- Freeradius-Users - lists.freeradius.org

Re: doubt regarding free-radius
by Michael Bathe 29 Sep '10

29 Sep '10

Hi, I couldn't solve my problem with this package. I think that not all dependencies could be fulfilled because of my core-installation. Finally I installed free-radius from blastwave wget http://download.blastwave.org/csw/pkgutil_i386.pkg pkgadd -d pkgutil_i386.pkg pkgutil --catalog pkgutil -a freeradius pkgutil -i freeradius # if there are problems with generating certs following worked for me cd /opt/csw/etc/raddb/certs/ date > ./random ./bootstrap radiusd -X Michael Am 29.09.2010 14:33, schrieb vijay: > Hi, > i saw your posting regarding segmentation-fault while run > following command on solaris10-x86. > > /usr/local/sbin/radiusd -X > > Iam also facing same problem.How you resolved it.It will be helpful to me. > > > > vijay > -- Michael Bathe Rechenzentrum -Netzwerkadministration- Tel.: +49 (0)331/288-1803 Fax: +49 (0)331/288-1730 Email: michael.bathe(a)gfz-potsdam.de ___________________________________ Helmholtz-Zentrum Potsdam Deutsches GeoForschungsZentrum - GFZ Stiftung des Öff. Rechts Land Brandenburg Telegrafenberg G257, D-14473 Potsdam

1 0

I have refered the doc again, and found some problem when the Vendor is PPP using simultaneous-use
by Spacelee 29 Sep '10

29 Sep '10

it says that for PPP, we should choose "other" in the type, but "other" means "don't bother checking, I believe what radutmp says". So which means if a user has a "stuck" entry in the session database she will not be able to login again. And I have met such problem also. When the wifi sudden shutdown or disconnect, which will leave the record of the user still online in the database, I have to clear it up manually, that 's not convenient. So what should I do with PPTP+PPP+Freeradius+MySQL when I have to set the simultaneous-use = 1 -- *Space Lee*

1 0

RE: New Install Problems
by Scott Miller 29 Sep '10

29 Sep '10

>> Been using FreeRadius for years now, no problems at all. Currently >> running 1.1 for over 5 years, upgrading the server and freeradius and am >> using Fedora 13. Downloaded the newest version, unzipped, went through >> config and ran into problems. ... >> /usr/bin/ld: .libs/radeapclient.o: undefined reference to symbol 'fr_perror' >> >> /usr/bin/ld: note: 'fr_perror' is defined in DSO >> /usr/local/lib/libfreeradius-radius-2.1.10.so so try adding it to the >> linker command line >> >> /usr/local/lib/libfreeradius-radius-2.1.10.so: could not read symbols: >> Invalid operation > > It's trying to link to the *installed* version of the library. This >is before the library has been installed. > > I'll put it down to a libtool issue. It has the happy trait of >re-writing build commands to reference libraries which don't exist. <sigh> > > Alan DeKok. >- Wondering if you happen to have a solution or work-around? Scott Miller

