- Freeradius-Users - lists.freeradius.org

bugs.freeradius.org unavailable?
by Bjørn Mork 12 Mar '09

12 Mar '09

Is it just me, or has bugs.freeradius.org died? I've tried from two different local ISPs without any luck. bjorn@canardo:~$ telnet bugs.freeradius.org 80 Trying 64.24.234.95... telnet: Unable to connect to remote host: Connection timed out bjorn@canardo:~$ traceroute bugs.freeradius.org traceroute to bugs.freeradius.org (64.24.234.95), 30 hops max, 40 byte packets 1 ti0036a380-l1.ti.telenor.net (88.88.0.180) 8.133 ms 10.113 ms 12.467 ms 2 ti0001d320-ge0-1-4-10.ti.telenor.net (146.172.83.41) 15.125 ms 17.632 ms 20.250 ms 3 ti0001c310-xe7-1-1.ti.telenor.net (146.172.98.145) 70.634 ms 71.198 ms 71.574 ms 4 ti3004c310-ae5-0.ti.telenor.net (146.172.100.53) 65.706 ms 68.951 ms 71.912 ms 5 ti3003c310-ae4-0.ti.telenor.net (146.172.100.46) 73.231 ms 75.950 ms 78.359 ms 6 ti9002b300-ae0-0.ti.telenor.net (146.172.105.38) 80.615 ms 75.509 ms 76.336 ms 7 xe-0-3-0.cr1.lhr1.uk.nlayer.net (195.66.224.37) 76.788 ms 76.429 ms 76.588 ms 8 xe-2-2-0.cr1.nyc3.us.nlayer.net (69.22.142.9) 140.652 ms 104.673 ms 105.095 ms 9 xe-2-1-0.cr2.ord1.us.nlayer.net (69.22.142.6) 125.930 ms 165.239 ms 165.139 ms 10 111.xe-3-3-0.cr2.ord1.us.scnet.net (216.246.88.146) 132.910 ms 134.031 ms 133.772 ms 11 v21.ar1.ord1.us.scnet.net (216.246.95.243) 135.433 ms 135.307 ms 135.239 ms 12 as6316.ge1-37.ar1.ord1.us.scnet.net (216.246.92.138) 136.447 ms 135.575 ms 135.738 ms 13 sch1-core1-s1-0.starnetusa.net (216.126.145.46) 137.034 ms 126.885 ms 127.757 ms 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 *^C bjorn@canardo:~$ telnet -b 84.215.114.143 bugs.freeradius.org 80 Trying 64.24.234.95... telnet: Unable to connect to remote host: Connection timed out bjorn@canardo:~$ traceroute -s 84.215.114.143 bugs.freeradius.org traceroute to bugs.freeradius.org (64.24.234.95), 30 hops max, 40 byte packets 1 10.234.0.1 (10.234.0.1) 91.665 ms 91.640 ms 92.866 ms 2 cm-84.208.4.126.getinternet.no (84.208.4.126) 92.968 ms 95.435 ms 95.529 ms 3 cm-84.208.26.1.getinternet.no (84.208.26.1) 95.505 ms 95.551 ms 95.544 ms 4 cm-84.208.26.6.getinternet.no (84.208.26.6) 92.866 ms 92.827 ms 95.060 ms 5 64.213.76.97 (64.213.76.97) 99.490 ms 100.178 ms 100.262 ms 6 xe-4-0-0.cr1.nyc2.us.nlayer.net (69.31.95.229) 202.685 ms 118.586 ms 118.625 ms 7 xe-4-2-0.cr1.ord1.us.nlayer.net (69.22.142.85) 159.379 ms 150.007 ms 150.088 ms 8 111.xe-3-3-0.cr1.ord1.us.scnet.net (216.246.88.162) 137.391 ms 138.172 ms 138.256 ms 9 v21.ar1.ord1.us.scnet.net (216.246.95.243) 138.306 ms 138.322 ms 138.260 ms 10 as6316.ge1-37.ar1.ord1.us.scnet.net (216.246.92.138) 138.349 ms 142.180 ms 142.210 ms 11 sch1-core1-s1-0.starnetusa.net (216.126.145.46) 142.238 ms 142.226 ms 142.263 ms 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 *^C The reason for wanting to access bugs.freeradius.org is a small dictionary patch I have. I assume the correct procedure still is opening a bug and attaching the patch? Bjørn

