- Freeradius-Users - lists.freeradius.org

Re: Please help me (Ivan Kalik)
by josgeorge thaikudathil 22 Jun '09

22 Jun '09

Hi , Thank you very much for the response but still i am getting same error can you please suggest accordingly .I had done 3 different tries in my user file those tries and output is given below Also i more think i remember while my installation db.ippool file and db.index file where not formed then i had to created those files in respective directory and i had given appropriate permission for that whether it will create any problem ?.... Also while useing command *rlm_ippool_tool -a ip-pool.db ip-index.db *i am getting output as 0 whether is it any problem ?... * DEFAULT Pool-Name := main_pool Fall-Through = Yes* ** *steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP* modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 81 users: Matched steve at 84 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find nas port information. Return NOOP. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 2 to 10.143.71.15:3734 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 2 with timestamp 4a3f7d84 Nothing to do. Sleeping until we see a request. -------------------------------------------------------------------------- *steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP,* * Fall-Through = Yes DEFAULT Pool-Name := main_pool* Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched steve at 82 users: Matched DEFAULT at 94 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find nas port information. Return NOOP. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 3 to 10.143.71.15:3740 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 4a3f7e1c Nothing to do. Sleeping until we see a request. ----------------------------------------------------------------------------------------------------------------- *DEFAULT Fall-Through = Yes steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP,* ** *DEFAULT Pool-Name := main_pool* ** Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched steve at 83 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 4 to 10.143.71.15:3751 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 4 with timestamp 4a3f7ed7 ----------------------------------------------------------------------------------------------------------- Thanks and regards Jos george. 9844459056

1 0

Please help me
by josgeorge thaikudathil 22 Jun '09

22 Jun '09

Hi , I am useing a free radius version available with redhat 4.5 ,RPM name is freeradius-1.0.1-3.RHEL4.3.i386.rpm I am trying to use ippool configuration configurations i had made is in radiusd.conf file ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start =10.143.71.15 range-stop =10.143.71.25 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = yes # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } accounting { main_pool } post-auth { main_pool } ------------------------------------------------------------------------------------------------------------------------------------------ in users file steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP DEFAULT Pool-Name := "main_pool" -------------------------------------------------------------------------------------------------------------------------------------------------------------- in clients file <nas ip> <secret key> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- and i am getting errors when i run /usr/sbin/radiusd -A -X modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 0 rlm_ippool: Could not find Pool-Name attribute. I am suspecting some problem with users file ... Can you please help me to find out what is missing -- Thanks and regards Jos george. 9844459056