2 1

Core with 64Bit pam_radius_auth on Solaris 9
by Peter Lambrechtsen 29 Sep '10

29 Sep '10

Hello I've managed to compile pam_radius-1.3.17 both 32Bit and 64Bit. I had to add -lsocket as part of linking to get it to work and modified the make file to have -m64 to compile on 64bit When I compile it for 64Bit this is my make output: gcc -Wall -fPIC -m64 -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function `ipstr2long': pam_radius_auth.c:185: warning: subscript has type `char' pam_radius_auth.c: In function `good_ipaddr': pam_radius_auth.c:221: warning: subscript has type `char' pam_radius_auth.c: In function `host2server': pam_radius_auth.c:277: warning: subscript has type `char' pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1027: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1030: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1081: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1097: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1102: warning: assignment from incompatible pointer type pam_radius_auth.c:1121: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1135: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1168: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1300: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1321: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1407: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1428: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1437: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1442: warning: passing arg 3 of `pam_get_item' from incompatible pointer type gcc -Wall -fPIC -m64 -m64 -I/usr/local/include -R/usr/local/lib/sparcv9 -c md5.c gcc -R/usr/local/lib/sparcv9 -m64 -shared pam_radius_auth.o md5.o -lpam -lsocket -lc -o pam_radius_auth.so Which is all well and good. But when I try and use the 64Bit version of pamtester it core dumps. The 32Bit version compiles fine, and 32bit version of pamtester also works fine. ./pamtester jpam peter authenticate Password: Bus Error (core dumped) In /var/adm/messages I get: Sep 22 13:51:46 sf2428 genunix: [ID 603404 kern.notice] NOTICE: core_log: pamtester[13662] core dumped: /var/core/core_sol9_pamtester_0_0_1285120305_13662 Any suggestions on what to do with gdb or to debug this problem?? I've seen a number of posts such as this one: http://networking.itags.org/networking-tech/58575/ Talking about changing the typedef for md5.h -#define uint32 u_int32_t +#define uint32 uint32_t However 1.3.17 already seems to have this patch. struct MD5Context { uint32_t buf[4]; uint32_t bits[2]; unsigned char in[64]; }; I'm no C developer so not sure where to go to from here. Any suggestions would be gratefully accepted. Cheers Peter

2 8

Error
by Samuel Isaias Barriga Perez 29 Sep '10

29 Sep '10

Hi: I have installed Freeradius on my Debian server, after I debug, I got this error, can you hep me with this problem. Thank you Samuel Tue Sep 28 13:41:15 2010 : Error: Failed binding to authentication address * port 1812: Address already in use Tue Sep 28 13:41:15 2010 : Error: /usr/local/etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812

3 2

FW: Session Resumption fails
by Panagiotis Georgopoulos 28 Sep '10

28 Sep '10

Forgot to mention that my FR's full log is here : http://pastebin.com/VWEaYAhP Cheers, Panos > Hello Alexander, all, > > Please see my comments inline... > > > > From: Alexander Clouter [mailto:alex@digriz.org.uk] > > Hi, > > > > * Panagiotis Georgopoulos <panos(a)comp.lancs.ac.uk> [2010-09-24 > > 22:33:14+0100]: > > > > > > I wish it was that simple! It seems that when I do > > "use_tunneled_reply > > > = yes" and although the authentication with FR succeeds, the 4-way > > > handshake between the client (wpa_supplicant 0.7.3) and the access > > > point (hostapd 0.7.2) fails with wpa_supplicant reporting : > > > > > /me does not recall saying enable 'copy_request_to_tunnel = yes'. > > With or without copy_request_to_tunnel enabled the outcome is the same > I am afraid, i.e. although full EAP-TTLS authentication succeeds the > end-client (not NAS) restarts EAP-TTLS authentication, when session > resumption and use_tunneled_reply are enabled on FreeRadius. > > (NB. when session resumption is off and use_tunneled_reply=no the full > communication goes fine and the client completes the 4-way handshake > after NAS gets EAP-Success). > > > > > State: ASSOCIATED -> 4WAY_HANDSHAKE > > > [snipped unread log] > > > EAPOL: Received EAP-Packet frame > > > > > > It seems that the Access Point realizes that the identity in FR's > > > reply has changed (from the outer identity to the inner one) and > > > somehow the client doesn't like this and doesn't reply to the 1st > > > message of the 4th way handshake. Instead it sends an EAPOL start > > > message and a full authentication restarts with the same outcome.. > > and then again and again. > > > > > Have you considered comparing the difference in the RADIUS packets > > going to-and-fro in both cases; the one where authentication works > and the > > one where it does not? What do you see? > > > > Yes I did, although I mostly concentrated on the 4-way handshake of the > client because this is where it is failing compared to without session > resumption. The end-client does not follow up the 1st message of the 4- > way handshake of the NAS, but decides to restart the full > authentication. > > (btw I was a bit more quick to send my previous email, because of the > impeding release of 2.1.10 where it was said that with session > resumption and use_tunneled_reply the session resumption should work, > but in my tests it wasn't. I wanted to see whether there was a quick > fix to be added to 2.1.10 before it gets released). > > As to the packet communication between the NAS and FreeRadius, there is > a change in the last packet (EAP-success) sent from FR to the NAS > compared to when authentication succeeds. Firstly it has as User-Name > attribute of the inner identity of the initial request and not the > outer one (which shouldn't cause the problem according to rfc 2865) and > secondly, it has MS-MPPE-Send-Key and MS-MPPE-Recv-Key *twice* which I > am guessing is causing the problem (rfc2548 as pointed out by > Alexander, helped me realize that). Why do they appear twice there, I > 've got no idea. > > Anyway, so what I thought to do is to go to the post-auth section of my > inner-server and add the following to remove the MS-MPPE-Send-Key and > MS-MPPE-Recv-Key attributes added by the inner-server and let the > default add its own. > > update reply { > MS-MPPE-Recv-Key !* 0x00 > MS-MPPE-Send-Key !* 0x00 > } > > Is the logic behind this fine or do you reckon it might break something > else in the future? > > The above solved the problem, in a sense, as now the end-client (pc) > authenticates just fine and finishes the 4-way handshake with the NAS. > However, session resumption still does not work. The server does add a > cache entry with the following : > > #Debug: SSL: adding session > 5705534d65ddd08de3b8649528274c1bc4e3d648bef7b643ffaf0f647afcac73 to > cache > #Info: [ttls] (other): SSL negotiation finished successfully > #Debug: SSL Connection Established > > ..but it does this every time a client tries to authenticate and it > never tries to really skip phase 2. I would really appreciate any ideas > on how I should fix this. > > Thanks a lot in advance, > Panos > > > >

