- Freeradius-Users - lists.freeradius.org

Re: FreeRadius only works in debug mode
by Greg.Webster＠westfraser.com 18 Mar '09

18 Mar '09

Thanks for the thoughts on this...it looks like the permissions on those directories are all good: # ls -al /var/log/radius/ total 10 drwx------ 3 radiusd radiusd 128 Mar 12 14:54 . drwxr-xr-x 13 root root 1552 Mar 17 11:36 .. drwx------ 2 radiusd radiusd 48 Apr 23 2008 radacct -rw-r--r-- 1 radiusd radiusd 5150 Mar 17 11:51 radius.log -rw-r--r-- 1 radiusd radiusd 0 Apr 23 2008 radutmp # ls -al /tmp drwxrwxrwt 9 root root 616 Mar 18 08:54 . # ls -al /etc/raddb/ total 208 drwxr-xr-x 3 root root 664 Mar 12 16:11 . drwxr-xr-x 83 root root 7072 Mar 17 11:33 .. -rw-r--r-- 1 root radiusd 422 Apr 23 2008 acct_users -rw-r--r-- 1 root radiusd 4074 Apr 23 2008 attrs drwxr-x--- 3 root radiusd 472 Mar 12 14:41 certs -rw-r----- 1 root radiusd 2937 Apr 23 2008 clients.conf -rw-r--r-- 1 root radiusd 929 Apr 23 2008 dictionary -rw-r----- 1 root radiusd 9332 Apr 23 2008 eap.conf -rw-r----- 1 root radiusd 4620 Apr 23 2008 example.pl -rw-r--r-- 1 root radiusd 2396 Apr 23 2008 hints -rw-r--r-- 1 root radiusd 1604 Apr 23 2008 huntgroups -rw-r--r-- 1 root radiusd 2333 Apr 23 2008 ldap.attrmap -rw-r----- 1 root radiusd 9330 Apr 23 2008 mssql.conf -rw-r----- 1 root radiusd 856 Apr 23 2008 naspasswd -rw-r--r-- 1 root radiusd 7316 Apr 23 2008 otp.conf -rw-r----- 1 root radiusd 1396 Apr 23 2008 otppasswd.sample -rw-r----- 1 root radiusd 14467 Apr 23 2008 postgresql.conf -rw-r----- 1 root radiusd 1039 Apr 23 2008 preproxy_users -rw-r----- 1 root radiusd 8834 Apr 23 2008 proxy.conf -rw-r--r-- 1 root radiusd 64646 Mar 12 16:06 radiusd.conf -rw-r----- 1 root radiusd 1405 Apr 23 2008 snmp.conf -rw-r----- 1 root radiusd 14173 Apr 23 2008 sql.conf -rw-r----- 1 root radiusd 6974 Mar 12 14:54 users So, unless there's another location that the radiusd user needs access to? I've verified that the service is definitely running as radiusd. I also looked up the possibility of the selinux protection and it's not set up at all on this system. Other thoughts? I'm stumped on this one. Thanks, Greg A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, > > > when run in debug, it runs with greater privs - check your eg /var/log/radius > directory, your used tmp directories, /etc/raddb etc for their permissions - does the > user/group you have defined in radiusd.conf have relevant read/write permissions > > other common issue is eg selinux daemon/service protection > > alan ---------------------------- This e-mail message and any attachments are confidential. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. If you are not the intended recipient, please notify me by return e-mail, do not open any attachment and delete this communication and any copy. Thank you