2 1

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 11 Mar '09

11 Mar '09

Hi Ivan, I used wireshark and didn't see anything referred about Account Packages. Only thing I see is Radius-Access Resquest, Access Challenges and Access Accept. Below are informations from my Zinwell G220 Plus, but away, o receibe an error as you see. Do you know what mean? Jan 1 18:55:16 wlan0: A wireless client is associated - 00:16:CF:B3:81:4E Jan 1 18:55:17 wlan0: WPA-TKIP RADIUS authentication in progress... Jan 1 18:55:27 wlan0: Authentication failled! (4-2: ERROR_NONEEQUL_REPLAYCOUNTER) Jan 1 18:55:28 wlan0: Open and authenticated Jan 1 18:56:47 wlan0: A wireless client is deauthenticated - 00:16:CF:B3:81:4E Jan 1 18:56:59 wlan0: A wireless client is associated - 00:16:CF:B3:81:4E Jan 1 18:56:59 wlan0: WPA-TKIP RADIUS authentication in progress... Jan 1 18:57:09 wlan0: Authentication failled! (4-2: ERROR_NONEEQUL_REPLAYCOUNTER) Jan 1 18:57:10 wlan0: Open and authenticated Here is my radius . rad_recv: Access-Request packet from host 192.168.1.20:1024, id=114, length=229 User-Name = "leo" NAS-IP-Address = 192.168.1.20 NAS-Port = 0 Called-Station-Id = "00059e887861" Calling-Station-Id = "0016cfb3814e" NAS-Identifier = "ZPlus AP" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700501900170301002087c1a68cee5e03e609b11b139ced4a1e1aac47b5519ace27d5598fa118de8177170301002019b9c21c89dac32bc991955f2eef609c8b1080b69fcb1adff8c5573546fc6cb7 State = 0xfa58367a8e0b8dd7abe16b9498e1d636 Message-Authenticator = 0x3f71351c1f04c73b0a85847aa94352b8 Thanks > >So, I'm very newer with linux also freeradius. If you permit, how can I see if the NAS send the account package? I'm using a ZINWELL G220 Plus and TP LInk WA501G. > > First run freeradius in debug mode (radiusd -X). If you don't see > accounting packets use wireshark. If wireshark can't see them check if > you have enabled accounting on your AP. > > Ivan Kalik > Kalik Informatika ISP _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

2 1

accounting manipulation
by Alexandre Chapellon 11 Mar '09

11 Mar '09

I have a working freeradius2 setup, in which I proxy accounting tickets to many home_servers using details file writing and detail listeners. For one of this home_server (let's call it HS1) I want to rewrite the Acct-(In|Out)put-Octets and Acct-(|n|Out)put-Gigawords with a value* taken from another home_server (let's call it HS2). I thought I could you use the perl module to do the math in the pre-proxy section of my HS1 Vhost, but i realised i have to ensure rewriting of attributes have to be done after and only after proxying accounting to HS2... Teh problem remains in the fact proxying to HS2 and proxing to HS1 are two separates virtualhosts... how can i ensure proxying to HS1 (and so attribute rewriting) will be done only after proxying to HS2? I am not a perl guru (either) is it possible to update attrbutes using rlm_perl? how? (the wiki dind't told me much about it) * Actually, the value should be the result of snmp or sql or else done on HS2... with math operation done on it to get the new Acct-(In|Out)put-Octets and Acct-(|n|Out)put-Gigawords values.... OMG i'm not sure it's very clear!

