- Freeradius-Users - lists.freeradius.org

inside Auth-Type has different rules
by Iliya Peregoudov 01 Oct '10

01 Oct '10

Hello, I have following configuration: authenticate { Auth-Type CHAP { chap db_backend chap { ok = 1 } db_backend } } First chap module call should handle cases when Cleartext-Password already set (for example, by files module). If there is Cleartext-Password, chap module returns *ok* or *reject*, so authentication should stop on these return codes. If there is no Cleartext-Password, chap module returns *invalid*, so authentication should proceed further. db_backend is a custom module that uses backend database. First db_backend call returns: - *ok* if backend database do not want password checking, - *reject* if backend database want to reject authentication, - *handled* if Proxy-To-Realm returned from backend database, - *updated* if Cleartext-Password returned from backend database. Authentication should stop on *ok*, *reject*, and *handled* return codes, and should proceed on *updated* return code. Second chap module call should check CHAP-Password against Cleartext-Password. Return code *ok* handling changed to proceed with authentication if password is correct. Second db_backend call returns *ok*, *reject*, or *handled* like first db_backend call. In freeradius 1.1.x this configuration works fine. In freeradius 2.1.x it doesn't work. I found that in freeradius 2.0.2 return code handling in Auth-Type subsections was changed. In freeradius 1.1.x return code handling was: - return notfound, ok, reject, userlock, handled - save noop, updated, fail, invalid (all with priority 1) In freeradius 2.1.x (starting with 2.0.2) return code handling is identical to authorize section: - save notfound (prio 1), noop (prio 2), ok (prio 3), updated (prio 4) - return fail, reject, userlock, invalid, handled This change was committed by commit id 4719ed0ce65f19586364. What is the reason for the change? It changes requirements for module return codes. Moreover, return code handling was changed only in Auth-Type subsections, not in authenticate section. When module's authenticate hook is called module has no clue is it called from authenticate section or from Auth-Type subsection. Regards, Iliya Peregoudov

2 1

Radius+Ldap:Allow the same host in multiple vlans
by Ramon Escriba 01 Oct '10

01 Oct '10

Hi I'm trying to organize my net using 802.1x able switches with freeradius 2.1.1+Openldap2-2.4+OpenSuse11.1 The system is running, at least @ test level but not yet deployed, but I reach a cross road and finally I've to choose. Or having one ldap subtree per vlan, filled with all host that bellong to this one, or store inside the host attributes all vlans it's allowed or may get in. The first "road" it's the one I've working actually, because I don't know how to implement the second, the elegant one. I have multiple devices that may belong to multiple vlans, so I shall have duplicated hosts, which I don't like @ all. In order to keep things easy I only use mac-"authentication", later 802.1x EAP wit user+pass ( EAP Mschapv2 or TTLS). The idea is to declare in one single place the vlans one host may be able to connect, from the first top priority vlan to try up to the last option.. Well, I'm using the radiusprofile attribute radiusTunnelGroupId to store the Vlan name or tag. If I set one host/user with the next "vlan tag" attributes: Uid=John.Cleese,ou=People,ou=Radius,xxxxxxxxxxxxxx ... radiusTunnelGroupId: 666 (Mad Scientist) radiusTunnelGroupId: 128 (Nut Engineers) radiusTunnelGroupId: 256 (Nerd IT guys) radiusTunnelGroupId: 51 ( blackhole control) ... userPassword XXXXXXXXXXXXXXXXX Or Uid=<mac-address>,ou=Devices,ou=Radius,xxxxxxxxxxxxxx cn: stupid.device.001 ... radiusTunnelGroupId: 666 (Mad scientist) radiusTunnelGroupId: 999 (FusionCore) ... The host/user, may have rights to connect to those vlans, from let say top prority (666) to the lesser one (51) [ldap attribute order], in the first case, and only 666 or 999 in the second. Some areas are restrited so only the ones with physical access may get connection to the right vlan. The problem is how may I configure radius so it may choose the "correct" vlan. Or try one and if not possible keep trying until no more choices are available. I also have "hungroups", but I realized, if I'm not wrong, that freeradius only gets the first match, never tries the others, so: BlackHoleCore NAS-IP-Address == 10.0.0.1 VacuumCleaner NAS-IP-Address == 10.0.0.1 CoffeeMachine NAS-IP-Address == 10.0.0.1 When in freeradius "users" file I try "DEFAULT Huntgroup-Name == CoffeeMachine, Auth-Type = LDAPCoffee" it will never get in, because NAS-IP 10.0.0.1 will always match BlackHoleCore, never the others.( It's ok?? Or I'm wrong or may I have to change something to get/force/allow multiple target??) A "problem" I found,I'm a newby in radius, is that I'm not able to choose between the diferent vlans, as radius always try to match first value of multivaluated attributes (radiusTunnelGroupId). I'm wrong again? Freeradius send the ACK-OK to the NAS-switch with the target Vlan for this device. If the "sent" vlan is not extended to that switch-NAS there fails silently( @ least seems so in Extreme networks), so the device is not connected. I was trying to use the "checkval" module, but I don't know it's the way it was thinked off. As far as I undertand I can not use it, maybe I'm wrong again. There's any elegant way to do it? Is that aproach, try the "next vlan" if exists @ ldap, possible, how? Many Thanks.

