- Freeradius-Users - lists.freeradius.org

Cleartext username
by Kristoffer Milligan 26 Aug '10

26 Aug '10

Hello list, I am currently using FreeRADIUS as my AAA server for a WiMAX network. Authentication is working perfectly, and the server is performing well. As part of my infrastructure-design I need to be able to forcibly kick users off the radiolink. As far as I have understood, this needs to be done using CoA/Disconnect-Request packets forged to match the NAS requirement. So far, so good. I have set up this query in my accounting section: if("%{sql:SELECT value FROM radcheck WHERE UserName = '%{SQL-User-Name}' and attribute = 'Acct-Logout-Now'}") { update disconnect { Reply-Message = "You have been closed." } } as a small test. However, %{SQL-User-Name} is an encrypted version of the username, which of course will not match anything in my database. Thu Aug 26 11:16:42 2010 : Info: (2) expand: SELECT value FROM radcheck WHERE UserName = '%{SQL-User-Name}' and attribute = 'Acct-Logout-Now' -> SELECT value FROM radcheck WHERE UserName = '=8Ham=3D1=7A62345d3c567f85678749f233ebe4577fbad' and attribute = 'Acct-Logout-Now' Thu Aug 26 11:16:42 2010 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Thu Aug 26 11:16:42 2010 : Info: (2) SQL query did not return any results Thu Aug 26 11:16:42 2010 : Debug: rlm_sql (sql): Released sql socket id: 0 Thu Aug 26 11:16:42 2010 : Info: (2) expand: %{sql:SELECT value FROM radcheck WHERE UserName = '%{SQL-User-Name}' and attribute = 'Acct-Logout-Now'} -> Thu Aug 26 11:16:42 2010 : Info: (2) ? Evaluating ("%{sql:SELECT value FROM radcheck WHERE UserName = '%{SQL-User-Name}' and attribute = 'Acct-Logout-Now'}") -> FALSE Thu Aug 26 11:16:42 2010 : Info: (2) ++? if ("%{sql:SELECT value FROM radcheck WHERE UserName = '%{SQL-User-Name}' and attribute = 'Acct-Logout-Now'}") -> FALSE How can I get the username in a cleartext format? Thanks in advance, - Kristoffer Milligan

2 3

windows7 machine authentication
by alois blasbichler 26 Aug '10

26 Aug '10

Hello list We use freeradius with opendlap and machine-authentification (samba-pcs) for years with success. Windows xp and vista clients works fine. Now i wanted to authenticate a Windows 7 laptop and i get the following errors : [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop and then [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 I dont use certificates neither on the server and neither on the client side. I read in teh internet that also windows7 should work without certificates - is that true ? Wath can bee the problem ? Do you need more debug-output ? Thank you and by luis

7 10

Getting "Access-Reject" when using radtest
by kartik dadwal 26 Aug '10

26 Aug '10

Hi, OS: Ubuntu 9.10 Freeradius 2.1.0 (Installed using synaptic packet manager) I have installed FreeRadius server and now I am testing it with the root@kartik-laptop:/usr/local/etc/raddb# *radtest testing password 127.0.0.1 0 testing123* OUTPUT: Sending Access-Request of id 248 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=248, length=20 =============================================== On the server terminal: root@kartik-laptop:/etc/freeradius# *radiusd -X* FreeRADIUS Version 2.1.0, for host i686-pc-linux-gnu, built on Aug 17 2010 at 22:33:30 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 46548, id=248, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 248 to 127.0.0.1 port 46548 Waking up in 4.9 seconds. Cleaning up request 3 ID 248 with timestamp +2942 Ready to process requests. ======================================================= I am newbie trying to make Freeradius work, please help. -- Best Regards Kartik

2 1

Configuration Problem with FreeRadius, Unix Authentication, and WRT54G2 WAP
by Jonathan Black 26 Aug '10

