- Freeradius-Users - lists.freeradius.org

FreeRADIUS as dhcp
by Urazaev Vadim 30 Jul '10

30 Jul '10

Hello all. I tried to configure freeradius to operate as dhcp server and reach the point from where I can`t proceed. the version of freeradius is 2.1.9 I have two situation 1. DHCP Discover packet comes from client who directly connected to network which freerasdius listen on. 2. DHCP Discover packet comes from relaying agent (Switch Linksys SPS224G4) Then I see in debug (radiusd -xxX) something like that In first case : ---------------- Received DHCP-Discover of id 359f8b7a from 0.0.0.0:68 to 0.0.0.0:6701 01 06 00 35 9f 8b 7a 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 7f 5f ff bf 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 37 0f 01 02 03 06 0c 0f 1c 1d 1f 21 28 29 2a 2c 2d ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Sending DHCP-Offer of id 359f8b7a from 0.0.0.0:67 to 255.255.255.255:680: 02 01 06 00 35 9f 8b 7a 00 00 00 00 00 00 00 00 16: 00 00 00 00 c0 a8 28 05 00 00 00 00 00 10 7f 5f 32: ff bf 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 02 01 04 ff ff ff 00 03 04 c0 a8 28 05 06 256: 08 c2 40 94 02 c3 40 94 01 33 04 00 01 51 80 36 272: 04 c0 a8 28 05 ff 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================= In second case I can see only DHCP Discover It seems like freeradius just ignores the packets that was relayed ================================================================= Received DHCP-Discover of id 12019719 from 192.168.40.17:68 to 0.0.0.0:6701 01 06 01 12 01 97 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a8 28 11 00 19 db ee ce a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 3d 07 01 00 19 db ee ce a6 52 12 01 06 00 04 00 01 01 01 02 08 00 06 00 1e e5 d0 9d 87 ff ================================================= Please give me a kick in right direction. ================================================= Full Output radiusd -X Thu Jul 29 16:24:58 2010 : Info: FreeRADIUS Version 2.1.9, for host i386-portbld-freebsd7.2, built on Jul 27 2010 at 08:03:44 Thu Jul 29 16:24:58 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Thu Jul 29 16:24:58 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Thu Jul 29 16:24:58 2010 : Info: PARTICULAR PURPOSE. Thu Jul 29 16:24:58 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Thu Jul 29 16:24:58 2010 : Info: GNU General Public License v2. Thu Jul 29 16:24:58 2010 : Info: Starting - reading configuration files ... Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Thu Jul 29 16:24:58 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Thu Jul 29 16:24:58 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Thu Jul 29 16:24:58 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/dhcp Thu Jul 29 16:24:58 2010 : Debug: main { Thu Jul 29 16:24:58 2010 : Debug: user = "freeradius" Thu Jul 29 16:24:58 2010 : Debug: group = "freeradius" Thu Jul 29 16:24:58 2010 : Debug: allow_core_dumps = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Thu Jul 29 16:24:58 2010 : Debug: main { Thu Jul 29 16:24:58 2010 : Debug: prefix = "/usr/local" Thu Jul 29 16:24:58 2010 : Debug: localstatedir = "/var" Thu Jul 29 16:24:58 2010 : Debug: logdir = "/var/log" Thu Jul 29 16:24:58 2010 : Debug: libdir = "/usr/local/lib/freeradius-2.1.9" Thu Jul 29 16:24:58 2010 : Debug: radacctdir = "/var/log/radacct" Thu Jul 29 16:24:58 2010 : Debug: hostname_lookups = no Thu Jul 29 16:24:58 2010 : Debug: max_request_time = 30 Thu Jul 29 16:24:58 2010 : Debug: cleanup_delay = 5 Thu Jul 29 16:24:58 2010 : Debug: max_requests = 1024 Thu Jul 29 16:24:58 2010 : Debug: pidfile = "/var/run/radiusd/radiusd.pid" Thu Jul 29 16:24:58 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Thu Jul 29 16:24:58 2010 : Debug: debug_level = 0 Thu Jul 29 16:24:58 2010 : Debug: proxy_requests = yes Thu Jul 29 16:24:58 2010 : Debug: log { Thu Jul 29 16:24:58 2010 : Debug: stripped_names = no Thu Jul 29 16:24:58 2010 : Debug: auth = yes Thu Jul 29 16:24:58 2010 : Debug: auth_badpass = no Thu Jul 29 16:24:58 2010 : Debug: auth_goodpass = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: security { Thu Jul 29 16:24:58 2010 : Debug: max_attributes = 200 Thu Jul 29 16:24:58 2010 : Debug: reject_delay = 1 Thu Jul 29 16:24:58 2010 : Debug: status_server = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Thu Jul 29 16:24:58 2010 : Debug: proxy server { Thu Jul 29 16:24:58 2010 : Debug: retry_delay = 5 Thu Jul 29 16:24:58 2010 : Debug: retry_count = 3 Thu Jul 29 16:24:58 2010 : Debug: default_fallback = no Thu Jul 29 16:24:58 2010 : Debug: dead_time = 120 Thu Jul 29 16:24:58 2010 : Debug: wake_all_if_all_dead = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: home_server localhost { Thu Jul 29 16:24:58 2010 : Debug: ipaddr = 127.0.0.1 Thu Jul 29 16:24:58 2010 : Debug: port = 1812 Thu Jul 29 16:24:58 2010 : Debug: type = "auth" Thu Jul 29 16:24:58 2010 : Debug: secret = "testing123" Thu Jul 29 16:24:58 2010 : Debug: response_window = 20 Thu Jul 29 16:24:58 2010 : Debug: max_outstanding = 65536 Thu Jul 29 16:24:58 2010 : Debug: require_message_authenticator = no Thu Jul 29 16:24:58 2010 : Debug: zombie_period = 40 Thu Jul 29 16:24:58 2010 : Debug: status_check = "status-server" Thu Jul 29 16:24:58 2010 : Debug: ping_interval = 30 Thu Jul 29 16:24:58 2010 : Debug: check_interval = 30 Thu Jul 29 16:24:58 2010 : Debug: num_answers_to_alive = 3 Thu Jul 29 16:24:58 2010 : Debug: num_pings_to_alive = 3 Thu Jul 29 16:24:58 2010 : Debug: revive_interval = 120 Thu Jul 29 16:24:58 2010 : Debug: status_check_timeout = 4 Thu Jul 29 16:24:58 2010 : Debug: irt = 2 Thu Jul 29 16:24:58 2010 : Debug: mrt = 16 Thu Jul 29 16:24:58 2010 : Debug: mrc = 5 Thu Jul 29 16:24:58 2010 : Debug: mrd = 30 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: home_server_pool my_auth_failover { Thu Jul 29 16:24:58 2010 : Debug: type = fail-over Thu Jul 29 16:24:58 2010 : Debug: home_server = localhost Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: realm example.com { Thu Jul 29 16:24:58 2010 : Debug: auth_pool = my_auth_failover Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: realm LOCAL { Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Loading Clients #### Thu Jul 29 16:24:58 2010 : Debug: client localhost { Thu Jul 29 16:24:58 2010 : Debug: ipaddr = 127.0.0.1 Thu Jul 29 16:24:58 2010 : Debug: require_message_authenticator = no Thu Jul 29 16:24:58 2010 : Debug: secret = "testing123" Thu Jul 29 16:24:58 2010 : Debug: nastype = "other" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Instantiating modules #### Thu Jul 29 16:24:58 2010 : Debug: instantiate { Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_exec Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating exec Thu Jul 29 16:24:58 2010 : Debug: exec { Thu Jul 29 16:24:58 2010 : Debug: wait = no Thu Jul 29 16:24:58 2010 : Debug: input_pairs = "request" Thu Jul 29 16:24:58 2010 : Debug: shell_escape = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_expr Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating expr Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_expiration Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating expiration Thu Jul 29 16:24:58 2010 : Debug: expiration { Thu Jul 29 16:24:58 2010 : Debug: reply-message = "Password Has Expired " Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_logintime Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating logintime Thu Jul 29 16:24:58 2010 : Debug: logintime { Thu Jul 29 16:24:58 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Thu Jul 29 16:24:58 2010 : Debug: minimum-timeout = 60 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Loading Virtual Servers #### Thu Jul 29 16:24:58 2010 : Debug: server inner-tunnel { Thu Jul 29 16:24:58 2010 : Debug: modules { Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_pap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating pap Thu Jul 29 16:24:58 2010 : Debug: pap { Thu Jul 29 16:24:58 2010 : Debug: encryption_scheme = "auto" Thu Jul 29 16:24:58 2010 : Debug: auto_header = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_chap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating chap Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_mschap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating mschap Thu Jul 29 16:24:58 2010 : Debug: mschap { Thu Jul 29 16:24:58 2010 : Debug: use_mppe = yes Thu Jul 29 16:24:58 2010 : Debug: require_encryption = no Thu Jul 29 16:24:58 2010 : Debug: require_strong = no Thu Jul 29 16:24:58 2010 : Debug: with_ntdomain_hack = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_unix Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating unix Thu Jul 29 16:24:58 2010 : Debug: unix { Thu Jul 29 16:24:58 2010 : Debug: radwtmp = "/var/log/radwtmp" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_eap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap Thu Jul 29 16:24:58 2010 : Debug: eap { Thu Jul 29 16:24:58 2010 : Debug: default_eap_type = "md5" Thu Jul 29 16:24:58 2010 : Debug: timer_expire = 60 Thu Jul 29 16:24:58 2010 : Debug: ignore_unknown_eap_types = no Thu Jul 29 16:24:58 2010 : Debug: cisco_accounting_username_bug = no Thu Jul 29 16:24:58 2010 : Debug: max_sessions = 4096 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-md5 Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-leap Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-gtc Thu Jul 29 16:24:58 2010 : Debug: gtc { Thu Jul 29 16:24:58 2010 : Debug: challenge = "Password: " Thu Jul 29 16:24:58 2010 : Debug: auth_type = "PAP" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-tls Thu Jul 29 16:24:58 2010 : Debug: tls { Thu Jul 29 16:24:58 2010 : Debug: rsa_key_exchange = no Thu Jul 29 16:24:58 2010 : Debug: dh_key_exchange = yes Thu Jul 29 16:24:58 2010 : Debug: rsa_key_length = 512 Thu Jul 29 16:24:58 2010 : Debug: dh_key_length = 512 Thu Jul 29 16:24:58 2010 : Debug: verify_depth = 0 Thu Jul 29 16:24:58 2010 : Debug: pem_file_type = yes Thu Jul 29 16:24:58 2010 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Thu Jul 29 16:24:58 2010 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Thu Jul 29 16:24:58 2010 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Thu Jul 29 16:24:58 2010 : Debug: private_key_password = "whatever" Thu Jul 29 16:24:58 2010 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Thu Jul 29 16:24:58 2010 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Thu Jul 29 16:24:58 2010 : Debug: fragment_size = 1024 Thu Jul 29 16:24:58 2010 : Debug: include_length = yes Thu Jul 29 16:24:58 2010 : Debug: check_crl = no Thu Jul 29 16:24:58 2010 : Debug: cipher_list = "DEFAULT" Thu Jul 29 16:24:58 2010 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Thu Jul 29 16:24:58 2010 : Debug: cache { Thu Jul 29 16:24:58 2010 : Debug: enable = no Thu Jul 29 16:24:58 2010 : Debug: lifetime = 24 Thu Jul 29 16:24:58 2010 : Debug: max_entries = 255 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-ttls Thu Jul 29 16:24:58 2010 : Debug: ttls { Thu Jul 29 16:24:58 2010 : Debug: default_eap_type = "md5" Thu Jul 29 16:24:58 2010 : Debug: copy_request_to_tunnel = no Thu Jul 29 16:24:58 2010 : Debug: use_tunneled_reply = no Thu Jul 29 16:24:58 2010 : Debug: virtual_server = "inner-tunnel" Thu Jul 29 16:24:58 2010 : Debug: include_length = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-peap Thu Jul 29 16:24:58 2010 : Debug: peap { Thu Jul 29 16:24:58 2010 : Debug: default_eap_type = "mschapv2" Thu Jul 29 16:24:58 2010 : Debug: copy_request_to_tunnel = no Thu Jul 29 16:24:58 2010 : Debug: use_tunneled_reply = no Thu Jul 29 16:24:58 2010 : Debug: proxy_tunneled_request_as_eap = yes Thu Jul 29 16:24:58 2010 : Debug: virtual_server = "inner-tunnel" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating eap-mschapv2 Thu Jul 29 16:24:58 2010 : Debug: mschapv2 { Thu Jul 29 16:24:58 2010 : Debug: with_ntdomain_hack = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authorize {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_realm Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating suffix Thu Jul 29 16:24:58 2010 : Debug: realm suffix { Thu Jul 29 16:24:58 2010 : Debug: format = "suffix" Thu Jul 29 16:24:58 2010 : Debug: delimiter = "@" Thu Jul 29 16:24:58 2010 : Debug: ignore_default = no Thu Jul 29 16:24:58 2010 : Debug: ignore_null = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_files, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_files Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating files Thu Jul 29 16:24:58 2010 : Debug: files { Thu Jul 29 16:24:58 2010 : Debug: usersfile = "/usr/local/etc/raddb/users" Thu Jul 29 16:24:58 2010 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Thu Jul 29 16:24:58 2010 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Thu Jul 29 16:24:58 2010 : Debug: compat = "no" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking session {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_radutmp Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating radutmp Thu Jul 29 16:24:58 2010 : Debug: radutmp { Thu Jul 29 16:24:58 2010 : Debug: filename = "/var/log/radutmp" Thu Jul 29 16:24:58 2010 : Debug: username = "%{User-Name}" Thu Jul 29 16:24:58 2010 : Debug: case_sensitive = yes Thu Jul 29 16:24:58 2010 : Debug: check_with_nas = yes Thu Jul 29 16:24:58 2010 : Debug: perm = 384 Thu Jul 29 16:24:58 2010 : Debug: callerid = yes Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-auth {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_attr_filter Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating attr_filter.access_reject Thu Jul 29 16:24:58 2010 : Debug: attr_filter attr_filter.access_reject { Thu Jul 29 16:24:58 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Thu Jul 29 16:24:58 2010 : Debug: key = "%{User-Name}" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } # modules Thu Jul 29 16:24:58 2010 : Debug: } # server Thu Jul 29 16:24:58 2010 : Debug: server dhcp { Thu Jul 29 16:24:58 2010 : Debug: modules { Thu Jul 29 16:24:58 2010 : Debug: Module: Checking dhcp DHCP-Discover {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_always, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_always Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating ok Thu Jul 29 16:24:58 2010 : Debug: always ok { Thu Jul 29 16:24:58 2010 : Debug: rcode = "ok" Thu Jul 29 16:24:58 2010 : Debug: simulcount = 0 Thu Jul 29 16:24:58 2010 : Debug: mpp = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking dhcp DHCP-Request {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking dhcp (null) {...