3 3

Radius+Huwaei switch + auto VLan Assignment issue
by Attou eric 22 Jun '09

22 Jun '09

Hello Everybody! We are having issue in trying to setup Radius server with a huwaei quidway S3900 as authenticator. The switch ports are configured as hybrid and tagged on all our four vlans. We also configure VLAN 1 (the default) as guest vlan of the ports and dot1x is activated globally and on each ethernet port. Radius server is configure to search for users in LDAP directory. Here is one off our user parameters in the directory: dn: uid=toto,ou=Users,ou=ceforp,dc=uac,dc=bj uid: toto cn: toto sambaSID: toto telephoneNumber: 00000000 roomNumber: 00000000 homePhone: 97 09 61 90/90 04 12 26 givenName: toto sn: toto mail: toto(a)ceforp.uac.bj objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: radiusProfile objectClass: top objectClass: sambaSamAccount objectClass: shadowAccount userPassword: {crypt}$1$JGZ378je$G9BPCKU.BWv1QEAZCQtFO. sambaLMPassword: AZERTY sambaNTPassword: AZERTY shadowLastChange: 14250 shadowMax: 99999 shadowWarning: 7 radiusTunnelPrivateGroup-Id: "2" radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN loginShell: /bin/bash uidNumber: 1616 gidNumber: 1614 homeDirectory: /home/toto gecos: Akouma toto,,,97 09 61 90/90 04 12 26 When we try the authentication with this user account, although radius log send the VLAN attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) in Access-Challenge messages and finally send an Access-Accept message, the switch does not assign the right VLAN( the switching from VLAN 1 to VLAN 2 does not occur) and the user still in VLAN 1. We note that there is no VLAN attribute in Access-Accept message. What may be wrong ? Below is the radius server's output log Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=22, length =115 User-Name = "toto" EAP-Message = 0x0201000901746f746f Message-Authenticator = 0x60464542ce8c771452c8234d62a8de2d NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry DEFAULT at line 172 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for toto expand: (&(objectclass=posixAccount)(uid=%u)) -> (&(objectclass=posixAcc ount)(uid=toto)) expand: dc=uac,dc=bj -> dc=uac,dc=bj rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection Sending Access-Challenge of id 22 to 192.168.100.5 port 5001 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa88eb0cba88ca91516c2ad39391ee6f1 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=23, length=236 User-Name = "toto" EAP-Message = 0x0202007019800000006616030100610100005d03014a3f38dbbadfdeb57d18de0598e2cc8fc3a93bdc048767fda66314b9273e319b200a7da7d94248ab602a4aad9e3fcb579310da741faf694e40b9fef41839ae4604001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x3cf0c9732a7a9b23dea1cf4538f76931 NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cba88ca91516c2ad39391ee6f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0eb6], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 23 to 192.168.100.5 port 5001 EAP-Message = 0x0103040019c000000f13160301004a0200004603014a3f46ed27ac2ce8a976a6a7a18e528a981c1274689c91b8dd0f371a71ef957e201e2e2fb4a46d14234197b85b3d21307055bb67a12dd408dcad5b39db5e679e770004001603010eb60b000eb2000eaf000759308207553082053da003020102020101300d06092a864886f70d01010505003081a2310b300906035504061302424a311330110603550408130a41746c616e7469717565311630140603550407130d41626f6d65792d43616c6176693121301f060355040a1318556e69766572736974652041626f6d65792d43616c6176693111300f060355040b1308526563746f726174311430 EAP-Message = 0x120603550403140b726f6f745f43415f554143311a301806092a864886f70d010901160b696e666f407561632e626a301e170d3038303731373135353833355a170d3039303731373135353833355a3081a4310b300906035504061302424a311330110603550408130a41746c616e7469717565311630140603550407130d41626f6d65792d43616c6176693121301f060355040a1318556e69766572736974652041626f6d65792d43616c6176693111300f060355040b1308526563746f726174311630140603550403130d63616c6176692e7561632e626a311a301806092a864886f70d010901160b696e666f407561632e626a30820222300d06 EAP-Message = 0x092a864886f70d01010105000382020f003082020a0282020100ba35068b7967acc67f03fe9f0cd76ea4fc16bb62b8986f8a2e70413e22942f1e7604ab691177fdb5fd14: a030bb00840b9281a6ee37482bcb1f95d7cbeb23a06a1f659a48f4380a23acc10952d5c70258579fbda12d599aabd12d4ddb5de20e943c515ea8f817f15fc4b1201ba2952a43c8b4ef52941f256670d7e216ec19930e940ce1832e9b953096dc6ef00bbb1dc173b800b183c5d1f20383d29f7c8795d5ed22c8d6075f492d2adb6700a51ed0f8c8793c2d460be5d822a8309b541802b27c2c496be98c1a0737ed88ac27cd94bd85ef58a16f3dba29d3b94754265bd7d24ddea4 