- Freeradius-Users - lists.freeradius.org

Active Directory, PEAP and random works....
by Abdessamad BARAKAT 17 May '10

17 May '10

Hi, I have a strange problem. I try to authenticate users againts AD, it's seems to be a typical deployment of freeradius. But it's works randomly. When it's don't works , the mschap/NTLM auth success, the server send a access-challenge, I see on the cisco aironet the access-challenge come back to the client and no reply from the client and the connection stucks: +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/MRSLAP03571.domain.priv with NT-Password expand: --username=%{mschap:User-Name:-None} -> --username=MRSLAP03571$ expand: %{mschap:NT-Domain} -> DOMAIN expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN} -> --domain=DOMAIN mschap2: 60 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=923aaffd82c69093 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=a7e9503bed0bfedf055e9e32e241e391ccb0dd649fe09bbe Exec-Program output: NT_KEY: 2254EC3D1B726196286DA65965D5D411 Exec-Program-Wait: plaintext: NT_KEY: 2254EC3D1B726196286DA65965D5D411 Exec-Program: returned: 0 ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010b00331a030a002e533d34423436443245344135353939434637453443423233353641343546393836333932393945373637 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe713faa1e618e0bc40c4047c03951291 PEAP: Processing from tunneled session code 0x1e9e490 11 EAP-Message = 0x010b00331a030a002e533d34423436443245344135353939434637453443423233353641343546393836333932393945373637 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe713faa1e618e0bc40c4047c03951291 PEAP: Got tunneled Access-Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 103 to <AIRONET CISCO> port 1645 EAP-Message = 0x010b004a1900170301003fd5c3f845006343c8072ae98874a3df6bc8c3594e045b31fe7220a5c44b269eac3e3cdf6f48de5d3066feeb70a8f1d958e6b25c5f7ead1fa5c9064b89cc24a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d184007551359eef79a3370536543a0 Finished request 8. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 95 with timestamp +56 Cleaning up request 1 ID 96 with timestamp +56 Cleaning up request 2 ID 97 with timestamp +56 I have already checked the XP extension is present on the certificate server: extendedKeyUsage = 1.3.6.1.5.5.7.3.1 ################################################## # # !!!!! WARNINGS for Windows compatibility !!!!! # ################################################## # # If you see the server send an Access-Challenge, # and the client never sends another Access-Request, # then # # STOP! # # The server certificate has to have special OID's # in it, or else the Microsoft clients will silently # fail. See the "scripts/xpextensions" file for # details, and the following page: # # http://support.microsoft.com/kb/814394/en- I use : freeradius 2.0.4 samba 3.2.5 cisco aironet 1240 I have tried other version of samba: 3.2.15 and 3.4.8 and freeradius 2.1.8 The samba / winbbind stuff seems to work correctly ( Tests wbinfo, ntlm_auth OK) I have the same issue with other XP / windows 7 supplicants. I think I have checked correctly the howto: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO I don't think I'm the first with the same problem so please help me before I'm going crazy :) Thanks a lot for any information.

3 4

COA default configuration...Need help to test radclient
by Eric Martell 17 May '10

