- Freeradius-Users - lists.freeradius.org

NAS type with NAS defined in SQL (FR 2.1.6)
by John Doppke 15 Sep '10

15 Sep '10

I've tried dozens of ways but I can't figure out how to get the NAS type for clients defined in MySQL. The column is populated, the query has the correct fields matching the source code for the module. The module appears to populate the address, shortname, nastype, secret and virtual server. Yet when I expand "${client:nastype}" I only get a value for clients defined in the clients file. SQL clients are always blank. I know I could do a special SQL query on each request, but I shouldn't have to. The data should already be in a variable. -John

2 1

Error: "Discarding duplicate request..."
by Mike Diggins 15 Sep '10

15 Sep '10

Our students have returned this week, and I've noticed a couple new messages logged to my FreeRadius 2.1.3 server. When it happens, my controllers fail over to the secondary Radius server. This has happened a few times. My Radius servers are only lightly loaded, and only configured to do authentication. No databases. Any idea what might be causing this? Sep 15 10:06:44 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 218 due to unfinished request 35236 Sep 15 10:07:01 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 219 due to unfinished request 35237 Sep 15 10:07:24 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:41 prad02 radiusd[10632]: WARNING: Unresponsive child for request 35239, in module component Sep 15 10:07:52 prad02 radiusd[10632]: WARNING: Unresponsive child for request 35240, in module component Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-7 port 32769 - ID: 173 due to unfinished request 35240 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-7 port 32769 - ID: 173 due to unfinished request 35240 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 221 due to unfinished request 35244 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 221 due to unfinished request 35244 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client FHSWLC-1 port 32768 - ID: 205 due to unfinished request 35245 -Mike

2 1

Question about radiusclient
by Ali Majdzadeh 15 Sep '10

15 Sep '10

Hello All In the radiusclient configuration file there is an option called auth_order which accepts two values (local, radius). If we set this option as follows: auth_order radius,local doesn't it means that if the authentication fails using RADIUS it should be performed using the /etc/passwd file? In other words, if we define all those users, which are not mentioned as radius users, as local users of the machine where radiusclient runs, it should be OK. Is that right? I have tested the so-called scenario, but it does not work. Does anyone have any experiences regarding this issue? Warm Regards Ali Majdzadeh Kohbanani

1 0

Policy Based on NAS IP address
by Nasser Heidari 15 Sep '10

15 Sep '10

Hi, Is it possible to apply special policy based on NAS IP Address, for example I want to check originating ip address for special NAS or set IP Address pool for the other NAS . Thanks in advance

2 1

Echo Effect Help
by Deepak 15 Sep '10

15 Sep '10

Hi, I don't know how to explain this problem. Sounds completely crazy. I have a freeRADIUS 2.1.7 (in CentOS 5.5) setup with MySQL backend to be used with dd-wrt chilli. I have tested in three separate line exchanging the location of radius and chilli but in particular line I found out that radius is behaving abnormally, which I called Echo Effect. When radius is put in that particular line, it doesn't respond to the request from chilli on one particular line of the other two lines. For Example: If radius is in Line 1, it processes the request from Line 2 but completely ignores from Line 3. By line I mean three separate DSL lines. If NAS is put inside the same subnet and authenticated locally, 'radacct' table gets about 20+ entries for single account login. Also noticed in debug mode that it is updating accounting information every second, while account intermin interval is set for every minute. After sometime 'radacct' table gets empty and doesn't get updated even if users are still logged in. To check that phenomenon, I left it on with about 10 users logged in. After sometime it crashed. This kind of repetition happens only in that line (with local authentication) but not on other lines. Same experiments done with radius on other two lines does not show any of these symptoms. 1. Does anyone have any experience in this kind of problem before? 2. Regarding the ignoring of request from particular line, does radius have some kind of self defense mechanism by blocking IP? Where to look for the clue? 3. What can trigger account update every second and multiple entry in 'radacct'? Regards Deepak