} for more modules to load Thu Jul 29 16:24:58 2010 : Error: /usr/local/etc/raddb/sites-enabled/dhcp[156]: No name specified for Post-Auth-Type block Thu Jul 29 16:24:58 2010 : Debug: } # modules Thu Jul 29 16:24:58 2010 : Debug: } # server Thu Jul 29 16:24:58 2010 : Debug: server { Thu Jul 29 16:24:58 2010 : Debug: modules { Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking authorize {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_preprocess Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating preprocess Thu Jul 29 16:24:58 2010 : Debug: preprocess { Thu Jul 29 16:24:58 2010 : Debug: huntgroups = "/usr/local/etc/raddb/huntgroups" Thu Jul 29 16:24:58 2010 : Debug: hints = "/usr/local/etc/raddb/hints" Thu Jul 29 16:24:58 2010 : Debug: with_ascend_hack = no Thu Jul 29 16:24:58 2010 : Debug: ascend_channels_per_line = 23 Thu Jul 29 16:24:58 2010 : Debug: with_ntdomain_hack = no Thu Jul 29 16:24:58 2010 : Debug: with_specialix_jetstream_hack = no Thu Jul 29 16:24:58 2010 : Debug: with_cisco_vsa_hack = no Thu Jul 29 16:24:58 2010 : Debug: with_alvarion_vsa_hack = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking preacct {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_acct_unique Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating acct_unique Thu Jul 29 16:24:58 2010 : Debug: acct_unique { Thu Jul 29 16:24:58 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking accounting {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Thu Jul 29 16:24:58 2010 : Debug: Module: Linked to module rlm_detail Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating detail Thu Jul 29 16:24:58 2010 : Debug: detail { Thu Jul 29 16:24:58 2010 : Debug: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" Thu Jul 29 16:24:58 2010 : Debug: header = "%t" Thu Jul 29 16:24:58 2010 : Debug: detailperm = 384 Thu Jul 29 16:24:58 2010 : Debug: dirperm = 493 Thu Jul 29 16:24:58 2010 : Debug: locking = no Thu Jul 29 16:24:58 2010 : Debug: log_packet_header = no Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Instantiating attr_filter.accounting_response Thu Jul 29 16:24:58 2010 : Debug: attr_filter attr_filter.accounting_response { Thu Jul 29 16:24:58 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" Thu Jul 29 16:24:58 2010 : Debug: key = "%{User-Name}" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Module: Checking session {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: Module: Checking post-auth {...} for more modules to load Thu Jul 29 16:24:58 2010 : Debug: } # modules Thu Jul 29 16:24:58 2010 : Debug: } # server Thu Jul 29 16:24:58 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "auth" Thu Jul 29 16:24:58 2010 : Debug: ipaddr = * Thu Jul 29 16:24:58 2010 : Debug: port = 0 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "acct" Thu Jul 29 16:24:58 2010 : Debug: ipaddr = * Thu Jul 29 16:24:58 2010 : Debug: port = 0 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "control" Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: socket = "/var/run/radiusd/radiusd.sock" Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: listen { Thu Jul 29 16:24:58 2010 : Debug: type = "dhcp" Thu Jul 29 16:24:58 2010 : Debug: ipaddr = * Thu Jul 29 16:24:58 2010 : Debug: port = 67 Thu Jul 29 16:24:58 2010 : Debug: } Thu Jul 29 16:24:58 2010 : Debug: Listening on authentication address * port 1812 Thu Jul 29 16:24:58 2010 : Debug: Listening on accounting address * port 1813 Thu Jul 29 16:24:58 2010 : Debug: Listening on command file /var/run/radiusd/radiusd.sock Thu Jul 29 16:24:58 2010 : Debug: Listening on dhcp address * port 67 as server dhcp Thu Jul 29 16:24:58 2010 : Debug: Listening on proxy address * port 1814 Thu Jul 29 16:24:58 2010 : Info: Ready to process requests. Received DHCP-Discover of id 12019719 from 192.168.40.17:68 to 0.0.0.0:6701 01 06 01 12 01 97 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a8 28 11 00 19 db ee ce a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 01 3d 07 01 00 19 db ee ce a6 52 12 01 06 00 04 00 01 01 01 02 08 00 06 00 1e e5 d0 9d 87 ff