17 May '10

Hi, I followed the direction of how to setup COA in the freeradius. Uncommented from client.conf coa_server = localhost-coa When I ran the sample radclient, I am not seeing any response back. echo "User-Name='cisco',User-Password='cisco',cisco-avpair='subscriber:command=account-logon',Cisco-Account-Info='S172.16.12.12'" | /home/test/freeradius-2.1.8/bin/radclient -x localhost:3799 coa testing123 Sending CoA-Request of id 79 to 127.0.0.1 port 3799 User-Name = "cisco" User-Password = "cisco" Cisco-AVPair = "subscriber:command=account-logon" Cisco-Account-Info = "S172.16.xx.xx" Sending CoA-Request of id 79 to 127.0.0.1 port 3799 User-Name = "cisco" User-Password = "cisco" Cisco-AVPair = "subscriber:command=account-logon" Cisco-Account-Info = "S172.16.xx.xx" Sending CoA-Request of id 79 to 127.0.0.1 port 3799 User-Name = "cisco" User-Password = "cisco" Cisco-AVPair = "subscriber:command=account-logon" Cisco-Account-Info = "S172.16.xx.xx" radclient: no response from server for ID 79 socket 3 Do I have to do anything more than any default configuration? Please help. Thanks and Regards, Log attached. # ./radiusd -xX Fri May 14 19:59:04 2010 : Info: FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on May 14 2010 at 15:36:52 Fri May 14 19:59:04 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Fri May 14 19:59:04 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri May 14 19:59:04 2010 : Info: PARTICULAR PURPOSE. Fri May 14 19:59:04 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri May 14 19:59:04 2010 : Info: GNU General Public License v2. Fri May 14 19:59:04 2010 : Info: Starting - reading configuration files ... Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/radiusd.conf Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/proxy.conf Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/clients.conf Fri May 14 19:59:04 2010 : Debug: including files in directory /home/test/freeradius-2.1.8/etc/raddb/modules/ Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/preprocess Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/perl Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/exec Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/detail.example.com Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/checkval Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/smbpasswd Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/smsotp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/radutmp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/ldap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/detail.log Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/krb5 Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/etc_group Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/attr_filter Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/expr Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/ntlm_auth Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/passwd Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/otp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/unix Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/detail Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/sradutmp Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/policy Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/logintime Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/pam Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/sql_log Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/attr_rewrite Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/files Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/cui Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/pap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/counter Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/mschap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/sqlcounter_expire_on_login Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/realm Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/echo Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/digest Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/wimax Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/always Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/acct_unique Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/mac2vlan Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/inner-eap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/chap Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/linelog Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/mac2ip Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/expiration Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/modules/ippool Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/eap.conf Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/policy.conf