1 0

Re: radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol
by Peter Param 11 Mar '09

11 Mar '09

>You have two different versions of OpenSSL installed. Thanks for that Alan. I've blown everything away and started from scratch and installed openssl 0.98j and used the following freeradius configuration: ./configure --bindir=/usr/bin \ --sbindir=/usr/sbin \ --sysconfdir=/etc \ --localstatedir=/var \ --libdir=/usr/lib \ --includedir=/usr/include \ --with-radacctdir=/var/log/freeradius/radacct \ --with-raddbdir=/etc/freeradius \ --with-openssl-includes=/usr/local/openssl/include \ --with-openssl-libraries=/usr/local/openssl/lib ...but I'm getting the following configuration errors even tho the libraries and includes (and header files mentioned) are in the right places. Can these errors be ignored? (a make file was successfully created) checking openssl/des.h presence... no configure: WARNING: openssl/des.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/des.h: proceeding with the compiler's result checking for openssl/des.h... yes checking openssl/hmac.h usability... yes checking openssl/hmac.h presence... no configure: WARNING: openssl/hmac.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/hmac.h: proceeding with the compiler's result checking for openssl/hmac.h... yes checking openssl/md4.h usability... yes checking openssl/md4.h presence... no configure: WARNING: openssl/md4.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/md4.h: proceeding with the compiler's result checking for openssl/md4.h... yes checking openssl/md5.h usability... yes checking openssl/md5.h presence... no configure: WARNING: openssl/md5.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/md5.h: proceeding with the compiler's result checking for openssl/md5.h... yes checking openssl/sha.h usability... yes checking openssl/sha.h presence... no configure: WARNING: openssl/sha.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: openssl/sha.h: proceeding with the compiler's result checking for openssl/sha.h... yes configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-libs. cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

FreeRADIUS 2.1.4 on FreeBSD 7.0
by Aldo Zavala 11 Mar '09

11 Mar '09

Hello, I just would like to know if there are some hints for compiling the FreeRADIUS 2.1.4 on the FreeBSD 7.0, should I compile it with the GNU gmake? what tips can share with me on this? Thanks, Aldo

2 1

Log says "duplicate requests", CPU maxing out
by Chhaya, Harshal 11 Mar '09

11 Mar '09

Thanks to Alan, we are now running freeRADIUS 2.1.3 on our embedded network controller. The problem is that now it is less stable than the 1.1.7 version we had been using. Again, I am sure our config is screwed up. For example, the 'radius.log' file contains dozens of files saying: Error: Discarding duplicate request from client test-net port NNNN - ID: XX due to unfinished request YYY The client.conf file has this entry: client 192.168.0.232/24 { secret = testing123 shortname = test-net } The config uses a flat file with uernames and cleartext passwords. There is no SQL database in the backend. Also, when we have 40+ clients attempting to connect to RADIUS, the CPU utilization reaches 100% and the processor becomes unresponsive. The 'maxserver' parameter in radiusd.conf is set to 32 (as it was for the older version). I am upping it to 64 to see if that solves the CPU problem. Thanks for any insights. Regards, - Harshal

4 9

Freeradius 2.1-1: failure modes
by leopold 11 Mar '09

11 Mar '09

Guys, I have a question about different failure modes in FreeRadius, basically I want to differentiate between different scenarios of failures and return a proper response (if any) to NAS device. Failure example: Backend database is down Right now FreeRadius returns reject to NAS rlm_sql (sql): Failed to connect DB handle #8 rlm_sql (sql): reconnect failed, database down? rlm_sql_getvpdata: database query error [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 8 ++[sql] returns fail Sending Access-Reject Say I do not want to return reject in this case and I want the switch to understand that radius is down and retry another radius server (a backup/failover). Because if I return reject the NAS device treats this as radius is UP and running. What is recommended behavior for Radius for: DB is down,Authentication infra is down(say kerberos is down)? Should it return REJECT or NOOP? Thank you very much for your responses. Leopold -- View this message in context: http://www.nabble.com/Freeradius-2.1-1%3A-failure-modes-tp22413666p22413666… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 13

