- Freeradius-Users - lists.freeradius.org

LDAP authentication failed
by snowman5840 22 Oct '10

22 Oct '10

Hi i have some problems with LDAP authentication. If I login on my windows xp sp3 client i want to check die login credentials against my LDAP service. But the xp client uses doubleslashs in the username!! I think this will be the problem!? If I test with radtest it works. What can i do to succecsful login? Debug log: rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=62, length=240 NAS-IP-Address = 192.168.0.2 NAS-Port = 50009 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C9" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xc5fe953bc3f98c0b9575e677705364e2 EAP-Message = 0x0207006119001703010056b327be51594f6985d1854f17199fefe7151d57481c244787051f7067a50a0056a15e0a831a3aa3661a61aeed66e3c7dc85cd3315301bfd825c786fd60e0110f5124e76e2d543c9a6fd99371be7f1a9637b8ce527669f Message-Authenticator = 0xad6e1b5107c7af4b9a5ba3e648d65859 +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "FIRMA1\usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for FIRMA1\usera [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> FIRMA1\5cusera [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=FIRMA1\5cusera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=FIRMA1\5cusera) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound Configuration part of LDAP module: ldap { server = "192.168.0.5" identity = "cn=admin,dc=firma1,dc=de" password = "xxxx" basedn = "dc=firma1,dc=de" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ...... } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp321786… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Activate LDAP group membership checking
by mic nightic 22 Oct '10

22 Oct '10

Hi, I'm trying to activate the LDAP group membership checking in FreeRadius. In my radiusd.conf i've modified the group checking section: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = ou By looking in my openldap logs, freeradius is not even trying to search for the group. Do i have to activate something else to enable group checking? Thank you

2 2

How to raise numbers of request/sec in Freeradius
by Robin 22 Oct '10

22 Oct '10

Hi, I use Freeradius2 to authenticate user login. I use the tools of Evolynx Radius Load Test to test number of request by second. I find only max 20-25 requests/sec in Freeradius. Can I raise the number via editing configuration files? Thanks. Robin Lu

2 1

freeradius with NTLM authentication
by Ramzi Abdallah 22 Oct '10

22 Oct '10

I have configured freeradius version 2.1.9 with mySQL backend and Active Directory integration (NTLM) for the purpose of using it to authenticate users against firewall protected policies. So far it’s all working. When a user hits a firewall protected policy he is prompted to authenticate after which the radius query the AD for the username and password. If the user credentials are correct access is granted. The bit that I cannot figure out is how to let the Radius use NTLM to check if the user is already logged in the domain controller and if so not to prompt him for his username and password via the firewall captive portal. Is that doable or I missed the idea behind the Active Directory integration? thank you Ramzi

2 3

cisco log entry
by MONTFORD, AUSTIN 22 Oct '10

22 Oct '10

What does this error mean on a cisco switch? I only get it on a certain model of switch with a certain ios image (a newer image doesn't give the error). It happens when the configuration is saved. Oct 18 16:40:21.365 EDT: %PARSER-3-BADSUBCMD: Unrecognized subcommand 32 in sg-radius command 'load-balance' I'm going to upgrade the ios on the last few switches soon so probably won't see the error again, but I'm just curious if it's something I should care about. This is with 2 Ubuntu Lucid servers using FreeRADIUS version 2.1.8. I used the "per user privilege level" user example and the "Config Sample #1" cisco device example from http://wiki.freeradius.org/Cisco (which was VERY helpful).

2 1

IPv6 Ascend Data Filter
by janardhan madabattula 21 Oct '10

21 Oct '10

Hi, I am trying to create IPv6 Ascend Data Filter in Free radius. but unfortunately its not happening. Any help? I have created Ascend-Data-Filter 242 abinary attribute in dictinary filter. Following is the record I am trying to parse. ======== ipv6 Password := test Service-Type = Framed-User, Framed-IP-Netmask = 255.255.255.255, Framed-Protocol = PPP, Session-Timeout = 86400, Idle-Timeout = 36000, Framed-IP-Address = 115.2.255.253, Framed-IPv6-Prefix = 3001:1:2:ffff::/64, Delegated-IPv6-Prefix = 6001:1:2:ffff::/64, Ascend-Data-Filter = "03000000300182ab102087ec0000000000000000200182ab102087ec12340917341500124080110000000C1200020000", =========== I am following this URL to create ADF. http://www.juniper.net/techpubs/software/erx/junose100/sw-rn-erx1001/html/s… Thanks, Jana