Fri May 14 19:59:04 2010 : Debug: including files in directory /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/ Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/originate-coa Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/inner-tunnel Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/default Fri May 14 19:59:04 2010 : Debug: including configuration file /home/test/freeradius-2.1.8/etc/raddb/sites-enabled/control-socket Fri May 14 19:59:04 2010 : Debug: main { Fri May 14 19:59:04 2010 : Debug: allow_core_dumps = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: including dictionary file /home/test/freeradius-2.1.8/etc/raddb/dictionary Fri May 14 19:59:04 2010 : Debug: main { Fri May 14 19:59:04 2010 : Debug: prefix = "/home/test/freeradius-2.1.8" Fri May 14 19:59:04 2010 : Debug: localstatedir = "/home/test/freeradius-2.1.8/var" Fri May 14 19:59:04 2010 : Debug: logdir = "/home/test/freeradius-2.1.8/var/log/radius" Fri May 14 19:59:04 2010 : Debug: libdir = "/home/test/freeradius-2.1.8/lib" Fri May 14 19:59:04 2010 : Debug: radacctdir = "/home/test/freeradius-2.1.8/var/log/radius/radacct" Fri May 14 19:59:04 2010 : Debug: hostname_lookups = no Fri May 14 19:59:04 2010 : Debug: max_request_time = 30 Fri May 14 19:59:04 2010 : Debug: cleanup_delay = 5 Fri May 14 19:59:04 2010 : Debug: max_requests = 1024 Fri May 14 19:59:04 2010 : Debug: pidfile = "/home/test/freeradius-2.1.8/var/run/radiusd/radiusd.pid" Fri May 14 19:59:04 2010 : Debug: checkrad = "/home/test/freeradius-2.1.8/sbin/checkrad" Fri May 14 19:59:04 2010 : Debug: debug_level = 0 Fri May 14 19:59:04 2010 : Debug: proxy_requests = yes Fri May 14 19:59:04 2010 : Debug: log { Fri May 14 19:59:04 2010 : Debug: stripped_names = no Fri May 14 19:59:04 2010 : Debug: auth = no Fri May 14 19:59:04 2010 : Debug: auth_badpass = no Fri May 14 19:59:04 2010 : Debug: auth_goodpass = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: security { Fri May 14 19:59:04 2010 : Debug: max_attributes = 200 Fri May 14 19:59:04 2010 : Debug: reject_delay = 1 Fri May 14 19:59:04 2010 : Debug: status_server = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri May 14 19:59:04 2010 : Debug: proxy server { Fri May 14 19:59:04 2010 : Debug: retry_delay = 5 Fri May 14 19:59:04 2010 : Debug: retry_count = 3 Fri May 14 19:59:04 2010 : Debug: default_fallback = no Fri May 14 19:59:04 2010 : Debug: dead_time = 120 Fri May 14 19:59:04 2010 : Debug: wake_all_if_all_dead = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server localhost { Fri May 14 19:59:04 2010 : Debug: ipaddr = 127.0.0.1 Fri May 14 19:59:04 2010 : Debug: port = 1812 Fri May 14 19:59:04 2010 : Debug: type = "auth" Fri May 14 19:59:04 2010 : Debug: secret = "testing123" Fri May 14 19:59:04 2010 : Debug: response_window = 20 Fri May 14 19:59:04 2010 : Debug: max_outstanding = 65536 Fri May 14 19:59:04 2010 : Debug: require_message_authenticator = no Fri May 14 19:59:04 2010 : Debug: zombie_period = 40 Fri May 14 19:59:04 2010 : Debug: status_check = "status-server" Fri May 14 19:59:04 2010 : Debug: ping_interval = 30 Fri May 14 19:59:04 2010 : Debug: check_interval = 30 Fri May 14 19:59:04 2010 : Debug: num_answers_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: num_pings_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: revive_interval = 120 Fri May 14 19:59:04 2010 : Debug: status_check_timeout = 4 Fri May 14 19:59:04 2010 : Debug: irt = 2 Fri May 14 19:59:04 2010 : Debug: mrt = 16 Fri May 14 19:59:04 2010 : Debug: mrc = 5 Fri May 14 19:59:04 2010 : Debug: mrd = 30 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server_pool my_auth_failover { Fri May 14 19:59:04 2010 : Debug: type = fail-over Fri May 14 19:59:04 2010 : Debug: home_server = localhost Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: realm example.com { Fri May 14 19:59:04 2010 : Debug: auth_pool = my_auth_failover Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: realm LOCAL { Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server localhost-coa { Fri May 14 19:59:04 2010 : Debug: ipaddr = 127.0.0.1 Fri May 14 19:59:04 2010 : Debug: port = 3799 Fri May 14 19:59:04 2010 : Debug: type = "coa" Fri