- Freeradius-Users - lists.freeradius.org

rlm_perl and tagged attributes problem
by Alexandr Kovalenko 31 Mar '09

31 Mar '09

Hello I'm trying to set up FreeRADIUS with rlm_perl module to have ability to interoperate with our billing/provisioning system. FreeRADIUS version: # radiusd -v radiusd: FreeRADIUS Version 1.1.7, for host amd64-portbld-freebsd6.3, built on Jan 15 2009 at 18:36:52 Perl version: # perl -V Summary of my perl5 (revision 5 version 8 subversion 8) configuration: Platform: osname=freebsd, osvers=6.3-rc2, archname=amd64-freebsd We are using Juniper ERX-310 BRAS to terminate our customers and to configure policies and so on, he need few attributes to be tagged. Here is what normal session should be like to: [never@nemo ~]$ radtest admin test 127.0.0.1 2 testing123 Sending Access-Request of id 229 to 127.0.0.1 port 1812 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=229, length=126 ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Qos-Parameters = "internet_tr_value 2097152" Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 ERX-Service-Statistics:1 = time-volume ERX-Service-Activate:1 = "telesys(1048576)" Please note ERX-Service-Statistics:1 and ERX-Service-Activate:1 attributes. I have minimized code in Perl module to achieve this, to exclude any possibility of our system influence: sub authorize { if (($RAD_REQUEST{'User-Name'} eq 'admin') and ($RAD_REQUEST{'User-Password'} eq 'test')) { $RAD_REPLY{'ERX-Service-Activate:1'} = 'telesys(1048576)'; $RAD_REPLY{'ERX-Service-Statistics:1'} = 'time-volume'; $RAD_REPLY{'ERX-Qos-Parameters'} = "internet_tr_value 2097152"; $RAD_REPLY{'ERX-Qos-Profile-Name'} = "SP_Tele_Internet"; $RAD_REPLY{'Framed-IP-Address'} = '10.0.112.2'; $RAD_REPLY{'Framed-IP-Netmask'}= "255.255.255.255"; return RLM_MODULE_OK; }; } Now let me to describe what happens. When I restart radiusd and issue 1st radius Access-Request packet, it returns attributes as expected. But the next one returns this: $ radtest admin test 127.0.0.1 2 testing123 Sending Access-Request of id 32 to 127.0.0.1 port 1812 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=32, length=125 ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Qos-Parameters = "internet_tr_value 2097152" Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 ERX-Service-Statistics:0 = time-volume ERX-Service-Activate:0 = "telesys(1048576)" Please note ":0" after 2 last ERX-* attributes, which is a) incorrect, b) in perl code it is clearly written as ":1". Please help me to resolve this issue. Thanks in advance. Here is log of correct behavior: ------------------------------------ rad_recv: Access-Request packet from host 127.0.0.1:64032, id=42, length=57 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 Using perl at 0x592370 rlm_perl: $VAR1 = {}; rlm_perl: defined rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Service-Activate = telesys (1048576) rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Statistics = time-volume rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 0 Using perl at 0x592370 rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 0 modcall: leaving group Perl (returns ok) for request 0 Sending Access-Accept of id 42 to 127.0.0.1 port 64032 ERX-Qos-Parameters = "internet_tr_value 2097152" ERX-Service-Activate:1 = "telesys (1048576)" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:1 = time-volume Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 Finished request 0 -------------------------------------------- Here is log of next try: -------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:49908, id=68, length=57 User-Name = "admin" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1 Using perl at 0x592370 rlm_perl: $VAR1 = {}; rlm_perl: defined rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair ERX-Service-Activate = telesys (1048576) rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Service-Statistics = time-volume rlm_perl: ERROR: Failed to create pair Primary-DNS = 77.91.190.21 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: ERROR: Failed to create pair Secondary-DNS = 77.91.190.24 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authorize]: module "perl" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Perl auth: type "Perl" Processing the authenticate section of radiusd.conf modcall: entering group Perl for request 1 Using perl at 0x592370 rlm_perl: Added pair ERX-Qos-Profile-Name = SP_Tele_Internet rlm_perl: Added pair ERX-Qos-Parameters = internet_tr_value 2097152 rlm_perl: Added pair Framed-IP-Address = 10.0.112.2 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = Perl modcall[authenticate]: module "perl" returns ok for request 1 modcall: leaving group Perl (returns ok) for request 1 Sending Access-Accept of id 68 to 127.0.0.1 port 49908 ERX-Qos-Parameters = "internet_tr_value 2097152" ERX-Service-Activate:0 = "telesys (1048576)" ERX-Qos-Profile-Name = "SP_Tele_Internet" ERX-Service-Statistics:0 = time-volume Framed-IP-Address = 10.0.112.2 Framed-IP-Netmask = 255.255.255.255 Finished request 1 -- Alexandr Kovalenko http://uafug.org.ua/

