- Freeradius-Users - lists.freeradius.org

Re: Freeradius2.1.6 installation problem
by ramesh p 07 Aug '09

07 Aug '09

When i execute as root user it's working.. [root@localhost bin]# radtest root xxxxxxx localhost 1813 testing123 other Sending Access-Request of id 26 to 127.0.0.1 port 1812 User-Name = "root" User-Password = "ast4roslab" NAS-IP-Address = 255.255.255.255 NAS-Port = 1813 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=26, length=32 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP On Fri, Aug 7, 2009 at 4:38 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 52, Issue 37 (Rokkhan) > 2. Re: Freeradius-Users Digest, Vol 52, Issue 38 (ramesh p) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 7 Aug 2009 13:02:52 +0200 > From: Rokkhan <rokkhan(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 37 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <335289090908070402g38118a0fm3c3e1df0be853984(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Could yo show us your sites-enabled/(server), who is listening on 1812 > port? > > No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > Failed to authenticate the user. > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > Hi Alan, > > [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 > testing123 > > other > > Sending Access-Request of id 134 to 127.0.0.1 port 1812 > > User-Name = "radtest" > > User-Password = "somepass" > > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1813 > > Framed-Protocol = PPP > > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, > length=20 > > > > > > Debug messages: > > > > rad_recv: Access-Request packet from host 127.0.0.1 port 36433, id=134, > > length=65 > > User-Name = "radtest" > > User-Password = "somepass" > > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1813 > > Framed-Protocol = PPP > > +- entering group authorize {...} > > ++[preprocess] returns ok > > ++[chap] returns noop > > ++[mschap] returns noop > > [suffix] No '@' in User-Name = "radtest", looking up realm NULL > > [suffix] No such realm "NULL" > > ++[suffix] returns noop > > [eap] No EAP-Message, not doing EAP > > ++[eap] returns noop > > ++[unix] returns notfound > > [files] users: Matched entry DEFAULT at line 172 > > ++[files] returns ok > > ++[expiration] returns noop > > ++[logintime] returns noop > > [pap] WARNING! No "known good" password found for the user. > Authentication > > may fail because of this. > > ++[pap] returns noop > > No authenticate method (Auth-Type) configuration found for the request: > > Rejecting the user > > Failed to authenticate the user. > > Using Post-Auth-Type Reject > > +- entering group REJECT {...} > > [attr_filter.access_reject] expand: %{User-Name} -> radtest > > attr_filter: Matched entry DEFAULT at line 11 > > ++[attr_filter.access_reject] returns updated > > Delaying reject of request 1 for 1 seconds > > Going to the next request > > Waking up in 0.9 seconds. > > Sending delayed reject for request 1 > > Sending Access-Reject of id 134 to 127.0.0.1 port 36433 > > Waking up in 4.9 seconds. > > Cleaning up request 1 ID 134 with timestamp +3582 > > Ready to process requests. > > > > > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Fri, 7 Aug 2009 11:22:58 +0100 > >> From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > >> Subject: Re: Freeradius2.1.6 installation problem > >> To: FreeRadius users mailing list > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: <20090807102258.GC19103(a)lboro.ac.uk> > >> Content-Type: text/plain; charset=us-ascii > >> > >> hi, > >> > >> your debug showed no actual traffic or packets hitting the > >> freeradius server - so cannot help you. > >> > >> alan > >> > >> > >> ------------------------------ > >> > >> Message: 3 > >> Date: Fri, 7 Aug 2009 16:09:04 +0530 > >> From: ramesh p <rock786143(a)gmail.com> > >> Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > >> To: freeradius-users(a)lists.freeradius.org > >> Message-ID: > >> <6b6aa6710908070339w57559054lfa1637cf39e51a48(a)mail.gmail.com> > >> Content-Type: text/plain; charset="iso-8859-1" > >> > >> *> Have you added 127.0.0.1 in the clients.conf? > >> > >> *yes. > >> > >> client localhost { > >> ipaddr = 127.0.0.1 > >> secret = testing123 > >> nastype = other > >> require_message_authenticator = no > >> } > >> > >> Thanks, > >> Rams. > >> > >> * > >> * > >> On Fri, Aug 7, 2009 at 3:30 PM, < > >> freeradius-users-request(a)lists.freeradius.org> wrote: > >> > >