26 Aug '10

First off: I'm trying to configure FreeRadius on a Qnap TS-239 Pro. I'm using ipkg to install freeradius. I've installed version 2.0.5-2 of freeradius. I'm attempting to set the system up so that users on the Qnap unit (The Radius Server) can use the same username and password to connect to wireless. So this is what I've done. I went into the the "users" file and added the following lines at the end of the file: ------------------------------------------------------------------------------------ DEFAULT Group=="Wireless_Users",Auth-type :=System Fall-Through = Yes ------------------------------------------------------------------------------------ At the end of the client.conf file I've added: ------------------------------------------------------------------------------------ client 192.168.1.183/32{ shortname ="WAP" secret = sharedsecret require_message_authenticator = no nastype = other } ------------------------------------------------------------------------------------ I went through and made the changes to the eap.conf that are listed in Section 3.2 of http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html . Anyway, when I attempt to connect to wireless with my iPhone, I'm getting rejected. I was running radiusd with "radiusd -X", and this is the output ------------------------------------------------------------------------------------ rad_recv: Access-Request packet from host 192.168.1.183 port 1053, id=55, length=158 User-Name = "testuser" NAS-IP-Address = 192.168.1.183 NAS-Port = 0 Called-Station-Id = "68-7F-74-23-A5-AC:test" Calling-Station-Id = "90-27-E4-50-B3-1C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200000d017465737475736572 Message-Authenticator = 0xb20d3523b73d726b86875844f6da1c8f +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry DEFAULT at line 202 ++[files] returns ok rad_check_password: Found Auth-Type System auth: type "System" +- entering group authenticate rlm_unix: Attribute "User-Password" is required for authentication. ++[unix] returns invalid auth: Failed to validate the user. Sending Access-Reject of id 55 to 192.168.1.183 port 1053 Finished request 11. Going to the next request Waking up in 4.9 seconds. ------------------------------------------------------------------------------------ If I enter "radtest testuser 123testing456 localhost 0 testing123" from the command line I receive: ------------------------------------------------------------------------------------ Sending Access-Request of id 98 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "123testing456" NAS-IP-Address = 192.168.3.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=98, length=20 Radius -X Debugging shows: rad_recv: Access-Request packet from host 127.0.0.1 port 36011, id=98, length=60 User-Name = "testuser" User-Password = "123testing456" NAS-IP-Address = 192.168.3.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 202 ++[files] returns ok rad_check_password: Found Auth-Type System auth: type "System" +- entering group authenticate ++[unix] returns ok Sending Access-Accept of id 98 to 127.0.0.1 port 36011 Finished request 12. Going to the next request ------------------------------------------------------------------------------------ I know that my iPhone is attempting to do EAP, and I see that it is rejecting the authentication attempt because it doesn't have a User-Password attribute set. I'm sure I've got this configured wrong somehow. Any help will be very much appreciated. Thanks!

2 1

Memory leak on reload
by Derek Chee 26 Aug '10

26 Aug '10

Hi, I have a FreeRADIUS 2.1.9 installation (compiled from source) running on Solaris 10 Sparc and I've run into a memory leak issue when reloading the configuration with a HUP signal. I have a very simple RADIUS setup with just an authorize and a users file. The users file is rather large at 41MB and over 110,000 records, but I've noticed that problem with the default empty users file, too. Starting up FreeRADIUS with -X, waiting until FreeRADIUS says "Ready to process requests." and checking the memory usage, I get this: # ./radiusd -X # ps -opid,vsz,rss,osz,args -p `pgrep radiusd` PID VSZ RSS SZ COMMAND 1379 250704 248448 31338 radiusd -X # pkill -HUP radiusd # ps -opid,vsz,rss,osz,args -p `pgrep radiusd` PID VSZ RSS SZ COMMAND 1379 488272 483376 61034 radiusd -X # pkill -HUP radiusd # ps -opid,vsz,rss,osz,args -p `pgrep radiusd` PID VSZ RSS SZ COMMAND 1379 725840 715856 90730 radiusd -X # pkill -HUP radiusd # ps -opid,vsz,rss,osz,args -p `pgrep radiusd` PID VSZ RSS SZ COMMAND 1379 963408 705800 120426 radiusd -X Eventually the radiusd process takes up all of the memory on the system and the system grinds to a halt. Does anybody have any suggestions on what might be causing this and how to fix it? -- Derek