2 5

How to use Autz-Type?
by Fajar A. Nugraha 31 Mar '09

31 Mar '09

Hi, I'm using freeradius 2.1.3 (self-compiled as RPM), and trying to use Autz-Type. I see example from /usr/share/doc/freeradius-2.1.3/Autz-Type: #================== authorize{ preprocess suffix Autz-Type customer1{ ldap1 } Autz-Type customer2{ ldap2 } files } users file------------------- DEFAULT Realm == "customer1", Autz-Type := customer1, Auth-Type := customer1 DEFAULT Realm == "customer2", Autz-Type := customer2, Auth-Type := customer2 ---------------------------- #================== So in /etc/raddb/sites-available/default I have this (only authorize section shown): #================== authorize { preprocess suffix Autz-Type DOM1 { sql1 } Autz-Type DOM2 { sql2 } files } #================== and on /etc/raddb/users I have this: #================== DEFAULT Realm == "domain1.com", Autz-Type := DOM1, Auth-Type := DOM1 DEFAULT Realm == "domain2.com", Autz-Type := DOM2, Auth-Type := DOM2 #================== but on starting freeradius I got this (full output on http://pastebin.com/f7ab657ef) Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" compat = "no" } /etc/raddb/users[2]: Parse error (check) for entry DEFAULT: Unknown value DOM1 for attribute Autz-Type Errors reading /etc/raddb/users /etc/raddb/modules/files[7]: Instantiation failed for module "files" Did I miss something? Regards, Fajar

3 4

PEAP test fails using eapol_test
by Bo Nygaard Bai 31 Mar '09

31 Mar '09

I have spend more than a week, trying every hint i could extract from google. But I am still unable to get a working PEAP setup. Could someone please point out my glaringly obvious mistake. Versions: freeradius built from 2.1.4 source (but it reports 2.1.5 on start!) eapol_test from wpa_supplicant-0.6.9 I am trying to perform PEAP with MSCHAPV2. eapol_test (wpa_supplicant-0.6.9) configuration: network={ eap=PEAP eapol_flags=0 key_mgmt=IEEE8021X identity="testuser" password="password" ca_cert="ca.pem" phase2="auth=MSCHAPV2" anonymous_identity="anonymous" } ./eapol_test -c eapol_test.conf.peap -a130.225.51.102 -p1812 -stesting123 -r1 eapol_test.log <http://kom.aau.dk/%7Ebai/wpa/eapol_test.log> radiusd -X radiusd.log <http://kom.aau.dk/%7Ebai/wpa/radiusd.log> Troubled spost seem to be: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Do i have to create an entry in users for the anonymous user? [peap] FAIL: Forcibly stopping session resumption as it is not allowed. This seems to happen after successful mschapv2 trough the tunnel. Any help will be appreciated! /Bo Bai