1 0

Re: Freeradius-Users Digest, Vol 52, Issue 38
by ramesh p 07 Aug '09

07 Aug '09

>Could you show us, how you use radtest and if you get any error? [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 testing123 other Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "radtest" User-Password = "somepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1813 Framed-Protocol = PPP rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 On Fri, Aug 7, 2009 at 4:27 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 52, Issue 36 (Rokkhan) > 2. Re: Freeradius-Users Digest, Vol 52, Issue 37 (ramesh p) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 7 Aug 2009 12:49:01 +0200 > From: Rokkhan <rokkhan(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <335289090908070349y64d04f48ic5a987a28e978e35(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Could you show us, how you use radtest and if you get any error? > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > >> Have you added 127.0.0.1 in the clients.conf? > > > > yes. > > > > client localhost { > > ipaddr = 127.0.0.1 > > secret = testing123 > > nastype = other > > require_message_authenticator = no > > } > > > > Thanks, > > Rams. > > > > > > > > On Fri, Aug 7, 2009 at 3:30 PM, > > <freeradius-users-request(a)lists.freeradius.org> wrote: > >> > >> > >> Message: 2 > >> Date: Fri, 7 Aug 2009 11:58:56 +0200 > >> From: Rokkhan <rokkhan(a)gmail.com> > >> Subject: Re: Freeradius2.1.6 installation problem > >> To: FreeRadius users mailing list > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: > >> <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > >> Content-Type: text/plain; charset=ISO-8859-1 > >> > >> Have you added 127.0.0.1 in the clients.conf? > >> > >> 2009/8/7 ramesh p <rock786143(a)gmail.com>: > >> > Unable to execute radtest. > >> > > >> > # radiusd -X > >> > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > >> > 2009 > >> > at 07:17:32 > >> > Copyright (C) 1999-2009 The FreeRADIUS server project and > contributors. > >> > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > >> > PARTICULAR PURPOSE. > >> > You may redistribute copies of FreeRADIUS under the terms of the > >> > GNU General Public License v2. > >> > Starting - reading configuration files ... > >> > including configuration file /usr/local/fnmt/radius2//etc/ > >> >> > >> >> raddb/radiusd.conf > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/proxy.conf > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > >> >> including files in directory > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/ > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/always > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/files > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/eap.conf > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > >> >> including files in directory > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > >> >> including configuration file > >> >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > >> >> including dictionary file > /usr/local/fnmt/radius2//etc/raddb/dictionary > >> >> main { > >> >> prefix = "/usr/local/fnmt/radius2/" > >> >> localstatedir = "/usr/local/fnmt/radius2//var" > >> >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > >> >> libdir = "/usr/local/fnmt/radius2//lib" > >> >> radacctdir = > "/usr/local/fnmt/radius2//var/log/radius/radacct" > >> >> hostname_lookups = no > >> >> max_request_time = 30 > >> >> cleanup_delay = 5 > >> >> max_requests = 1024 > >> >> allow_core_dumps = no > >> >> pidfile = > >> >> "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > >> >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > >> >> debug_level = 0 > >> >> proxy_requests = yes > >> >> log { > >> >> stripped_names = no > >> >> auth = no > >> >> auth_badpass = no > >> >> auth_goodpass = no > >> >> } > >> >> security { > >> >> max_attributes = 200 > >> >> reject_delay = 1 > >> >> status_server = yes > >> >> } > >> >> } > >> >> } > >> >> radiusd: #### Loading Realms and Home Servers #### > >> >> proxy server { > >> >> retry_delay = 5 > >> >> retry_count = 3 > >> >> default_fallback = no > >> >> dead_time = 120 > >> >> wake_all_if_all_dead = no > >> >> } > >> >> home_server localhost { > >> >> ipaddr = 127.0.0.1 > >> >> port = 1812 > >> >> type = "auth" > >> >> secret = "testing123" > >> >> response_window = 20 > >> >> max_outstanding = 65536 > >> >> require_message_authenticator = no > >> >> zombie_period = 40 > >> >> status_check = "status-server" > >> >> ping_interval = 30 > >> >> check_interval = 30 > >> >> num_answers_to_alive = 3 > >> >> num_pings_to_alive = 3 > >> >> revive_interval = 120 > >> >> status_check_timeout = 4 > >> >> irt = 2 > >> >> mrt = 16 > >> >> mrc = 5 > >> >> mrd = 30 > >> >> } > >> >> home_server_pool my_auth_failover { > >> >> type = fail-over > >> >> home_server = localhost > >> >> } > >> >> realm example.com { > >> >> auth_pool = my_auth_failover > >> >> } > >> >> realm LOCAL { > >> >> } > >> >> radiusd: #### Loading Clients #### > >> >> client localhost { > >> >> ipaddr = 127.0.0.1 > >> >> require_message_authenticator = no > >> >> secret = "testing123" > >> >> nastype = "other" > >> >> } > >> >> client xx.xx.xx.xx { > >> >> require_message_authenticator = no > >> >> secret = "testing123" > >> >> shortname = "rparsa" > >> >> nastype = "other" > >> >> login = "radtest" > >> >> } > >> >> radiusd: #### Instantiating modules #### > >> >> instantiate { > >> >> Module: Linked to module rlm_exec > >> >> Module: Instantiating exec > >> >> exec { > >> >> wait = no > >> >> input_pairs = "request" > >> >> shell_escape = yes > >> >> } > >> >> Module: Linked to module rlm_expr > >> >> Module: Instantiating expr > >> >> Module: Linked to module rlm_expiration > >> >> Module: Instantiating expiration > >> >> expiration { > >> >> reply-message = "Password Has Expired " > >> >> } > >> >> Module: Linked to module rlm_logintime > >> >> Module: Instantiating logintime > >> >> logintime { > >> >> reply-message = "You are calling outside your allowed > timespan > >> >> " > >> >> minimum-timeout = 60 > >> >> } > >> >> } > >> >> radiusd: #### Loading Virtual Servers #### > >> >> server inner-tunnel { > >> >> modules { > >> >> Module: Checking authenticate {...