2 2

LDAP VPN Auth yet not in group?
by freeradius＠corwyn.net 24 Aug '10

24 Aug '10

I authenticate VPN users where the VPN Server authenticates against a LDAP server and FreeRadius 2.1.8 on CentOS. That generally, works fine. I'm using a user account to authenticate the radius server against AD for the queries. What's odd is tho the other user accounts work, I can't authenticate with that actual user account (even though it's in the same Security group). Multiple other users in the security group VPN_Users work. What seems (to me) to be odd in particular is I see ue Aug 24 16:41:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") Tue Aug 24 16:41:57 2010 : Info: ? Evaluating (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Tue Aug 24 16:41:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Tue Aug 24 16:41:57 2010 : Info: ++- entering if (Huntgroup-Name == "VPN_Huntgroup") {...} Tue Aug 24 16:41:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") Tue Aug 24 16:41:57 2010 : Debug: [ldap] Entering ldap_groupcmp() which makes me think it sees the user _sonicwall in the VPN_Users group, but then I get: Tue Aug 24 16:41:57 2010 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Info: ? Evaluating (Ldap-Group == "VPN_Users") -> FALSE Tue Aug 24 16:41:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") -> FALSE Any insights appreciated. Thanks Rick Full output below. rad_recv: Access-Request packet from host 10.4.1.241 port 1196, id=26, length=126 User-Name = "_sonicwall" MS-CHAP-Challenge = 0x780006c8503fee2cdf1d2505fe99f322 MS-CHAP2-Response = 0x01002f06ff27350f7121396d65349fc61ca90000000000000000675d0094d1b342dc5f172dc60bd9fd258fb94fc68aac5ff6 NAS-IP-Address = 10.4.1.241 NAS-Port = 0 Tue Aug 24 16:41:57 2010 : Info: server server_vpn { Tue Aug 24 16:41:57 2010 : Info: +- entering group authorize {...} Tue Aug 24 16:41:57 2010 : Info: ++[preprocess] returns ok Tue Aug 24 16:41:57 2010 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Tue Aug 24 16:41:57 2010 : Info: ++[mschap] returns ok Tue Aug 24 16:41:57 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 24 16:41:57 2010 : Info: [files] expand: OU=Enterprise,DC=int,DC=invtitle,DC=com -> OU=Enterprise,DC=int,DC=invtitle,DC=com Tue Aug 24 16:41:57 2010 : Info: [files] expand: %{Stripped-User-Name} -> Tue Aug 24 16:41:57 2010 : Info: [files] ... expanding second conditional Tue Aug 24 16:41:57 2010 : Info: [files] expand: %{User-Name} -> _sonicwall Tue Aug 24 16:41:57 2010 : Info: [files] expand: (&(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=person)) -> (&(sAMAccountname=_sonicwall)(objectClass=person)) Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=invtitle,DC=com, with filter (&(sAMAccountname=_sonicwall)(objectClass=person)) Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom))) Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=invtitle,DC=com, with filter (&(cn=VPN_Users)(|(&(objectClass=GroupOfNames)(member=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom)))) Tue Aug 24 16:41:57 2010 : Debug: [ldap] object not found Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] performing search in CN=_sonicwall,OU=Service Accounts,OU=Special User Accounts,OU=Enterprise,DC=int,DC=invtitle,DC=com, with filter (objectclass=*) Tue Aug 24 16:41:57 2010 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Info: ++[files] returns noop Tue Aug 24 16:41:57 2010 : Info: [ldap] performing user authorization for _sonicwall Tue Aug 24 16:41:57 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Tue Aug 24 16:41:57 2010 : Info: [ldap] ... expanding second conditional Tue Aug 24 16:41:57 2010 : Info: [ldap] expand: %{User-Name} -> _sonicwall Tue Aug 24 16:41:57 2010 : Info: [ldap] expand: (&(sAMAccountname=%{%{Stripped-User-Name}:-%{User-Name}})(objectClass=person)) -> (&(sAMAccountname=_sonicwall)(objectClass=person)) Tue Aug 24 16:41:57 2010 : Info: [ldap] expand: OU=Enterprise,DC=int,DC=invtitle,DC=com -> OU=Enterprise,DC=int,DC=invtitle,DC=com Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=invtitle,DC=com, with filter (&(sAMAccountname=_sonicwall)(objectClass=person)) Tue Aug 24 16:41:57 2010 : Info: [ldap] looking for check items in directory... Tue Aug 24 16:41:57 2010 : Info: [ldap] looking for reply items in directory... Tue Aug 24 16:41:57 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Aug 24 16:41:57 2010 : Info: [ldap] user _sonicwall authorized to use remote access Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Info: ++[ldap] returns ok Tue Aug 24 16:41:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") Tue Aug 24 16:41:57 2010 : Info: ? Evaluating (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Tue Aug 24 16:41:57 2010 : Info: ++? if (Huntgroup-Name == "VPN_Huntgroup") -> TRUE Tue Aug 24 16:41:57 2010 : Info: ++- entering if (Huntgroup-Name == "VPN_Huntgroup") {...} Tue Aug 24 16:41:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") Tue Aug 24 16:41:57 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Aug 24 16:41:57 2010 : Info: expand: OU=Enterprise,DC=int,DC=invtitle,DC=com -> OU=Enterprise,DC=int,DC=invtitle,DC=com Tue Aug 24 16:41:57 2010 : Info: expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom))) Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] performing search in OU=Enterprise,DC=int,DC=invtitle,DC=com, with filter (&(cn=VPN_Users)(|(&(objectClass=GroupOfNames)(member=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3d_sonicwall\2cOU\3dService Accounts\2cOU\3dSpecial User Accounts\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dinvtitle\2cDC\3dcom)))) Tue Aug 24 16:41:57 2010 : Debug: [ldap] object not found Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Aug 24 16:41:57 2010 : Debug: [ldap] performing search in CN=_sonicwall,OU=Service Accounts,OU=Special User Accounts,OU=Enterprise,DC=int,DC=invtitle,DC=com, with filter (objectclass=*) Tue Aug 24 16:41:57 2010 : Debug: rlm_ldap::ldap_groupcmp: ldap_get_values() failed Tue Aug 24 16:41:57 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Aug 24 16:41:57 2010 : Info: ? Evaluating (Ldap-Group == "VPN_Users") -> FALSE Tue Aug 24 16:41:57 2010 : Info: +++? if (Ldap-Group == "VPN_Users") -> FALSE Tue Aug 24 16:41:57 2010 : Info: +++- entering else else {...} Tue Aug 24 16:41:57 2010 : Info: ++++[reject] returns reject Tue Aug 24 16:41:57 2010 : Info: +++- else else returns reject Tue Aug 24 16:41:57 2010 : Info: ++- if (Huntgroup-Name == "VPN_Huntgroup") returns reject Tue Aug 24 16:41:57 2010 : Auth: Invalid user: [_sonicwall] (from client VPN_SOHO port 0) Tue Aug 24 16:41:57 2010 : Info: } # server server_vpn Tue Aug 24 16:41:57 2010 : Info: Using Post-Auth-Type Reject Tue Aug 24 16:41:57 2010 : Info: +- entering group REJECT {...} Tue Aug 24 16:41:57 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> _sonicwall Tue Aug 24 16:41:57 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Aug 24 16:41:57 2010 : Info: ++[attr_filter.access_reject] returns updated Tue Aug 24 16:41:57 2010 : Info: Delaying reject of request 17 for 1 seconds Tue Aug 24 16:41:57 2010 : Debug: Going to the next request Tue Aug 24 16:41:57 2010 : Debug: Waking up in 0.9 seconds. Tue Aug 24 16:41:58 2010 : Info: Sending delayed reject for request 17 Sending Access-Reject of id 26 to 10.4.1.241 port 1196 Tue Aug 24 16:41:58 2010 : Debug: Waking up in 4.9 seconds. Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