2 1

radclient:: Failed to find IP address for dhcppc0
by vnsquall 18 Mar '09

18 Mar '09

Hi everyone, i'm a newbie for configuring radius and i have some problems when i try to use radtest to test the freeradius-server-2.1.3. I have installed by following commands: $ ./configure --prefix=/usr/local/freeradius $ make $ make install Everything is OK and i type: [root@localhost ~]# /usr/local/freeradius/sbin/radiusd -X .................................. .................................. radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. After that, on another shell command, i try to test with radtest: /usr/local/freeradius/bin/radtest test test 127.0.0.1 0 testing123 radclient:: Failed to find IP address for dhcppc0 radclient: Nothing to send. I try to test with ping command: [root@dhcppc0 ~]# ping 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.046 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.046 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.050 ms 64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.044 ms ^C --- 127.0.0.1 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 0.044/0.046/0.050/0.007 ms -All the others conf file is the default setting. Thank you for any try to help me!!!! -- View this message in context: http://www.nabble.com/radclient%3A%3A-Failed-to-find-IP-address-for-dhcppc0… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: FreeRadius 2.0.5... canŽt make it work
by Jan Strauch 18 Mar '09

18 Mar '09

Many thanks There have been quite a few changes since 1.0.2. Now the clients are loaded from the nas-table. The logins are looked up in the DB too, but not working. IŽll be back if I canŽt fix it by myself. Jan > -----Ursprüngliche Nachricht----- > Von: <tnt(a)kalik.net> > Gesendet: 18.03.09 16:38:55 > An: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Betreff: Re: FreeRadius 2.0.5... canŽt make it work > >terminal 1 : radiusd -X gives me : > > > .. > >radiusd: #### Instantiating modules #### > > instantiate { > > Module: Linked to module rlm_exec > > Module: Instantiating exec > > exec { > > wait = no > > input_pairs = "request" > > shell_escape = yes > > } > > Module: Linked to module rlm_expr > > Module: Instantiating expr > > Module: Linked to module rlm_expiration > > Module: Instantiating expiration > > expiration { > > reply-message = "Password Has Expired " > > } > > Module: Linked to module rlm_logintime > > Module: Instantiating logintime > > logintime { > > reply-message = "You are calling outside your allowed timespan " > > minimum-timeout = 60 > > } > > } > .. > > ... but 127.0.0.1 is not unknown > > Yes, it is unknown. > > > >sql.conf : readclients = yes > >clients.conf : completely commented out > > As are many other things. sql among them. > > > > >mysql> select * from nas order by id desc limit 1; > >+----+-----------+-----------+--------+-------+--------+-----------+-------------+ > >| id | nasname | shortname | type | ports | secret | community | description | > >+----+-----------+-----------+--------+-------+--------+-----------+-------------+ > >| 56 | 127.0.0.1 | localhost | MikTik | NULL | test | NULL | NULL | > >+----+-----------+-----------+--------+-------+--------+-----------+-------------+ > >1 row in set (0.00 sec) > > > >What do I do wrong ? > > You haven't listed sql anywhere. So, the server is not reading nas > table. Even if it did read it - you haven't got any authentication > modules enabled. Go back to default configuration, add sql in > instantiate in radiusd.conf - and watch it work. Then make *small* > changes to configuration files. When you break something you will know > what you have done. Butchering configuration blindly like this can end > only one way - failure. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > _______________________________________________________________________ Aufgepasst: Sind Ihre Daten beim Online-Banking auch optimal geschützt? Jetzt absichern: https://homebanking.web.de/?mc=mail@footer.hb