1 0

New Install Problems
by Scott Miller 28 Sep '10

28 Sep '10

Been using FreeRadius for years now, no problems at all. Currently running 1.1 for over 5 years, upgrading the server and freeradius andam using Fedora 13. Downloaded the newest version, unzipped, went throughconfig and ran into problems. ./configure - seemed to go OK make - produced the following errors:(did not attempt make install yet) /usr/bin/ld: .libs/radeapclient.o: undefined reference tosymbol 'fr_perror'/usr/bin/ld: note: 'fr_perror' is defined in DSO/usr/local/lib/libfreeradius-radius-2.1.10.so so try adding it to the linkercommand line/usr/local/lib/libfreeradius-radius-2.1.10.so: could notread symbols: Invalid operationcollect2: ld returned 1 exit statusgmake[6]: *** [radeapclient] Error 1gmake[6]: Leaving directory `/home/scott/freeradius-server-2.1.10/src/modules/rlm_eap'gmake[5]: *** [rlm_eap] Error 2gmake[5]: Leaving directory`/home/scott/freeradius-server-2.1.10/src/modules'gmake[4]: *** [all] Error 2gmake[4]: Leaving directory`/home/scott/freeradius-server-2.1.10/src/modules'gmake[3]: *** [modules] Error 2gmake[3]: Leaving directory`/home/scott/freeradius-server-2.1.10/src'gmake[2]: *** [all] Error 2gmake[2]: Leaving directory`/home/scott/freeradius-server-2.1.10/src'gmake[1]: *** [src] Error 2gmake[1]: Leaving directory`/home/scott/freeradius-server-2.1.10'make: *** [all] Error 2[root@radius1 freeradius-server-2.1.10]# This is a fresh install of Fedora 13. I don't rememberrunning into any problems with FreeRadius 1.1, even imported my ICRadiusdatabase with no problems at that time. Anyone have any idea of what I'm missing? Thanks,Scott