2 1

MySQL and PEAP not talking
by Doe Hoe 31 Mar '09

31 Mar '09

Hi. I'm quite a newbie, so please keep it simple. I have been fighting with this for the past 10 hours! I am trying to do PEAP authentication (without certificates) where a client (Windows XP/Vista) gains WPA wi-fi access with a username and password using FreeRADIUS (v2.1.4) as the RADIUS server on Ubuntu Linux 8.10. I have gotten as far as compiling FreeRADIUS with SSL/TLS support and getting a Windows client to gain WPA access where his username/pass is in the "/etc/freeradius/users" file. I'm not interested in doing any LDAP or Active Directory stuff (don't want to use ntlm_auth), so obviously "MS-CHAP-Use-NTLM-Auth := No" was included with the user/pass in the "/etc/freeradius/users" file. And as I said, the client could gain Wi-fi WPA access using PEAP authentication. However, I would like to manage usernames and passwords in a MySQL database. The relevant part of the MySQL schema that I have been trying is as follows: radcheck (id,username,attribute,op,value) radreply (id,username,attribute,op,value) I have configured FreeRADIUS to talk to MySQL using various tutorials on the internet and have confirmed this works with the "radtest" shell command (I get an accept-accept back for any users in the "radcheck" table. So to try do it with PEAP authentication I inserted the following in the tables. INSERT INTO radcheck (username,attribute,op,value) VALUES ('user1','Cleartext-Password',':=','pass1') INSERT INTO radreply (username,attribute,op,value) VALUES ('user1','MS-CHAP-Use-NTLM-Auth',':=','No') Note how I have included "MS-CHAP-Use-NTLM-Auth := No" as a reply attribute. But, no matter what I do, this does not allow a client to authenticate. freeradius debug (with -X switch) gives me the following (I've only included the parts which I think are relevant: .................. [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user8' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok .................. EAP-Message = 0x0108001f1a0108001a1025124f5e6a8bc7778687e657b729c16b7573657238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x31f7332531ff293ae0350b28678bf4db [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0108001f1a0108001a1025124f5e6a8bc7778687e657b729c16b7573657238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x31f7332531ff293ae0350b28678bf4db [peap] Got tunneled Access-Challenge ++[eap] returns handled ................... [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for user1 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. .................. The parts that gives away the fact that the "MS-CHAP-Use-NTLM-Auth := No" is not being read from the database: 1) no users are found in the "SELECT FROM radreply" query 2) underneath "[peap] Got tunneled reply code 11" there is no "MS-CHAP-Use-NTLM-Auth := No" as there is when a user is authenticated from the "users" file. 3) The fact that I cannot get the client to gain access! I really don't know what to do from this point. I haven't included any of my freeradius configuration files because I really don't know which ones to include. So if you want to see them just let me know which ones you want. Thanks in advance Doron

3 6

Meaning of errormessage?
by Tom Schmitt 31 Mar '09

31 Mar '09

Hi, i use an old version of freeradius, 1.1.2. And yes, I will upgrade to a new version soon. But for now I have a question regarding a few errormessages I see in my logfile. Maybe someone caould help me to understand them. I use EAP with TSL to authenticate clients which are sending their certificate which are installed on each client and I have on my Radiusserver the root certificate to verify them. It is working, the clients are authenticated and happy, but in the logfile of the Radiusserver I see each time the following messages: > Wed Mar 25 16:49:53 2009 : Error: TLS_accept:error in SSLv3 read client certificate A > Wed Mar 25 16:49:53 2009 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > Wed Mar 25 16:49:54 2009 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > Wed Mar 25 16:49:54 2009 : Auth: Login OK: [host/client01.example.com] (from client WLANCONTROLLER nasid WLANCONTROLLER port 29 cli 00-23-34-35-36-36) As I understand the first lines, the Radiusserver can't read the certificate. But if this is true, how the hell could the Login be OK? Without certificate the Authentication should fail, shouldn't it? But if the certificates are okay, what is the meaning of the errormessages? Sorry if this is trivial for some of you, but I really have no idea what to do with this. Tom. -- Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 1

Storing Realms on database
by Giovanni Lovato 30 Mar '09

30 Mar '09

Currently we store realms on a SQL database and a cron script updates proxy.conf. This is ugly and unstable due to the required restart of FreeRADIUS. There is a native method to store Realms on a SQL database like users, groups, clients, ip pools and huntgroups?

