- Freeradius-Users - lists.freeradius.org

Fwd: FreeRadius2&MySQL
by Student University 15 Aug '10

15 Aug '10

Dears , I am planing to migrate from Aradial to FreeRadius2 and i currently have 10000 subscribers so can please guide me of how i can setup the freeradius 2 with MYSQL to be 100% ready for such production ,,,, Thanks in advanced ,,,

6 9

SqlCounter reload after initial authentication
by tadiguy＠verizon.net 14 Aug '10

14 Aug '10

I'm using Freeradius + Chillispot+MySql for hotspot. Sqlcounter noresetcounter works fine for prepaid access time, however the counter is loaded only once when the user first authenticate. This means that even if Max-All-Session changes after initial logon (as it happens when the user adds more credit) the user is session is still terminated at the end of the initial count down. How can I force Freeradius sqlcounter to re-load and begin counting down when Max-All-Session is updated after initial authentication? If this is not possible any workaround or hacks to accomplish this behaviour will be greatly appreciated. Thanks.

3 2

pam_auth_radius - Map radius user to local account?
by Cory Johnson 14 Aug '10

14 Aug '10

Greetings, I have several Linux and BSD servers that I would like to authenticate against my FreeRADIUS server. My question is, do I have to create unix users on each server that match the names of the radius user that I am logging as? For example, could users logging in via radius be automatically "mapped" to a single unix account, no matter what RADIUS credentials they used? Or maybe give users a different unix account depending on the LDAP group they are in? If anyone can point me in the right direction that'd be great. Or if I, in fact, do not want to do this, please let me know. =) --CJ