2 1

Version 2.1.10 has been released
by Alan DeKok 28 Sep '10

28 Sep '10

Thanks to everyone for being patient. Version 2.1.10 has just been released. http://freeradius.org/ The changelog is quite large for a "stable" release. We've fixed a number of minor bugs. We've also added features which have been requested for a long time. Most notably: * Print out large WARNING message if we send an Access-Challenge for EAP, and receive no follow-up messages from the client. This means that when EAP has been misconfigured or not deployed correctly, the server will print a message in debug mode saying "go read a specific page on the Wiki". That page contains detailed instructions for how to solve the problem. * Added support for TLS-Cert-* attributes. For details, see raddb/sites-available/default, "post-auth" section. This means that much more complex certificate checking can be done. * Updated more documentation to use "Restructured Text" format. Thanks to James Lockie. This makes the documentation simpler and easier to read. There are a number of other minor features which "round out" the server functionality. This makes it the best release for stability, documentation, and ease of use. Alan DeKok.

4 7

FreeRadius and LDAP from Nortel Switch
by BELLIERE Eric 28 Sep '10

28 Sep '10

Phil, Fine It is working better. What a stupid error :-) Now I have to troubleshoot because the Freeradius send a Accept but the Switch is saying Invalid Password FR 2.1.9 Sending Access-Accept of id 169 to 192.168.250.64 port 4481 Switch Login: ebellier Password: ******** Invalid Password. Many Thanks. Eric B. ****