May 14 19:59:04 2010 : Debug: secret = "testing1234" Fri May 14 19:59:04 2010 : Debug: response_window = 30 Fri May 14 19:59:04 2010 : Debug: max_outstanding = 65536 Fri May 14 19:59:04 2010 : Debug: zombie_period = 40 Fri May 14 19:59:04 2010 : Debug: status_check = "none" Fri May 14 19:59:04 2010 : Debug: ping_interval = 30 Fri May 14 19:59:04 2010 : Debug: check_interval = 30 Fri May 14 19:59:04 2010 : Debug: num_answers_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: num_pings_to_alive = 3 Fri May 14 19:59:04 2010 : Debug: revive_interval = 300 Fri May 14 19:59:04 2010 : Debug: status_check_timeout = 4 Fri May 14 19:59:04 2010 : Debug: irt = 2 Fri May 14 19:59:04 2010 : Debug: mrt = 16 Fri May 14 19:59:04 2010 : Debug: mrc = 5 Fri May 14 19:59:04 2010 : Debug: mrd = 30 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: home_server_pool coa { Fri May 14 19:59:04 2010 : Debug: type = fail-over Fri May 14 19:59:04 2010 : Debug: virtual_server = originate-coa.example.com Fri May 14 19:59:04 2010 : Debug: home_server = localhost-coa Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Loading Clients #### Fri May 14 19:59:04 2010 : Debug: client localhost { Fri May 14 19:59:04 2010 : Debug: ipaddr = 127.0.0.1 Fri May 14 19:59:04 2010 : Debug: require_message_authenticator = no Fri May 14 19:59:04 2010 : Debug: secret = "testing123" Fri May 14 19:59:04 2010 : Debug: nastype = "other" Fri May 14 19:59:04 2010 : Debug: coa_server = "localhost-coa" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Instantiating modules #### Fri May 14 19:59:04 2010 : Debug: instantiate { Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_exec Fri May 14 19:59:04 2010 : Debug: Module: Instantiating exec Fri May 14 19:59:04 2010 : Debug: exec { Fri May 14 19:59:04 2010 : Debug: wait = no Fri May 14 19:59:04 2010 : Debug: input_pairs = "request" Fri May 14 19:59:04 2010 : Debug: shell_escape = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_expr Fri May 14 19:59:04 2010 : Debug: Module: Instantiating expr Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_expiration Fri May 14 19:59:04 2010 : Debug: Module: Instantiating expiration Fri May 14 19:59:04 2010 : Debug: expiration { Fri May 14 19:59:04 2010 : Debug: reply-message = "Password Has Expired " Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_logintime Fri May 14 19:59:04 2010 : Debug: Module: Instantiating logintime Fri May 14 19:59:04 2010 : Debug: logintime { Fri May 14 19:59:04 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Fri May 14 19:59:04 2010 : Debug: minimum-timeout = 60 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: radiusd: #### Loading Virtual Servers #### Fri May 14 19:59:04 2010 : Debug: server originate-coa.example.com { Fri May 14 19:59:04 2010 : Debug: modules { Fri May 14 19:59:04 2010 : Debug: Module: Checking pre-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_always, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_always Fri May 14 19:59:04 2010 : Debug: Module: Instantiating ok Fri May 14 19:59:04 2010 : Debug: always ok { Fri May 14 19:59:04 2010 : Debug: rcode = "ok" Fri May 14 19:59:04 2010 : Debug: simulcount = 0 Fri May 14 19:59:04 2010 : Debug: mpp = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Instantiating fail Fri May 14 19:59:04 2010 : Debug: always fail { Fri May 14 19:59:04 2010 : Debug: rcode = "fail" Fri May 14 19:59:04 2010 : Debug: simulcount = 0 Fri May 14 19:59:04 2010 : Debug: mpp = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } # modules Fri May 14 19:59:04 2010 : Debug: } # server Fri May 14 19:59:04 2010 : Debug: server inner-tunnel { Fri May 14 19:59:04 2010 : Debug: modules { Fri May 14 19:59:04 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_pap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating pap Fri May 14 19:59:04 2010 : Debug: pap { Fri May 14 19:59:04 2010 : Debug: encryption_scheme = "auto" Fri May 14 19:59:04 2010 : Debug: auto_header = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_chap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating chap Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_mschap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating mschap Fri May 14 19:59:04 2010 : Debug: mschap { Fri May 14 19:59:04 2010 : Debug: use_mppe = yes Fri May 14 19:59:04 2010 : Debug: require_encryption = no Fri May 14 19:59:04 2010 : Debug: require_strong = no Fri May 14 19:59:04 2010 : Debug: with_ntdomain_hack = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_unix Fri May 14 19:59:04 2010 : Debug: Module: Instantiating unix Fri May 14 19:59:04 2010 : Debug: unix { Fri May 14 19:59:04 2010 : Debug: radwtmp = "/home/test/freeradius-2.1.8/var/log/radius/radwtmp" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_eap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap Fri May 14 19:59:04 2010 : Debug: eap { Fri May 14 19:59:04 2010 : Debug: default_eap_type = "md5" Fri May 14 19:59:04 2010 : Debug: timer_expire = 60 Fri May 14 19:59:04 2010 : Debug: ignore_unknown_eap_types = no Fri May 14 19:59:04 2010 : Debug: cisco_accounting_username_bug = no Fri May 14 19:59:04 2010 : Debug: max_sessions = 4096 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-md5 Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-leap Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-gtc Fri May 14 19:59:04 2010 : Debug: gtc { Fri May 14 19:59:04 2010 : Debug: challenge = "Password: " Fri May 14 19:59:04 2010 : Debug: auth_type = "PAP" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-tls Fri May 14 19:59:04 2010 : Debug: tls { Fri May 14 19:59:04 2010 : Debug: rsa_key_exchange = no Fri May 14 19:59:04 2010 : Debug: dh_key_exchange = yes Fri May 14 19:59:04 2010 : Debug: rsa_key_length = 512 Fri May 14 19:59:04 2010 : Debug: dh_key_length = 512 Fri May 14 19:59:04 2010 : Debug: verify_depth = 0 Fri May 14 19:59:04 2010 : Debug: pem_file_type = yes Fri May 14 19:59:04 2010 : Debug: private_key_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/server.pem" Fri May 14 19:59:04 2010 : Debug: certificate_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/server.pem" Fri May 14 19:59:04 2010 : Debug: CA_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/ca.pem" Fri May 14 19:59:04 2010 : Debug: private_key_password = "whatever" Fri May 14 19:59:04 2010 : Debug: dh_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/dh" Fri May 14 19:59:04 2010 : Debug: random_file = "/home/test/freeradius-2.1.8/etc/raddb/certs/random" Fri May 14 19:59:04 2010 : Debug: fragment_size = 1024 Fri May 14 19:59:04 2010 : Debug: include_length = yes Fri May 14 19:59:04 2010 : Debug: check_crl = no Fri May 14 19:59:04 2010 : Debug: cipher_list = "DEFAULT" Fri May 14 19:59:04 2010 : Debug: make_cert_command = "/home/test/freeradius-2.1.8/etc/raddb/certs/bootstrap" Fri May 14 19:59:04 2010 : Debug: cache { Fri May 14 19:59:04 2010 : Debug: enable = no Fri May 14 19:59:04 2010 : Debug: lifetime = 24 Fri May 14 19:59:04 2010 : Debug: max_entries = 255 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-ttls Fri May 14 19:59:04 2010 : Debug: ttls { Fri May 14 19:59:04 2010 : Debug: default_eap_type = "md5" Fri May 14 19:59:04 2010 : Debug: copy_request_to_tunnel = no Fri May 14 19:59:04 2010 : Debug: use_tunneled_reply = no Fri May 14 19:59:04 2010 : Debug: virtual_server = "inner-tunnel" Fri May 14 19:59:04 2010 : Debug: include_length = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-peap Fri May 14 19:59:04 2010 : Debug: peap { Fri May 14 19:59:04 2010 : Debug: default_eap_type = "mschapv2" Fri May 14 19:59:04 2010 : Debug: copy_request_to_tunnel = no Fri May 14 19:59:04 2010 : Debug: use_tunneled_reply = no Fri May 14 19:59:04 2010 : Debug: proxy_tunneled_request_as_eap = yes Fri May 14 19:59:04 2010 : Debug: virtual_server = "inner-tunnel" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri May 14 19:59:04 2010 : Debug: Module: Instantiating eap-mschapv2 Fri May 14 19:59:04 2010 : Debug: mschapv2 { Fri May 14 19:59:04 2010 : Debug: with_ntdomain_hack = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_realm Fri May 14 19:59:04 2010 : Debug: Module: Instantiating suffix Fri May 14 19:59:04 2010 : Debug: realm suffix { Fri May 14 19:59:04 2010 : Debug: format = "suffix" Fri May 14 19:59:04 2010 : Debug: delimiter = "@" Fri May 14 19:59:04 2010 : Debug: ignore_default = no Fri May 14 19:59:04 2010 : Debug: ignore_null = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_files, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_files Fri May 14 19:59:04 2010 : Debug: Module: Instantiating files Fri May 14 19:59:04 2010 : Debug: files { Fri May 14 19:59:04 2010 : Debug: usersfile = "/home/test/freeradius-2.1.8/etc/raddb/users" Fri May 14 19:59:04 2010 : Debug: acctusersfile = "/home/test/freeradius-2.1.8/etc/raddb/acct_users" Fri May 14 19:59:04 2010 : Debug: preproxy_usersfile = "/home/test/freeradius-2.1.8/etc/raddb/preproxy_users" Fri May 14 