2 2

Freeradius + Active Directory
by Rashard Roberts 21 Oct '10

21 Oct '10

Hello I am trying to get Freeradius to authenticate end-user using Active Directory. The end-user will be using be there AD username and password to login to network devices. Would some please help me? I have embedded a copy of the debug log from the radius server. rad_recv: Access-Request packet from host 192.168.168.252:1645, id=94, length=92 User-Name = "svc-ldap-01@corp-test" User-Password = "WindowsXP!" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.168.252 NAS-Port = 10 Calling-Station-Id = "192.168.168.194" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "corp-test" for User-Name = "svc-ldap-01@corp-test" rlm_realm: No such realm "corp-test" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 94 to 192.168.168.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 94 with timestamp 4cbf5aee Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.168.252:1645, id=95, length=104 User-Name = "svc-ldap-01(a)corp-test.weather.com" User-Password = "WindowsXP!" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.168.252 NAS-Port = 10 Calling-Station-Id = "192.168.168.194" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "corp-test.weather.com" for User-Name = " svc-ldap-01(a)corp-test.weather.com" rlm_realm: No such realm "corp-test.weather.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 95 to 192.168.168.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 95 with timestamp 4cbf5b25 Nothing to do. Sleeping until we see a request.

4 7

802.1x host/machine authentication
by Chidanand Gangur 21 Oct '10

21 Oct '10

Hi, I have following setup where windows host is connected to Cisco 2960 which is connected to Microsoft AD via RADIUS proxy Windows host (XP SP3) -> Cisco 2960 -> freeRADIUS proxy (2.1.10) -> Microsoft AD (2003) In the above setup user authentication goes fine. I am using PEAP v1 authentication. I am struggling hard to make host authentication successful. When the machine boots I see radius Access-Request with User-Name = "host/ radhost1.testad1.com" which qualifies to IPASS type realm and searches for realm as "host" and things do not work. Please point me to links/docs or give me pointer where/how to start. rad_recv: Access-Request packet from host 192.168.6.200 port 1645, id=141, length=165 User-Name = "host/radhost1.testad1.com" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-21-D7-00-51-89" Calling-Station-Id = "00-13-20-38-33-27" EAP-Message = 0x021a001e01686f73742f726164686f7374312e746573746164312e636f6d Message-Authenticator = 0x2deded3294b409a59441b3e5777a9a87 NAS-Port-Type = Ethernet NAS-Port = 50009 NAS-IP-Address = 192.168.6.200 Wed Oct 20 07:27:48 2010 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Oct 20 07:27:48 2010 : Info: +- entering group authorize {...} Wed Oct 20 07:27:48 2010 : Info: ++[preprocess] returns ok Wed Oct 20 07:27:48 2010 : Info: ++[chap] returns noop Wed Oct 20 07:27:48 2010 : Info: ++[mschap] returns noop Wed Oct 20 07:27:48 2010 : Info: [IPASS] Looking up realm "host" for User-Name = "host/radhost1.testad1.com" Wed Oct 20 07:27:48 2010 : Info: [IPASS] Found realm "DEFAULT" Wed Oct 20 07:27:48 2010 : Info: [IPASS] Adding Stripped-User-Name = " radhost1.testad1.com" Wed Oct 20 07:27:48 2010 : Info: [IPASS] Adding Realm = "DEFAULT" Wed Oct 20 07:27:48 2010 : Info: [IPASS] Authentication realm is LOCAL. Wed Oct 20 07:27:48 2010 : Info: ++[IPASS] returns ok Wed Oct 20 07:27:48 2010 : Info: [suffix] Request already proxied. Ignoring. Wed Oct 20 07:27:48 2010 : Info: ++[suffix] returns ok Wed Oct 20 07:27:48 2010 : Info: [ntdomain] Request already proxied. Ignoring. Wed Oct 20 07:27:48 2010 : Info: ++[ntdomain] returns ok Wed Oct 20 07:27:48 2010 : Info: [realmpercent] Request already proxied. Ignoring. Wed Oct 20 07:27:48 2010 : Info: ++[realmpercent] returns ok Wed Oct 20 07:27:48 2010 : Info: [eap] EAP packet type response id 26 length 30 Wed Oct 20 07:27:48 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Oct 20 07:27:48 2010 : Info: ++[eap] returns updated Wed Oct 20 07:27:48 2010 : Info: ++[unix] returns notfound Wed Oct 20 07:27:48 2010 : Info: ++[files] returns noop Wed Oct 20 07:27:48 2010 : Info: ++[expiration] returns noop Wed Oct 20 07:27:48 2010 : Info: ++[logintime] returns noop Wed Oct 20 07:27:48 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Oct 20 07:27:48 2010 : Info: ++[pap] returns noop Wed Oct 20 07:27:48 2010 : Info: Found Auth-Type = EAP Wed Oct 20 07:27:48 2010 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Oct 20 07:27:48 2010 : Info: +- entering group authenticate {...} Wed Oct 20 07:27:48 2010 : Info: [eap] EAP Identity Wed Oct 20 07:27:48 2010 : Info: [eap] processing type md5 Wed Oct 20 07:27:48 2010 : Debug: rlm_eap_md5: Issuing Challenge Wed Oct 20 07:27:48 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 141 to 192.168.6.200 port 1645 EAP-Message = 0x011b001604100675c546c11b2ad0f1a7341b757af909 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d4e1d1a6d5519217cdc7f95e535c25b Wed Oct 20 07:27:48 2010 : Info: Finished request 48. Wed Oct 20 07:27:48 2010 : Debug: Going to the next request Wed Oct 20 07:27:48 2010 : Debug: Waking up in 4.9 seconds. Thanks & Regards -- Chidanand Gangur Pune.