2 2

FreeRadius crashed on loading test.
by Konstantin Chekushin 15 Sep '10

15 Sep '10

Good day. I want to continue Dinh Pham Cong topic ((FreeRadius crashed on accounting load tests with 1000 concurrent clients - Tue, 10 Nov 2009 01:39:30 -0800 )) I use freeradius 2.1.9 Linux myhost 2.6.26-2-amd64 Some info from radiusd.conf : -------------- max_request_time = 30 cleanup_delay = 5 max_requests = 2048 hostname_lookups = no allow_core_dumps = yes regular_expressions     = yes extended_expressions    = yes log {         destination = files         file = ${logdir}/radius.log         syslog_facility = daemon         stripped_names = no         auth = yes         auth_badpass = yes         auth_goodpass = yes } checkrad = ${sbindir}/checkrad security {         max_attributes = 200         reject_delay = 1         status_server = yes } proxy_requests  = no $INCLUDE clients.conf thread pool {         start_servers = 5         max_servers = 32         min_spare_servers = 3         max_spare_servers = 10         max_requests_per_server = 0 } -------------- I'm using rlm_sql for my own ippool module: database = "mysql" num_sql_socks = 32 I've started ./radius -xxx -f I've prepared huge file with auth requests for sending: Packet-Type = Access-Request NAS-Identifier = "nas1" User-Name = "test" User-Password = "test" NAS-IP-Address = 212.93.99.126 NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "37129111111" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Acct-Session-Id = "d45d637e72d54736" Acct-Multi-Session-Id = "d45d637e396391a1" Packet-Type = Access-Request NAS-Identifier = "nas1" User-Name = "test2" User-Password = "test2" NAS-IP-Address = 212.93.99.126 NAS-Port-Type = Virtual Called-Station-Id = "3" Calling-Station-Id = "37126222222" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Acct-Session-Id = "d45d637e5b97ac8e" Acct-Multi-Session-Id = "d45d637e2dc41c4e" and so on then, I've run radclient: cat auth-det.log |/usr/local/freeradius2.1.9/bin/radclient -c 1 -p 500 -q localhost:1812 auth testkey my module process requests too slow (I will discover this problem in few days, this is mysql-db-cluster issues), but this test causes radiusd segmentation fault. I've grabbed the core and look what it shows: Core was generated by `./radiusd -xxx -f'. Program terminated with signal 11, Segmentation fault. [New process 7173] [New process 7180] [New process 7181] [New process 7182] [New process 7183] [New process 7185] [New process 7187] [New process 7188] [New process 7191] [New process 7193] [New process 7196] [New process 7197] [New process 7174] [New process 7199] [New process 7177] [New process 7202] [New process 7203] [New process 7205] [New process 7176] [New process 7175] [New process 7184] [New process 7186] [New process 7189] [New process 7190] [New process 7192] [New process 7194] [New process 7195] [New process 7198] [New process 7200] [New process 7201] [New process 7204] [New process 7206] [New process 7107] #0  request_pre_handler (request=0xb493fc20) at event.c:1769 1769            if (request->packet->dst_port == 0) { (gdb) bt #0  request_pre_handler (request=0xb493fc20) at event.c:1769 #1  0x0806e404 in radius_handle_request (request=0xb493fc20, fun=0x804ef20 <rad_authenticate>) at event.c:3728 #2  0x08066970 in request_handler_thread (arg=0xae9cbf8) at threads.c:493 #3  0xb780e4c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #4  0xb75b684e in clone () from /lib/i686/cmov/libc.so.6 And here is last breath of my radius (from radius.log) Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16359 in component  module . Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16366 in component  module . Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16369 in component  module . Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16383 in component  module . Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16169 ID 189 with timestamp +952 Tue Sep 14 16:44:43 2010 : Info: Child is finally responsive for request 14864 Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16165 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16186 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16189 in component post-auth module lmtsqlippool1. *** Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16241 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16243 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16223 ID 21 with timestamp +952 Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16173 ID 190 with timestamp +952 Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16165 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16186 in component post-auth module lmtsqlippool1. *** Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16241 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16243 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16174 ID 151 with timestamp +952 Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16177 ID 58 with timestamp +952 Tue Sep 14 16:44:44 2010 : Info: Cleaning up request 16181 ID 60 with timestamp +952 Tue Sep 14 16:44:44 2010 : Debug: rlm_sql_mysql: query:  COMMIT Tue Sep 14 16:44:44 2010 : Info: [lmtsqlippool1]        expand: UPDATE ippool SET active=1, username=%{Calling-Station-Id} WHERE username=0 AND iprange_id IN (2) LIMIT 1 -> UPDATE ippool SET active=1, username=37126333333 WHERE username=0 AND iprange_id IN (2) LIMIT 1 Tue Sep 14 16:44:44 2010 : Debug: rlm_sql_mysql: query:  UPDATE ippool SET active=1, username=37126333333 WHERE username=0 AND iprange_id IN (2) LIMIT 1 Tue Sep 14 16:44:44 2010 : Debug: rlm_sql (sql1): Released sql socket id: 19 Tue Sep 14 16:44:44 2010 : Info: ++++[lmtsqlippool1] returns ok Tue Sep 14 16:44:44 2010 : Info: +++- policy redundant returns ok Tue Sep 14 16:44:44 2010 : Info: ++- else else returns ok Tue Sep 14 16:44:44 2010 : Info: } # server localonly Tue Sep 14 16:44:44 2010 : Info: request 16165 was cancelled. Tue Sep 14 16:44:44 2010 : Info: Finished request 16165. Tue Sep 14 16:44:44 2010 : Debug: Going to the next request Tue Sep 14 16:44:44 2010 : Debug: Thread 1 waiting to be assigned a request Tue Sep 14 16:44:44 2010 : Debug: Thread 1 got semaphore Tue Sep 14 16:44:44 2010 : Debug: Thread 1 handling request 16244, (20 handled so far) Looks like a bug, am I right?