3 6

Default ldap fallthrough but no Auth-Type set
by Harry Hoffman 01 Oct '10

01 Oct '10

Hi All, I'm running freeradius 2.1.8 on a Redhat 5.x box. We're setup to authenticate against LDAP and AD using the how-tos and wiki on the freeradius website. Users might be in LDAP, or AD, or both. I've stuck with the default config and enabled both ldap and ntlm_auth (after making sure that both sources can authenticate per the docs). Both sources of authentication work. It seems that when enabling the ldap module, it become the default if nothing else sets the Auth-Type. Now I'm trying to walk through the exercise of getting AD auth to work if a user is present in AD, or getting LDAP auth to work if the user is present in LDAP. In the authorize { ... } section of sites-enabled/default I have the following: ntlm_auth ldap { notfound = return } In the authenticate { ... } section of sites-enabled/default I have the following Auth-Type: # ntlm_auth authentication. Auth-Type ntlm_auth { ntlm_auth } Auth-Type LDAP { group{ ldap{ reject = 1 ok = return } ntlm_auth{ reject = 1 ok = return } } } If the user has a entry in the LDAP database then the Auth-Type is set to LDAP and the authorization jumps to Auth-Type LDAP and goes through the groups stanza trying to authenticate to ldap or ntlm_auth. However if the user is not in LDAP then it seems as though Auth-Type is never set so the default authentication is attempted via ldap, which fails. I don't understand why it doesn't try the Auth-Type LDAP definition. Everywhere I read, the docs say not to specifically set Auth-Type but to let the server figure it out. So, how do I let the server figure out that the Auth-Type should be ntlm_auth when the authorize { ... } section matches ntlm_auth? rad_recv: Access-Request packet from host 127.0.0.1 port 55874, id=200, length=63 User-Name = "admin" User-Password = "password" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20100930 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m %d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20100930 [auth_log] expand: %t -> Thu Sep 30 10:32:05 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "admin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "admin", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=admin [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok [ldap] performing user authorization for admin [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> admin [ldap] expand: (&(uid= %{%{Stripped-User-Name}:-%{User-Name}})(!(inetCOS=802.1x_disabled))) -> (&(uid=admin)(!(inetCOS=802.1x_disabled))) [ldap] expand: ou=People,dc=ip-solutions,dc=net,o=internet -> ou=People,dc=ip-solutions,dc=net,o=internet [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.ip-solutions.net:389, authentication 0 [ldap] starting TLS [ldap] bind as / to ldap.ip-solutions.net:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=ip-solutions,dc=net,o=internet, with filter (&(uid=admin)(!(inetCOS=802.1x_disabled))) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect ( [ldap] User not found): [admin] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 200 to 127.0.0.1 port 55874 Waking up in 4.9 seconds. Cleaning up request 0 ID 200 with timestamp +3 Ready to process requests. Cheers, Harry