} for more modules to load > >> >> Module: Linked to module rlm_pap > >> >> Module: Instantiating pap > >> >> pap { > >> >> encryption_scheme = "auto" > >> >> auto_header = no > >> >> } > >> >> Module: Linked to module rlm_chap > >> >> Module: Instantiating chap > >> >> Module: Linked to module rlm_mschap > >> >> Module: Instantiating mschap > >> >> mschap { > >> >> use_mppe = yes > >> >> require_encryption = no > >> >> require_strong = no > >> >> with_ntdomain_hack = no > >> >> } > >> >> Module: Linked to module rlm_unix > >> >> Module: Instantiating unix > >> >> unix { > >> >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > >> >> } > >> >> Module: Linked to module rlm_eap > >> >> Module: Instantiating eap > >> >> eap { > >> >> default_eap_type = "md5" > >> >> timer_expire = 60 > >> >> ignore_unknown_eap_types = no > >> >> cisco_accounting_username_bug = no > >> >> max_sessions = 2048 > >> >> } > >> >> Module: Linked to sub-module rlm_eap_md5 > >> >> Module: Instantiating eap-md5 > >> >> Module: Linked to sub-module rlm_eap_leap > >> >> Module: Instantiating eap-leap > >> >> Module: Linked to sub-module rlm_eap_gtc > >> >> Module: Instantiating eap-gtc > >> >> gtc { > >> >> challenge = "Password: " > >> >> auth_type = "PAP" > >> >> } > >> >> Module: Linked to sub-module rlm_eap_tls > >> >> Module: Instantiating eap-tls > >> >> tls { > >> >> rsa_key_exchange = no > >> >> dh_key_exchange = yes > >> >> rsa_key_length = 512 > >> >> dh_key_length = 512 > >> >> verify_depth = 0 > >> >> pem_file_type = yes > >> >> private_key_file = > >> >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> >> certificate_file = > >> >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > >> >> private_key_password = "whatever" > >> >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > >> >> random_file = > "/usr/local/fnmt/radius2//etc/raddb/certs/random" > >> >> fragment_size = 1024 > >> >> include_length = yes > >> >> check_crl = no > >> >> cipher_list = "DEFAULT" > >> >> make_cert_command = > >> >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > >> >> cache { > >> >> enable = no > >> >> lifetime = 24 > >> >> max_entries = 255 > >> >> } > >> >> } > >> >> Module: Linked to sub-module rlm_eap_ttls > >> >> Module: Instantiating eap-ttls > >> >> ttls { > >> >> default_eap_type = "md5" > >> >> copy_request_to_tunnel = no > >> >> use_tunneled_reply = no > >> >> virtual_server = "inner-tunnel" > >> >> include_length = yes > >> >> } > >> >> Module: Linked to sub-module rlm_eap_peap > >> >> Module: Instantiating eap-peap > >> >> peap { > >> >> default_eap_type = "mschapv2" > >> >> copy_request_to_tunnel = no > >> >> use_tunneled_reply = no > >> >> proxy_tunneled_request_as_eap = yes > >> >> virtual_server = "inner-tunnel" > >> >> } > >> >> Module: Linked to sub-module rlm_eap_mschapv2 > >> >> Module: Instantiating eap-mschapv2 > >> >> mschapv2 { > >> >> with_ntdomain_hack = no > >> >> } > >> >> Module: Checking authorize {...} for more modules to load > >> >> Module: Linked to module rlm_preprocess > >> >> Module: Instantiating preprocess > >> >> preprocess { > >> >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > >> >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > >> >> with_ascend_hack = no > >> >> ascend_channels_per_line = 23 > >> >> with_ntdomain_hack = no > >> >> with_specialix_jetstream_hack = no > >> >> with_cisco_vsa_hack = no > >> >> with_alvarion_vsa_hack = no > >> >> } > >> >> Module: Checking preacct {...} for more modules to load > >> >> Module: Linked to module rlm_acct_unique > >> >> Module: Instantiating acct_unique > >> >> acct_unique { > >> >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > >> >> Client-IP-Address, NAS-Port" > >> >> } > >> >> Module: Checking accounting {...} for more modules to load > >> >> Module: Linked to module rlm_detail > >> >> Module: Instantiating detail > >> >> detail { > >> >> detailfile = > >> >> > >> >> > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > >> >> header = "%t" > >> >> detailperm = 384 > >> >> dirperm = 493 > >> >> locking = no > >> >> log_packet_header = no > >> >> } > >> >> Module: Instantiating attr_filter.accounting_response > >> >> attr_filter attr_filter.accounting_response { > >> >> attrsfile = > >> >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > >> >> key = "%{User-Name}" > >> >> } > >> >> Module: Checking session {...} for more modules to load > >> >> Module: Checking post-proxy {...} for more modules to load > >> >> Module: Checking post-auth {...} for more modules to load > >> >> } # modules > >> >> } # server > >> >> radiusd: #### Opening IP addresses and Ports #### > >> >> listen { > >> >> type = "auth" > >> >> ipaddr = * > >> >> port = 0 > >> >> } > >> >> listen { > >> >> type = "acct" > >> >> ipaddr = * > >> >> port = 0 > >> >> } > >> >> listen { > >> >> type = "control" > >> >> listen { > >> >> socket = > >> >> "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > >> >> } > >> >> } > >> >> Listening on authentication address * port 1812 > >> >> Listening on accounting address * port 1813 > >> >> Listening on command file > >> >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > >> >> Listening on proxy address * port 1814 > >> >> Ready to process requests. > >> >> > >> >> I'm able to send packets using NTRadping tool however the packets are > >> >> rejected using radtest? > >> >> Why? Anthing wrong in the configuration? > >> >> > >> >> Thanks, > >> >> Rams. > >> > > >> > - > >> > List info/subscribe/unsubscribe? See > >> > http://www.freeradius.org/list/users.html > >> > > >> > >> > >> ------------------------------ > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > >> > >> End of Freeradius-Users Digest, Vol 52, Issue 36 > >> ************************************************ > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 2 > Date: Fri, 7 Aug 2009 16:27:07 +0530 > From: ramesh p <rock786143(a)gmail.com> > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 37 > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <6b6aa6710908070357k13c0f2dl58f859c9b547a67b(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Alan, > [root@localhost sbin]# radtest radtest somepass 127.0.0.1 1813 testing123 > other > Sending Access-Request of id 134 to 127.0.0.1 port 1812 > User-Name = "radtest" > User-Password = "somepass" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1813 > Framed-Protocol = PPP > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 > > > Debug messages: > > rad_recv: Access-Request packet from host 127.0.0.1 port 36433, id=134, > length=65 > User-Name = "radtest" > User-Password = "somepass" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1813 > Framed-Protocol = PPP > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "radtest", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > [files] users: Matched entry DEFAULT at line 172 > ++[files] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > No authenticate method (Auth-Type) configuration found for the request: > Rejecting the user > Failed to authenticate the user. > Using Post-Auth-Type Reject > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> radtest > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 1 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 1 > Sending Access-Reject of id 134 to 127.0.0.1 port 36433 > Waking up in 4.9 seconds. > Cleaning up request 1 ID 134 with timestamp +3582 > Ready to process requests. > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Fri, 7 Aug 2009 11:22:58 +0100 > > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > > Subject: Re: Freeradius2.1.6 installation problem > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <20090807102258.GC19103(a)lboro.ac.uk> > > Content-Type: text/plain; charset=us-ascii > > > > hi, > > > > your debug showed no actual traffic or packets hitting the > > freeradius server - so cannot help you. > > > > alan > > > > > > ------------------------------ > > > > Message: 3 > > Date: Fri, 7 Aug 2009 16:09:04 +0530 > > From: ramesh p <rock786143(a)gmail.com> > > Subject: Re: Freeradius-Users Digest, Vol 52, Issue 36 > > To: freeradius-users(a)lists.freeradius.org > > Message-ID: > > <6b6aa6710908070339w57559054lfa1637cf39e51a48(a)mail.gmail.com> > > Content-Type: text/plain; charset="iso-8859-1" > > > > *> Have you added 127.0.0.1 in the clients.conf? > > > > *yes. > > > > client localhost { > > ipaddr = 127.0.0.1 > > secret = testing123 > > nastype = other > > require_message_authenticator = no > > } > > > > Thanks, > > Rams. > > > > * > > * > > On Fri, Aug 7, 2009 at 3:30 PM, < > > freeradius-users-request(a)lists.freeradius.org> wrote: > > > > > > > > > > > Message: 2 > > > Date: Fri, 7 Aug 2009 11:58:56 +0200 > > > From: Rokkhan <rokkhan(a)gmail.com> > > > Subject: Re: Freeradius2.1.6 installation problem > > > To: FreeRadius users mailing list > > > <freeradius-users(a)lists.freeradius.org> > > > Message-ID: > > > <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > > > Content-Type: text/plain; charset=ISO-8859-1 > > > > > > *Have you added 127.0.0.1 in the clients.conf?* > > > > > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > > > Unable to execute radtest. > > > > > > > > # radiusd -X > > > > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > > > 2009 > > > > at 07:17:32 > > > > Copyright (C) 1999-2009 The FreeRADIUS server project and > contributors. > > > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > > > > PARTICULAR PURPOSE. > > > > You may redistribute copies of FreeRADIUS under the terms of the > > > > GNU General Public License v2. > > > > Starting - reading configuration files ... > > > > including configuration file /usr/local/fnmt/radius2//etc/ > > > >> > > > >> raddb/radiusd.conf > > > >> including configuration file > > > /usr/local/fnmt/radius2//etc/raddb/proxy.conf > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > > > >> including files in directory > > /usr/local/fnmt/radius2//etc/raddb/modules/ > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/always > > > >> including configuration file > > > >> > /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/files > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > > > >> including configuration file > > /usr/local/fnmt/radius2//etc/raddb/eap.conf > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > > > >> including files in directory > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > > > >> including configuration file > > > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > > > >> including dictionary file > > /usr/local/fnmt/radius2//etc/raddb/dictionary > > > >> main { > > > >> prefix = "/usr/local/fnmt/radius2/" > > > >> localstatedir = "/usr/local/fnmt/radius2//var" > > > >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > > > >> libdir = "/usr/local/fnmt/radius2//lib" > > > >> radacctdir = > "/usr/local/fnmt/radius2//var/log/radius/radacct" > > > >> hostname_lookups = no > > > >> max_request_time = 30 > > > >> cleanup_delay = 5 > > > >> max_requests = 1024 > > > >> allow_core_dumps = no > > > >> pidfile = > > "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > > > >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > > > >> debug_level = 0 > > > >> proxy_requests = yes > > > >> log { > > > >> stripped_names = no > > > >> auth = no > > > >> auth_badpass = no > > > >> auth_goodpass = no > > > >> } > > > >> security { > > > >> max_attributes = 200 > > > >> reject_delay = 1 > > > >> status_server = yes > > > >> } > > > >> } > > > >> } > > > >> radiusd: #### Loading Realms and Home Servers #### > > > >> proxy server { > > > >> retry_delay = 5 > > > >> retry_count = 3 > > > >> default_fallback = no > > > >> dead_time = 120 > > > >> wake_all_if_all_dead = no > > > >> } > > > >> home_server localhost { > > > >> ipaddr = 127.0.0.1 > > > >> port = 1812 > > > >> type = "auth" > > > >> secret = "testing123" > > > >> response_window = 20 > > > >> max_outstanding = 65536 > > > >> require_message_authenticator = no > > > >> zombie_period = 40 > > > >> status_check = "status-server" > > > >> ping_interval = 30 > > > >> check_interval = 30 > > > >> num_answers_to_alive = 3 > > > >> num_pings_to_alive = 3 > > > >> revive_interval = 120 > > > >> status_check_timeout = 4 > > > >> irt = 2 > > > >> mrt = 16 > > > >> mrc = 5 > > > >> mrd = 30 > > > >> } > > > >> home_server_pool my_auth_failover { > > > >> type = fail-over > > > >> home_server = localhost > > > >> } > > > >> realm example.com { > > > >> auth_pool = my_auth_failover > > > >> } > > > >> realm LOCAL { > > > >> } > > > >> radiusd: #### Loading Clients #### > > > >> client localhost { > > > >> ipaddr = 127.0.0.1 > > > >> require_message_authenticator = no > > > >> secret = "testing123" > > > >> nastype = "other" > > > >> } > > > >> client xx.xx.xx.xx { > > > >> require_message_authenticator = no > > > >> secret = "testing123" > > > >> shortname = "rparsa" > > > >> nastype = "other" > > > >> login = "radtest" > > > >> } > > > >> radiusd: #### Instantiating modules #### > > > >> instantiate { > > > >> Module: Linked to module rlm_exec > > > >> Module: Instantiating exec > > > >> exec { > > > >> wait = no > > > >> input_pairs = "request" > > > >> shell_escape = yes > > > >> } > > > >> Module: Linked to module rlm_expr > > > >> Module: Instantiating expr > > > >> Module: Linked to module rlm_expiration > > > >> Module: Instantiating expiration > > > >> expiration { > > > >> reply-message = "Password Has Expired " > > > >> } > > > >> Module: Linked to module rlm_logintime > > > >> Module: Instantiating logintime > > > >> logintime { > > > >> reply-message = "You are calling outside your allowed > timespan > > > " > > > >> minimum-timeout = 60 > > > >> } > > > >> } > > > >> radiusd: #### Loading Virtual Servers #### > > > >> server inner-tunnel { > > > >> modules { > > > >> Module: Checking authenticate {...