EAP-Message = 0x45efe16f59861c8f63dffa7835ba4e3f654afd6c2f50bbd1f11e220bd5df962d0e516688c7e9124128eb9bd23caf997fe12ad314ecbbce6c5dd3549df7aeb8b879bfdf2727b3aa1e4019283741448cf3e2148ea203a546e25c60fee5fe5da03d3fe1265da3dbe91bb7e620d1932e83d4e05433d6f2aa30a5264f30a134574f03c418c8077e7333d774f9b8a6451eea70a918f132cecf7957423a22784653042a5fcc6a8a0a66aefce4fff473ee078ed7fb2a3b1cab12694e3d1f9f44bae7ebaa6c6be4686e475ab908428af9592000f62b93ba39bfe15863907dc535941e1d7e9b5236874fb51979f8662aadc3dc1bdc5e34a9bdd3e32430fbe857523b EAP-Message = 0x0d3f2885d5031e5f76099610 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa88eb0cba98da91516c2ad39391ee6f1 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=24, length=130 User-Name = "toto" EAP-Message = 0x020300061900 Message-Authenticator = 0xb5552c32bd90604d37c9c0fb4482455e NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cba98da91516c2ad39391ee6f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 24 to 192.168.100.5 port 5001 EAP-Message = 0x010403fc1940b38003bf6e1f8b658ce51826eea11c0bf44abf450203010001a38201903082018c30090603551d1304023000301106096086480186f8420101040403020640302b06096086480186f842010d041e161c54696e7943412047656e657261746564204365727469666963617465301d0603551d0e04160414f17eea30a8f7f709053f3f7bed44e40d6d63c68a3081d70603551d230481cf3081cc8014c3580d7f0c9b26c3fcca6bddecc25329b3ed999ea181a8a481a53081a2310b300906035504061302424a311330110603550408130a41746c616e7469717565311630140603550407130d41626f6d65792d43616c6176693121301f06 EAP-Message = 0x0355040a1318556e69766572736974652041626f6d65792d43616c6176693111300f060355040b1308526563746f726174311430120603550403140b726f6f745f43415f554143311a301806092a864886f70d010901160b696e666f407561632e626a820900f454a6d25d837f6130160603551d12040f300d810b696e666f407561632e626a30160603551d11040f300d810b696e666f407561632e626a30160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d0101050500038202010075889612daeb738396e4a633941133cd7614298049994d4992ccef22cbb75e37e26fe9f51f9ce8515ea0918db7864da4440933 EAP-Message = 0x48844b57b3456682ac4b3f45d62d86f7212af508730fb37f53225ffbbc2fdb3389346da7802eec86548588c0cf01c50417969e4d3566c9ca0ae3910f6c79047d2510b9fb557185e826bf355820de2952f9aec584ce6e89062b088ded33999cde33f95fe3fe6f173623cde8838901421c17541dacf82879a49712ba9d082c9ebde368272af85d031e9049dead03902ebe71bb3a1b5e3c8385902c677cfac0c1ee8ac405a6cb77c6f64cdcf09b1d61874cb3eac03ce9f283d130caaceaa38a65c12e7d13a6d34444def970fd60d973fe7b2031abc41fa019dfd91cdfeeaab155f615f327c7b5fd711b79db87f45aa2b97c4e2bb44ef02d77392b0bb5d93c EAP-Message = 0xe888d84f68211cd1f5c40eda157273e3e193c20d682ad3f30f0765ece4c20646afac050b8493e0874845971a2a03645d412b6aa96ea90fcae6df3fd94d6502900ad1c15f756f6c28cec9618f497faf5c32c200771a0b0e9652749b06ffa8837b0795883b757b81e62b4ad3d9eba615ccf63fc7f6d12d038814e32d013972b21b033399b4dea04c7368b4c20e80c405d25d70a49b1c16ad339510cc041bc529950d5e0769de26399739d2383499951bc54db8c1342e86354291c1f62b8b1816be8e184a30b6c761c73eea65c0d03ae8830007503082074c30820534a003020102020900f454a6d25d837f61300d06092a864886f70d01010505003081a2 EAP-Message = 0x310b300906035504 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa88eb0cbaa8aa91516c2ad39391ee6f1 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=25, length=130 User-Name = "toto" EAP-Message = 0x020400061900 Message-Authenticator = 0x5eeac44dfede983aedee24c387cb44e9 NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cbaa8aa91516c2ad39391ee6f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 25 to 192.168.100.5 port 5001 EAP-Message = 0x010503fc1940061302424a311330110603550408130a41746c616e74: 69717565311630140603550407130d41626f6d65792d43616c6176693121301f060355040a1318556e69766572736974652041626f6d65792d43616c6176693111300f060355040b1308526563746f726174311430120603550403140b726f6f745f43415f554143311a301806092a864886f70d010901160b696e666f407561632e626a301e170d3038303731373135353331385a170d3138303731353135353331385a3081a2310b300906035504061302424a311330110603550408130a41746c616e7469717565311630140603550407130d41626f6d65792d43616c617669 EAP-Message = 