- Freeradius-Users - lists.freeradius.org

Re: will hints file be processed?
by Alan DeKok 14 Apr '10

14 Apr '10

Stefan A. wrote: > Even If I assign values to THEattributes in hints file, some later > evaluations in the default file are pretending: > > "Request:THEattributes not found" What does that mean? > How may I debug the processing of the hints file? Debug mode is fine. > Starting "radiusd -Xx" works fine: > ... > Fri Apr 9 18:34:25 2010 : Debug: (Loaded rlm_preprocess, checking if > it's valid) > Fri Apr 9 18:34:25 2010 : Debug: Module: Linked to module rlm_preprocess > Fri Apr 9 18:34:25 2010 : Debug: Module: Instantiating preprocess > Fri Apr 9 18:34:25 2010 : Debug: preprocess { > Fri Apr 9 18:34:25 2010 : Debug: huntgroups = > "/usr/local/etc/raddb/huntgroups" > Fri Apr 9 18:34:25 2010 : Debug: hints = "/usr/local/etc/raddb/hints" > ... > > receiving the a packet, I will output > ... > Fri Apr 9 18:34:54 2010 : Info: +- entering group authorize {...} > Fri Apr 9 18:34:54 2010 : Info: ++[preprocess] returns ok Yes... it's not matching anything in the 'hints' file. > I remember, that it has shown something like 'matched Line 17' in the past. > I'm sure, editing the correct hints file: If I do a mistake in a DEFAULT > line, radiusd does not load. What is in the packet, and what is in the 'hints' file? A comparison of the two should show why it isn't matching. > Any Idea, how to get more output, at least for the positive matches? Edit the source code. Alan DeKok.

1 0

Dan Schaffer is not in the office
by Dan Schaffer 13 Apr '10

13 Apr '10

I will be out of the office starting Tue 04/13/2010 and will not return until Thu 04/15/2010. I will respond to your message when I return.

1 0

How to handle challenge response using PAM auth in FreeRadius
by Rajendra Hegde 13 Apr '10

13 Apr '10

Hello, I am developing a PAM module for radius server. The radius server is configured to use PAM auth. It reads /etc/pam.d/radiusd and loads it on receiving auth request. The PAM module talks to external Authentication server and sometimes gets back "Challenge Respose". How can this be returned back to radius server from pam_sm_authenticate from my PAM module ? Please note that this is different than what pam_radius_auth.c does. pam_radius_auth.c talks to radius directly via network where as my module directly gets loaded by Radius. Why should not there be a way to return "Challenge Respose" from linux PAM back to it's loader ? Can this possible linux limitation be overcome by radius calling another exported function for PAM module covering all scenarios including "Challenge Response" ? Where should I look into in the freeradius codebase, if I were to add that functionality ? with best regards, The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. Please see our legal details at http://www.cryptocard.com CRYPTOCard Inc. is registered in the province of Ontario, Canada with Business number 80531 6478. CRYPTOCard Europe is limited liability company registered in England and Wales (with registered number 05728808 and VAT number 869 3979 41); its registered office is Aztec Centre, Aztec West, Almondsbury, Bristol, UK, BS32 4TD

4 10

Daemon exit normally but unexpectedly
by gorec2005 gorec2005 13 Apr '10

13 Apr '10

Tell my - how can you search exactly where the error occurs because of what the daemon exit's: Tue Apr 6 09:51:28 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 14:52:34 2010 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Apr 7 14:52:34 2010 : Info: rlm_sql (sql): Attempting to connect to radius@10.1.1.111:/radius Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Apr 7 14:52:34 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Apr 7 14:52:34 2010 : Info: Loaded virtual server <default> Wed Apr 7 14:52:34 2010 : Info: Ready to process requests. Wed Apr 7 14:52:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 14:52:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 14:52:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Apr 7 14:52:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 14:59:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 14:59:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 14:59:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Apr 7 14:59:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 14:59:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 14:59:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 14:59:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 14:59:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:00:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:00:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:00:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Apr 7 15:00:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:00:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:00:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:00:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Apr 7 15:00:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:01:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:01:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:01:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Apr 7 15:01:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:02:12 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:02:12 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:02:12 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Apr 7 15:02:12 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:04:42 2010 : Error: rlm_sql_mysql: MYSQL Error: No Fields Wed Apr 7 15:04:42 2010 : Error: rlm_sql_mysql: MYSQL error: Wed Apr 7 15:04:42 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Apr 7 15:04:42 2010 : Error: rlm_sql (sql): failed after re-connect Wed Apr 7 15:06:42 2010 : Info: Exiting normally.