1 0

FreeRadius and Redundant LDAP Problems
by Kory Wheatley 13 Aug '10

13 Aug '10

am trying to setup what I thought should be a fairly simple Freeradius configuration but I am having problems. Simply put I would like FreeRadius to authenticate against our LDAP servers and look into a couple groups to see if the user is authorized. I would also like to have redundant ldap servers so that if one went down for maintenance or other reasons users could still authenticate. I can get Freeradius to work with one LDAP server, but when I try to implement the redundant I have not had any success. According to the debug log, it is find the group the user belongs to correctly, but instead of setting the Auth-Type to LDAP it is setting it to PAP and rejecting. When I configure the system for one LDAP server to Auth-Type is LDAP and everything works. It is probably something simple that I am missing, and would appreciate any suggestions. I have included the debug log below and the configuration files, I have removed all the comments out of the configuration files to be under the 100k size restriction for the list. Thanks Output from request in debugging mode: rad_recv: Access-Request packet from host 127.0.0.1 port 47611, id=245, length=60 User-Name = "testuser" User-Password = "testpassword" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [ldap-server1] Entering ldap_groupcmp() [files] expand: ou=people,o=test,o=isp -> ou=people,o=test,o=isp [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> testuser [files] expand: (uid=%{%{Stripped-User-Name}:- %{User-Name}}) -> (uid=testuser) [ldap-server1] ldap_get_conn: Checking Id: 0 [ldap-server1] ldap_get_conn: Got Id: 0 [ldap-server1] attempting LDAP reconnection [ldap-server1] (re)connect to ldapserver.somedomain.com:389, authentication 0 [ldap-server1] bind as uid=testuser, ou=people, o=test, o=isp/testpassword to ldapserver.somedomain.com:389 [ldap-server1] waiting for bind result ... [ldap-server1] Bind was successful [ldap-server1] performing search in ou=people,o=test,o=isp, with filter (uid=testuser) [ldap-server1] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquem ember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dtestuser\2cou\3dpeople\2co\3dtest\2co\3disp))(&(o bjectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestuser\2cou\3dpeople\2co\3dtest\2co\3disp))) [ldap-server1] ldap_get_conn: Checking Id: 0 [ldap-server1] ldap_get_conn: Got Id: 0 [ldap-server1] performing search in cn=DialupFS,ou=Groups,o=test,o=isp, with filter (|(&(objectClass=GroupOfNames)(member=uid\ 3dtestuser\2cou\3dpeople\2co\3dtest\2co\3disp))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestuser\2cou\3dpeople\2co\ 3dtest\2co\3disp))) rlm_ldap::ldap_groupcmp: User found in group cn=DialupFS,ou=Groups,o=test,o=isp [ldap-server1] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 166 ++[files] returns ok ++- entering policy redundant {...} [ldap-server1] performing user authorization for testuser [ldap-server1] expand: %{Stripped-User-Name} -> [ldap-server1] ... expanding second conditional [ldap-server1] expand: %{User-Name} -> testuser [ldap-server1] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap-server1] expand: ou=people,o=test,o=isp -> ou=people,o=test,o=isp [ldap-server1] ldap_get_conn: Checking Id: 0 [ldap-server1] ldap_get_conn: Got Id: 0 [ldap-server1] performing search in ou=people,o=test,o=isp, with filter (uid=testuser) [ldap-server1] looking for check items in directory... [ldap-server1] sambaNtPassword -> NT-Password == 0x4234354137334235383034463441323531343346353339333433413430363642 [ldap-server1] sambaLmPassword -> LM-Password == 0x3036323444434332394538433236434346463137333635464146314646453839 [ldap-server1] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap-server1] user testuser authorized to use remote access [ldap-server1] ldap_release_conn: Release Id: 0 +++[ldap-server1] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testpassword" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 245 to 127.0.0.1 port 47611 Reply-Message = "FS User Authorized" Waking up in 4.9 seconds. Cleaning up request 0 ID 245 with timestamp +48 Ready to process requests. Default File: authorize { preprocess chap mschap User File: DEFAULT ldap-server1-Ldap-Group == "cn=DialupFS,ou=Groups,o=test,o=isp" Reply-Message = "FS User Authorized" DEFAULT ldap-server1-Ldap-Group == "cn=DialupST,ou=Groups,o=test,o=isp" Reply-Message = "ST User Authorized" DEFAULT ldap-server2-Ldap-Group == "cn=DialupFS,ou=Groups,o=test,o=isp" Reply-Message = "FS User Authorized" DEFAULT ldap-server2-Ldap-Group == "cn=DialupST,ou=Groups,o=test,o=isp" Reply-Message = "ST User Authorized" DEFAULT Auth-Type := Reject Reply-Message = "User Not Authorized" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP ldap module file: ldap ldap-server1 { server = "ldapserver.somedomain.com" identity = "uid=raduser, ou=people, o=test, o=isp" password = testpassword basedn = "ou=people,o=test,o=isp" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueName s)( uniquemember=%{control:Ldap-UserDn})))" } ldap ldap-server2 { server = "ldapserver2.somedomain.com" identity = "uid=raduser, ou=people, o=test, o=isp" password = testpassword basedn = "ou=people,o=test,o=isp" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueName s)( uniquemember=%{control:Ldap-UserDn})))" } The radiusd.conf file: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr ldap-server1 ldap-server2 expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ suffix eap { ok = return } unix files redundant { ldap-server1 ldap-server2 } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant { ldap-server1 ldap-server2 } } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap }

4 11

Stripping a realm in EAP
by David Peterson 13 Aug '10

13 Aug '10

We have a working radius server and are trying to authenticate using EAP-TTLS with a stripped username. The username sent is 8888(a)WiMAX.com, the realm is defined without the nostrip option. However once it's inside the inner-tunnel, the username and domain are authenticated against the sql server instead of the stripped username. We are using a local proxy for the realm. David