0x3121301f060355040a1318556e69766572736974652041626f6d65792d43616c6176693111300f060355040b1308526563746f726174311430120603550403140b726f6f745f43415f554143311a301806092a864886f70d010901160b696e666f407561632e626a30820222300d06092a864886f70d01010105000382020f003082020a0282020100f4b24ec17856ccd0925b38267d08f774b4e8305facfc02da999c9d5787a4d6b57af62d62531b4ee11135cf1546825c9c7aa6eb452c5adc6a768616ec978be9ddb0e98b1b1d23d2056c5fe37f46247295851e5c4866dec12d3b298b3d9b7629208465333f1f479a886f8321e8768b6a32c9563ecf EAP-Message = 0xfd7d052a60062bf19ea4c007138dbedfb86604118f1c20c7e7769a82cd10564c4624a53786e894a174a253585bca0e92e8f32923fdde919eee543c6ac7b1e6af377a726d62cdab0941c4bacccd7a40fd1762b4682c47150b33a819d4ce4e01e31a989dce7ea27fc14c6bf6c4ef036929e3ec575b94610bcc30d0d0159b94a41182650f071d1b73a7e9a8cbe844be37b3ce1193910909bee58ca887a0a4b6ea65674aac02012eb9c0f5207982e2b06d2c4d36e5af8b508edf8f65234696eeae28121a786c906e933f56770d32ee8987de8b678d809dc53d98da8b805c62953231091b47026c2bf695899b7c170197219e4b80f6d5bb1135c76e11e641e7 EAP-Message = 0x6eda160e7661681a20b9381dcddcc5da66c62e9d40885dd74b38733981cc17f8735cca0122e34ed54e822d8d607215055a06834c0d0dd8b770fe025c4d0fb310baea2e876d5e9574e4c68282d0b440acd1bb420f329c0cefda380d72c6cd635dca12658b638b58bea300430511b391e39ffa5a778cd618a444517759644e3b714a3c7dba6b53de21aea101b29656e30203010001a38201813082017d301d0603551d0e04160414c3580d7f0c9b26c3fcca6bddecc25329b3ed999e3081d70603551d230481cf3081cc8014c3580d7f0c9b26c3fcca6bddecc25329b3ed999ea181a8a481a53081a2310b300906035504061302424a3113301106035504 EAP-Message = 0x08130a41746c616e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa88eb0cbab8ba91516c2ad39391ee6f1 Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=26, length=130 User-Name = "toto" EAP-Message = 0x020500061900 Message-Authenticator = 0x95ef28d6ba4539705842ff6961284ff6 NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cbae86a91516c2ad39391ee6f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 32 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - toto PEAP: Got tunneled EAP-Message EAP-Message = 0x0208000901746f746f PEAP: Got tunneled identity of toto PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to toto PEAP: Sending tunneled request EAP-Message = 0x0208000901746f746f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "toto" server (null) { +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for toto expand: (&(objectclass=posixAccount)(uid=%u)) -> (&(objectclass=posixAccount)(uid=toto)) expand: dc=uac,dc=bj -> dc=uac,dc=bj rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=uac,dc=bj, with filter (&(objectclass=posixAccount)(uid=toto)) rlm_ldap: checking if remote access for toto is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute sambaNTPassword as RADIUS attribute NT-Password == 0x4332313832333530444532433243463343344435434231343441394431444233 rlm_ldap: LDAP attribute sambaLMPassword as RADIUS attribute LM-Password == 0x3337364436424445433041413644323839343445324446343839413838304534 rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "totouser" :rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusTunnelPrivateGroupId as RADIUS attribute Tunnel-Private-Group-Id:0 = "2" rlm_ldap: LDAP attribute radiusTunnelMediumType as RADIUS attribute Tunnel-Medium-Type:0 = IEEE-802 rlm_ldap: LDAP attribute radiusTunnelType as RADIUS attribute Tunnel-Type:0 = VLAN rlm_ldap: user toto authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server (null) PEAP: Got tunneled reply RADIUS code 11 Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x0109001e1a010900191007ae8dd49bdfd0c817732291052c1735746f746f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0c186c320c1176bedb16c1e664f42fe2 PEAP: Processing from tunneled session code 0x7c2670 11 Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x0109001e1a010900191007ae8dd49bdfd0c817732291052c1735746f: 746f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0c186c320c1176bedb16c1e664f42fe2 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 29 to 192.168.100.5 port 5001 EAP-Message = 0x010900351900170301002ae5ded2cf6543b4449305996cc5fdcfec9bf7867d5fdb62ee189022502a79da435f13d7b9b80c2f8ced86 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa88eb0cbaf87a91516c2ad39391ee6f1 Finished request 7. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=30, length=210 User-Name = "toto" EAP-Message = 0x020900561900170301004bbaf13ec9d401f583cd58929b8f7f454cdb002639dc4ea00b14a69f6400eea5d340665d95edb631514792962e1d54723456e074bd14b4ba6f45464f3d30552dc3f8823cd456500ca92efae7 Message-Authenticator = 0xa44820cdf03d1108a8d932ec95e953ef NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cbaf87a91516c2ad39391ee6f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 86 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x0209003f1a0209003a31f627621d72908d812dcc8660104a923b00000000000000007d029e559fbcc706309ba7f099f573290ecf7056a219884a00746f746f PEAP: Setting User-Name to toto PEAP: Sending tunneled request EAP-Message = 0x0209003f1a0209003a31f627621d72908d812dcc8660104a923b00000000000000007d029e559fbcc706309ba7f099f573290ecf7056a219884a00746f746f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "toto" State = 0x0c186c320c1176bedb16c1e664f42fe2 server (null) { +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for toto expand: (&(objectclass=posixAccount)(uid=%u)) -> (&(objectclass=posixAccount)(uid=toto)) expand: dc=uac,dc=bj -> dc=uac,dc=bj rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=uac,dc=bj, with filter (&(objectclass=posixAccount)(uid=toto)) rlm_ldap: checking if remote access for toto is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute sambaNTPassword as RADIUS attribute NT-Password == 0x4332313832333530444532433243463343344435434231343441394431444233 rlm_ldap: LDAP attribute sambaLMPassword as RADIUS attribute LM-Password == 0x3337364436424445433041413644323839343445324446343839413838304534 rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "totouser" rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusTunnelPrivateGroupId as RADIUS attribute Tunnel-Private-Group-Id:0 = "2" rlm_ldap: LDAP attribute radiusTunnelMediumType as RADIUS attribute Tunnel-Medium-Type:0 = IEEE-802 rlm_ldap: LDAP attribute radiusTunnelType as RADIUS attribute Tunnel-Type:0 = VLAN rlm_ldap: user toto authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for toto with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server (null) PEAP: Got tunneled reply RADIUS code 11 Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x010a00331a0309002e533d45324635434146333132433946454341393932443738373436364344424342443444364643444134 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0c186c320d1276bedb16c1e664f42fe2 PEAP: Processing from tunneled session code 0x7c52c0 11 Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x010a00331a0309002e533d45324635434146333132433946454341393932443738373436364344424342443444364643444134 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0c186c320d1276bedb16c1e664f42fe2 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 30 to 192.168.100.5 port 5001 EAP-Message = 0x010a004a1900170301003ff9c9a8096c8008435d18d64dd2844e84eaccd55bc005519a1e4330882677b71ee2dfdead2f7bfc9dcf711bd2b6776b5ded041a41783f07063d0a82dfff7eee Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa88eb0cba084a91516c2ad39391ee6f1 Finished request 8. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=31, length=153 User-Name = "toto" EAP-Message = 0x020a001d19001703010012c5c3e515e280e0362280ea65d35a6ee5f57e Message-Authenticator = 0xb12836f1115dd64af2d01d2d0fc41bca NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cba084a91516c2ad39391ee6f1 +- entering group authorize rad_recv: Access-Request packet from host 192.168.100.5 port 5001, id=32, length =162 User-Name = "toto" EAP-Message = 0x020b00261900170301001bac16d38a5cfbaed36ed0105a6c7c16925c 925a2a8a04b60c164770 Message-Authenticator = 0x6969775e3b691b3e7ef57aaa3e4d3ba7 NAS-IP-Address = 192.168.100.5 NAS-Identifier = "000fe265a2f5" NAS-Port = 268455937 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000b-5d4a-369f" State = 0xa88eb0cba185a91516c2ad39391ee6f1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "toto", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 11 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Login OK: [toto/<via Auth-Type = EAP>] (from client uac_quid002 port 268455937 cli 000b-5d4a-369f) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 32 to 192.168.100.5 port 5001 MS-MPPE-Recv-Key = 0x3fc9ad8eb5c61fa194fbcf43ec68aa879a28a6f2b25d5dcc96531f47dccdae69 MS-MPPE-Send-Key = 0xaf8ead06473463ae03e04ac1cc4f09e8e827287effa7ccaf360b0b8bbc2ed18e EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "toto" Finished request 10. Going to the next request Waking up in 4.1 seconds. Thanks for your help!