} for more modules to load > > > >> Module: Linked to module rlm_pap > > > >> Module: Instantiating pap > > > >> pap { > > > >> encryption_scheme = "auto" > > > >> auto_header = no > > > >> } > > > >> Module: Linked to module rlm_chap > > > >> Module: Instantiating chap > > > >> Module: Linked to module rlm_mschap > > > >> Module: Instantiating mschap > > > >> mschap { > > > >> use_mppe = yes > > > >> require_encryption = no > > > >> require_strong = no > > > >> with_ntdomain_hack = no > > > >> } > > > >> Module: Linked to module rlm_unix > > > >> Module: Instantiating unix > > > >> unix { > > > >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > > > >> } > > > >> Module: Linked to module rlm_eap > > > >> Module: Instantiating eap > > > >> eap { > > > >> default_eap_type = "md5" > > > >> timer_expire = 60 > > > >> ignore_unknown_eap_types = no > > > >> cisco_accounting_username_bug = no > > > >> max_sessions = 2048 > > > >> } > > > >> Module: Linked to sub-module rlm_eap_md5 > > > >> Module: Instantiating eap-md5 > > > >> Module: Linked to sub-module rlm_eap_leap > > > >> Module: Instantiating eap-leap > > > >> Module: Linked to sub-module rlm_eap_gtc > > > >> Module: Instantiating eap-gtc > > > >> gtc { > > > >> challenge = "Password: " > > > >> auth_type = "PAP" > > > >> } > > > >> Module: Linked to sub-module rlm_eap_tls > > > >> Module: Instantiating eap-tls > > > >> tls { > > > >> rsa_key_exchange = no > > > >> dh_key_exchange = yes > > > >> rsa_key_length = 512 > > > >> dh_key_length = 512 > > > >> verify_depth = 0 > > > >> pem_file_type = yes > > > >> private_key_file = > > > >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > > > >> certificate_file = > > "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > > > >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > > > >> private_key_password = "whatever" > > > >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > > > >> random_file = > > "/usr/local/fnmt/radius2//etc/raddb/certs/random" > > > >> fragment_size = 1024 > > > >> include_length = yes > > > >> check_crl = no > > > >> cipher_list = "DEFAULT" > > > >> make_cert_command = > > > >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > > > >> cache { > > > >> enable = no > > > >> lifetime = 24 > > > >> max_entries = 255 > > > >> } > > > >> } > > > >> Module: Linked to sub-module rlm_eap_ttls > > > >> Module: Instantiating eap-ttls > > > >> ttls { > > > >> default_eap_type = "md5" > > > >> copy_request_to_tunnel = no > > > >> use_tunneled_reply = no > > > >> virtual_server = "inner-tunnel" > > > >> include_length = yes > > > >> } > > > >> Module: Linked to sub-module rlm_eap_peap > > > >> Module: Instantiating eap-peap > > > >> peap { > > > >> default_eap_type = "mschapv2" > > > >> copy_request_to_tunnel = no > > > >> use_tunneled_reply = no > > > >> proxy_tunneled_request_as_eap = yes > > > >> virtual_server = "inner-tunnel" > > > >> } > > > >> Module: Linked to sub-module rlm_eap_mschapv2 > > > >> Module: Instantiating eap-mschapv2 > > > >> mschapv2 { > > > >> with_ntdomain_hack = no > > > >> } > > > >> Module: Checking authorize {...} for more modules to load > > > >> Module: Linked to module rlm_preprocess > > > >> Module: Instantiating preprocess > > > >> preprocess { > > > >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > > > >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > > > >> with_ascend_hack = no > > > >> ascend_channels_per_line = 23 > > > >> with_ntdomain_hack = no > > > >> with_specialix_jetstream_hack = no > > > >> with_cisco_vsa_hack = no > > > >> with_alvarion_vsa_hack = no > > > >> } > > > >> Module: Checking preacct {...} for more modules to load > > > >> Module: Linked to module rlm_acct_unique > > > >> Module: Instantiating acct_unique > > > >> acct_unique { > > > >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > > > >> Client-IP-Address, NAS-Port" > > > >> } > > > >> Module: Checking accounting {...} for more modules to load > > > >> Module: Linked to module rlm_detail > > > >> Module: Instantiating detail > > > >> detail { > > > >> detailfile = > > > >> > > > > > > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > > >> header = "%t" > > > >> detailperm = 384 > > > >> dirperm = 493 > > > >> locking = no > > > >> log_packet_header = no > > > >> } > > > >> Module: Instantiating attr_filter.accounting_response > > > >> attr_filter attr_filter.accounting_response { > > > >> attrsfile = > > > >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > > > >> key = "%{User-Name}" > > > >> } > > > >> Module: Checking session {...} for more modules to load > > > >> Module: Checking post-proxy {...} for more modules to load > > > >> Module: Checking post-auth {...} for more modules to load > > > >> } # modules > > > >> } # server > > > >> radiusd: #### Opening IP addresses and Ports #### > > > >> listen { > > > >> type = "auth" > > > >> ipaddr = * > > > >> port = 0 > > > >> } > > > >> listen { > > > >> type = "acct" > > > >> ipaddr = * > > > >> port = 0 > > > >> } > > > >> listen { > > > >> type = "control" > > > >> listen { > > > >> socket = > > "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > > > >> } > > > >> } > > > >> Listening on authentication address * port 1812 > > > >> Listening on accounting address * port 1813 > > > >> Listening on command file > > > >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > > > >> Listening on proxy address * port 1814 > > > >> Ready to process requests. > > > >> > > > >> I'm able to send packets using NTRadping tool however the packets > are > > > >> rejected using radtest? > > > >> Why? Anthing wrong in the configuration? > > > >> > > > >> Thanks, > > > >> Rams. > > > > > > > > - > > > > List info/subscribe/unsubscribe? See > > > > http://www.freeradius.org/list/users.html > > > > > > > > > > > > > ------------------------------ > > > > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > > > > > > > > End of Freeradius-Users Digest, Vol 52, Issue 36 > > > ************************************************ > > > > >