1 0

FreeRadius and LDAP from Nortel Switch
by BELLIERE Eric 28 Sep '10

28 Sep '10

Dears, I would like to make a radius authentication while access to a Network Elements (Nortel ERS 8600). This authentication will be done via LDAP. Everything seems to be ok except that when the request is sent from the Network elements the password is not in clear text and then FreeRadius says that password didn't matches. When I try from RadPing (from my laptop) then my LDAP authentication is OK Can you please help me? >From RadPing rad_recv: Access-Request packet from host 172.18.113.82 port 3340, id=1, length=48 User-Name = "ebellier" User-Password = "xxxxxxxxxx" Tue Sep 28 14:25:30 2010 : Info: +- entering group authorize {...} Tue Sep 28 14:25:30 2010 : Info: ++[preprocess] returns ok Tue Sep 28 14:25:30 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.18.113.82/auth-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.113.82/auth-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [auth_log] expand: %t -> Tue Sep 28 14:25:30 2010 Tue Sep 28 14:25:30 2010 : Info: ++[auth_log] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[chap] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[mschap] returns noop Tue Sep 28 14:25:30 2010 : Info: [suffix] No '@' in User-Name = "ebellier", looking up realm NULL Tue Sep 28 14:25:30 2010 : Info: [suffix] Found realm "DEFAULT" Tue Sep 28 14:25:30 2010 : Info: [suffix] Adding Stripped-User-Name = "ebellier" Tue Sep 28 14:25:30 2010 : Info: [suffix] Adding Realm = "DEFAULT" Tue Sep 28 14:25:30 2010 : Info: [suffix] Authentication realm is LOCAL. Tue Sep 28 14:25:30 2010 : Info: ++[suffix] returns ok Tue Sep 28 14:25:30 2010 : Info: [eap] No EAP-Message, not doing EAP Tue Sep 28 14:25:30 2010 : Info: ++[eap] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[unix] returns updated Tue Sep 28 14:25:30 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Sep 28 14:25:30 2010 : Info: [files] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:25:30 2010 : Info: [files] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:25:30 2010 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 8 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass =GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be))) Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (&(cn=GF_FW_networkManagementProdAdmin)(|(&(objectClass=GroupOfNames)(member =uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be)))) request done: ld 0x1fb4500 msgid 9 Tue Sep 28 14:25:30 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group GF_FW_networkManagementProdAdmin Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: ++[files] returns noop Tue Sep 28 14:25:30 2010 : Info: [ldap] performing user authorization for ebellier Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 10 Tue Sep 28 14:25:30 2010 : Info: [ldap] looking for check items in directory... Tue Sep 28 14:25:30 2010 : Info: [ldap] looking for reply items in directory... Tue Sep 28 14:25:30 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Sep 28 14:25:30 2010 : Info: [ldap] Setting Auth-Type = LDAP Tue Sep 28 14:25:30 2010 : Info: [ldap] user ebellier authorized to use remote access Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[expiration] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[logintime] returns noop Tue Sep 28 14:25:30 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue Sep 28 14:25:30 2010 : Info: ++[pap] returns noop Tue Sep 28 14:25:30 2010 : Info: Found Auth-Type = LDAP Tue Sep 28 14:25:30 2010 : Info: +- entering group LDAP {...} Tue Sep 28 14:25:30 2010 : Info: [ldap] login attempt by "ebellier" with password "xxxxxxx" Tue Sep 28 14:25:30 2010 : Info: [ldap] user DN: uid=ebellier,ou=Staff, o=mobistar.be Tue Sep 28 14:25:30 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 1 Tue Sep 28 14:25:30 2010 : Debug: [ldap] bind as uid=ebellier,ou=Staff, o=mobistar.be/Mamour20 to 192.168.154.50:389 Tue Sep 28 14:25:30 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fbcdb0 msgid 1 Tue Sep 28 14:25:30 2010 : Debug: [ldap] Bind was successful Tue Sep 28 14:25:30 2010 : Info: [ldap] user ebellier authenticated succesfully Tue Sep 28 14:25:30 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:25:30 2010 : Auth: Login OK: [ebellier/Mamour20] (from client 172.18.113.82/32 port 0) Tue Sep 28 14:25:30 2010 : Info: +- entering group post-auth {...} Tue Sep 28 14:25:30 2010 : Info: [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/172.18.113.82/reply-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.113.82/reply-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [reply_log] expand: %t -> Tue Sep 28 14:25:30 2010 Tue Sep 28 14:25:30 2010 : Info: ++[reply_log] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 1 to 172.18.113.82 port 3340 Tue Sep 28 14:25:30 2010 : Info: Finished request 3. Tue Sep 28 14:25:30 2010 : Debug: Going to the next request Tue Sep 28 14:25:30 2010 : Debug: Waking up in 4.9 seconds. Tue Sep 28 14:25:35 2010 : Info: Cleaning up request 3 ID 1 with timestamp +176 Tue Sep 28 14:25:35 2010 : Info: Ready to process requests. >From Nortel ERS : rad_recv: Access-Request packet from host 192.168.250.64 port 4439, id=186, length=60 User-Name = "ebellier" User-Password = "%\357\350\t\310}\341Ú¡9\327F\336F\034\364" NAS-IP-Address = 192.168.250.64 NAS-Port = 1 Tue Sep 28 14:22:40 2010 : Info: +- entering group authorize {...