3 2

Refusing to start due to insecure configuration
by miaowang 22 Jun '09

22 Jun '09

HI: I COPY FreeRADIUS.net to D: It running ok but to drive c:, it can not startup : C:\FreeRADIUS.net\bin>radiusd.exe -d ../etc/raddb -AX Starting - reading configuration files ... reread_config: reading radiusd.conf Configuration directory ../etc/raddb is globally writable. Refusing to start due to insecure configuration. Errors reading radiusd.conf what wrong about it? C is NTFS D is fat32 2009-06-22 miaowang

2 1

Radius database connectivity
by Robert White 21 Jun '09

21 Jun '09

I have a question about db connectivity with Radius. I currently have OpenRadius connecting to a mssql database using unixODBC/TDS. If the database ever goes down for some reason and then comes back up, I have to restart Radius in order to re-establish db connectivity. Is this an openradius problem or is it a unixODBC issue? Does anyone know how I would be able to get connectivity to reestablish automatically? Thanks, W

2 2

Re: Authentication failure - PEAP - MS-CHAPv2
by Diego Martín Capello 19 Jun '09

19 Jun '09

>> Follow the instructions on my web site: http://deployingradius.com >> It has a step by step guide to get EAP working. Follow the guide. It >> *will* work. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > Thanks, I'm going to try it. Anyway, I don't think it could be Samba > related, because my config uses an LDAP database, which is totally > independent from Samba. > The only reason I can imagine, is a bug in the firmware of the access > point... but let's see what happens using your configuration. I think you are using sef-signed ssl certificates in the freeradius server and the windows XP client is trying to "validate" them; if that is right try to configure windows xp client to not to validate them. Best regards and sorry for my english! Diego Martín Capello > Gergely Kiss >

4 8

..DBI.so: undefined symbol: PL_tainting at.. while perl script compilation
by Tomasz Kolaj 19 Jun '09