2 1

vmps switch-port shutdown
by Habegger Lukas, ERZ-AZD-AID-NOC 01 Oct '10

01 Oct '10

hi I try to shutdown (errdisabled) a port of a cisco3560 with the vmps-shutdown response. i use freeradius 2.1.10 and rlm_perl. Could someone tell me how the response should look like. so fare i have: $RAD_REPLY{'VMPS-Packet-Type'} = "VMPS-Join-Response"; $RAD_REPLY{'VMPS-Error-Code'} = "VMPS-Shutdown"; $RAD_REPLY{'VMPS-Sequence-Number'} = $RAD_REQUEST{'VMPS-Sequence-Number'}; i can set the vlan on a port for a specific mac but the port does not go to errdisabled when i use the above. Thanks for help Lukas

2 1

choose proxy based on AD
by David McPike 30 Sep '10

30 Sep '10

Hello All, We are in the process of migrating users from one AD tree to another. The migrated accounts will exist in both AD directories for a while (usernames will not change) and I need to be able to choose a radius server based on an LDAP group membership. I have this working fine for cases where users do not supply a realm but I am not sure of the best way to do this for users that do supply an ntdomain-style realm. In the new domain, no one requires a realm (need to strip if the user has already been migrated), while the old domain has several child domains. I am using FR 2.1.10. I was not successful trying to change the proxy server after one had already been chosen. I tried to remove the Realm attribute in the authorize section but the request still went to the initially chosen radius pool. I tried stripping the realm manually prior to realm processing in authorize {} but have not been successful yet. I am using a simple regex like this: if (User-Name =~ /^[A-z]+\\(.*)/) { update request { Stripped-User-Name := "%{1}" } } This always fails for 'radtest realm\\user'. Am I missing something or is there a more elegant way to accomplish this? Thanks very much, David

3 6

Question about rlm-unix authentication
by James S. Smith 30 Sep '10

30 Sep '10

I'm trying to get FreeRadius to authenticate against the local server's usernames and passwords. I have a fresh installation and I've confirmed that authentication is working with a test entry in the /etc/raddb/users file. I've also tested authentication from another system and it works too. I then try to authentication against a unix account I have on the system ("testrad"). It comes back as "Access-Reject", which seems to suggest it tried to look for the user account and felt it wasn't there and in the radiusd -X the unix module reports "notfound". I've confirmed I can log in via Unix with this account, so it definitely works. I also made a test program that makes the same calls as rlm_unix and it was able to successfully lookup the user account. Could this be a problem with the CentOS package of FreeRadius? Anyone else had this problem? [root@todcsvnm01 ~]# radtest testing password 127.0.0.1 0 testing123 Sending Access-Request of id 232 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=232, length=20 [root@todcsvnm01 ~]# radtest testrad 74828752 127.0.0.1 0 testing123 Sending Access-Request of id 176 to 127.0.0.1 port 1812 User-Name = "testrad" User-Password = "74828752" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=176, length=20 [root@todcsvnm01 ~]# radiusd -X FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Mar 31 2010 at 00:14:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/passwd.rpmsave including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 52413, id=232, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry testing at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "password" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 232 to 127.0.0.1 port 52413 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 232 with timestamp +34 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 43090, id=176, length=59 User-Name = "testrad" User-Password = "74828752" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testrad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testrad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 176 to 127.0.0.1 port 43090 Waking up in 4.9 seconds. Cleaning up request 1 ID 176 with timestamp +69 Ready to process requests. James S. Smith Network Architect WIND Mobile 207 Queen's Quay West, Suite 710 Toronto, ON M5J 1A7 Direct: 416-640-9792 Fax: 416-987-1203 www.windmobile.ca www.twitter.com/WINDmobile www.facebook.com/WINDmobile The Power of Conversation This message contains confidential information and is intended only for the individual named. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Fwd: FreeRadius + VSA
by Noura Kossentini 30 Sep '10