1 0

simultaneous logins
by tyllerd 13 Aug '10

13 Aug '10

Hi, I have searched on the mailing list and I see that it is suggested to limit simultaneous users by doing user,simultaneous-use,:=,1 I just need to know does this limit user to one login on freeradius or on that nas? as I add this value into the radcheck table. and I try login twice from the same NAS, but the second login fails. Then I try login from one NAS and then again from another NAS and it works. So does simultaneous-use only tell the NAS to let user X login once or is supposed to be server side? Do I need to right a script to do it server side? Thank you -- View this message in context: http://old.nabble.com/simultaneous-logins-tp29426841p29426841.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Freeradius2 + LDAP of Lotus Notes
by rrperez 13 Aug '10

13 Aug '10

I have configured my Freeradius2 server to authenticate in an LDAP server that is used by Lotus Notes. I'm having a problem even though it bind successfully because there is no password attribute in the LDAP server of Lotus Notes. Does it mean that Lotus Notes doesn't store the password of its users in the LDAP server? -- View this message in context: http://old.nabble.com/Freeradius2-%2B-LDAP-of-Lotus-Notes-tp29426192p294261… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Password Policy - Expired Password - mschap
by Theparanoidone Theparanoidone 13 Aug '10

13 Aug '10

Greetings~ We are using FreeRadius 2.1.3 (on snow leopard server). All users are authenticating with vlan assignments correctly; however, if you enable the ldap/(opendirectory) option to "require user to change password on next login" the client is unable to connect. The client login screen will not proceed to prompt the user for a new password; it's simply rejected. If you remove the password policy forcing a password reset, then the user can authenticate. In other words, it appears radius (mschap / ntlm_auth) is specifically rejecting the user if the user has a password reset flag set. Here is a snippet from the radius server debug log: Failed auth: ======= Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] No NT-Password configured. Trying OpenDirectory Authentication. [mschap] OD username_string = adouglas, OD shortUserName=adouglas (length = 8) rlm_mschap: authentication failed -14161 ++[mschap] returns reject Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "142" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> adouglas attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 15 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 15 Sending Access-Reject of id 245 to 10.0.200.3 port 53907 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 ======= Success auth: ======= Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] No NT-Password configured. Trying OpenDirectory Authentication. [mschap] OD username_string = adouglas, OD shortUserName=adouglas (length = 8) [mschap] dsDoDirNodeAuth returns stepbuff: S=67322D06B7A0A7BB9EBC681EAAEE6FB197CDDCB2 (len=40) ++[mschap] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "142" MS-CHAP2-Success = 0xa9533d36373332324430364237413041374242394542433638314541414545364642313937434444434232 [ttls] Got tunneled Access-Accept ======= One last thing to note, if we specifically allow all users to authenticate (as described in the FAQ with DEFAULT AuthType := Accept), the client login screen will proceed to prompt the user to update a new password. Is there a way to handle password policies (either by ignoring it during mschap, or adding a pre/post filter of some sort)? Any help would greatly be appreciated, thanks in advance, --jsmith