19:59:04 2010 : Debug: compat = "no" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking session {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_radutmp Fri May 14 19:59:04 2010 : Debug: Module: Instantiating radutmp Fri May 14 19:59:04 2010 : Debug: radutmp { Fri May 14 19:59:04 2010 : Debug: filename = "/home/test/freeradius-2.1.8/var/log/radius/radutmp" Fri May 14 19:59:04 2010 : Debug: username = "%{User-Name}" Fri May 14 19:59:04 2010 : Debug: case_sensitive = yes Fri May 14 19:59:04 2010 : Debug: check_with_nas = yes Fri May 14 19:59:04 2010 : Debug: perm = 384 Fri May 14 19:59:04 2010 : Debug: callerid = yes Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_attr_filter Fri May 14 19:59:04 2010 : Debug: Module: Instantiating attr_filter.access_reject Fri May 14 19:59:04 2010 : Debug: attr_filter attr_filter.access_reject { Fri May 14 19:59:04 2010 : Debug: attrsfile = "/home/test/freeradius-2.1.8/etc/raddb/attrs.access_reject" Fri May 14 19:59:04 2010 : Debug: key = "%{User-Name}" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } # modules Fri May 14 19:59:04 2010 : Debug: } # server Fri May 14 19:59:04 2010 : Debug: server { Fri May 14 19:59:04 2010 : Debug: modules { Fri May 14 19:59:04 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_preprocess Fri May 14 19:59:04 2010 : Debug: Module: Instantiating preprocess Fri May 14 19:59:04 2010 : Debug: preprocess { Fri May 14 19:59:04 2010 : Debug: huntgroups = "/home/test/freeradius-2.1.8/etc/raddb/huntgroups" Fri May 14 19:59:04 2010 : Debug: hints = "/home/test/freeradius-2.1.8/etc/raddb/hints" Fri May 14 19:59:04 2010 : Debug: with_ascend_hack = no Fri May 14 19:59:04 2010 : Debug: ascend_channels_per_line = 23 Fri May 14 19:59:04 2010 : Debug: with_ntdomain_hack = no Fri May 14 19:59:04 2010 : Debug: with_specialix_jetstream_hack = no Fri May 14 19:59:04 2010 : Debug: with_cisco_vsa_hack = no Fri May 14 19:59:04 2010 : Debug: with_alvarion_vsa_hack = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking preacct {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_acct_unique Fri May 14 19:59:04 2010 : Debug: Module: Instantiating acct_unique Fri May 14 19:59:04 2010 : Debug: acct_unique { Fri May 14 19:59:04 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking accounting {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Fri May 14 19:59:04 2010 : Debug: Module: Linked to module rlm_detail Fri May 14 19:59:04 2010 : Debug: Module: Instantiating detail Fri May 14 19:59:04 2010 : Debug: detail { Fri May 14 19:59:04 2010 : Debug: detailfile = "/home/test/freeradius-2.1.8/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Fri May 14 19:59:04 2010 : Debug: header = "%t" Fri May 14 19:59:04 2010 : Debug: detailperm = 384 Fri May 14 19:59:04 2010 : Debug: dirperm = 493 Fri May 14 19:59:04 2010 : Debug: locking = no Fri May 14 19:59:04 2010 : Debug: log_packet_header = no Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Instantiating attr_filter.accounting_response Fri May 14 19:59:04 2010 : Debug: attr_filter attr_filter.accounting_response { Fri May 14 19:59:04 2010 : Debug: attrsfile = "/home/test/freeradius-2.1.8/etc/raddb/attrs.accounting_response" Fri May 14 19:59:04 2010 : Debug: key = "%{User-Name}" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Module: Checking session {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri May 14 19:59:04 2010 : Debug: } # modules Fri May 14 19:59:04 2010 : Debug: } # server Fri May 14 19:59:04 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: type = "auth" Fri May 14 19:59:04 2010 : Debug: ipaddr = * Fri May 14 19:59:04 2010 : Debug: port = 0 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: type = "acct" Fri May 14 19:59:04 2010 : Debug: ipaddr = * Fri May 14 19:59:04 2010 : Debug: port = 0 Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: type = "control" Fri May 14 19:59:04 2010 : Debug: listen { Fri May 14 19:59:04 2010 : Debug: socket = "/home/test/freeradius-2.1.8/var/run/radiusd/radiusd.sock" Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: } Fri May 14 19:59:04 2010 : Debug: Listening on authentication address * port 1812 Fri May 14 19:59:04 2010 : Debug: Listening on accounting address * port 1813 Fri May 14 19:59:04 2010 : Debug: Listening on command file /home/test/freeradius-2.1.8/var/run/radiusd/radiusd.sock Fri May 14 19:59:04 2010 : Debug: Listening on proxy address * port 1814 Fri May 14 19:59:04 2010 : Info: Ready to process requests.

