- Freeradius-Users - lists.freeradius.org

Re: radiusd log filename
by Fred MAISON 12 Mar '10

12 Mar '10

OK, Alan, It's clear. Unfortunately, logrotate version on last RedHat/CentOS does not support YYYYMMDD dateext function I can find on Debian ... I will have to write a postrotate script to do it. Thanks a lot. Fred > Date: Fri, 12 Mar 2010 14:04:03 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: radiusd log filename > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4B9A3BC3.7020109(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Fred MAISON wrote: > > I would like to change daemon log filename to have a YYYYMMDD suffix, in > > order to have an automatic daily log rotation, but this does not seems > > to be supported, as log_file does not seems to expand variables as this > > can be done for request logs or acct detail. > > It doesn't support log file rotation like that. > > I suggest using "logrotate". > > Alan DeKok.

2 2

ldap authenticate object not found
by omega bk 12 Mar '10

12 Mar '10

hello i got my user "bernard" on my openldap database. see my ldapserch: radtest:# ldapsearch -x -b "dc=example,dc=com" uid=bernard # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=bernard # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 #################################" but when i tried to authenticate bernard through freeradius i'ts fail. see the debug output. thank u so much guys. radtest:# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Mar 10 2010 at 13:50:12 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.20.253 { require_message_authenticator = no secret = "testinglinagora" shortname = "labtest8021x" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.75.128.251" port = 389 password = "test" identity = "cn=manager,ou=admins,ou=radius,dc=example,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=users,ou=radius,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" password_attribute = "userPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "radiusGroupName" groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8171ff8 Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=106, length=153 User-Name = "bernard" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x0202000c016265726e617264 Message-Authenticator = 0xcc5fc5a87a81a474f4171b85e6789f3d Cisco-NAS-Port = "FastEthernet0/24" NAS-Port = 50024 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.20.253 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "bernard", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> bernard [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.75.128.251:389, authentication 0 [ldap] bind as cn=manager,ou=admins,ou=radius,dc=example,dc=com/test to 10.75.128.251:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found rlm_ldap::ldap_groupcmp: search failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for bernard [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> bernard [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 106 to 192.168.20.253 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2b3e4ab22b3d5f3fba6933e793eadc35 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=107, length=165 User-Name = "bernard" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x020300060319 Message-Authenticator = 0xc84586b06705544163ffe219bcfddbce Cisco-NAS-Port = "FastEthernet0/24" NAS-Port = 50024 NAS-Port-Type = Ethernet State = 0x2b3e4ab22b3d5f3fba6933e793eadc35 NAS-IP-Address = 192.168.20.253 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "bernard", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> bernard [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 *[ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found rlm_ldap::ldap_groupcmp: search failed* [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for bernard [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> bernard [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=bernard) [ldap] expand: ou=users,ou=radius,dc=example,dc=com -> ou=users,ou=radius,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=users,ou=radius,dc=example,dc=com, with filter (uid=bernard) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type PEAP [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 107 to 192.168.20.253 port 1645 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 106 with timestamp +19 Waking up in 1.0 seconds. Cleaning up request 1 ID 107 with timestamp +19 Ready to process requests. *thanks for helping me*

4 9

radiusd log filename
by Fred MAISON 12 Mar '10

12 Mar '10

Hello freeradius-users, I have some radius instances started by name (radiusd -n xyz -d /opt/freeradius/xyz/etc/raddb), which by default generate log files as /var/log/radius/xyz.log. I would like to change daemon log filename to have a YYYYMMDD suffix, in order to have an automatic daily log rotation, but this does not seems to be supported, as log_file does not seems to expand variables as this can be done for request logs or acct detail. log_file = ${logdir}/${name}.log works fine, but log_file = ${logdir}/${name}.%Y%m%d is not expanded and generate /var/log/radius/c4france.%Y%m%d instead of /var/log/radius/c4france.20100312... Is the any way to achieve this setup ? Best regards Fred

