Servers,dc=kochar,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in OU=Servers,dc=kochar,dc=com, with filter (&(sAMAccountName=vijay.singh)) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user vijay.singh authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "vijay.singh" with password "Password" [ldap] user DN: CN=Vijay Singh,OU=Servers,DC=kochar,DC=com [ldap] (re)connect to 172.17.3.223:389, authentication 1 [ldap] bind as CN=Vijay Singh,OU=Servers,DC=kochar,DC=com/Password to 172.17.3.223:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user vijay.singh authenticated succesfully ++[ldap] returns ok expand: Host %n% -> Host 172.17.3.210% Login OK: [vijay.singh] (from client Kipl Asr Network port 1 cli 172.17.27.9) Host 172.17.3.210% # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 177 to 172.17.3.210 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +12 Ready to process requests. Can anyone help to get autheticattion working with active directory group? -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-Not-working-properly-tp4593327… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

vlan ldap radiusd
by Serge van Namen 18 Jul '11

18 Jul '11

Hi, I'm working on a proof-of-concept for 802.1x and dynamic vlan's on switches. All this works perfectly with user@realm, but now I want to read the vlan ID from a ldap attribute and then send the radius request with that value in "Tunnel-Private-Group-ID". Can anyone give me a bump in the right direction? Yours, Serge

3 9