2 1

PEAP/MS-CHAPv2 issue: mschap verified successful, but peap got no responses.
by Wang Nan 13 Apr '10

13 Apr '10

(others keywords: ActiveDirectory, Active Directory, AD, winbind, samba, eap.conf, peap, mschap) Hi FreeRARIUS gurus, I was implementing FreeRADIUS solution integrated with AD environment by using Samba/Winbind. EAP/TLS works, but not PEAP/MSCHAPv2, in that peap module is waiting for something after ntlm_auth returns success. I tested kinit/wbinfo/ntlm_auth individually, and they all works. I they tried all the ways (modifying around in /etc/raddb) came into my mind before I decided to ask help from freeradius mailling-list. I also tried with incorrect domain credentials, and the freeradius successfully rejected, whereas the correct could not successfully pass. I don't know if I misunderstand anything about freeradius configuration, so I post the log here. It would be appreciated if somebody here could give me a hand. Many Thanks, Eric Version: FreeRADIUS 2.1.6 AD box: MS Windows 2003 Radius box: OpenSUSE 11.2 Switch: Cisco 2950 Test Clients: WinXP(SP3) The following messages are copied from /var/log/radius.log: group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 10.6.10.4 { require_message_authenticator = no secret = "test" shortname = "10.6.10.4" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/MyCerts/server.key" certificate_file = "/etc/raddb/certs/MyCerts/server.pem" CA_file = "/etc/raddb/certs/MyCerts/ca.pem" private_key_password = "testing123" dh_file = "/etc/raddb/certs/MyCerts/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no make_cert_command = "/etc/raddb/certs/MyCerts/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 } Thread spawned new child 1. Total threads in pool: 1 Thread 1 waiting to be assigned a request Thread spawned new child 2. Total threads in pool: 2 Thread 2 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 5 waiting to be assigned a request Thread pool initialized radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to socket: Address already in use /etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 Waking up in 0.9 seconds. Thread 1 got semaphore Thread 1 handling request 8, (2 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 0 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Finished request 8. Going to the next request Thread 1 waiting to be assigned a request Waking up in 0.9 seconds. Thread 5 got semaphore Thread 5 handling request 9, (2 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 1 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0a8f], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 9. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.9 seconds. Thread 4 got semaphore Thread 4 handling request 10, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 10. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.9 seconds. Thread 3 got semaphore Thread 3 handling request 11, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 11. Going to the next request Thread 3 waiting to be assigned a request Waking up in 0.9 seconds. Thread 2 got semaphore Thread 2 handling request 12, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 4 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 182 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Finished request 12. Going to the next request Thread 2 waiting to be assigned a request Waking up in 0.9 seconds. Thread 1 got semaphore Thread 1 handling request 13, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Finished request 13. Going to the next request Thread 1 waiting to be assigned a request Waking up in 0.8 seconds. Thread 5 got semaphore Thread 5 handling request 14, (3 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 6 length 41 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - MYDOMAIN\user2 PEAP: Got tunneled identity of MYDOMAIN\user2 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to MYDOMAIN\user2 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 6 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled [peap] Got tunneled Access-Challenge ++[eap] returns handled Finished request 14. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.8 seconds. Thread 4 got semaphore Thread 4 handling request 15, (4 handled so far) +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 7 length 95 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 PEAP: Setting User-Name to MYDOMAIN\user2 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 7 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for user2 with NT-Password [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=MYDOMAIN [mschap] expand: --username=%{mschap:User-Name} -> --username=user2 [mschap] mschap2: ab [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=482dd107d4b6071b [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=7cb8be62e4bf7ef40c1d0e858acf3c321d869149d0be4215 Exec-Program output: NT_KEY: 99EC5F817A0D1BC302A389EA28204422 Exec-Program-Wait: plaintext: NT_KEY: 99EC5F817A0D1BC302A389EA28204422 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled [peap] Got tunneled Access-Challenge ++[eap] returns handled Finished request 15. Going to the next request Thread 4 waiting to be assigned a request Waking up in 3.8 seconds. Cleaning up request 8 ID 218 with timestamp +93 Cleaning up request 9 ID 219 with timestamp +93 Cleaning up request 10 ID 220 with timestamp +93 Cleaning up request 11 ID 221 with timestamp +93 Cleaning up request 12 ID 222 with timestamp +93 Cleaning up request 13 ID 223 with timestamp +93 Cleaning up request 14 ID 224 with timestamp +93 Waking up in 0.1 seconds. Cleaning up request 15 ID 225 with timestamp +93 Ready to process requests. Ready to process requests. Exiting normally.