2 1

Autentification error
by Tokie 12 Mar '10

12 Mar '10

Hi, I'm trying to connect my hotspot to freeradius with the mysql. With the old version(1.1.7) works good! Now I installed newer version and I copied the same configurations in new files (radius.con, site-enabled/default, sql.conf, client.conf ); but don't works!! Looks the debugging (freeradius -XXX), I believe that the problem is this: > Fri Mar 5 17:05:48 2010 : Debug: rlm_pap: WARNING! No "known good" > password found for the user. Authentication may fail because of this. > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from pap (rlm_pap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[pap] returns noop > Fri Mar 5 17:05:48 2010 : Debug: rad_check_password: Found > Auth-Type CHAP > Fri Mar 5 17:05:48 2010 : Debug: auth: type "CHAP" > Fri Mar 5 17:05:48 2010 : Debug: +- entering group CHAP > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authenticate]: calling > chap (rlm_chap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: rlm_chap: login attempt by "user" > with CHAP password > Fri Mar 5 17:05:48 2010 : Debug: rlm_chap: Cleartext-Password is > required for authentication > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authenticate]: returned > from chap (rlm_chap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[chap] returns invalid > Fri Mar 5 17:05:48 2010 : Debug: auth: Failed to validate the user. > Fri Mar 5 17:05:48 2010 : Auth: Login incorrect (rlm_chap: Clear text > password not available): [user/<CHAP-Password>] (from client nas port > 2154823689 cli 00:25:D3:XX:XX:XX) How can I fix the problem?? This is all debugging on freeradius -XXX: > Fri Mar 5 17:05:26 2010 : Debug: Listening on authentication address > * port 1812 > Fri Mar 5 17:05:26 2010 : Debug: Listening on accounting address * > port 1813 > Fri Mar 5 17:05:26 2010 : Debug: Listening on proxy address * port 1814 > Fri Mar 5 17:05:26 2010 : Debug: Ready to process requests. > rad_recv: Access-Request packet from host 192.168.1.100 port 60079, > id=20, length=198 > NAS-Port-Type = Ethernet > Calling-Station-Id = "00:25:D3:XX:XX:XX" > Called-Station-Id = "hotspot1" > NAS-Port-Id = "wlan1" > User-Name = "user" > NAS-Port = 2154823689 > Acct-Session-Id = "80700009" > Framed-IP-Address = 10.5.50.251 > Mikrotik-Host-IP = 10.5.50.251 > CHAP-Challenge = 0xc9da34f1dc7f357d5c51772d9da40e38 > CHAP-Password = 0xa1c879f954b7bd431d878d20b8fcef94ef > Service-Type = Login-User > WISPr-Logoff-URL = "http://10.5.50.1/logout" > NAS-Identifier = "MikroTik" > NAS-IP-Address = 192.168.1.100 > Fri Mar 5 17:05:48 2010 : Debug: +- entering group authorize > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling > preprocess (rlm_preprocess) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from preprocess (rlm_preprocess) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[preprocess] returns ok > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling chap > (rlm_chap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: rlm_chap: Setting 'Auth-Type := CHAP' > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from chap (rlm_chap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[chap] returns ok > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling > mschap (rlm_mschap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from mschap (rlm_mschap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[mschap] returns noop > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling > suffix (rlm_realm) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: rlm_realm: No '@' in User-Name = > "user", looking up realm NULL > Fri Mar 5 17:05:48 2010 : Debug: rlm_realm: No such realm "NULL" > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from suffix (rlm_realm) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[suffix] returns noop > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling eap > (rlm_eap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: rlm_eap: No EAP-Message, not doing EAP > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from eap (rlm_eap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[eap] returns noop > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling unix > (rlm_unix) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from unix (rlm_unix) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[unix] returns notfound > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling > files (rlm_files) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from files (rlm_files) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[files] returns noop > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling > expiration (rlm_expiration) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from expiration (rlm_expiration) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[expiration] returns noop > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling > logintime (rlm_logintime) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from logintime (rlm_logintime) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[logintime] returns noop > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: calling pap > (rlm_pap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: rlm_pap: WARNING! No "known good" > password found for the user. Authentication may fail because of this. > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authorize]: returned > from pap (rlm_pap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[pap] returns noop > Fri Mar 5 17:05:48 2010 : Debug: rad_check_password: Found > Auth-Type CHAP > Fri Mar 5 17:05:48 2010 : Debug: auth: type "CHAP" > Fri Mar 5 17:05:48 2010 : Debug: +- entering group CHAP > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authenticate]: calling > chap (rlm_chap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: rlm_chap: login attempt by "user" > with CHAP password > Fri Mar 5 17:05:48 2010 : Debug: rlm_chap: Cleartext-Password is > required for authentication > Fri Mar 5 17:05:48 2010 : Debug: modsingle[authenticate]: returned > from chap (rlm_chap) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[chap] returns invalid > Fri Mar 5 17:05:48 2010 : Debug: auth: Failed to validate the user. > Fri Mar 5 17:05:48 2010 : Auth: Login incorrect (rlm_chap: Clear text > password not available): [user/<CHAP-Password>] (from client nas port > 2154823689 cli 00:25:D3:XX:XX:XX) > Fri Mar 5 17:05:48 2010 : Debug: Found Post-Auth-Type Reject > Fri Mar 5 17:05:48 2010 : Debug: +- entering group REJECT > Fri Mar 5 17:05:48 2010 : Debug: modsingle[post-auth]: calling > attr_filter.access_reject (rlm_attr_filter) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: expand: %{User-Name} -> user > Fri Mar 5 17:05:48 2010 : Debug: attr_filter: Matched entry DEFAULT > at line 11 > Fri Mar 5 17:05:48 2010 : Debug: modsingle[post-auth]: returned > from attr_filter.access_reject (rlm_attr_filter) for request 0 > Fri Mar 5 17:05:48 2010 : Debug: ++[attr_filter.access_reject] > returns updated > Fri Mar 5 17:05:48 2010 : Debug: Delaying reject of request 0 for 1 > seconds > Fri Mar 5 17:05:48 2010 : Debug: Going to the next request > Fri Mar 5 17:05:48 2010 : Debug: Waking up in 0.9 seconds. > rad_recv: Access-Request packet from host 192.168.1.100 port 60079, > id=20, length=198 > Fri Mar 5 17:05:49 2010 : Debug: Waiting to send Access-Reject to > client nas port 60079 - ID: 20 > Fri Mar 5 17:05:49 2010 : Debug: Waking up in 0.6 seconds. > rad_recv: Access-Request packet from host 192.168.1.100 port 60079, > id=20, length=198 > Fri Mar 5 17:05:49 2010 : Debug: Waiting to send Access-Reject to > client nas port 60079 - ID: 20 > Fri Mar 5 17:05:49 2010 : Debug: Waking up in 0.3 seconds. > Fri Mar 5 17:05:49 2010 : Debug: Sending delayed reject for request 0 > Sending Access-Reject of id 20 to 192.168.1.100 port 60079 > Fri Mar 5 17:05:49 2010 : Debug: Waking up in 4.9 seconds. > Fri Mar 5 17:05:54 2010 : Debug: Cleaning up request 0 ID 20 with > timestamp +22 > Fri Mar 5 17:05:54 2010 : Debug: Ready to process requests. Thanks a lot!! Bye Tokie