19 Jun '09

Hello, After system upgrade perl script used to authenticate clients by postgres fail while radiusd is loading: (log also at http://pastebin.com/m46849dbe) baza raddb # radiusd -f Can't load '/usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/auto/DBI/DBI.so' for module DBI: /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/auto/DBI/DBI.so: undefined symbol: PL_tainting at /usr/lib64/perl5/5.8.8/x86_64-linux/DynaLoader.pm line 230. at /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/DBI.pm line 263 BEGIN failed--compilation aborted at /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/DBI.pm line 263. Compilation failed in require at /etc/raddb/example.pl line 6. BEGIN failed--compilation aborted at /etc/raddb/example.pl line 6. baza raddb # head -n 6 example.pl #!/usr/bin/perl use strict; #use Pg; use DBI; modules/perl file contains: perl { module = /etc/raddb/example.pl func_authenticate = authenticate func_authorize = authorize max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Reproducible: Always Steps to Reproduce: 1.Upgrade system (perl, postgres, freeradius), do perl-upgrade all 2.Configure freeradius to use example.pl as authenticate system 3.run radiusd Actual Results: Can't load '/usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/auto/DBI/DBI.so' for module DBI: /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/auto/DBI/DBI.so: undefined symbol: PL_tainting at /usr/lib64/perl5/5.8.8/x86_64-linux/DynaLoader.pm line 230. at /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/DBI.pm line 263 BEGIN failed--compilation aborted at /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux/DBI.pm line 263. Compilation failed in require at /etc/raddb/example.pl line 6. BEGIN failed--compilation aborted at /etc/raddb/example.pl line 6. Regards, -- Tomasz Kolaj ABP Computer

4 3

Accounting with TLS
by Nik Alleyne 19 Jun '09

19 Jun '09

Morning Guys, Now that I have my clients authenticating via certificates is it possible for me to do accounting for those clients. I know the option is available if I'm using MySQL, because I have seen the tutorials on how to achieve this. If it can be done with certificates can someone please guide me. Thanks Nik Nik

2 1

Cannot Authenticate - Help!
by Filipe Scalioni 19 Jun '09

19 Jun '09

Hi, I'm new to FreeRadius, and I'm having some hard time to put it to work. Simply talking: I can authenticate from my linux (Suse 11.1) using radtest, directly linked to the server (LAN). Here is the answer: protagoras:~ # radtest teste teste 192.168.10.113:1812 1812 testing123 Sending Access-Request of id 240 to 192.168.10.113 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 rad_recv: Access-Accept packet from host 192.168.10.113 port 1812, id=240, length=20 So, it works... But then I put the AP to work (Linksys wrt54g), configured like this: Security mode: WPA Enterprise WPA Algorithms: TKIP RADIUS Server Address: 192.168.10.113 - this is my RADIUS server IP RADIUS Port: 1812 Shared Key: testing123 Key Renewal Timeout: 3600 seconds All good, but when I try to connect from Windows XP, Vista or 7, configured like this Network Authentication: WPA Data Encryption: TKIP EAP Type: PEAP Authentication Method: MsCHAPv2 Not sending my windows login parameters It nevers authenticates... No matter what I do. I tried everything I could find on the list or FAQ before registering. Here goes the log [root@testecent raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd.pid" main: bind_address = 192.168.10.113 IP address [192.168.10.113] main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "clear" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "ldap.your.domain" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "o=My Org,c=UA" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x96835d0 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Listening on authentication 192.168.10.113:1812 Listening on accounting 192.168.10.113:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.40:2373, id=0, length=182 Message-Authenticator = 0xfa745a613580068b4534b34cf22f8724 Service-Type = Framed-User User-Name = "backup" Framed-MTU = 1488 Called-Station-Id = "00-1D-7E-5F-DF-AB:Metasys-Desktop" Calling-Station-Id = "00-15-AF-CF-FE-DB" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b016261636b7570 NAS-IP-Address = 192.168.10.40 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "unix" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [backup/<no User-Password attribute>] (from client Linksys port 1 cli 00-15-AF-CF-FE-DB) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.10.40 port 2373 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4a490f7e Nothing to do. Sleeping until we see a request. I have no idea how to fix it to make it read the password. I know it's authenticating as last method in my NIS, and it works flawlessly over the LAN with other linux client, like I said in the begining. Any help would be really appreciated, I need this to finish my Graduation! Thanks!