3 8

pre-proxy automatically added "NAS-IP-Address"
by ichiro tanaka 21 Oct '10

21 Oct '10

Hi. i have a problem proxy. Proxying to auth-server, and "NAS-IP-Address" was automatically added by proxy. can I stop it? I used ntradping-1.5 and freeradius-2.1.10. --hosts-- ntradping-1.5 10.233.55.200 proxy (freeradius-2.1.10) 10.233.36.101 auth-server (freeradius-2.1.10) 10.233.36.100 --debug log-- FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Oct 20 2010 at 15:43:53 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /tmp/radius/etc/raddb/radiusd.conf including configuration file /tmp/radius/etc/raddb/proxy.conf including configuration file /tmp/radius/etc/raddb/clients.conf including files in directory /tmp/radius/etc/raddb/modules/ including configuration file /tmp/radius/etc/raddb/modules/radutmp including configuration file /tmp/radius/etc/raddb/modules/passwd including configuration file /tmp/radius/etc/raddb/modules/cui including configuration file /tmp/radius/etc/raddb/modules/opendirectory including configuration file /tmp/radius/etc/raddb/modules/dynamic_clients including configuration file /tmp/radius/etc/raddb/modules/ippool including configuration file /tmp/radius/etc/raddb/modules/realm including configuration file /tmp/radius/etc/raddb/modules/pam including configuration file /tmp/radius/etc/raddb/modules/ldap including configuration file /tmp/radius/etc/raddb/modules/always including configuration file /tmp/radius/etc/raddb/modules/counter including configuration file /tmp/radius/etc/raddb/modules/smbpasswd including configuration file /tmp/radius/etc/raddb/modules/sql_log including configuration file /tmp/radius/etc/raddb/modules/logintime including configuration file /tmp/radius/etc/raddb/modules/wimax including configuration file /tmp/radius/etc/raddb/modules/detail.example.com including configuration file /tmp/radius/etc/raddb/modules/policy including configuration file /tmp/radius/etc/raddb/modules/unix including configuration file /tmp/radius/etc/raddb/modules/mschap including configuration file /tmp/radius/etc/raddb/modules/ sqlcounter_expire_on_login including configuration file /tmp/radius/etc/raddb/modules/files including configuration file /tmp/radius/etc/raddb/modules/otp including configuration file /tmp/radius/etc/raddb/modules/inner-eap including configuration file /tmp/radius/etc/raddb/modules/perl including configuration file /tmp/radius/etc/raddb/modules/etc_group including configuration file /tmp/radius/etc/raddb/modules/linelog including configuration file /tmp/radius/etc/raddb/modules/mac2vlan including configuration file /tmp/radius/etc/raddb/modules/attr_rewrite including configuration file /tmp/radius/etc/raddb/modules/digest including configuration file /tmp/radius/etc/raddb/modules/sradutmp including configuration file /tmp/radius/etc/raddb/modules/expr including configuration file /tmp/radius/etc/raddb/modules/expiration including configuration file /tmp/radius/etc/raddb/modules/attr_filter including configuration file /tmp/radius/etc/raddb/modules/mac2ip including configuration file /tmp/radius/etc/raddb/modules/pap including configuration file /tmp/radius/etc/raddb/modules/detail including configuration file /tmp/radius/etc/raddb/modules/detail.log including configuration file /tmp/radius/etc/raddb/modules/smsotp including configuration file /tmp/radius/etc/raddb/modules/krb5 including configuration file /tmp/radius/etc/raddb/modules/acct_unique including configuration file /tmp/radius/etc/raddb/modules/echo including configuration file /tmp/radius/etc/raddb/modules/ntlm_auth including configuration file /tmp/radius/etc/raddb/modules/exec including configuration file /tmp/radius/etc/raddb/modules/preprocess including configuration file /tmp/radius/etc/raddb/modules/chap including configuration file /tmp/radius/etc/raddb/modules/checkval including configuration file /tmp/radius/etc/raddb/eap.conf including configuration file /tmp/radius/etc/raddb/policy.conf including files in directory /tmp/radius/etc/raddb/sites-enabled/ including configuration file /tmp/radius/etc/raddb/sites-enabled/control-socket including configuration file /tmp/radius/etc/raddb/sites-enabled/default including configuration file /tmp/radius/etc/raddb/sites-enabled/inner-tunnel including dictionary file /tmp/radius/etc/raddb/dictionary main { prefix = "/tmp/radius" localstatedir = "/tmp/radius/var" logdir = "/tmp/radius/var/log/radius" libdir = "/tmp/radius/lib" radacctdir = "/tmp/radius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/tmp/radius/var/run/radiusd/radiusd.pid" checkrad = "/tmp/radius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm example.jp { nostrip authhost = 10.233.36.101 secret = secret } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.233.55.200 { require_message_authenticator = no secret = "secret" shortname = "ntradping" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /tmp/radius/etc/raddb/modules/ exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /tmp/radius/etc/raddb/modules/ expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /tmp/radius/etc/raddb/ modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /tmp/radius/etc/raddb/ modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /tmp/radius/etc/raddb/sites-enabled/inner- tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /tmp/radius/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /tmp/radius/etc/raddb/modules/ chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /tmp/radius/etc/raddb/modules/ mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /tmp/radius/etc/raddb/modules/ unix unix { radwtmp = "/tmp/radius/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /tmp/radius/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/tmp/radius/etc/raddb/certs" pem_file_type = yes private_key_file = "/tmp/radius/etc/raddb/certs/server.pem" certificate_file = "/tmp/radius/etc/raddb/certs/server.pem" CA_file = "/tmp/radius/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/tmp/radius/etc/raddb/certs/dh" random_file = "/tmp/radius/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/tmp/radius/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /tmp/radius/etc/raddb/modules/ realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /tmp/radius/etc/raddb/modules/ files files { usersfile = "/tmp/radius/etc/raddb/users" acctusersfile = "/tmp/radius/etc/raddb/acct_users" preproxy_usersfile = "/tmp/radius/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /tmp/radius/etc/raddb/modules/ radutmp radutmp { filename = "/tmp/radius/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /tmp/radius/ etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/tmp/radius/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /tmp/radius/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /tmp/radius/etc/raddb/modules/ digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /tmp/radius/etc/raddb/ modules/preprocess preprocess { huntgroups = "/tmp/radius/etc/raddb/huntgroups" hints = "/tmp/radius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /tmp/radius/etc/raddb/ modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /tmp/radius/etc/raddb/modules/ detail detail { detailfile = "/tmp/radius/var/log/radius/radacct/%{Client-IP-Address}/ detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /tmp/ radius/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/tmp/radius/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/tmp/radius/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /tmp/radius/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.233.55.200 port 58623, id=35, length=55 User-Name = "user(a)example.jp" User-Password = "password" # Executing section authorize from file /tmp/radius/etc/raddb/sites-enabled/ default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "example.jp" for User-Name = "user(a)example.jp" [suffix] Found realm "example.jp" [suffix] Adding Realm = "example.jp" [suffix] Proxying request from user user to realm example.jp [suffix] Preparing to proxy authentication request to realm "example.jp" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 230 to 10.233.36.100 port 1812 User-Name = "user(a)example.jp" User-Password = "password" NAS-IP-Address = 10.233.55.200 Proxy-State = 0x3335 Proxying request 0 to home server 10.233.36.100 port 1812 Sending Access-Request of id 230 to 10.233.36.100 port 1812 User-Name = "user(a)example.jp" User-Password = "password" NAS-IP-Address = 10.233.55.200 Proxy-State = 0x3335 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.233.36.100 port 1812, id=230, length =24 Proxy-State = 0x3335 # Executing section post-proxy from file /tmp/radius/etc/raddb/sites-enabled/ default +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /tmp/radius/etc/raddb/sites-enabled/ default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 35 to 10.233.55.200 port 58623 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 35 with timestamp +6 Ready to process requests. thanks for your help ichiro tanaka

2 2

One virtual server for MS-chapv2 against Active Directory, the other one agaist ldap ntpasswd?
by schilling 20 Oct '10

20 Oct '10

Hi All, Can I have one virtual server listening on 1812/1813 for authenticating with ms-chapv2 against AD, and then another virtual server listening on 1814/1815 authenticating with ms-chapv2 against LDAP with ntpassword hash? We are able to get a instance running for against AD, but not able to get it working against LDAP. The user will continue try the AD. Thanks, Shiling

1 0