3 9

FreeRadius + Cisco VPDN with multiple VRFs not working
by Jasper Jans 12 Aug '10

12 Aug '10

Hi, I hope someone on this lists still knows how to build this... We have an old setup that authenticates ISDN dial-in users and puts them in a Cisco VRF depending on which user authenticates. However this was all build about eight years ago using both home grown radius servers, etc. At the moment I'm trying to build a new platform using FreeRadius but I get stuck it seems at some point during the authentication and setup of the session. A quick overview of the setup: Cisco 180x as dial-in router Cisco AS5350 (NAS terminating the ISDN call) running IOS c5350-jk9s-mz.124-15.T9.bin Cisco 7200 (VHG/PE terminating the VPDN tunnel and ultimately the PPP session) running IOS c7200-jk9s-mz.123-20.bin Freeradius v1.1.3 (default that ships with CentOS 5.5) using MySQL as an backend. I manage to get the call to dial-in, the NAS to setup the VPDN tunnel and the VHG to send the radius request to terminate the PPP session. I actually see that the virtual-template gets cloned to a virtual-access interface - however after a few sessions the connection drops and if I issue a "show run" on the virtual-access interface it does not seem to have any config on it. I've included the output of a debug of both the VHG as well as of the radius server at the end of this mail. I've also included the running configuration of the AS5350 and 7200 incase I did something wrong there. I realize this makes for a rather large email - my apologies. I hope someone can tell me what it is that I'm doing wrong. Thanks a lot for taking the time to have a look. - Jasper ------------ Debug VHG: Aug 12 16:15:42.916 CEST: ppp55 PPP: Phase is ESTABLISHING Aug 12 16:15:42.916 CEST: ppp55 PPP: Send Message[Dynamic Bind Response] Aug 12 16:15:42.916 CEST: ppp55 LCP: I FORCED rcvd CONFACK len 30 Aug 12 16:15:42.916 CEST: ppp55 LCP: AuthProto CHAP (0x0305C22305) Aug 12 16:15:42.916 CEST: ppp55 LCP: MagicNumber 0x0D06A846 (0x05060D06A846) Aug 12 16:15:42.916 CEST: ppp55 LCP: MRRU 1524 (0x110405F4) Aug 12 16:15:42.916 CEST: ppp55 LCP: EndpointDisc 1 asd-tc3-ap01 (0x130F016173642D7463332D61703031) Aug 12 16:15:42.916 CEST: ppp55 LCP: I FORCED sent CONFACK len 38 Aug 12 16:15:42.916 CEST: ppp55 LCP: AuthProto CHAP (0x0305C22305) Aug 12 16:15:42.916 CEST: ppp55 LCP: MagicNumber 0x9A996122 (0x05069A996122) Aug 12 16:15:42.916 CEST: ppp55 LCP: MRRU 1500 (0x110405DC) Aug 12 16:15:42.916 CEST: ppp55 LCP: EndpointDisc 1 test-klant(a)backup.nl Aug 12 16:15:42.916 CEST: ppp55 LCP: (0x131701746573742D6B6C616E74406261) Aug 12 16:15:42.916 CEST: ppp55 LCP: (0x636B75702E6E6C) Aug 12 16:15:42.916 CEST: ppp55 PPP: Phase is FORWARDING, Attempting Forward Aug 12 16:15:42.916 CEST: ppp55 PPP SSS: Receive SSS-Mgr Connect-Local Aug 12 16:15:42.916 CEST: ppp55 PPP: Phase is AUTHENTICATING, Unauthenticated User Aug 12 16:15:42.916 CEST: RADIUS/ENCODE(0000003C):Orig. component type = VPDN Aug 12 16:15:42.916 CEST: RADIUS: AAA Unsupported Attr: interface [153] 14 Aug 12 16:15:42.916 CEST: RADIUS: 55 6E 69 71 2D 53 65 73 73 2D 49 44 [Uniq-Sess-ID] Aug 12 16:15:42.916 CEST: RADIUS(0000003C): Storing nasport 55 in rad_db Aug 12 16:15:42.916 CEST: RADIUS(0000003C): Config NAS IP: 195.18.85.3 Aug 12 16:15:42.916 CEST: RADIUS/ENCODE(0000003C): acct_session_id: 60 Aug 12 16:15:42.916 CEST: RADIUS(0000003C): sending Aug 12 16:15:42.916 CEST: RADIUS(0000003C): Send Access-Request to 195.18.104.132:1812 id 1645/71, len 114 Aug 12 16:15:42.916 CEST: RADIUS: authenticator DD 7C 9E 37 25 71 75 C1 - 3A F2 17 44 A0 BA BF E4 Aug 12 16:15:42.916 CEST: RADIUS: Framed-Protocol [7] 6 PPP [1] Aug 12 16:15:42.916 CEST: RADIUS: User-Name [1] 22 " test-klant(a)backup.nl" Aug 12 16:15:42.916 CEST: RADIUS: CHAP-Password [3] 