4 5

Problem with external authentication script
by Stefan Kuegler 18 Jun '09

18 Jun '09

Hello. I have some trouble to call an external authentication script in freeradius. I want to use MOTP for authentication. MOTP uses a shell-script (/usr/local/bin/otpverify.sh) to verify the given password. The script needs five arguments (User, One-Time-Password, Secret, PIN and Offset). My system is a fresh installation of freeradius on a Debian/Lenny system. I did the following changes on the following config-files: 1. A new dictionary-file (included in /etc/freeradius/dictionary): /etc/freeradius/dictionary.motp ------------------------------- ATTRIBUTE Secret 960 string ATTRIBUTE PIN 961 string ATTRIBUTE Offset 962 string 2. A new module in /etc/freeradius/radiusd.conf (modules-section): ---------------------------- [...] exec motp { wait = yes program = "/usr/local/bin/otpverify.sh %{User-Name} %{User-Password} %{Secret} %{PIN} %{Offset}" input_pairs = request output_pairs = config } [...] 3. /etc/freeradius/sites-enabled/default (section authenticate) ------------------------------------- [...] Auth-Type MOTP { motp } 4. /etc/freeradius/users --------------------- DEFAULT Auth-Type = Accept Exec-Program-Wait = "/usr/local/bin/otpverify.sh '%{User-Name}' '%{User-Password}' '%{Secret}' '%{PIN}' '%{Offset}'", Fall-Through = Yes stefan Secret = 143a5c6fa125ac1f, PIN = 1234, Offset = 0 The main-problem is: freeradius didn't call the script with all the needed arguments - so the authentication failes: [...] expand: /usr/local/bin/otpverify.sh '%{User-Name}' '%{User-Password}' '%{Secret}' '%{PIN}' '%{Offset}' -> /usr/local/bin/otpverify.sh 'stefan' '123' '' '' '' [...] Can anybody tell me where I did the mistake in my configuration ?? Thanks a lot Stefan P.S. Here is the complete debugging output: FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 7 2008 at 17:42:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.82.41 { require_message_authenticator = no secret = "testing123" } client 192.168.82.40 { require_message_authenticator = no secret = "testing123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating motp exec motp { wait = yes program = "/usr/local/bin/otpverify.sh %{User-Name} %{User-Password} %{Secret} %{PIN} %{Offset}" input_pairs = "request" output_pairs = "config" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.82.40 port 1026, id=43, length=78 User-Name = "stefan" User-Password = "123" Service-Type = Authenticate-Only NAS-Identifier = "ubuntu.kuegler.org" NAS-IP-Address = 192.168.82.40 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "stefan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry DEFAULT at line 2 expand: /usr/local/bin/otpverify.sh '%{User-Name}' '%{User-Password}' '%{Secret}' '%{PIN}' '%{Offset}' -> /usr/local/bin/otpverify.sh 'stefan' '123' '' '' '' users: Matched entry stefan at line 9 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [stefan/123] (from client 192.168.82.40 port 0) +- entering group post-auth Exec-Program output: FAIL Exec-Program-Wait: plaintext: FAIL Exec-Program: returned: 3 Login incorrect (external check said so) ++[exec] returns reject Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> stefan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.82.40 port 1026, id=43, length=78 Waiting to send Access-Reject to client 192.168.82.40 port 1026 - ID: 43 Sending delayed reject for request 0 Sending Access-Reject of id 43 to 192.168.82.40 port 1026 Waking up in 4.9 seconds.

4 14