2 1

Trouble with PPTP & FreeRadius
by Mike Diggins 30 Mar '09

30 Mar '09

I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening? VPN logs from my failing PPTP connection: Mar 27 15:03:30 macvpn-inside 13885796 03/27/2009 15:03:30.520 SEV=4 PPTP/47 RPT=37605 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:03:30 macvpn-inside 13885797 03/27/2009 15:03:30.590 SEV=4 PPTP/42 RPT=37421 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:03:33 macvpn-inside 13885798 03/27/2009 15:03:33.800 SEV=5 PPP/8 RPT=33514 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:03:33 macvpn-inside 13885799 03/27/2009 15:03:33.890 SEV=4 PPTP/35 RPT=37406 76.64.100.68 Session closed on tunnel 76.64.100.68 (peer 0, local 61694, serial 44796), reason: User request (No additional info) FreeRadius debug log of failed connection: Ready to process requests. rad_recv: Access-Request packet from host 172.26.69.8 port 1479, id=77, length=146 User-Name = "test26" NAS-Port = 8057 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "76.64.100.68" MS-CHAP-Response = 0x02010000000000000000000000000000000000000000000000002f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 MS-CHAP-Challenge = 0x5e0b3b68c24784e0 NAS-IP-Address = 172.26.69.8 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test26", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=test26 [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 [mschap] mschap1: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=5e0b3b68c24784e0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 Exec-Program output: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program-Wait: plaintext: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program: returned: 0 ++[mschap] returns ok Login OK: [test26] (from client macvpn port 8057) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 77 to 172.26.69.8 port 1479 Finished request 5. Going to the next request And my VPN logs from a working connection (ciscosecure radius): Mar 27 15:08:11 macvpn-inside 13886204 03/27/2009 15:08:11.640 SEV=4 PPTP/47 RPT=37606 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:08:11 macvpn-inside 13886205 03/27/2009 15:08:11.710 SEV=4 PPTP/42 RPT=37422 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:08:14 macvpn-inside 13886215 03/27/2009 15:08:14.920 SEV=5 PPP/8 RPT=33515 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:08:17 macvpn-inside 13886216 03/27/2009 15:08:17.790 SEV=5 PPP/49 RPT=33002 76.64.100.68 User [test26] IPCP assigned IP Address 172.26.94.7 Mar 27 15:08:17 macvpn-inside 13886217 03/27/2009 15:08:17.790 SEV=4 AUTH/22 RPT=354231 76.64.100.68 User [test26] Group [Base Group] connected, Session Type: PPTP -Mike

4 11

Rp-speed limit help
by Mordor Networks 30 Mar '09

30 Mar '09

Hi , i added RP-upsteam-speed-limit and RP-down-speed-limit attributes to my freeradius and i can see the outout with radiusd -X Sending Access-Accept of id 250 to 127.0.0.1 port 37116 Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1492 Session-Timeout = 43200 Idle-Timeout = 1200 Port-Limit = 1 RP-Upstream-Speed-Limit := 128 RP-Downstream-Speed-Limit := 128 Finished request 3 but i cannt see RP-Upstream-Speed-Limit := 128 RP-Downstream-Speed-Limit := 128 in /var/run/radattr.pppX for example cat /var/run/radattr.ppp13 Framed-Protocol PPP Framed-IP-Address 255.255.255.254 Framed-IP-Netmask 255.255.255.255 Framed-MTU 1492 Session-Timeout 43200 Idle-Timeout 1200 Port-Limit 1 anyone can help me with this issue please regards

2 4

pam -- how to handle reply attributes
by krishna Mohan 30 Mar '09

30 Mar '09

Hi,I wrote my PAM module (to authenticate a user against Sun AM) for freeRadius and that part is working fine. Now, the PAM module will receive few response attributes from the authenticating application for each user, for whom the authentication is success.How to receive this kind of application specific attributes and how to insert them in Radius-Accept packet? This is an urgent requirement for me.Appreciating your helpThanks,Sri.

2 1

RE: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, Never mind i figure out my problem. I add this line in my configuration: ldap { notfound = reject } So if user is not in my ldap. Then its rejected. Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Ville Leinonen Sent: Mon 30/03/2009 14:36 To: freeradius-users(a)lists.freeradius.org Subject: Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem. Hi, Maybe im not started this post clearly. So i try open again what i want to do. I have a computer certificates. I also have openldap and that ldap includes my computer accounts. Now I want to use those certificates to authenticate computers and get authorization information inside my ldap. If computers dont have account in my ldap it's rejected. But if i put only ldap in my authorization section radius gives: "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" If i put also eap in authorization section, the radius uses eap for authorization and give access-accept. Even if user not found in ldap. Br, Ville >Here is some other logs if i use only ldap for authorize section: > >You have butchered the configuration and now you are wondering why it's >not working? If you don't know what you are doing - don't do it. If >you feel the urge to disable something (disbling unused modules is >hardly going to make any impact on preformance) get things working first >- than remove things you feel you must one by one. If you remove >something vital you will know what it was and will be able to put it >back. >Use default configuration. Configure *only* ldap module. Don't make >*any* changes to virtual servers (authorize, authenticate etc.). And it >will work. >Ivan Kalik >Kalik Informatika ISP

1 0