Error in Authentication
by Jaswinder Kaur 11 Mar '09

11 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello All, I am using freeradius 2.1.1 on Suse 10 SP1. I am trying to integrate Freeradius with edirectory, but somehow, I am not able to achieve the desired result, the client just sits while trying to authenticate, I can see the Radius server reading the username and password, but still its not authenticating it. Kindly Help. I am attaching the debug from radius server here: rad_recv: Access-Request packet from host 130.1.254.174 port 20002, id=98, length=142 NAS-Port-Id = "AP1/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User EAP-Message = 0x0201000a016a6b617572 User-Name = "jkaur" NAS-Port = 22283 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0xe4060b16fe2c51beb980f9935f65bfc7 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jkaur", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jkaur [ldap] expand: (uid=%u) -> (uid=jkaur) [ldap] expand: ou=it,ou=cse,ou=no,o=nycc -> ou=it,ou=cse,ou=no,o=nycc rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to FS-NWMASTER.NYCC.INTERNAL:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=radadmin,o=nycc/f9s4b991 to FS-NWMASTER.NYCC.INTERNAL:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=it,ou=cse,ou=no,o=nycc, with filter (uid=jkaur) [ldap] checking if remote access for jkaur is allowed by dialupAccess [ldap] Added the eDirectory password rimpysaini in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user jkaur authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 98 to 130.1.254.174 port 20002 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80cadc2980c8c54cf63317ea2469d24f Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 130.1.254.174 port 20002, id=99, length=142 NAS-Port-Id = "AP1/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User EAP-Message = 0x0202000a016a6b617572 User-Name = "jkaur" NAS-Port = 22283 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0x76041cb28fa2b04c02d0efce299c7d5c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jkaur", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jkaur [ldap] expand: (uid=%u) -> (uid=jkaur) [ldap] expand: ou=it,ou=cse,ou=no,o=nycc -> ou=it,ou=cse,ou=no,o=nycc rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=it,ou=cse,ou=no,o=nycc, with filter (uid=jkaur) [ldap] checking if remote access for jkaur is allowed by dialupAccess [ldap] Added the eDirectory password rimpysaini07 in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user jkaur authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 99 to 130.1.254.174 port 20002 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91df0da291dc14674239f44201d53d4a Finished request 1. Going to the next request Waking up in 3.8 seconds. rad_recv: Access-Request packet from host 130.1.254.174 port 20002, id=100, length=230 NAS-Port-Id = "AP1/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User User-Name = "jkaur" NAS-Port = 22283 State = 0x91df0da291dc14674239f44201d53d4a EAP-Message = 0x0203005019800000004616030100410100003d030149b7dca0ddb16c7a496e5deebbe35ff527acaeff8dbba62fec80e4f180ae48a600001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0x19f917f08434ae523871513b4caafa8a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jkaur", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0894], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 100 to 130.1.254.174 port 20002 EAP-Message = 0x0104040019c0000008d1160301002a02000026030149b7dcf9318b3ef84c939831ce58e8857748b1d22f1327019078b16af9a86cd90000040016030108940b00089000088d0003b9308203b53082029da003020102020101300d06092a864886f70d010104050030819e310b300906035504061302554b311730150603550408130e4e6f727468596f726b7368697265311630140603550407130d4e6f727468616c6c6572746f6e310d300b060355040a13044e5943433128302606092a864886f70d0109011619667761646d696e406e6f727468796f726b732e676f762e756b312530230603550403131c5261646975732043657274696669636174 EAP-Message = 