1 0

1st login Script sample
by Sumon Ahmed 24 Aug '10

24 Aug '10

Dear Sir, I've tried a lot to find out the solution for auto expiration day limit from 1st login, but no luck. I'm not that much expert in freeradius. I'm planning 15 days limit from user 1st login. I'll be grateful if anyone can give me a step by step solution for this problem. exec Post-Auth unlang Thanks, Sumon

3 3

Limit of 68 entries per session?
by Jay Kuhne (jkuhne) 24 Aug '10

24 Aug '10

Hello, I am attempting to create ACLs for a session (dual-stack v4 & v6) with freeradius using av-pair. I am finding that with fall-through, I am limited to 68 lines no matter what the content. Does anyone know off-hand if this is a configuration limitation or does it have to do with RADIUS packet size? For example, you can see in this Radusd -X output, the last 2 permit statements here are these yet I have another 66 entries I would like to add. Cisco-AVPair += "ip:inacl#3=permit ip 50.3.1.1 0.0.255.255 any" Cisco-AVPair += "ip:inacl#4=permit ip 50.4.1.1 0.0.255.255 any" Thanks in advance if anyone has the answer. Jay [pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 144 to 5.28.6.10 port 1645 Service-Type += Framed-User Framed-Protocol += PPP Framed-IPv6-Prefix += 15:0:0:1::/64 Cisco-AVPair += "ipv6:inacl#1=permit ipv6 15::1:0:0:0:0/64 any" Cisco-AVPair += "ipv6:inacl#2=permit tcp 1::1/64 any eq 50001" Cisco-AVPair += "ip:inacl#1=permit ip host 21.1.1.2 any" Cisco-AVPair += "ip:inacl#2=permit tcp 192.1.1.1 0.0.255.255 any eq 11" Framed-IP-Address += 21.1.1.2 X-Ascend-Maximum-Time == 10000 X-Ascend-Idle-Limit == 30000 Cisco-AVPair += "ipv6:inacl#3=permit ipv6 any 31:1:1:3:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#4=permit ipv6 any 31:1:1:4:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#5=permit ipv6 any 31:1:1:5:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#6=permit ipv6 any 31:1:1:6:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#7=permit ipv6 any 31:1:1:7:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#8=permit ipv6 any 31:1:1:8:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#9=permit ipv6 any 31:1:1:9:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#10=permit ipv6 any 31:1:1:a:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#11=permit ipv6 any 31:1:1:b:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#12=permit ipv6 any 31:1:1:c:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#13=permit ipv6 any 31:1:1:d:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#14=permit ipv6 any 31:1:1:e:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#15=permit ipv6 any 31:1:1:f:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#16=permit ipv6 any 31:1:1:10:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#17=permit ipv6 any 31:1:1:11:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#18=permit ipv6 any 31:1:1:12:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#19=permit ipv6 any 31:1:1:13:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#20=permit ipv6 any 31:1:1:14:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#21=permit ipv6 any 31:1:1:15:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#22=permit ipv6 any 31:1:1:16:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#23=permit ipv6 any 31:1:1:17:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#24=permit ipv6 any 31:1:1:18:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#25=permit ipv6 any 31:1:1:19:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#26=permit ipv6 any 31:1:1:1a:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#27=permit ipv6 any 31:1:1:1b:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#28=permit ipv6 any 31:1:1:1c:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#29=permit ipv6 any 31:1:1:1d:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#30=permit ipv6 any 31:1:1:1e:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#31=permit ipv6 any 31:1:1:1f:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#32=permit ipv6 any 31:1:1:20:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#33=permit ipv6 any 31:1:1:21:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#34=permit ipv6 any 31:1:1:22:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#35=permit ipv6 any 31:1:1:23:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#36=permit ipv6 any 31:1:1:24:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#37=permit ipv6 any 31:1:1:25:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#38=permit ipv6 any 31:1:1:26:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#39=permit ipv6 any 31:1:1:27:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#40=permit ipv6 any 31:1:1:28:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#41=permit ipv6 any 31:1:1:29:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#42=permit ipv6 any 31:1:1:2a:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#43=permit ipv6 any 31:1:1:2b:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#44=permit ipv6 any 31:1:1:2c:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#45=permit ipv6 any 31:1:1:2d:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#46=permit ipv6 any 31:1:1:2e:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#47=permit ipv6 any 31:1:1:2f:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#48=permit ipv6 any 31:1:1:30:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#49=permit ipv6 any 31:1:1:31:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#50=permit ipv6 any 31:1:1:32:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#51=permit ipv6 any 31:1:1:33:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#52=permit ipv6 any 31:1:1:34:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#53=permit ipv6 any 31:1:1:35:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#54=permit ipv6 any 31:1:1:36:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#55=permit ipv6 any 31:1:1:37:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#56=permit ipv6 any 31:1:1:38:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#57=permit ipv6 any 31:1:1:39:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#58=permit ipv6 any 31:1:1:3a:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#59=permit ipv6 any 31:1:1:3b:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#60=permit ipv6 any 31:1:1:3c:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#61=permit ipv6 any 31:1:1:3d:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#62=permit ipv6 any 31:1:1:3e:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#63=permit ipv6 any 31:1:1:3f:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#64=permit ipv6 any 31:1:1:40:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#65=permit ipv6 any 31:1:1:41:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#66=permit ipv6 any 31:1:1:42:1:1:1:1/64" Cisco-AVPair += "ipv6:inacl#67=permit ipv6 any 31:1:1:43:1:1:1:1/64" Cisco-AVPair += "ip:inacl#3=permit ip 50.3.1.1 0.0.255.255 any" Cisco-AVPair += "ip:inacl#4=permit ip 50.4.1.1 0.0.255.255 any" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 143 with timestamp +11 Cleaning up request 1 ID 144 with timestamp +11 Ready to process requests.