2 2

pap or chap authentication with MS AD Backend
by Sallee, Stephen (Jake) 30 Jul '10

30 Jul '10

Could someone please point me to a good how-to that will explain how to get either pap or chap running using Microsoft AD as a backend? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 2

Grouping similar users to profiles
by Natr Brazell 29 Jul '10

29 Jul '10

I am looking for information on grouping users into profiles/groups. I've searched around the FAQ's and docs but not finding a clear picture. I've found how to associate a user with a group of NAS's. . Here's the scenario. There is a specfic VSA from Juniper called Juniper-Local-User-Name. This gets mapped to a locally defined profile on the NAS. In the users file I have the following: bob.smith Juniper-Local-User-Name = "tier3", mary.jane Juniper-Local-User-Name = "tier3", bobby.sue Juniper-Local-User-Name = "tier3", Furthermore there is other VSA's such as the Juniper-Allow-Commands and Juniper-Deny-Commands. So I can do things like: billy.bob Juniper-Local-User-Name = "tier2", Juniper-Deny-Commands "(show system alarms)|(show system software)" john.doe Juniper-Local-User-Name = "tier2", Juniper-Deny-Commands "(show system alarms)|(show system software)" So to the point, rather than defining each user with the same parameters every time, can I create a group, for instance TIER3, and associate User-Name's above to the group. And if so how or point me to some specific examples. I am using LDAP also so if there is an LDAP solution same question. Howto?

2 4

LDAP authentication problem
by Sallee, Stephen (Jake) 29 Jul '10

29 Jul '10

I have correctly configured the LDAP module (I think...) but when I try to authenticate a user I get an error saying the user cannot be found. I have attached the debug output. I have tried turning the "follow referrals" and "rebind" vars on and off but I get the same outcome. At first, I was getting a timeout error but I increased the timeouts and fixed that. I know the user is correct. Here is the LDAP string for the user: LDAP://CN=dspam,OU=InformationTechnology,OU=UsersByDepartment,OU=Adminis trative,DC=umhb,DC=edu Any ideas? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