0x6520417574686f72697479301e170d3038313031373132333332325a170d3039313031373132333332325a308183310b300906035504061302554b311730150603550408130e4e6f727468596f726b7368697265310d300b060355040a13044e5943433122302006035504031319526164697573205365727665722043657274696669636174653128302606092a864886f70d0109011619667761646d696e406e6f727468796f726b732e676f762e756b30820122300d06092a864886f70d01010105000382010f003082010a0282010100cd13f0d013bb9dec50e4dd7bdc9fbc58229f5604d1451e3ae04cad5d2c7471897746e05a7030161f06e586 EAP-Message = 0xcd6df9ae5bbac452b9ced66324dd524c5a35c3953c75332375f2f052de026a52a5407fe96d32e09ee2b527e1cd4289e4ba50268864a77112c2ca82d73241a9e85be9329a83b668676fe469daca13f973910e3805e022171956443f726e3715f75c88689c7456abf4cf6b9905ad8621dfff3df28bf3a9377bda878b98b009db95c59c2890eeac812ffeb008f58be609fbadb652836c4f84f32381ce24e182c7798ebdd4ccc214261ab6cc5341b05803f72393f54477bd7734a6cfe401c74548648ab1e14458e8addfa65525acd0737d327e29ed56210203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d EAP-Message = 0x0101040500038201010084cd6c73a9a87de7c7a2e2077fd165eb2f179852170c01a1a7922a912af1b486c5792df4c09f3943821aa7ab0c906b89409a89037b6ce50e66a5b9406d1f6b4d46b3e0c9f483d0e0783cf7fa07b6a7bc349e8126cb570e7924e0d65f8902a4fd6e1a15f0395821ac50e3dc2e9700bd8002cff236d10b5bedd3f31c0ea1d403abcbd09e628ef5fb5a0678a719841c910e0459ab86a644047c6c37c6816de61d000fb47e82b402b9113c90d2b1d174071d840f82524a85704e74ac87f3828690dd7c9a96810697f69b01b832a0e75e003a97376beb90336a9bf3d81a0145ea584a1f736701604f9c3102e3db94d9d1665d3b4733 EAP-Message = 0xa0d76c148e6c209f19daf73c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91df0da290db14674239f44201d53d4a Finished request 2. Going to the next request Waking up in 3.8 seconds. rad_recv: Access-Request packet from host 130.1.254.174 port 20002, id=101, length=156 NAS-Port-Id = "AP1/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User User-Name = "jkaur" NAS-Port = 22283 State = 0x91df0da290db14674239f44201d53d4a EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0x6c0a9364d053c262952bdb3618da745b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jkaur", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 101 to 130.1.254.174 port 20002 EAP-Message = 0x010503fc1940a90004ce308204ca308203b2a0030201020209009b1b08b0dc10c143300d06092a864886f70d010105050030819e310b300906035504061302554b311730150603550408130e4e6f727468596f726b7368697265311630140603550407130d4e6f727468616c6c6572746f6e310d300b060355040a13044e5943433128302606092a864886f70d0109011619667761646d696e406e6f727468796f726b732e676f762e756b312530230603550403131c52616469757320436572746966696361746520417574686f72697479301e170d3038313031373132333233365a170d3038313131363132333233365a30819e310b300906035504 EAP-Message = 0x061302554b311730150603550408130e4e6f727468596f726b7368697265311630140603550407130d4e6f727468616c6c6572746f6e310d300b060355040a13044e5943433128302606092a864886f70d0109011619667761646d696e406e6f727468796f726b732e676f762e756b312530230603550403131c52616469757320436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d49ead33ecc1b617197e30620c4e3b9942d4e0e2a1ffc2a574ae6a544c53ce06a00c19cdfaa411508579d8d004b09da444fe5bf25e8d32dcda6f5e4d09bd879839bb3feccff9 EAP-Message = 0xa5b69f3fdfed63a2cc0ebe2c9d2593dda02396af057fef8305d18791273ad1dc9735caa330e78518c48d94ab8f1b99e077ba85acd2687c7ea01a8f8aaab311770897891fe93c9b4f7c3e4484c76151a333063c8ee1886d53cfe4b702e6ce3e7eed4c20620bf1fe9beecaf34088944e6a0322ac938b7a55f7b410efc2600156eb51a1c31a52770ea19fb58e757de90a9f36e21341fb28350205ef0e07bdb4849837ca5695cb28a05890f65bb7bfa348e1809c1d6072e3e3496d870203010001a382010730820103301d0603551d0e04160414dbc19e39b5ff87ed34aa19e93ee4b0137e6900783081d30603551d230481cb3081c88014dbc19e39b5ff87 EAP-Message = 0xed34aa19e93ee4b0137e690078a181a4a481a130819e310b300906035504061302554b311730150603550408130e4e6f727468596f726b7368697265311630140603550407130d4e6f727468616c6c6572746f6e310d300b060355040a13044e5943433128302606092a864886f70d0109011619667761646d696e406e6f727468796f726b732e676f762e756b312530230603550403131c52616469757320436572746966696361746520417574686f726974798209009b1b08b0dc10c143300c0603551d13040530030101ff300d06092a864886f70d010105050003820101009c7bcb32cf7d349b4654e9e3b4abfd92a5a087fcf4c7e8e5a798896a EAP-Message = 0xfe0d8480599c7ac3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91df0da293da14674239f44201d53d4a Finished request 3. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 130.1.254.174 port 20002, id=102, length=156 NAS-Port-Id = "AP1/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User User-Name = "jkaur" NAS-Port = 22283 State = 0x91df0da293da14674239f44201d53d4a EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0x7cb007c0ef1b2a4023d78e8c55ffbd6a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jkaur", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 102 to 130.1.254.174 port 20002 EAP-Message = 0x010600eb1900c4e5df22b2997947c345df9f73a6626b07517c5a726255d236ef91678b9dbd214791bfa39479046f030aec36f700bedcaa04b3806e3b0273a730d7b377fa8b259b433d3f2327ddb27a17e2dec166919e6f6c1f8615baaf8f6aca7d3544983e8b21be5f42651b80d05bc937533d9813c13a30c615ac07bb23221aac800d99641262e5dc9790a2f8a021ccb83999eb9626cfd463580589b33bb5e583ea7e10846af95052a4075a9c2ab01dc7d3c42336b1c3f284a0f3975abea2685d187d38752a63875df19cc80a22f75eb3481eb665081aeb1e77ca79b2066e059ed416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91df0da292d914674239f44201d53d4a Finished request 4. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 130.1.254.174 port 20002, id=103, length=156 NAS-Port-Id = "AP1/1" Calling-Station-Id = "00-1F-3B-70-5B-7F" Called-Station-Id = "00-18-6E-30-70-C0:NYCC_TEST" Service-Type = Framed-User User-Name = "jkaur" NAS-Port = 22283 State = 0x91df0da292d914674239f44201d53d4a EAP-Message = 0x020600061900 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 130.1.254.174 Message-Authenticator = 0xf6d9d82b0d35719f05b623c4f8655f5d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jkaur", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 103 to 130.1.254.174 port 20002 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91df0da295d814674239f44201d53d4a Finished request 5. Going to the next request Waking up in 3.7 seconds. Cleaning up request 0 ID 98 with timestamp +145 Waking up in 1.1 seconds. Cleaning up request 1 ID 99 with timestamp +146 Cleaning up request 2 ID 100 with timestamp +148 Cleaning up request 3 ID 101 with timestamp +148 Cleaning up request 4 ID 102 with timestamp +148 Cleaning up request 5 ID 103 with timestamp +148 Ready to process requests. Any help is greatly appreciated. Thanks, JK -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.9.0 (Build 472) Charset: US-ASCII wsBVAwUBSbfhvvsvZpRjP72bAQigHAf+Oq2xkxpqarERcbOXk6eM4aEb7+d7W4GR cZfA42GyFMstZ6+RQ5ERt1pMaGDv/6FajFPBA1SK1bqFDQ3rcJyqissMOS5Oscb2 ORw7b8kWFX2NUwQANDnZYSxz9LhPZlUTaRHqWzDcicvuELiIQxJStbK+dIZ2fWFV PvPAgpKtddbvpL3smKlY1aFkYmUtsumBd0xsljzX3j+qTzEeli6y+MpGDYXfvmLe i4b3B2sP39VXjQCP0Z+Zx3yduR9YfAoNrn/fUBdiIQSKrgUn9Lz5Lsox1lbbhyKT BIQGsDqpiktukzW7N6Va7pF/tjfAko/Kmf2SxKTsoOdG8sKaSgnv4g== =4Ibp -----END PGP SIGNATURE----- Access your county council services online 24 hours a day, 7 days a week at www.northyorks.gov.uk. WARNING Any opinions or statements expressed in this e-mail are those of the individual and not necessarily those of North Yorkshire County Council. This e-mail and any files transmitted with it are confidential and solely for the use of the intended recipient. If you receive this in error, please do not disclose any information to anyone, notify the sender at the above address and then destroy all copies. North Yorkshire County Council�s computer systems and communications may be monitored to ensure effective operation of the system and for other lawful purposes. Although we have endeavoured to ensure that this e-mail and any attachments are free from any virus we would advise you to take any necessary steps to ensure that they are actually virus free. If you receive an �out of office� notice from the person you are contacting and you wish to request information under either the Freedom of Information Act, the Data Protection Act or the Environmental Information Regulations please forward your request by e-mail to the Data Management Team (datamanagement.officer(a)northyorks.gov.uk) who will process your request. North Yorkshire County Council.