3 3

IP Problems with Simultanaous Logins across 2 NAS - Cisco VPN3000
by Lucio Godoy 12 Mar '10

12 Mar '10

Hi All; I have Freeradius 2 setup with the MySQL database back-end and it is working really well with one Cisco VPN 3060, I also allow multiple logins from the same user. But yesterday i have added a second VPN server and whole thing stop working, user gets authenticated across the 2 NAS, but i belive the freeradius is getting confused with the 2 NAS. As a test I have edited the: ippool.conf FROM: ## The ORDER BY clause of this query tries to allocate the same IP-address ## which user had last session... #####allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ ##### WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) \ ##### ORDER BY (username <> '%{User-Name}'), \ ##### (callingstationid <> '%{Calling-Station-Id}'), \ ##### expiry_time \ ##### LIMIT 1 \ ##### FOR UPDATE" TO: # ## If you prefer to allocate a random IP address every time, i # ## use this query instead allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' \ AND expiry_time = NULL \ ORDER BY RAND() \ LIMIT 1 \ FOR UPDATE" All worked well and then it stopped. Is there any other place i have to change to allow simultaneus logins across 2 NAS, pls? Many thanks Lucio _________________________________________________________________ We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now http://clk.atdmt.com/UKM/go/195013117/direct/01/

1 1

Users Groups
by Siryx XL 11 Mar '10

11 Mar '10

Hi everyone. I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks. I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work. Thanks in advance. _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969

5 8

libpam-radius-auth and EAP
by Sebastien Chapiron 11 Mar '10

11 Mar '10

Hi, I'm trying to setup a radius server in order to authenticate users from OpenVPN and I am therefore using the libpam-radius-auth plugin (on Ubuntu 9.10). Since the RADIUS requests that this lib sends are using PAP (as far as I can tell from the freeradius debug output), i was wondering whether it would be possible to send EAP message using libpam-radius-auth (or at least [MS]CHAP) ? I don't even know if it makes sense since EAP messages are in theory sent between the radius server and the access client (not the radius client as libpam-radius-auth enables a host to be). The point is that i don't quite like my users' password (connected via OpenVPN) to be weakly encrypted by the shared secret between the radius client and server and even worse, visible as plain-text in FR debug output. I hope someone will be able to shed some light here because i might be confused over this whole EAP over RADIUS thing... I just want the easiest solution to make the radius communications more secure in my scenario. Thanks for you help ;) P.S: using IPSec to secure the channel between the radius client and server is too much pain in the ass to be considered as a viable solution. I'm not *that* paranoid !