1 0

FreeRadius 2.0.5... canŽt make it work
by Jan Strauch 18 Mar '09

18 Mar '09

Hello world ! I try to set up a new FR-server (v2.0.5). I lost 4 days until now and it still does not work. It just generates amounts of output without accepting anything: terminal 1 : radiusd -X gives me : FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Oct 9 2008 at 16:13:43 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/snmp.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = yes max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. terminal 2 : radtest test test localhost 0 test Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.2 NAS-Port = 0 radclient: no response from server for ID 178 socket 3 Parallel on terminal 1 : Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 59802 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 59802 Ready to process requests. ... ... but 127.0.0.1 is not unknown sql.conf : readclients = yes clients.conf : completely commented out mysql> select * from nas order by id desc limit 1; +----+-----------+-----------+--------+-------+--------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+-----------+-----------+--------+-------+--------+-----------+-------------+ | 56 | 127.0.0.1 | localhost | MikTik | NULL | test | NULL | NULL | +----+-----------+-----------+--------+-------+--------+-----------+-------------+ 1 row in set (0.00 sec) What do I do wrong ? This thing does not care what I configure, it always does the same, nothing. I have sqltrace = yes, but after days of trying there is no sqltrace.sql on the server (yes I made updatedb) there is nearly nothing in the log, but I configured it to log everything (good-auth, bad-auth, etc) All this worked best with FR 1.x.x. Please help thx _______________________________________________________________________ Aufgepasst: Sind Ihre Daten beim Online-Banking auch optimal geschützt? Jetzt absichern: https://homebanking.web.de/?mc=mail@footer.hb

3 2

LDAP Config Clarification
by Jason Frisvold 18 Mar '09

18 Mar '09

Hi all, I recently set up a new freeradius installation for VPN authentication. This is my first foray into using the LDAP module and, while I am successfully authenticating, I want to make sure that my config is both correct and streamlined. I am seeing a few failed authentications due to loss of LDAP connections, so I'm also trying to identify where that problem exists. The radius server is currently very low use, handling only a few requests an hour. This may increase later on, but I don't see it having to handle more than a few requests per minute. However, I would like to make sure those requests are handled efficiently and quickly. The current radius ldap config looks like this : modules { ldap { server = "ldap.example.com" port = 636 identity = "cn=manager,o=MyOrg" password = MySuperSecretPassword basedn = "o=MyOrg" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "memberOf" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))" groupmembership_attribute = memberOf net_timeout = 1 timeout = 8 timelimit = 3 } } In our users file, we have the following : DEFAULT Auth-Type := Reject Fall-Through = 1 DEFAULT Ldap-Group == "cn=vpn,ou=groups,o=myorg", Auth-Type := Accept Fall-Through = 1 DEFAULT Ldap-Group == "cn=admin,ou=groups,o=myorg" Class = ADMIN, Fall-Through = 1 DEFAULT Ldap-Group == "cn=user,ou=groups,o=myorg" Class = USER, Fall-Through = 1 Essentially, we want to assign a user to a specific class based on what group they are in, with some groups superseding others. Our LDAP entries have multiple memberOf attributes that list the groups a user is in, as well as groups that list the members. I was able to get this to work, but it appears that every group is scanned to find the user rather than merely using the memberOf attribute in the main LDAP record. Is there a way to trigger on that rather than scanning the groups? Note: The dictionary mapping file (ldap.attrs) is the default one, I have made no changes. With respect to the users file, I believe I can remove the Fall-Through parameter there for all but the vpn LDAP group. That would cut down, somewhat, on the group scanning. In the main radius config, can I remove all of the unused modules? I don't believe we're using PAP/CHAP/MS-CHAP at all, nor are we using the unix passwd file or EAP. Those can all be commented out to save time/resources, correct? And finally, can someone give me a few hints on how to identify the cause of the "LDAP connection lost" messages we see? They seem to be intermittent and I am unable to find a cause for them. The network is stable and there is no loss of connectivity at the lower layers. I believe radius is sending keepalives, correct, so a loss of connectivity could indicate keepalives being lost? Any help is appreciated! Thanks! If there's any additional information I can provide that would help, please let me know. -- --------------------------- Jason Frisvold xenophage0(a)gmail.com --------------------------- "I love deadlines. I like the whooshing sound they make as they fly by." - Douglas Adams