3 5

Free Radius testing....
by John Raja 16 May '10

16 May '10

Hi, I have installed freeradius server in centos. I am trying to test with below mentioned command i am getting the error output as given below , Please help me out... I have created the username in the user file "bob Cleartext-Password := "hello" *Command* # radtest bob bob localhost 1812 testing *Output* Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 radclient: no response from server for ID 147 socket 3 ************************************************************************************************************************************************ Regards, John Raja Network Engineer IP Extn : 500092 Te : 022-40609028 </pre><img src="http://www.5paisa.com/Logo-change-signature.gif"><p><small> Confidentiality & Disclaimer: This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mails are notencrypted and cannot be guaranteed to be secured or error-free as information could be intercepted, corrupted, lost, destroyed arrive late or incomplete, or contain viruses. The sender, which includes India Infoline Limited and its group companies, will not be liable for any errors or ommissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.</small>

3 2

EAP-TLS and MAC Authentication
by John McDonnell 16 May '10

16 May '10

First a little information on our setup. When I first started working here, the wireless network had been in place for a year already and was rather small, only 3 access points and ~90 laptops. My boss set it up as static WEP (I don't know why WEP instead of WPA) and used the AP's (Cisco 1121 series) authorized MAC list to restrict access to our laptops. When I came on board, we just received about 250 new laptops from the grant and the AP's couldn't fit all of the MAC addresses in the space allocated in the flash as simulated NVRAM. For a quick fix, I changed how much NVRAM was simulated in order for the AP's to hold the info when rebooted. Of course, maintaining the MAC list on all of these AP's (we got an additional 8 or 9 AP's at that time) was a nightmare, plus the AP's seemed a bit sluggish with authenticating laptops. I convinced my boss to let me configure a FreeRADIUS server to do the authentication, removing all of the MAC addresses from the AP's and resetting the NVRAM to its default size. We now have about 15 AP's and ~400 laptops. Some AP's are overloaded while others have no load at all, though this has little to do with FR other than the fact the AP's lose packets to FR from time to time, through no fault of FR at all. This summer, due to budget cuts, we won't be getting in much new equipment which frees me up to do some long needed adjustments to the wireless network. I am going to be converting from WEP to WPA finally. I don't want to use WPA-PSK so I am looking at doing EAP-TLS. I have a test server up that I've gotten to work with EAP-TLS using the snake-oil certificates. On the AP's, there is the option of doing EAP and MAC authentication. This leads to my question. Does doing MAC authentication really accomplish anything when using EAP-TLS? The certificates can't be copied from the laptop they are installed onto as far as I know. They're running XP SP3 and when installing the certificates, the option to export them will not be checked. This should mean that if it has a valid certificate, it is one of our laptops and not someone who somehow stole a cert and installed it on their laptop. I'm not doing any dynamic VLAN assignments over the wireless so I really don't see any need for MAC authentication and just see it as unneeded overhead. Is there any reason why I'm wrong with this assumption? The only thing I can see enabling MAC authentication for is if we switch at some point to EAP-TTLS or EAP-PEAP to verify that the user is logging in with one of our laptops and not one they brought in from home/cell phone/etc. Or if I can convince my boss to authenticate all the wired connections so that no one brings in a laptop from home and plugs it into the network. (We've had at least some substitute teachers do this apparently, not sure if any full-time staff has done this.) While I might end up creating temporary users for when we have presenters and use EAP-[TTLS|PEAP] for them, I'd have to not do MAC authentication for them as finding out the MAC address in advance seems rather unlikely to happen. Sorry for being so long winded, but I wanted to make sure I got everything relevant about our setup and what I'm trying to do across. And as I finish my proof-reading, I realize that regardless of if I do MAC authentication or not, it seems rather pointless to enable the option on the AP as the MAC address would be sent regardless of if I set it or not. (Which really makes me wonder why they even included it, unless I'm misunderstanding something.) I think the proper solution would be to do a check in FR to ensure when the user requests access, that the requesting MAC is from one of our machines. Regardless, could someone let me know if there is any need to do MAC authentication when doing EAP-TLS? -- John McDonnell Penn Cambria School District mcdonnjd(a)pcam.org

2 3

autthentication error
by shirkavand 15 May '10

15 May '10

Hi, I have configurated a freeradius server using MySql authentication. When i run "radtest" i get a succefull response: rad_recv: Access-Request packet from host 127.0.0.1 port 45562, id=209, length=59 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sqltest' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sqltest' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testpwd" [pap] Using clear text password "testpwd" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 209 to 127.0.0.1 port 45562 Finished request 20. Going to the next request Now i have configurated a windows supplicant, when i enter the credentials for login from the suplicant pc, the radius server always sends a rejected response in the servers terminal(i have freeradius over debug mode to se all the messages), this is what i get: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.4 port 3666, id=0, length=139 Cleaning up request 18 ID 0 with timestamp +502 User-Name = "sqltest" NAS-IP-Address = 192.168.1.4 Called-Station-Id = "00226b81bae1" Calling-Station-Id = "002369764cef" NAS-Identifier = "00226b81bae1" NAS-Port = 21 Framed-MTU = 1400 State = 0x5589d8c55588dc92d29bccd07151cb7c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100060319 Message-Authenticator = 0xb35d1b6482700c1122714ca033d1e480 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sqltest' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sqltest' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 19 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 19 Sending Access-Reject of id 0 to 192.168.1.4 port 3666 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 19 ID 0 with timestamp +502 Ready to process requests. As i can see the error is located here: Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select when the windows suppllicant tryes to access the server found an EAP authentication..that from some reason fails, when i do a "radtest" the the server tells: Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testpwd" [pap] Using clear text password "testpwd" [pap] User authenticated successfully I have configurated the windows client as recomended over in wiki. freeradius.org site Any idea? Cheers

3 6

A question about disconnections
by Nick Warr 14 May '10

14 May '10

We're a WISP using freeradius to do our AAA, and are in the process of updating our backend to the latest version of freeradius (probably 2.1.8), and we've been able to resolve a lot of issues with our current setup, except for a few (possibly vital) problems. The one we haven't been able to find anything about is if there's a method, or check we can implement to prevent this sort of situation. We have a central radius server, and a few point to point connections where we have our point to multipoint connections (base stations) each base stations is a NAS, which for the most part works just fine. Our problem happens if something interrupts the point to point connectivity, the PPP sessions between the CPEs and the base stations remain up, but on the radius side, if the point to point connection remains down for longer than the idle timeout, the user (at least for freeradius) is disconnected. The NAS however, remains unaware of this (as the UDP disconnect message didn't arrive.. link down and all that), and the user remains up and functional, but we no longer have any accounting for that user. This of course, we can reset by hand, but if it happens during the night for example, we could lose several hours of accounting. What I'd like to know is if freeradius 2.x has some sort of functionality we can configure to make sure that if the radius server is receiving accounting packets for an account which should be disconnected, that it will re-send the PoD to get the NAS to actually disconnect it. Is what I'm requesting something strange (or conversely idiotic, because it's only our Mikrotik base stations that don't do something like this) ? Thanks, Nick Warr