1 0

Re: Freeradius-Users Digest, Vol 52, Issue 36
by ramesh p 07 Aug '09

07 Aug '09

*> Have you added 127.0.0.1 in the clients.conf? *yes. client localhost { ipaddr = 127.0.0.1 secret = testing123 nastype = other require_message_authenticator = no } Thanks, Rams. * * On Fri, Aug 7, 2009 at 3:30 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > > > Message: 2 > Date: Fri, 7 Aug 2009 11:58:56 +0200 > From: Rokkhan <rokkhan(a)gmail.com> > Subject: Re: Freeradius2.1.6 installation problem > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <335289090908070258x710b5551n5faf93155ffeece8(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > *Have you added 127.0.0.1 in the clients.conf?* > > 2009/8/7 ramesh p <rock786143(a)gmail.com>: > > Unable to execute radtest. > > > > # radiusd -X > > FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 > 2009 > > at 07:17:32 > > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > > PARTICULAR PURPOSE. > > You may redistribute copies of FreeRADIUS under the terms of the > > GNU General Public License v2. > > Starting - reading configuration files ... > > including configuration file /usr/local/fnmt/radius2//etc/ > >> > >> raddb/radiusd.conf > >> including configuration file > /usr/local/fnmt/radius2//etc/raddb/proxy.conf > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/clients.conf > >> including files in directory /usr/local/fnmt/radius2//etc/raddb/modules/ > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/ldap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/pap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/exec > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/expr > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/always > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.example.com > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/unix > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/chap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/expiration > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/pam > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/wimax > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/logintime > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/realm > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/linelog > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/otp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/checkval > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/mschap > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/counter > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/digest > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/passwd > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/files > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/policy > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/perl > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/ippool > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/modules/echo > >> including configuration file /usr/local/fnmt/radius2//etc/raddb/eap.conf > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/policy.conf > >> including files in directory > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > >> including configuration file > >> /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > >> including dictionary file /usr/local/fnmt/radius2//etc/raddb/dictionary > >> main { > >> prefix = "/usr/local/fnmt/radius2/" > >> localstatedir = "/usr/local/fnmt/radius2//var" > >> logdir = "/usr/local/fnmt/radius2//var/log/radius" > >> libdir = "/usr/local/fnmt/radius2//lib" > >> radacctdir = "/usr/local/fnmt/radius2//var/log/radius/radacct" > >> hostname_lookups = no > >> max_request_time = 30 > >> cleanup_delay = 5 > >> max_requests = 1024 > >> allow_core_dumps = no > >> pidfile = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > >> checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > >> debug_level = 0 > >> proxy_requests = yes > >> log { > >> stripped_names = no > >> auth = no > >> auth_badpass = no > >> auth_goodpass = no > >> } > >> security { > >> max_attributes = 200 > >> reject_delay = 1 > >> status_server = yes > >> } > >> } > >> } > >> radiusd: #### Loading Realms and Home Servers #### > >> proxy server { > >> retry_delay = 5 > >> retry_count = 3 > >> default_fallback = no > >> dead_time = 120 > >> wake_all_if_all_dead = no > >> } > >> home_server localhost { > >> ipaddr = 127.0.0.1 > >> port = 1812 > >> type = "auth" > >> secret = "testing123" > >> response_window = 20 > >> max_outstanding = 65536 > >> require_message_authenticator = no > >> zombie_period = 40 > >> status_check = "status-server" > >> ping_interval = 30 > >> check_interval = 30 > >> num_answers_to_alive = 3 > >> num_pings_to_alive = 3 > >> revive_interval = 120 > >> status_check_timeout = 4 > >> irt = 2 > >> mrt = 16 > >> mrc = 5 > >> mrd = 30 > >> } > >> home_server_pool my_auth_failover { > >> type = fail-over > >> home_server = localhost > >> } > >> realm example.com { > >> auth_pool = my_auth_failover > >> } > >> realm LOCAL { > >> } > >> radiusd: #### Loading Clients #### > >> client localhost { > >> ipaddr = 127.0.0.1 > >> require_message_authenticator = no > >> secret = "testing123" > >> nastype = "other" > >> } > >> client xx.xx.xx.xx { > >> require_message_authenticator = no > >> secret = "testing123" > >> shortname = "rparsa" > >> nastype = "other" > >> login = "radtest" > >> } > >> radiusd: #### Instantiating modules #### > >> instantiate { > >> Module: Linked to module rlm_exec > >> Module: Instantiating exec > >> exec { > >> wait = no > >> input_pairs = "request" > >> shell_escape = yes > >> } > >> Module: Linked to module rlm_expr > >> Module: Instantiating expr > >> Module: Linked to module rlm_expiration > >> Module: Instantiating expiration > >> expiration { > >> reply-message = "Password Has Expired " > >> } > >> Module: Linked to module rlm_logintime > >> Module: Instantiating logintime > >> logintime { > >> reply-message = "You are calling outside your allowed timespan > " > >> minimum-timeout = 60 > >> } > >> } > >> radiusd: #### Loading Virtual Servers #### > >> server inner-tunnel { > >> modules { > >> Module: Checking authenticate {...} for more modules to load > >> Module: Linked to module rlm_pap > >> Module: Instantiating pap > >> pap { > >> encryption_scheme = "auto" > >> auto_header = no > >> } > >> Module: Linked to module rlm_chap > >> Module: Instantiating chap > >> Module: Linked to module rlm_mschap > >> Module: Instantiating mschap > >> mschap { > >> use_mppe = yes > >> require_encryption = no > >> require_strong = no > >> with_ntdomain_hack = no > >> } > >> Module: Linked to module rlm_unix > >> Module: Instantiating unix > >> unix { > >> radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > >> } > >> Module: Linked to module rlm_eap > >> Module: Instantiating eap > >> eap { > >> default_eap_type = "md5" > >> timer_expire = 60 > >> ignore_unknown_eap_types = no > >> cisco_accounting_username_bug = no > >> max_sessions = 2048 > >> } > >> Module: Linked to sub-module rlm_eap_md5 > >> Module: Instantiating eap-md5 > >> Module: Linked to sub-module rlm_eap_leap > >> Module: Instantiating eap-leap > >> Module: Linked to sub-module rlm_eap_gtc > >> Module: Instantiating eap-gtc > >> gtc { > >> challenge = "Password: " > >> auth_type = "PAP" > >> } > >> Module: Linked to sub-module rlm_eap_tls > >> Module: Instantiating eap-tls > >> tls { > >> rsa_key_exchange = no > >> dh_key_exchange = yes > >> rsa_key_length = 512 > >> dh_key_length = 512 > >> verify_depth = 0 > >> pem_file_type = yes > >> private_key_file = > >> "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> certificate_file = "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > >> CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > >> private_key_password = "whatever" > >> dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > >> random_file = "/usr/local/fnmt/radius2//etc/raddb/certs/random" > >> fragment_size = 1024 > >> include_length = yes > >> check_crl = no > >> cipher_list = "DEFAULT" > >> make_cert_command = > >> "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > >> cache { > >> enable = no > >> lifetime = 24 > >> max_entries = 255 > >> } > >> } > >> Module: Linked to sub-module rlm_eap_ttls > >> Module: Instantiating eap-ttls > >> ttls { > >> default_eap_type = "md5" > >> copy_request_to_tunnel = no > >> use_tunneled_reply = no > >> virtual_server = "inner-tunnel" > >> include_length = yes > >> } > >> Module: Linked to sub-module rlm_eap_peap > >> Module: Instantiating eap-peap > >> peap { > >> default_eap_type = "mschapv2" > >> copy_request_to_tunnel = no > >> use_tunneled_reply = no > >> proxy_tunneled_request_as_eap = yes > >> virtual_server = "inner-tunnel" > >> } > >> Module: Linked to sub-module rlm_eap_mschapv2 > >> Module: Instantiating eap-mschapv2 > >> mschapv2 { > >> with_ntdomain_hack = no > >> } > >> Module: Checking authorize {...} for more modules to load > >> Module: Linked to module rlm_preprocess > >> Module: Instantiating preprocess > >> preprocess { > >> huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > >> hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > >> with_ascend_hack = no > >> ascend_channels_per_line = 23 > >> with_ntdomain_hack = no > >> with_specialix_jetstream_hack = no > >> with_cisco_vsa_hack = no > >> with_alvarion_vsa_hack = no > >> } > >> Module: Checking preacct {...} for more modules to load > >> Module: Linked to module rlm_acct_unique > >> Module: Instantiating acct_unique > >> acct_unique { > >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, > >> Client-IP-Address, NAS-Port" > >> } > >> Module: Checking accounting {...} for more modules to load > >> Module: Linked to module rlm_detail > >> Module: Instantiating detail > >> detail { > >> detailfile = > >> > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > >> header = "%t" > >> detailperm = 384 > >> dirperm = 493 > >> locking = no > >> log_packet_header = no > >> } > >> Module: Instantiating attr_filter.accounting_response > >> attr_filter attr_filter.accounting_response { > >> attrsfile = > >> "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > >> key = "%{User-Name}" > >> } > >> Module: Checking session {...} for more modules to load > >> Module: Checking post-proxy {...} for more modules to load > >> Module: Checking post-auth {...} for more modules to load > >> } # modules > >> } # server > >> radiusd: #### Opening IP addresses and Ports #### > >> listen { > >> type = "auth" > >> ipaddr = * > >> port = 0 > >> } > >> listen { > >> type = "acct" > >> ipaddr = * > >> port = 0 > >> } > >> listen { > >> type = "control" > >> listen { > >> socket = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > >> } > >> } > >> Listening on authentication address * port 1812 > >> Listening on accounting address * port 1813 > >> Listening on command file > >> /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > >> Listening on proxy address * port 1814 > >> Ready to process requests. > >> > >> I'm able to send packets using NTRadping tool however the packets are > >> rejected using radtest? > >> Why? Anthing wrong in the configuration? > >> > >> Thanks, > >> Rams. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 52, Issue 36 > ************************************************ >