2 1

ldap stuff (v 2.1.1)
by Kenneth Grady 11 Mar '09

11 Mar '09

I would like to have an ldap group that is another instance of ldap (selected by departmentNumber), but I don't see how to add it into the configuration (users file). ldap everyonePlusMacs { server = "ldap" basedn = "dc=example,dc=com" filter = "(|(&(objectClass=person)(employeenumber=%{User-Name}))(&(objectClass=pers on)(uid=%{User-Name}))(companyHostMacAddress=%{User-Name}))" ... groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=employeeNumber=%{User-Name},ou=peo ple,dc=lanl,dc=gov))(&(objectClass=GroupOfNames)(memberUid=%{User-Name}))))" } ldap NetworkingOnly { server = "ldap" basedn = "dc=example,dc=com" filter = "(|(&(objectClass=person)(employeenumber=%{User-Name})(departmentNumber=IT))(&(objectClass=pers on)(uid=%{User-Name})(departmentNumber=IT)))" ... } ldap SalesOnly { server = "ldap" basedn = "dc=example,dc=com" filter = "(|(&(objectClass=person)(employeenumber=%{User-Name})(departmentNumber=Sales)(&(objectClass=pers on)(uid=%{User-Name})(departmentNumber=Sales)))" ... }

2 4

AD Integration Doc
by Colantuoni, Robert 11 Mar '09

11 Mar '09

I was also bitten by the bug where ntlm_auth returns a bad NT_KEY. It took me a few hours of searching the mailing lists before I stumbled across this thread: http://marc.info/?l=freeradius-users&m=123455952011812&w=2 If there were a warning or mention of the issue on the how-to page, it would help users who are just starting to integrate their radius server with AD. http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO I would have edited the page myself, but it doesn't look like it's a public wiki. Thanks to the radius guys for a great piece of software. ---------------------------------- Robert G Colantuoni CIT - Operational Support Services University at Buffalo rgc(a)buffalo.edu 716.645.3552

1 0