3 7

gigawords and bandwith
by Lars 18 Mar '09

18 Mar '09

Hi, i'm new here and i need your help in the following 2 points. Point 1: Acct-Input/Output-Gigawords Point 2: Bandwithlimit with PPP and PPPoE My system: debian with kernel 2.6.8-2-386, Roaring Penguin PPPoE Version 3.10, PPP 2.4.4 (not quit sure) and MySQL 4.1.10a. Point 1) After I recognized that the accounting data (acct-input/output-octet) will set to zero if the user downloaded more than 4 GB I added to sql.conf and to table radacct the parameter acct-input/output-gigawords. But It won't be filled with data, it's always zero. The sql statements look like this ({acct_table1} and {acct_table2} are both radacct) accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE ${acct_table2} \ SET AcctStopTime = '%S', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', \ AcctTerminateCause = '%{Acct-Terminate-Cause}', \ AcctStopDelay = '%{Acct-Delay-Time}', \ ConnectInfo_stop = '%{Connect-Info}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT into ${acct_table2} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, \ NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, \ AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, \ AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, \ ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', \ DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), \ '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', \ '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" accounting_update_query_alt = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, \ NASPortId, NASPortType, AcctStartTime, AcctSessionTime, \ AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, \ CalledStationId, CallingStationId, ServiceType, FramedProtocol, \ FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', \ DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), \ '%{Acct-Session-Time}', '%{Acct-Authentic}', '', \ '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', \ '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', \ '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" Point 2) I have to limit the user's bandwith so I think about a simple possibility to do that. The best way imho would be an additional entry in "radreplay" for this user. I want to limit on the pppoe-server machine not at the user placed equipment. Is it possible? And if yes: How? Regards Lars

1 0

Re: MS-CHAP2 Failure
by Mike Diggins 18 Mar '09

18 Mar '09

I've made no progress in finding a solution to my MSCHAP problem. To summarize, Winbind and FreeRadius authenticate via PAP fine on both servers (RedHat V5), but MSCHAP fails on one of the two (see below). I tried tar'ing up the entire /etc/raddb directory and copied it to the other machine, but it still fails. I also rejoined the Windows domain, but nothing is working. Does MSCHAP have any other dependency on the system, that PAP doesn't? I don't know where else to look. -Mike On Mon, 16 Mar 2009, Mike Diggins wrote: > > I configured what I thought were two identical FreeRadus 2.1.3 servers. I'm > attempting to do MS-CHAP2 authentication on both, one is working, the other > is not. For the life of me I can't find any difference in their > configuration. > > On my client, I switch the host name between the two servers, everything else > stays the same. One works, one fails, and I don't know why. Below is the > debug output for both the failure and success. PAP authentication works fine > on both with the same id. What the heck have I missed? > > This is the one that fails: > > rad_recv: Access-Request packet from host 192.168.2.15 port 2357, id=26, > length=127 > NAS-Identifier = "test-cam1" > NAS-IP-Address = 192.168.2.15 > MS-CHAP-Challenge = 0xbd4261d677c0d793ee781d7a032218df > MS-CHAP2-Response = > 0xa300ac9567587df3e83b3799dc49a53f433000000000000000007e0e6320a093349fbd0afc94436ed32e1258e26c5463147b > User-Name = "test26" > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > ++[mschap] returns ok > [suffix] No '@' in User-Name = "test26", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > [files] users: Matched entry DEFAULT at line 5 > ++[files] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = MSCHAP > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Told to do MS-CHAPv2 for test26 with NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect > ++[mschap] returns reject > Failed to authenticate the user. > Login incorrect: [test26] (from client 192.168.2.15 port 0) > Using Post-Auth-Type Reject > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> test26 > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 7 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 7 > Sending Access-Reject of id 26 to 192.168.2.15 port 2357 > Waking up in 4.9 seconds. > Cleaning up request 7 ID 26 with timestamp +1885 > Ready to process requests. > > > This one works: > > rad_recv: Access-Request packet from host 192.168.2.15 port 2358, id=115, > length=127 > NAS-Identifier = "test-cam1" > NAS-IP-Address = 192.168.2.15 > MS-CHAP-Challenge = 0xfdd0ccd7059225f80093cea2929eb415 > MS-CHAP2-Response = > 0x780017ff811e7761fc6bd332fb45f4f6b3f50000000000000000b6834efb6626804caf2aa055c5a157851e9bc927698cf23f > User-Name = "test26" > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > ++[mschap] returns ok > [suffix] No '@' in User-Name = "test26", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[unix] returns notfound > [files] users: Matched entry DEFAULT at line 5 > ++[files] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = MSCHAP > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Told to do MS-CHAPv2 for test26 with NT-Password > [mschap] expand: --username=%{mschap:User-Name:-None} -> > --username=test26 > [mschap] No NT-Domain was found in the User-Name. > [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 > [mschap] mschap2: fd > [mschap] expand: --challenge=%{mschap:Challenge:-00} -> > --challenge=cc26ba941d6d9678 > [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> > --nt-response=b6834efb6626804caf2aa055c5a157851e9bc927698cf23f > Exec-Program output: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B > Exec-Program-Wait: plaintext: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B > Exec-Program: returned: 0 > ++[mschap] returns ok > Login OK: [test26] (from client 192.168.2.15 port 0) > +- entering group post-auth {...} > ++[exec] returns noop > Sending Access-Accept of id 115 to 192.168.2.15 port 2358 > MS-CHAP2-Success = > 0x78533d41453631324635393130344535373132364133414234374339463844443541453538384142453943 > Finished request 5. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 5 ID 115 with timestamp +1773 > Ready to process requests. > > -Mike > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