2 2

option 82
by Kevin Croes 11 Mar '10

11 Mar '10

Hi, I work at an ISP and we are looking at the possibility to use option 82 in FreeRADIUS. The other side is going to send us an ordernumber and then we want to send a configuration back (an ip address etc.). Been searching how to do this in FreeRADIUS, but haven't found much useful information. So, if somebody can point me in the right direction on how to set it up in FreeRADIUS. Any help will be greatly appreciated. Gr, Kevin

5 5

Modifying FreeRADIUS queries [from the wiki]
by Jeff Wark 11 Mar '10

11 Mar '10

I apologize if this is a trivial question, but I cannot find an explanation regarding my specific question. I have seen the following entry in the wiki regarding taking into account Gigawords: *snip* Modify FreeRADIUS Queries Secondly, modify the accounting queries in sql.conf to make the SQL database perform the computation that is required to merge the two values sent as attributes by the NAS into one single 64-bit integer stored in the database. All occurrences of '%{Acct-Input-Octets}' need to be replaced with: '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}' The same thing needs to be done for '%{Acct-Output-Octets}': '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' *snip* I understand the left shifting of the Gigawords value and the subsequent 'or'-ing of the Acct-Input-Octets value to produce one 64-bit value. The part that confuses me is the repeated occurrence of the ':-0' at the end of each variable. What is the purpose of this? I have seen it on other pages used with other variable substitutions. I have also seen the above Gigawords entry done without the ':-0' [only once though]. I would rather understand the purpose behind the entry rather than blindly copying it. If there is a wiki page or FAQ entry that I have missed regarding this syntax, I would love to know about it. Thanks for the input. -Jeff Wark

2 1

PAP + ??NT challange??
by Rosario Lumia 11 Mar '10

11 Mar '10

Hi to all. I've this configuration: - freeradius 2.x - in mysql i have user "rosario" with attribute "NT-Passwors" and value "NTHash of my password" when i try to use radtest works greatlly. But i have a web library the try to authenticate the same user "rosario" but in "user-password" it put (i think) an NT-challenge password. This is the log of freeradius. rad_recv: Access-Request packet from host 127.0.0.1 port 51435, id=32, length=85 NAS-Identifier = "radius2" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "rosario" User-Password = "\202\204\005\340-\275\341\344u\351-\310L$\260\242" +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100311 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100311 expand: %t -> Thu Mar 11 15:31:56 2010 ++[auth_log] returns ok ++[mschap] returns noop [ntdomain] No '\' in User-Name = "rosario", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [suffix] No '@' in User-Name = "rosario", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop expand: %{User-Name} -> rosario [sql] sql_set_user escaped user --> 'rosario' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rosario' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rosario' ORDER BY id expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'rosario' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> rosario [sql_meeting] sql_set_user escaped user --> 'rosario' rlm_sql (sql_meeting): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rosario' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='rosario' rlm_sql (sql_meeting): Released sql socket id: 4 [sql_meeting] User rosario not found ++[sql_meeting] returns notfound WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> rosario [sql_biblio] sql_set_user escaped user --> 'rosario' rlm_sql (sql_biblio): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rosario' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='rosario' rlm_sql (sql_biblio): Released sql socket id: 4 [sql_biblio] User rosario not found ++[sql_biblio] returns notfound WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> rosario [sql_signum] sql_set_user escaped user --> 'rosario' rlm_sql (sql_signum): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rosario' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='rosario' rlm_sql (sql_signum): Released sql socket id: 4 [sql_signum] User rosario not found ++[sql_signum] returns notfound [pap] Normalizing NT-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "???�-��u�-�L$��" [pap] Using NT encryption. [pap] rlm_mschap: NT-Hash: ???�-��u�-�L$�� [pap] rlm_mschap: NT-Hash: Result: 9bf2e48c667225847414c60fd3b16ce0 expand: %{mschap:NT-Hash ???�-��u�-�L$��} -> 9bf2e48c667225847414c60fd3b16ce0 [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: NT password check failed): [rosario] (from client localhost port 0 cli 127.0.0.1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to 127.0.0.1 port 51435 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 51435, id=32, length=85 Sending duplicate reply to client localhost port 51435 - ID: 32 Sending Access-Reject of id 32 to 127.0.0.1 port 51435 Waking up in 4.9 seconds. Cleaning up request 0 ID 32 with timestamp +7 Ready to process requests. I think that rlm_pap try to hashing a not cleartext-password and so it doesn't work. How can I tell to rlm_pap to do the right thing, otherwise to try to hash a cleartect-password and do something (that i don't know) if not? Thanks. Rosario -- Rosario L.

2 2