1 0

Re: No authenticate method (Auth-Type) configuration found
by Ahmed Munir 13 Apr '10

13 Apr '10

Hi, Thanks for reply. Well user is created on SQL, and I uncommented 'sql' from sites-enabled/default on Authorized section and Accounting Section. But when I add 'sql' in Authenticate section I'm getting same error. i.e. [root@newtest raddb]# radtest sqltest testpwd 127.0.0.1 1812 testing123 Sending Access-Request of id 38 to 127.0.0.1 port 1812 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=38, length=20 The user I created in SQL listed down below; id username attribute op value 1 sqltest Cleartext-Password := testpwd Please advise what am I missing? Kindly assist me. Date: Mon, 12 Apr 2010 13:25:45 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: No authenticate method (Auth-Type) configuration found > for the request: Rejecting the user > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20100412122545.GA14869(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I'm newbie in FreeRadius, I installed latest version of it and followed > the steps as mentioned in the websites: > http://www.howtoforge.com/authentication-authorization-and-accounting-with-… > http://wiki.freeradius.org/SQL_HOWTO. After configuring basic setup I'm > facing i.e. No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user when I issue "radtest sqltest testpwd 127.0.0.1 > 1812 testing123". > > the username 'sqltest' gives a slight hint. > > is this user in 'users' file or in SQL? if the username is > in SQL, then you need to activate the SQL stuff (uncomment or > add SQL to the auth section) - its not on by default because > then all sites would have to have SQL up and running for anything > to work (or else it'd crash and burn) > > alan > > > -- Regards, Ahmed Munir

2 1

Somewhat OT: Empty SubjectAltName on server certificate (EAP-PEAP)
by Sergio Belkin 12 Apr '10

12 Apr '10

Hi, I have a certificate with xpextensions but its "SubjectAltName" is empty. Is Mandatory or only is wrong when its content doesn't match with FQDN? Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

Error: rlm_eap: No EAP session matching the State variable.
by Rupesh Kumar 12 Apr '10

12 Apr '10

Hi, I am using latest freeradius server (version 2.1.8). I have two authenticated sessions established with radius server and when disable and reenable the dot1x sessions, then I am seeing the following error and one request is getting Reject message from the server. Info: Found Auth-Type = EAP Info: +- entering group authenticate {...} Error: rlm_eap: No EAP session matching the State variable. Info: [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request Info: [eap] Failed in handler Info: ++[eap] returns invalid I have seen the archive and found there are some old issues related to this error. Is it a known issue in radius server or what is the root cause of it. I have attached radius server failure log messages Thanks in advance ! Cheers Rupesh

3 3

[2.1.8] No actions performed on (own) received accounting packets.
by Etienne Pretorius 12 Apr '10

12 Apr '10

Hello List, I seen to have a small issue. I have 2 running Freeradius 2.1.8 servers. I have set up proxying via the detail file readers - but for some strange reason, when the packet arrives at the remote server It says that it has received the Accounting-Request but then does no processing. The strange thing is, is that I have accounting packet proxied to me from my up stream provider and they are being processed as expected. Where should I look to see why the server is not processing the Accounting-Request. Kind Regards, Etienne

2 2

Win 7 IKEv2+PEAP = "no NPS server"?
by Stefan Winter 12 Apr '10

12 Apr '10

Hello, I wonder if anyone else has come across this already... Google is not very helpful here. We're setting up a VPN Server (strongswan) with Windows 7 in IKEv2 mode. The client side is supposed to authenticate with PEAP(*) to FreeRADIUS. That works pretty well, but on the first PEAP connection to the server, there's a big fat warning on the Win 7 UI: "You're connecting to a server which is not a valid NPS Server for this domain. You are strongly discouraged from continuing... bla..." If you click Connect, *everything works*. Now I'm wondering what needs to be done to make that useless warning go away... Maybe the FreeRADIUS server certificate needs yet another Extended Key Usage or so? I didn't really find helpful documentation. I wonder why it's Win 7's business anyway: of course the other end is not a NPS server. It's FreeRADIUS. But why would an EAP client consider it its own business to warn about a vendor discrepancy on the RADIUS far end? Greetings, Stefan Winter (*) If you just select EAP-MSCHAPv2 (no inner tunnel), the end result at the FR side is a crippled User-Name (which makes it impossible to auth users). Whether it's Win 7 or the strongswan EAP -> RADIUS conversion that gets it wrong, I don't know. -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 8