30 Sep '10

---------- Forwarded message ---------- From: Noura Kossentini <kossentini.noura(a)gmail.com> Date: 2010/9/29 Subject: FreeRadius + VSA To: freeradius-users-owner(a)lists.freeradius.org Hi how can I add a VSA to freeRadius server?? thanks

3 5

RE: New Install Problems
by Scott Miller 30 Sep '10

30 Sep '10

>> Scott Miller wrote: >> Wondering if you happen to have a solution or work-around? >> > > >$ ./configure --disable-libltdl-install --with-system-libtool > > That *may* work. > > The longer-term fix is removing libltdl && libtool entirely. Modern >systems all have sane compilers && link systems. The intermediate layer >of insanity added by those tools is no longer necessary. > > Alan DeKok. > When configure with this: ./configure --disable-libltdl-install --with-system-libtool Make (don't even get to "make install" yet) I get this: gmake[4]: Entering directory `/home/scott/freeradius-server-2.1.10/src/main' /usr/bin/libtool --mode=link gcc -export-dynamic -dlopen self \ -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo stats.lo session.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo evaluate.lo vmps.lo detail.lo \ /home/scott/freeradius-server-2.1.10/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread \ -lcrypt /home/scott/freeradius-server-2.1.10/libltdl/libltdl.la -lcrypto -lssl -lcrypto libtool: link: rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT libtool: link: (cd .libs && gcc -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fPIC -c -fno-builtin "radiusdS.c") libtool: link: rm -f ".libs/radiusdS.c" ".libs/radiusd.nm" ".libs/radiusd.nmS" ".libs/radiusd.nmT" libtool: link: gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/scott/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /home/scott/freeradius-server-2.1.10/libltdl/.libs/libltdl.so -ldl -lssl -lcrypto -Wl,-rpath -Wl,/usr/local/lib .libs/modules.o: In function `setup_modules': /home/scott/freeradius-server-2.1.10/src/main/modules.c:1372: undefined reference to `lt_preloaded_symbols' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/home/scott/freeradius-server-2.1.10/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/home/scott/freeradius-server-2.1.10/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/scott/freeradius-server-2.1.10/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/home/scott/freeradius-server-2.1.10' make: *** [all] Error 2

2 1

Unix Group based White-List
by Sid Stuart 29 Sep '10

29 Sep '10

We would like to configure authentication using the Unix module. We would also like to have a white-list based on a group in /etc/group. We created an entry in the /etc/raddb/users file that looks like, DEFAULT Group == "enabled", Auth-Type := System Unfortunately, this passes all users with a valid account through, even when they are not listed in the group. We can set up a blacklist with DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled." DEFAULT Auth-type := System but would prefer a white-list approach. Does anyone know how to do this? Sid

2 1

Radius not recording - The maximum number of threads (300) are active, cannot spawn new thread to handle request
by Marie Tambe 29 Sep '10

29 Sep '10

Can someone help with this Please. I always have restart server before radius can record again on Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 180550544) for request 6431961 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 2446359440) for request 6431965 Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Error: Dropping conflicting packet from client att:1646 - ID: 63 due to unfinished request 6434567 Mon Sep 20 18:45:19 2010 : Error: Dropping conflicting packet from client att:1646 - ID: 65 due to unfinished request 6433323 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 2939382672) for request 6431951 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 3086240656) for request 6431963 Mon Sep 20 18:45:19 2010 : Error: Dropping conflicting packet from client att:1646 - ID: 155 due to unfinished request 6433435 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 3044281232) for request 6431966 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 1869417360) for request 6432076 Mon Sep 20 Thanks and Regards Marie ________________________________ The information contained in this email and any attachments is strictly confidential and is for the use of the intended recipient. Any use, dissemination, distribution, or reproduction of any part of this email or any attachment is prohibited. If you are not the intended recipient, please notify the sender by return email and delete all copies including attachments.

4 10