} Tue Sep 28 14:22:40 2010 : Info: ++[preprocess] returns ok Tue Sep 28 14:22:40 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.250.64/auth-detail-20100928 Tue Sep 28 14:22:40 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.250.64/auth-detail-20100928 Tue Sep 28 14:22:40 2010 : Info: [auth_log] expand: %t -> Tue Sep 28 14:22:40 2010 Tue Sep 28 14:22:40 2010 : Info: ++[auth_log] returns ok Tue Sep 28 14:22:40 2010 : Info: ++[chap] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[mschap] returns noop Tue Sep 28 14:22:40 2010 : Info: [suffix] No '@' in User-Name = "ebellier", looking up realm NULL Tue Sep 28 14:22:40 2010 : Info: [suffix] Found realm "DEFAULT" Tue Sep 28 14:22:40 2010 : Info: [suffix] Adding Stripped-User-Name = "ebellier" Tue Sep 28 14:22:40 2010 : Info: [suffix] Adding Realm = "DEFAULT" Tue Sep 28 14:22:40 2010 : Info: [suffix] Authentication realm is LOCAL. Tue Sep 28 14:22:40 2010 : Info: ++[suffix] returns ok Tue Sep 28 14:22:40 2010 : Info: [eap] No EAP-Message, not doing EAP Tue Sep 28 14:22:40 2010 : Info: ++[eap] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[unix] returns updated Tue Sep 28 14:22:40 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Sep 28 14:22:40 2010 : Info: [files] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:22:40 2010 : Info: [files] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] attempting LDAP reconnection Tue Sep 28 14:22:40 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] bind as / to 192.168.154.50:389 Tue Sep 28 14:22:40 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fb4500 msgid 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] Bind was successful Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 2 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass =GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be))) Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (&(cn=GF_FW_networkManagementProdAdmin)(|(&(objectClass=GroupOfNames)(member =uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be)))) request done: ld 0x1fb4500 msgid 3 Tue Sep 28 14:22:40 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group GF_FW_networkManagementProdAdmin Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: ++[files] returns noop Tue Sep 28 14:22:40 2010 : Info: [ldap] performing user authorization for ebellier Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 4 Tue Sep 28 14:22:40 2010 : Info: [ldap] looking for check items in directory... Tue Sep 28 14:22:40 2010 : Info: [ldap] looking for reply items in directory... Tue Sep 28 14:22:40 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Sep 28 14:22:40 2010 : Info: [ldap] Setting Auth-Type = LDAP Tue Sep 28 14:22:40 2010 : Info: [ldap] user ebellier authorized to use remote access Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:22:40 2010 : Info: ++[expiration] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[logintime] returns noop Tue Sep 28 14:22:40 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue Sep 28 14:22:40 2010 : Info: ++[pap] returns noop Tue Sep 28 14:22:40 2010 : Info: Found Auth-Type = LDAP Tue Sep 28 14:22:40 2010 : Info: +- entering group LDAP {...} Tue Sep 28 14:22:40 2010 : Info: [ldap] login attempt by "ebellier" with password "%ïè È}áÚ¡9×FÞF?ô" Tue Sep 28 14:22:40 2010 : Info: [ldap] user DN: uid=ebellier,ou=Staff, o=mobistar.be Tue Sep 28 14:22:40 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] bind as uid=ebellier,ou=Staff, o=mobistar.be/%ïè È}áÚ¡9×FÞF?ô to 192.168.154.50:389 Tue Sep 28 14:22:40 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fbcd90 msgid 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] Bind failed with invalid credentials Tue Sep 28 14:22:40 2010 : Info: ++[ldap] returns reject Tue Sep 28 14:22:40 2010 : Info: Failed to authenticate the user. Tue Sep 28 14:22:40 2010 : Auth: Login incorrect ( [ldap] Bind as user failed): [ebellier/%\357\350\t\310}\341Ú¡9\327F\336F\034\364] (from client 192.168.250.64 port 1) Tue Sep 28 14:22:40 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Tue Sep 28 14:22:40 2010 : Info: Using Post-Auth-Type Reject Tue Sep 28 14:22:40 2010 : Info: +- entering group REJECT {...} Tue Sep 28 14:22:40 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Sep 28 14:22:40 2010 : Info: ++[attr_filter.access_reject] returns updated Tue Sep 28 14:22:40 2010 : Info: Delaying reject of request 0 for 1 seconds Tue Sep 28 14:22:40 2010 : Debug: Going to the next request Tue Sep 28 14:22:40 2010 : Debug: Waking up in 0.9 seconds. Tue Sep 28 14:22:41 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 186 to 192.168.250.64 port 4439 Tue Sep 28 14:22:41 2010 : Debug: Waking up in 4.9 seconds. Tue Sep 28 14:22:46 2010 : Info: Cleaning up request 0 ID 186 with timestamp +6 Tue Sep 28 14:22:46 2010 : Info: Ready to process requests. <http://k-village/team_members/who_s_who/kpeople01.asp?login=ebellier> Eric Bellière Operation & Integration Expert ITNO/ISO/ISIO/LSS Mobistar NV/SA Avenue Jean Mermoz 32 6041 Gosselies cid:image003.jpg@01C961E5.77656AB0 Tel: +32 (0)2 745 7997 GSM: +32(0)495 55 1343

2 1