19 * Aug 12 16:15:42.916 CEST: RADIUS: NAS-Port-Type [61] 6 Virtual [5] Aug 12 16:15:42.916 CEST: RADIUS: NAS-Port [5] 6 55 Aug 12 16:15:42.916 CEST: RADIUS: Calling-Station-Id [31] 12 "0365465531" Aug 12 16:15:42.916 CEST: RADIUS: Called-Station-Id [30] 11 "207300300" Aug 12 16:15:42.916 CEST: RADIUS: Service-Type [6] 6 Framed [2] Aug 12 16:15:42.916 CEST: RADIUS: NAS-IP-Address [4] 6 195.18.85.3 Aug 12 16:15:42.920 CEST: RADIUS: Received from id 1645/71 195.18.104.132:1812, Access-Accept, len 150 Aug 12 16:15:42.920 CEST: RADIUS: authenticator 4B 16 16 8C 36 79 DB 45 - 61 5E D1 5D 34 51 1A 0E Aug 12 16:15:42.920 CEST: RADIUS: Service-Type [6] 6 Framed [2] Aug 12 16:15:42.920 CEST: RADIUS: Framed-Protocol [7] 6 PPP [1] Aug 12 16:15:42.920 CEST: RADIUS: Vendor, Cisco [26] 57 Aug 12 16:15:42.920 CEST: RADIUS: Cisco AVpair [1] 51 "lcp:interface-config=ip vrf forwarding test-klant" Aug 12 16:15:42.920 CEST: RADIUS: Vendor, Cisco [26] 55 Aug 12 16:15:42.920 CEST: RADIUS: Cisco AVpair [1] 49 "lcp:interface-config=ip unnumbered Loopback1132" Aug 12 16:15:42.920 CEST: RADIUS: Framed-IP-Address [8] 6 192.168.2.1 Aug 12 16:15:42.920 CEST: RADIUS(0000003C): Received from id 1645/71 Aug 12 16:15:42.920 CEST: ppp55 PPP: Phase is FORWARDING, Attempting Forward Aug 12 16:15:42.920 CEST: ppp55 PPP: Send Message[Connect Local] Aug 12 16:15:42.920 CEST: Vi2 PPP: Phase is DOWN, Setup Aug 12 16:15:42.920 CEST: ppp55 PPP: Bind to [Virtual-Access2] Aug 12 16:15:42.920 CEST: Vi2 PPP: Send Message[Static Bind Response] Aug 12 16:15:42.924 CEST: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up Aug 12 16:15:42.924 CEST: Vi2 PPP: Phase is AUTHENTICATING, Authenticated User Aug 12 16:15:42.924 CEST: Vi2 CHAP: O SUCCESS id 2 len 4 Aug 12 16:15:43.924 CEST: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up Aug 12 16:15:52.868 CEST: Vi2 CHAP: I CHALLENGE id 86 len 41 from " test-klant(a)backup.nl" Aug 12 16:15:52.868 CEST: RADIUS/ENCODE(0000003C): sendauth, failing over Aug 12 16:15:52.868 CEST: RADIUS/ENCODE(0000003C): send packet; BEGIN Aug 12 16:15:52.868 CEST: Vi2 CHAP: Unable to authenticate for peer Aug 12 16:15:52.868 CEST: Vi2 PPP: Sending Acct Event[Down] id[3C] Aug 12 16:15:52.868 CEST: Vi2 PPP: Phase is TERMINATING Aug 12 16:15:52.868 CEST: Vi2 LCP: O TERMREQ [Open] id 1 len 4 Aug 12 16:15:52.888 CEST: Vi2 LCP: I TERMACK [TERMsent] id 1 len 4 Aug 12 16:15:52.888 CEST: Vi2 LCP: State is Closed Aug 12 16:15:52.888 CEST: Vi2 PPP: Phase is DOWN Aug 12 16:15:52.888 CEST: Vi2 PPP: Send Message[Disconnect] Aug 12 16:15:52.892 CEST: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down Aug 12 16:15:53.868 CEST: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down ------------------------ Debug radius: rad_recv: Access-Request packet from host 195.18.85.193:1645, id=42, length=122 User-Name = "backup.nl" User-Password = "cisco" NAS-Port = 20326 NAS-Port-Id = "Serial3/3:26" NAS-Port-Type = ISDN Calling-Station-Id = "0365465531" Called-Station-Id = "207300300" Connect-Info = "64000 HDLC" Service-Type = Dialout-Framed-User NAS-IP-Address = 195.18.85.193 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/auth-detail-20100812' rlm_detail: /var/log/radius/radacct/auth-detail-%Y%m%d expands to /var/log/radius/radacct/auth-detail-20100812 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 radius_xlat: 'backup.nl' rlm_sql (sql): sql_set_user escaped user --> 'backup.nl' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'backup.nl' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'backup.nl' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'backup.nl' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'backup.nl' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/var/log/radius/radacct/reply-detail-20100812' rlm_detail: /var/log/radius/radacct/reply-detail-%Y%m%d expands to /var/log/radius/radacct/reply-detail-20100812 modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 42 to 195.18.85.193 port 1645 Cisco-AVPair += "vpdn:tunnel-id=AS5350-All" Cisco-AVPair += "vpdn:ip-addresses=195.18.85.3" Cisco-AVPair += "vpdn:tunnel-type=l2tp" Cisco-AVPair += "vpdn:l2tp-tunnel-password=cisco" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 195.18.85.3:1645, id=73, length=114 Framed-Protocol = PPP User-Name = "test-klant(a)backup.nl" CHAP-Password = 0x02011f8ce0ed5275d50c7a786cc7e47c6b NAS-Port-Type = Virtual NAS-Port = 57 Calling-Station-Id = "0365465531" Called-Station-Id = "207300300" Service-Type = Framed-User NAS-IP-Address = 195.18.85.3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/auth-detail-20100812' rlm_detail: /var/log/radius/radacct/auth-detail-%Y%m%d expands to /var/log/radius/radacct/auth-detail-20100812 modcall[authorize]: module "auth_log" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 radius_xlat: 'test-klant(a)backup.nl' rlm_sql (sql): sql_set_user escaped user --> 'test-klant(a)backup.nl' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test-klant(a)backup.nl' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = ' test-klant(a)backup.nl' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test-klant(a)backup.nl' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = ' test-klant(a)backup.nl' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 1 rlm_chap: login attempt by "test-klant(a)backup.nl" with CHAP password rlm_chap: Using clear text password test for user test-klant(a)backup.nlauthentication. rlm_chap: chap user test-klant(a)backup.nl authenticated succesfully modcall[authenticate]: module "chap" returns ok for request 1 modcall: leaving group CHAP (returns ok) for request 1 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 radius_xlat: '/var/log/radius/radacct/reply-detail-20100812' rlm_detail: /var/log/radius/radacct/reply-detail-%Y%m%d expands to /var/log/radius/radacct/reply-detail-20100812 modcall[post-auth]: module "reply_log" returns ok for request 1 modcall: leaving group post-auth (returns ok) for request 1 Sending Access-Accept of id 73 to 195.18.85.3 port 1645 Service-Type := Framed-User Framed-Protocol := PPP Cisco-AVPair += "lcp:interface-config#1=ip vrf forwarding test-klant" Cisco-AVPair += "lcp:interface-config#2=ip vrf forwarding test-klant" Finished request 1 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 42 with timestamp 4c64044c Cleaning up request 1 ID 73 with timestamp 4c64044c Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 195.18.85.193:1646, id=43, length=263 Acct-Session-Id = "00000114" Framed-Protocol = PPP Tunnel-Medium-Type:0 = IP Tunnel-Client-Endpoint:0 = "195.18.85.193" Tunnel-Server-Endpoint:0 = "195.18.85.3" Tunnel-Type:0 = L2TP Acct-Tunnel-Connection = "1057600042" Tunnel-Client-Auth-Id:0 = "AS5350-All" Tunnel-Server-Auth-Id:0 = "asd-cap-dr03" User-Name = "test-klant(a)backup.nl" Acct-Authentic = RADIUS Acct-Session-Time = 10 Acct-Input-Octets = 53 Acct-Output-Octets = 16 Acct-Input-Packets = 2 Acct-Output-Packets = 2 Acct-Terminate-Cause = Host-Request Acct-Status-Type = Stop NAS-Port = 20326 NAS-Port-Id = "Serial3/3:26" NAS-Port-Type = ISDN Calling-Station-Id = "0365465531" Called-Station-Id = "207300300" Connect-Info = "64000 HDLC" Service-Type = Framed-User NAS-IP-Address = 195.18.85.193 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 20326,Client-IP-Address = 195.18.85.193,NAS-IP-Address = 195.18.85.193,Acct-Session-Id = "00000114",User-Name = "test-klant(a)backup.nl"' rlm_acct_unique: Acct-Unique-Session-ID = "76ea71aaa12d8845". modcall[preacct]: module "acct_unique" returns ok for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/var/log/radius/radacct/detail-20100812' rlm_detail: /var/log/radius/radacct/detail-%Y%m%d expands to /var/log/radius/radacct/detail-20100812 modcall[accounting]: module "detail" returns ok for request 2 modcall[accounting]: module "unix" returns ok for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'test-klant(a)backup.nl' rlm_radutmp: Logout for NAS asd-tc3-ap01 port 20326, but no Login record modcall[accounting]: module "radutmp" returns ok for request 2 radius_xlat: 'test-klant(a)backup.nl' rlm_sql (sql): sql_set_user escaped user --> 'test-klant(a)backup.nl' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2010-08-12 16:25:26', AcctSessionTime = '10', AcctInputOctets = '53', AcctOutputOctets = '16', AcctTerminateCause = 'Host-Request', AcctStopDelay = '0', ConnectInfo_stop = '64000 HDLC' WHERE AcctSessionId = '00000114' AND UserName = ' test-klant(a)backup.nl' AND NASIPAddress = '195.18.85.193'' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00000114', '76ea71aaa12d8845', ' test-klant(a)backup.nl', '', '195.18.85.193', '20326', 'ISDN', DATE_SUB('2010-08-12 16:25:26', INTERVAL (10 + 0) SECOND), '2010-08-12 16:25:26', '10', 'RADIUS', '', '64000 HDLC', '53', '16', '207300300', '0365465531', 'Host-Request', 'Framed-User', 'PPP', '', '0', '0')' rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sql" returns ok for request 2 modcall: leaving group accounting (returns ok) for request 2 Sending Accounting-Response of id 43 to 195.18.85.193 port 1646 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 43 with timestamp 4c640456 Nothing to do. Sleeping until we see a request. ------------------- Database entries MySQL: mysql> select * from radcheck where UserName = 'backup.nl'; +------+-----------+-----------+----+-------+ | id | UserName | Attribute | op | Value | +------+-----------+-----------+----+-------+ | 1445 | backup.nl | Password | == | cisco | +------+-----------+-----------+----+-------+ 1 row in set (0.00 sec) mysql> select * from radreply where UserName = 'backup.nl'; +------+-----------+--------------+----+---------------------------------+ | id | UserName | Attribute | op | Value | +------+-----------+--------------+----+---------------------------------+ | 2246 | backup.nl | Cisco-AVPair | += | vpdn:tunnel-id=AS5350-All | | 2247 | backup.nl | Cisco-AVPair | += | vpdn:ip-addresses=195.18.85.3 | | 2248 | backup.nl | Cisco-AVPair | += | vpdn:tunnel-type=l2tp | | 2249 | backup.nl | Cisco-AVPair | += | vpdn:l2tp-tunnel-password=cisco | +------+-----------+--------------+----+---------------------------------+ 4 rows in set (0.00 sec) mysql> select * from radcheck where UserName = 'test-klant(a)backup.nl'; +------+----------------------+-----------+----+-------+ | id | UserName | Attribute | op | Value | +------+----------------------+-----------+----+-------+ | 1444 | test-klant(a)backup.nl | Password | == | test | +------+----------------------+-----------+----+-------+ 1 row in set (0.00 sec) mysql> select * from radreply where UserName = 'test-klant(a)backup.nl'; +------+----------------------+-------------------+----+-----------------------------------------------------+ | id | UserName | Attribute | op | Value | +------+----------------------+-------------------+----+-----------------------------------------------------+ | 2231 | test-klant(a)backup.nl | Service-Type | := | Framed-User | | 2250 | test-klant(a)backup.nl | Framed-Protocol | := | PPP | | 2263 | test-klant(a)backup.nl | Cisco-AVPair | += | lcp:interface-config#1=ip vrf forwarding test-klant | | 2264 | test-klant(a)backup.nl | Cisco-AVPair | += | lcp:interface-config#2=ip vrf forwarding test-klant | +------+----------------------+-------------------+----+-----------------------------------------------------+ 4 rows in set (0.00 sec)