Passing variables from inner tunnel
by newtownz 29 Jul '10

29 Jul '10

Hi, I'm trying to pass the value of LDAP-UserDn from the inner-tunnel to the default server. I have read unlang and also tried many combinations including update outer.control from the inner tunnel and nothing worked... Here is a debug output where we can see that the User-Dn get expanded correctly in the tunnel but is empty in the default server. ++[eap] returns ok +- entering group post-auth {...} expand: %{control:LDAP-UserDn} -> cn=aruba,ou=etudiant,o=org Exec-Program output: etudiant Exec-Program-Wait: plaintext: etudiant Exec-Program: returned: 0 ++[reply] returns noop ++[outer.control] returns noop } # server inner-tunnel .... .... [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop expand: %{control:LDAP-UserDn} -> PHP Notice: Undefined offset: 0 in /etc/freeradius/scripts/php3 on line 4 Exec-Program output: dewor Exec-Program-Wait: plaintext: dewor Exec-Program: returned: 0 Thanks Jean -- View this message in context: http://old.nabble.com/Passing-variables-from-inner-tunnel-tp29279811p292798… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 10

Prevent Interim-Update packets being proxied
by Murray Long 29 Jul '10

29 Jul '10

Hi all, I would like to be able to prevent Interim-Update accounting packets for a realm from being proxied. Start and Stop packets need to be proxied, but the Interim-Updated should only be handled locally. Is this possible with freeradius? Many Thanks, Murray

2 1

Re: Freeradius-Users Digest, Vol 63, Issue 95
by Tom Leach 29 Jul '10

29 Jul '10

Alan, changing from User-Password to Password-With-Header brought back the 'No "known good" password' error. I'm going through the rlm_pap.c code to try to see what's going on here. I haven't found any docs yet on what the various mapping possibilities are and what they do. Do you have a pointer to any so I don't keep bugging you and the list? I agree with the 'get it work, then tune it' approach. That's where I'm at now. It's working, I'm just trying to make all the messages go away :) Thanks! Tom Here is a snippet from radiusd -X: [ldap-server1] Added Crypt-Password = 4gOgBZqZgtwIw in check items [ldap-server1] looking for check items in directory... [ldap-server1] userPassword -> Password-With-Header == "{crypt}4gOgBZqZgtwIw" [ldap-server1] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap-server1] user testuser authorized to use remote access > Date: Tue, 27 Jul 2010 09:00:23 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Another LDAP/RADIUS integration problem. > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C4E8407.3030503(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Tom Leach wrote: >> Alan, I changed the ldap.attrmap file from "checkItem Crypt-Password >> userPassword" to "checkItem User-Password userPassword" and it's >> authenticating now, but I now have a new message in the debug output and >> I'm not sure if it's a problem, suggestion, or otherwise. > > It's a suggestion. But the first step was to get it to work. > >> I can't >> change the LDAP directory to contain actual cleartext passwords, so it >> may just be something that I have to live with. > > Change the mapping in ldap.attrmap to: > > checkItem Password-With-Header userPassword > > That should *still* work, and will remove the warning. > > The process here is to first get it to work, and then get it to work > better. > > Alan DeKok.

2 3

Solaris 10 1.13 FreeRadius
by Kory Wheatley 29 Jul '10

29 Jul '10

Will LDAP failover work on Solaris 10 with FreeRadius 1.1.3 ? This is the default that comes with Solaris or do we need to upgrade FreeRadius.

2 1

coa proxy'ing with a NAC device
by Kevin Ehlers 29 Jul '10

29 Jul '10

I'm having a really hard time with proxying or just dealing with CoA's. The documentation just isn't working for me. I can configure the coa server. I can get the originate-coa server up too. I can send CoA's to the server, but I can't get it to proxy them or re-send them as if it was originating the CoA. I see that they're being processed when looking at debug mode. But I just don't know how to do anything with them. This is what I want to do: [lots of switches doing dot1x]<->[freeradius]<->[NAC device, PacketFence in this case] I want to be able to send a CoA request from PacketFence (or another management server) to freeradius, and have it relay that CoA to a specific switch. E.g. I have determined that a user needs to be quarantined, so I run a script on the backend, and part of that requires having that user re-authenticate and get assigned a quarantine vlan. PF determines which switch they're on, sends a CoA to FreeRadius, FreeRadius then sends the CoA to the correct switch. Is there a way to do this without configuring a client entry for every edge device? Should I be using the proxy.conf in some way? I'm not really clear about how to use the virtual servers in regard to proxying. Thanks, -- Kevin Ehlers Network Engineer University of Oregon

2 1

send radius response without request
by Sallee, Stephen (Jake) 29 Jul '10

29 Jul '10

Is it possible to have FreeRADIUS send a radius response without first receiving a request, provided I can feed it the same information the request would have? OR Is it possible for FreeRADIUS to see the request come from one host and have the response go to another? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1