5 7

Relaying of accounting requests between Freeradius servers
by Patric 18 Mar '09

18 Mar '09

Greetings list, I have finally been able to upgrade my secondary freeradius server to 2.1.3 and I must commend everyone on their hard work, the changes are great :) I am having some trouble but would like to clarify my understanding before posting all my problem details in case I have misunderstood something. My question is independent of server or platform version and addresses the fundamental mechanics of the relaying process. I am using a virtual server setup to proxy accounting requests between 2 servers for mirroring purposes. As I understand the process server 1 receives an accounting request, which it will process according to its accounting section (in my case inserted into a table via the sql module). If successful, it will then proxy the request to server 2, which will also process it according to its own accounting section. Server 2 will then attempt to proxy the request to server 1 as per its proxy configuration, but will fail on a duplicate record, which will stop duplication from occuring. Is my understanding in this correct, that server 1 will send the request to server 2, and server 2 will try to send it to server 1 again but will fail with a duplication error? Many thanks Patric

5 10

configuring eap2
by Leonid Sigal 18 Mar '09

18 Mar '09

Hello, could some one with a such experience to provide a STEP BY STEP procedure to configure eap2 module: which configuration files have to be update and how ? Thanks in advance, Leonid.

2 1

FreeRadius only works in debug mode
by Greg.Webster＠westfraser.com 17 Mar '09

17 Mar '09

Hello all, My other email to the list from last week appears to have disappeared into the ether...probably too big with the whole config file. Hopefull someone can offer advice on this issue. If I start up radiusd (on SuSE/OES linux, install from Yast) with the standard script in init.d it doesn't open up the port or authenticate. However, if I add the debug parameter (-x) to that same script, it works just fine. For example, if I change this line in /etc/init.d/radiusd ... startproc $RADIUSD_BIN > /var/log/radius/radius.log ... to this ... startproc $RADIUSD_BIN -x > /var/log/radius/radius.log ... it authenticates beautifully. Googling around it looks like I'm not the only one with this problem, but the only solution seems to be a manual recompile. Help? Thanks in advance! Greg Webster ---------------------------- This e-mail message and any attachments are confidential. Any dissemination or use of this information by a person other than the intended recipient is unauthorized. If you are not the intended recipient, please notify me by return e-mail, do not open any attachment and delete this communication and any copy. Thank you

2 1