2 2

Debug option to view generated key
by Vineet Verma 24 Aug '10

24 Aug '10

Does FreeRADIUS offer a debug option that displays the key generated during EAP-TLS (or the unencrypted MPPE keys sent out)? I understand this would be a security risk in a live network but it would be helpful for debugging issues found in the lab. Thanks, Vineet

2 1

Screwy RHEL problem
by Daniel Davidson 23 Aug '10

23 Aug '10

I am migrating our system to freeradius2, I have a test environment that works well on my fedora system that I am moving to a new server. I can authenticate with the server perfectly if I start the server using radiusd -X, however if I then cancel that and run it with the RHEL startup script it doesnt work. I messed with the startup script so that it would run with -X, and noticed my problem right away. If I run the raidusd -X from command line it loads the ldap module, when I run the script, it doesnt load the ldap module. I see no reason for this to happen, does anyone have any experience with this problem? If so, what is the solution? I double checked the permissions and they should be correct. thanks, Dan [root@radius modules]# radiusd -X FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Dec 30 2009 at 13:46:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ ... including configuration file /etc/raddb/modules/ldap ...... successful auth [root@radius modules]# /etc/init.d/radiusd start Starting RADIUS server: FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Dec 30 2009 at 13:46:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ .... no ldap line ..... failed auth

1 1