3 3

detail logging not right with IPv6 clients
by Alan Buxey 15 Sep '10

15 Sep '10

hi, believe I have found a small bugette in FreeRADIUS. Although I'm posting to the list to ensure I'm not just being silly or if there is another way to get the result. whilst our config has been tweaked to local requirements, we are running the pretty much standard detail.log module which dumps auth log etc into a subdirectory of the radius log directory eg radacct/127.0.0.1/auth-log-XXXXXXXX or such however, this only works when the client is using IPv4. when the client is using IPv6 then this directory is not made and therefore no nice detail logs are kept for those things...(well, they are, but read on......) ( and its not quite true in our case as we ALSO use another detail module and the buffered-sql virtual server..thanks very much, we are saved. ) however, I'm concerned for those who dont tweak and this 'out of box' detail.log should work..... obviously, its to do with the fact it uses %{Client-IP-Address} as part of the detailfile construction as the logs show: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct//auth-detail-20100914 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct//reply-detail-20100914 and thus all of the detail logs for ANY IPv6 client get munged into the top level directory. alan

2 2

Failed default PAP and PEAP in CentOS
by Javier Richard Quinto Ancieta 14 Sep '10

14 Sep '10

CentOS 5.4 installing freeradius from the default base repository freeradius-1.1.3-1.5.el5_4 If I add, to the top of /etc/raddb/users: bob Cleartext-Password := "hello" Then when I attempt to start freeradius I get: /etc/raddb/users[1]: Parse error (check) for entry bob: Unknown attribute "Cleartext-Password" But I added to the top of /etc/raddb/users of the next way: user User-Password == "pass" Auth-Type := EAP And It's Ok. Now I updated the freeradius to version 2 and I did the same configuration, now I have in users file user Cleartext-Password := "pass" And I do radiusd -X and It's Ok But when I added to the top of /etc/raddb/users of the next way: userY User-Password == "passY" Auth-Type := Local I have the next fail: [root@73 raddb]# radiusd -X FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 200.37.45.97 { require_message_authenticator = no secret = "inictel" shortname = "AP-RADIUS" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/radiuskeycert.pem" certificate_file = "/etc/raddb/certs/radiuskeycert.pem" CA_file = "/etc/raddb/certs/cacert.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Enter PEM pass phrase: Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 52849, id=171, length=58 User-Name = "userYY" User-Password = "passYY" NAS-IP-Address = 0.0.0.73 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "userYY", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> userYY attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 171 to 127.0.0.1 port 52849 Waking up in 4.9 seconds. -- Quinto Ancieta Javier Richard jquinto(a)inictel-uni.edu.pe, richardqa(a)gmail.com telf: 9931-78569-5213902-3461808-533 Remember: Nothing is impossible, because the dreams of yesterday are the hopes of today and tomorrow can become a reality.

3 2

Freeradius + MySql + Wireless Clients without certificates
by Esteban TALAVERA 14 Sep '10

14 Sep '10

Hi I´ll like to know if there is a way to configurates a Radius server + Mysql to authenticate Wireless clients via a Cisco AP without certificates (EAP TLS), only a username and password Thanks -- *Esteban Talavera*

5 10

passing VLAN tag to clients
by matteo＠crs4.it 14 Sep '10

14 Sep '10

Hello, I'm using Freeradius 2.1.8 on Fedora 13 with EAP-TTL and PAP with inner authentication with OpenLDAP as backend. Everything is working fine, but the problem is that I haven't an OpenLDAP "Radius oriented", that is there is no VLAN info in my LDIFs. So, is there a way, external to the authentication process, to pass the vlan tag to the clients so that the ports they're attached to might join the correct vlan? Thanks a lot ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1