2 1

Configuration trouble (2.1.8 for use with WiMAX)
by Sumedh Sathaye 14 May '10

14 May '10

Dear all, I am trying to use FreeRadius 2.1.8 for AAA in a wimax network. The problem I am facing is that the WiMAX-MSK keys are not generated by FreeRadius. Can someone help me figure out what I am not doing OR doing incorrectly? I have configured the "raddb/sites-available/default" and "raddb/modules/wimax" files per instructions included in the files themselves. For reference, here are the configuration stanzas in the post-auth section of "default": update request { WiMAX-MN-NAI = "%{User-Name}" } update reply { WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = "%{EAP-MSK}" } wimax Run-log from "radiusd -X" is also included at the end of this message. Here is the message that indicates that EAP is not computing MSK and EMSK: [wimax] No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys. Thank you in advance, and I apologize if this question has been answered before -- I did not find answers/pointers in the FAQ or the Wiki. Best Regards, Sumedh ---------------------------------------------- FreeRADIUS Version 2.1.8, for host x86_64-unknown-linux-gnu, built on May 11 2010 at 23:50:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_wimax Module: Instantiating wimax wimax { delete_mppe_keys = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 33946, id=0, length=99 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Service-Type = Authenticate-Only User-Name = "00:11:22:33:44:55" EAP-Message = 0x020100160130303a31313a32323a33333a34343a3535 Message-Authenticator = 0xfd69faa6c99f7a3370053df2352bf710 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "00:11:22:33:44:55", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry 00:11:22:33:44:55 at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 33946 EAP-Message = 0x0102001604106bbf07a4c14f3a8827abfc156663de53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6657d5226655d142401be8626f19b077 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 33946, id=1, length=117 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Service-Type = Authenticate-Only User-Name = "00:11:22:33:44:55" State = 0x6657d5226655d142401be8626f19b077 EAP-Message = 0x020200160410c5ef19bc837126c1f52cff9375b3dfbd Message-Authenticator = 0x4bd0892e19ab27690245b2a54eb0039a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "00:11:22:33:44:55", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry 00:11:22:33:44:55 at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop expand: %{User-Name} -> 00:11:22:33:44:55 ++[request] returns noop expand: %{EAP-MSK} -> ++[reply] returns noop [wimax] No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys. ++[wimax] returns noop Sending Access-Accept of id 1 to 127.0.0.1 port 33946 EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:11:22:33:44:55" WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = 0x Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +119 Cleaning up request 1 ID 1 with timestamp +119 Ready to process requests.

4 7

Freeradius privilege separation
by Michał Dopierała 14 May '10

14 May '10

Hi! It is possible in freeradius to have one user who has full privilege level to one equipment (one cisco router privilege lvl15), and limited privilege level to other equipment (other router with smaller privilege e.g. lvl10 which will be configured on router)? How to separate it? My current configuration of users: mdopierala Auth-Type := PAP, Crypt-Password = "passwrd" Service-Type = "Administrative-User", Cisco-AVPair="shell:priv-lvl=15", Brocade-Auth-Role ="Administrator" and part of clienf.conf client 192.168.1.1 { secret = community shortname = router1 } client 192.168.1.2 { secret = community shortname = router2 } I'm waiting for response Michal Dopierala

3 4

Pending release of 2.1.9
by Alan DeKok 14 May '10

14 May '10

I've put pre releases of 2.1.9 on the web: http://git.freeradius.org/pre/ Please try them, and note any issues. If there aren't problems, we can release 2.1.9 real soon now. Alan DeKok.

4 11

configuration freeradius with mysql
by dorra aa 14 May '10

14 May '10

hi i installed mysql. and i modify in /etc/freeradius/sql.conf: readclients=yes also, i decommented in /etc/freeradius/radiusd.conf: accounting {.... sql} authorize {... sql} i run again freeradius -X: but it seems failed because of sql: this is the output [...] sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server r! oot@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user 'root'@'localhost' (using password: YES)' # but i check it and it's ok i have in sql.conf: sql{server = "localhost" login = "root" password = "rootpass"} rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. #but i begin with installing mysql-server and i add a user in the database rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! sk! ipped 5, tried to connect 0 rlm_sql (sql): generate_sql_clients() r eturned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1860] Unknown module "sql". radiusd.conf[1789] Failed to parse authorize section. _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1