2 2

issues when compiling freeradius 2.1.9 on solaris 10 x86
by maximatt 12 Aug '10

12 Aug '10

hi... i try to compile freeradius 2.1.9 on solaris 10, but i have some problems.... i install from freeware the following packages . gcc-3.4.6-sol10-x86-local and /libiconv-1.13.1-sol10-x86-local.gz and then i try to just have a simple compilation. # PATH=/usr/local/bin/:/usr/sfw/bin/:$PATH; export PATH # CC=gcc ./configure # gmake . . /Desktop/freeRadius/tmp/freeradius-server-2.1.9/libtool --mode=link gcc -release 2.1.9 \ -export-dynamic -o libfreeradius-radius.la -rpath /usr/local/lib dict.lo filters.lo hash.lo hmac.lo hmacsha1.lo isaac.lo log.lo misc.lo missing.lo md4.lo md5.lo print.lo radius.lo rbtree.lo sha1.lo snprintf.lo strlcat.lo strlcpy.lo token.lo udpfromto.lo valuepair.lo fifo.lo packet.lo event.lo getaddrinfo.lo vqp.lo heap.lo dhcp.lo gcc -shared -Wl,-h -Wl,libfreeradius-radius-2.1.9.so -o .libs/ libfreeradius-radius-2.1.9.so .libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o .libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o .libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o .libs/snprintf.o .libs/strlcat.o .libs/strlcpy.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o .libs/fifo.o .libs/packet.o .libs/event.o .libs/getaddrinfo.o .libs/vqp.o .libs/heap.o .libs/dhcp.o -lc (cd .libs && rm -f libfreeradius-radius.so && ln -s libfreeradius-radius-2.1.9.so libfreeradius-radius.so) false cru .libs/libfreeradius-radius.a dict.o filters.o hash.o hmac.o hmacsha1.o isaac.o log.o misc.o missing.o md4.o md5.o print.o radius.o rbtree.o sha1.o snprintf.o strlcat.o strlcpy.o token.o udpfromto.o valuepair.o fifo.o packet.o event.o getaddrinfo.o vqp.o heap.o dhcp.o gmake[4]: *** [libfreeradius-radius.la] Error 1 gmake[4]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src/lib' gmake[3]: *** [lib] Error 2 gmake[3]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/Desktop/freeRadius/tmp/freeradius-server-2.1.9' gmake: *** [all] Error 2 what could be happend' thanks -- *Salu2 ;)*

2 1