2 1

Freeradius2.1.6 installation problem
by ramesh p 07 Aug '09

07 Aug '09

Unable to execute radtest. # radiusd -X FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Jul 30 2009 at 07:17:32 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/fnmt/radius2//etc/ > > raddb/radiusd.conf > including configuration file /usr/local/fnmt/radius2//etc/raddb/proxy.conf > including configuration file > /usr/local/fnmt/radius2//etc/raddb/clients.conf > including files in directory /usr/local/fnmt/radius2//etc/raddb/modules/ > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/ldap > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/pap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/exec > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/expr > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/attr_filter > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/radutmp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/preprocess > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/always > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/ > detail.example.com > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/attr_rewrite > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/etc_group > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/unix > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/mac2vlan > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/chap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/smsotp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/expiration > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/pam > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/inner-eap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/acct_unique > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/wimax > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/smbpasswd > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/logintime > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/sql_log > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/realm > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/linelog > including configuration file /usr/local/fnmt/radius2//etc/raddb/modules/otp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/mac2ip > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/checkval > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/krb5 > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/mschap > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/counter > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/detail > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/digest > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/passwd > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/sradutmp > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/files > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/policy > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/detail.log > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/perl > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/ippool > including configuration file > /usr/local/fnmt/radius2//etc/raddb/modules/echo > including configuration file /usr/local/fnmt/radius2//etc/raddb/eap.conf > including configuration file /usr/local/fnmt/radius2//etc/raddb/policy.conf > including files in directory > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/ > including configuration file > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/control-socket > including configuration file > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/default > including configuration file > /usr/local/fnmt/radius2//etc/raddb/sites-enabled/inner-tunnel > including dictionary file /usr/local/fnmt/radius2//etc/raddb/dictionary > main { > prefix = "/usr/local/fnmt/radius2/" > localstatedir = "/usr/local/fnmt/radius2//var" > logdir = "/usr/local/fnmt/radius2//var/log/radius" > libdir = "/usr/local/fnmt/radius2//lib" > radacctdir = "/usr/local/fnmt/radius2//var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > allow_core_dumps = no > pidfile = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/fnmt/radius2//sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client xx.xx.xx.xx { > require_message_authenticator = no > secret = "testing123" > shortname = "rparsa" > nastype = "other" > login = "radtest" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/usr/local/fnmt/radius2//var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = > "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > certificate_file = "/usr/local/fnmt/radius2//etc/raddb/certs/server.pem" > CA_file = "/usr/local/fnmt/radius2//etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/usr/local/fnmt/radius2//etc/raddb/certs/dh" > random_file = "/usr/local/fnmt/radius2//etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = > "/usr/local/fnmt/radius2//etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating preprocess > preprocess { > huntgroups = "/usr/local/fnmt/radius2//etc/raddb/huntgroups" > hints = "/usr/local/fnmt/radius2//etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating detail > detail { > detailfile = > "/usr/local/fnmt/radius2//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Instantiating attr_filter.accounting_response > attr_filter attr_filter.accounting_response { > attrsfile = > "/usr/local/fnmt/radius2//etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock" > } > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file > /usr/local/fnmt/radius2//var/run/radiusd/radiusd.sock > Listening on proxy address * port 1814 > Ready to process requests. > > I'm able to send packets using NTRadping tool however the packets are > rejected using radtest? > Why? Anthing wrong in the configuration? > > Thanks, > Rams.

3 2

regex not evaluated?
by Marlon Duksa 07 Aug '09

07 Aug '09

Hi - does anyone know why this does not work: basic-TP User-Password == "csetestp" User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$", Alc-Subsc-ID-Str := "%{NAS-Port-Id}", Alc-Subsc-Prof-Str := "%{1}", Alc-SLA-Prof-Str := "%{2}", Alc-MSAP-Serv-Id := "100", Alc-MSAP-Policy := "msaps", Alc-Default-Router := 20.0.0.1, Framed-IP-Address := 20.0.0.2, Framed-IP-Netmask := 255.255.0.0, Session-Timeout := 600, Fall-Through = Yes DEFAULT NAS-Port-Id =~ "^([^:]+):" Alc-MSAP-Interface := "port-%{1}" The request qoes through all lines but the Alc-Subsc-Prof-Str and Alc-Subsc-SLA-Str are empty. Obviously, the User-Name matches the regexpr, therefore, those two string should have returned values of %{1} and %{2}. This is the request: rad_recv: Access-Request packet from host 114.0.1.1:51080, id=29, length=90 User-Name = "basic-TP" User-Password = "csetestp" NAS-IP-Address = 1.1.1.1 DSL-Circuit-ID = "basic-TP" DSL-Remote-ID = "-0" NAS-Port-Type = Ethernet NAS-Port-Id = "1/1/1:10" This is what is returned: Sending Access-Accept of id 29 to 114.0.1.1 port 51080 User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$" Alc-Subsc-ID-Str := "1/1/1:10" Alc-Subsc-Prof-Str := "" Alc-SLA-Prof-Str := "" Alc-MSAP-Serv-Id := 100 Alc-MSAP-Policy := "msaps" Alc-Default-Router := 20.0.0.1 Framed-IP-Address := 20.0.0.2 Framed-IP-Netmask := 255.255.0.0 Session-Timeout := 600 Alc-MSAP-Interface := "port-1/1/1" Thanks, Marlon.

3 2

rlm_sql module won't compile under Solaris 10
by shivashankar 07 Aug '09

07 Aug '09

hi, i am using Freeradius 2.1.6. gcc -shared -Wl,-h -Wl,rlm_sql_mysql-2.1.6.so -o .libs/rlm_sql_mysql-2.1.6.so .libs/sql_mysql.o -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread -lc -m64 ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32 ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-2.1.6.so collect2: ld returned 1 exit status gmake[10]: *** [rlm_sql_mysql.la] Error 1 gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2:,( -- View this message in context: http://www.nabble.com/rlm_sql-module-won%27t-compile-under-Solaris-10-tp248… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: Freeradius-Users Digest, Vol 52, Issue 33
by Gilbert Lo 07 Aug '09

07 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

gmake giving --------ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32
by shivashankar 07 Aug '09

07 Aug '09

hi, i using freeradius 2.1.7 while gmake ..i am getting gcc -shared -Wl,-h -Wl,rlm_sql_mysql-2.1.6.so -o .libs/rlm_sql_mysql-2.1.6.so .libs/sql_mysql.o -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread -lc -m64 ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32 ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-2.1.6.so collect2: ld returned 1 exit status gmake[10]: *** [rlm_sql_mysql.la] Error 1 gmake[10]: Leaving directory `/opt/packages/freeradius-server-2.1.6/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 :,( ------------- ---------- ------------- -- View this message in context: http://www.nabble.com/gmake-giving---------ld%3A-fatal%3A-file-.libs-sql_my… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Error: rlm_eap: Failed to store handler
by Rokkhan 06 Aug '09

06 Aug '09

Hi, im new on the freeradius world but very curious. Sorry but my english is not very good. I have a working Freedius 1.0.5 server since year 2005 and i want to improve it, migrating a Freeradius 2.1.1-6 version, the latest version i have found for my Sles10 Sp2 server. This server its allowed to authenticate users by EAP-PEAP Mschapv2 and EAP-LEAP against Files and Ldap. In the new server moved all users in user's file to mysql server. All users in mysql are stored with Cleartext-Password. When i run server on debug mode for doing tests the server works without problems, and validate's users using both types of EAP and both Authorization types (Ldap and Mysql). But when i run as daemon and i introduce it in production validating about 2000 of users, freeradius 2.1.1-6 crashes in a few minutes and shows this error "Error: rlm_eap: Failed to store handler". I have only one server called default on sites-enabled configured like this. (The accounting is configured in another virtual server and works fine ) - Default Server - listen { ipaddr = * port = 1832 type = auth } authorize { preprocess eap { ok = return } sql ldap } # Authentication authenticate { Auth-Type MS-CHAP { mschap } # Allow EAP authentication. eap } session { sql } # Post-Authentication post-auth { Post-Auth-Type REJECT { attr_filter.access_reject sql } } pre-proxy { } post-proxy { eap } And Eap.conf is configured like this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 300 # Cisco LEAP leap { } ## EAP-TLS tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = secret private_key_file = ${certdir}/cert-srv.pem certificate_file = ${certdir}/cert-srv.pem CA_file = ${cadir}/cacert.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no } mschapv2 { } } The debug log shows this. rad_recv: Access-Request packet from host 10.50.31.201 port 1645, id=48, length=120 User-Name = "25" Framed-MTU = 1400 Called-Station-Id = "000d.ed77.db21" Calling-Station-Id = "000b.6b1e.7177" Message-Authenticator = 0xf1247640d8918729e0c58f0f88dc5a8a EAP-Message = 0x02010007013235 NAS-Port-Type = Virtual NAS-Port = 358 NAS-IP-Address = 10.50.31.201 NAS-Identifier = "sar76010001" Mon Jul 27 17:16:25 2009 : Info: +- entering group authorize {...} Mon Jul 27 17:16:25 2009 : Info: ++[preprocess] returns ok Mon Jul 27 17:16:25 2009 : Info: [eap] EAP packet type response id 1 length 7 Mon Jul 27 17:16:25 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Jul 27 17:16:25 2009 : Info: ++[eap] returns updated Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Info: [sql] sql_set_user escaped user --> '25' Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 6 Mon Jul 27 17:16:25 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '25' ORDER BY id Mon Jul 27 17:16:25 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '25' ORDER BY priority Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Released sql socket id: 6 Mon Jul 27 17:16:25 2009 : Info: [sql] User 25 not found Mon Jul 27 17:16:25 2009 : Info: ++[sql] returns notfound Mon Jul 27 17:16:25 2009 : Info: [ldap] performing user authorization for 25 Mon Jul 27 17:16:25 2009 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Mon Jul 27 17:16:25 2009 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=25) Mon Jul 27 17:16:25 2009 : Info: [ldap] expand: o=eroskiusers -> o=eroskiusers Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: performing search in o=eroskiusers, with filter (uid=25) Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: object not found or got ambiguous search result Mon Jul 27 17:16:25 2009 : Info: [ldap] search failed Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Jul 27 17:16:25 2009 : Info: ++[ldap] returns notfound Mon Jul 27 17:16:25 2009 : Info: Found Auth-Type = EAP Mon Jul 27 17:16:25 2009 : Info: +- entering group authenticate {...} Mon Jul 27 17:16:25 2009 : Info: [eap] EAP Identity Mon Jul 27 17:16:25 2009 : Info: [eap] processing type tls Mon Jul 27 17:16:25 2009 : Info: [tls] Initiate Mon Jul 27 17:16:25 2009 : Info: [tls] Start returned 1 Mon Jul 27 17:16:25 2009 : Error: rlm_eap: Failed to store handler Mon Jul 27 17:16:25 2009 : Info: ++[eap] returns fail Mon Jul 27 17:16:25 2009 : Info: Failed to authenticate the user. Mon Jul 27 17:16:25 2009 : Auth: Login incorrect (rlm_ldap: User not found): [25/<via Auth-Type = EAP>] (from client wifiap_arenal port 358 cli 000b.6b1e.7177) Mon Jul 27 17:16:25 2009 : Info: Using Post-Auth-Type Reject Mon Jul 27 17:16:25 2009 : Info: +- entering group REJECT {...} Mon Jul 27 17:16:25 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 27 17:16:25 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Info: [sql] sql_set_user escaped user --> '25' Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Password} -> Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{Chap-Password} -> Mon Jul 27 17:16:25 2009 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '25', '', 'Access-Reject', '2009-07-27 17:16:25') Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '25', '', 'Access-Reject', '2009-07-27 17:16:25') Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 5 Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Released sql socket id: 5 Mon Jul 27 17:16:25 2009 : Info: ++[sql] returns ok Mon Jul 27 17:16:25 2009 : Info: Delaying reject of request 1045 for 1 seconds Mon Jul 27 17:16:25 2009 : Debug: Going to the next request Mon Jul 27 17:16:25 2009 : Info: Cleaning up request 994 ID 190 with timestamp +39 Mon Jul 27 17:16:25 2009 : Info: Sending delayed reject for request 1040 I looked to machine resources and CPU is 90% idle and has 1Gb of free ram when crashes so i dont think that could be a memory or cpu load problem. Anyone can help me, what im a doing wrong?. The configuration is very similar to the freeradius 1.0.5 server that works well. Thanks for all.

3 5

DEAFAULT keyword??
by Marlon Duksa 06 Aug '09

06 Aug '09

Hi - I've been reading through WiKi pages but still not clear. I need to evaluate two attributes and I'm doing this with the =~ operator. But the second attribute is not evaluated but instead returned as reg expr (exactly as stated below) DEFAULT *User-Name =~ "^([aA-zZ]+)-([aA-zZ]+)$", Auth-Type := Local, User-Password == "csetestp"* Alc-Subsc-ID-Str := "%{NAS-Port-Id}", Alc-Subsc-Prof-Str := "%{1}", Alc-SLA-Prof-Str := "%{2}", Alc-MSAP-Serv-Id := "100", Alc-MSAP-Policy := "msaps", *NAS-Port-Id =~ "^([^:]+):", * Alc-MSAP-Interface := "port-%{1}" Why is NAS-Port-ID returned, according to operators is should not be. I'm trying to evaluate NAS-Port attr and then based on the results assign a value to the last attribute: Alc-MSAP-Interface. If I put a DEFAULT keyword with credentials (Auth-Type, User-Pswd), infront of NAS-Port-Id, then, NAS-Port-Id and Alc-MSAP-Interfaces are not returned at all. What is the significance of this 'DEFAULT' keyword in the 'users' file? Thanks, Marlon

2 5