- Freeradius-Users - lists.freeradius.org

LDAP login failed: check identity, password settings in ldap section of radiusd.conf, (re)connection attempt failed
by hsuan 24 Nov '08

24 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. I have set the radiusd configuration file (/usr/local/etc/raddb/radius.conf) about ldap information as follows : ldap { server = "localhost" identity = "cn=Manager，dc=nchc，dc=org，dc=tw" password = hsuan basedn = "dc=nchc，dc=org，dc=tw" filter = (&(!(objectClass=alias))(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 ldap_connections_number = 5 password_header = "{crypt}" password_attribute =User-Password timeout = 4 timelimit = 3 net_timeout = 1 } But when I using “radius -X” to start the radius server ,and in the client I using “radtest ldapuser ldapuser radius_server_ip 0 secret” , The server shown the message : [ldap] performing user authorization for ldapuser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(!(objectClass=alias))(uid=%{Stripped-User-Name:-%{User-Name}}))" -> (&(!(objectClass=alias))(uid=ldapuser))" [ldap] expand: dc=nchc??dc=org??dc=tw -> dc=nchc??dc=org??dc=tw rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager??dc=nchc??dc=org??dc=tw/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [ldapuser/ldapuser] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 128 to 192.168.2.1 port 49351 Waking up in 4.9 seconds. Cleaning up request 3 ID 128 with timestamp +135542 Then the client receive the “rad_recv: Access-Reject packet from host 192.168.2.1 port 1812, id=22, length=20” What’s the problem ? how can I fix the error ? Regards, Vicky

2 1

802.1x and framed-ip-address attribute
by Andrew Rikhlivsky 24 Nov '08

24 Nov '08

Hello All, I'm using 802.1x for authenticating users. How can I use Framed-Ip-Address attribute to assign client ip address?

2 1

Bind to ldap with the current auticated user
by Ram Akuka 23 Nov '08

23 Nov '08

Hi, i am trying to bind to LDAP server with my the current auth user .. so i added the following to the ldap module: identity = "uid=%{Stripped-User-Name:-%{User-Name}},ou=people,o=XXX,o=XXX" password = "%{%{User-Password}:-%{Chap-Password}}" but insted of compressing the unlang string and using the uid i get the fallowing error: rlm_ldap: uid=%{Stripped-User-Name:-%{User-Name}},ou=people,o=XXX.,o=XXX bind to LDAPSERVER.XXX.com:389 failed No such object rlm_ldap: (re)connection attempt failed can some one help me here and tell me what i am doing wrong here???? thanks in advance , Ram

3 2

Access-Reject in attempted PAP cleartext setup?
by Vincent Fox 23 Nov '08

23 Nov '08

Hello! I am unable to make even a simple PAP cleartext setup work and cannot figure out what I am doing wrong. The note about it should "just work" well not for me so far..... I simply did an apt-get and settings are nearly all defaults. I did add a secret to clients.conf for 127.0.0.1 I tried both settings in modules/pap for auto_header of yes and no. I get this error: root@slim:/etc/raddb# radtest vf5 testing123 localhost 1812 testing123 Sending Access-Request of id 214 to 127.0.0.1 port 1812 User-Name = "vf5" User-Password = "testing123" NAS-IP-Address = 10.70.1.9 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=214, length=32 Reply-Message = "Hello, vf5" Simple entry added to default users file: vf5 Cleartext-Password := "testing123" Reply-Message = "Hello, %{User-Name}" proot@slim:/etc/raddb/modules# apt-cache show freeradius Package: freeradius Priority: optional Section: net Installed-Size: 2668 Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Original-Maintainer: Stephen Gran <sgran(a)debian.org> Architecture: i386 Version: 2.1.0+dfsg-0ubuntu2 Provides: radius-server Depends: lsb-base (>= 3.0-6), libc6 (>= 2.4), libfreeradius2 (= 2.1.0+dfsg-0ubuntu2), libgdbm3, libltdl7 (>= 2.2.4), libpam0g (>= 0.99.7.1), libperl5.10 (>= 5.10.0), python2.5 (>= 2.5), freeradius-common Recommends: freeradius-utils Suggests: freeradius-ldap, freeradius-mysql, freeradius-krb5, freeradius-postgresql Filename: pool/main/f/freeradius/freeradius_2.1.0+dfsg-0ubuntu2_i386.deb Size: 1148040 MD5sum: 7576890ba8dccbfb9078b92ba4680bc8 SHA1: 9255fee9508af63e2cf0ff09fe22be8c3b10055f SHA256: 1e1d156ebe3b3bded135adc4b752a62a703dd8cb7253a60f2ec754c1ee0f932a Description: a high-performance and highly configurable RADIUS server A high-performance RADIUS server with support for... - many vendor-specific attributes - proxying and replicating requests by any criteria - authentication on system passwd, SQL, Kerberos, LDAP, users file, or PAM - multiple DEFAULT configurations - regexp matching in string attributes and lots more. Bugs: mailto:ubuntu-users@lists.ubuntu.com Origin: Ubuntu And radiusd -XXX output shows: Sat Nov 22 20:14:09 2008 : Debug: Listening on authentication address * port 1812 Sat Nov 22 20:14:09 2008 : Debug: Listening on accounting address * port 1813 Sat Nov 22 20:14:09 2008 : Debug: Listening on proxy address * port 1814 Sat Nov 22 20:14:09 2008 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 53924, id=214, length=55 User-Name = "vf5" User-Password = "testing123" NAS-IP-Address = 10.70.1.9 NAS-Port = 1812 Sat Nov 22 20:14:19 2008 : Info: +- entering group authorize {...} Sat Nov 22 20:14:19 2008 : Info: ++[preprocess] returns ok Sat Nov 22 20:14:19 2008 : Info: ++[chap] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[mschap] returns noop Sat Nov 22 20:14:19 2008 : Info: [suffix] No '@' in User-Name = "vf5", looking up realm NULL Sat Nov 22 20:14:19 2008 : Info: [suffix] No such realm "NULL" Sat Nov 22 20:14:19 2008 : Info: ++[suffix] returns noop Sat Nov 22 20:14:19 2008 : Info: [eap] No EAP-Message, not doing EAP Sat Nov 22 20:14:19 2008 : Info: ++[eap] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[unix] returns updated Sat Nov 22 20:14:19 2008 : Info: [files] users: Matched entry vf5 at line 93 Sat Nov 22 20:14:19 2008 : Debug: expand: Hello, %{User-Name} -> Hello, vf5 Sat Nov 22 20:14:19 2008 : Info: ++[files] returns ok Sat Nov 22 20:14:19 2008 : Info: ++[expiration] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[logintime] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[pap] returns updated Sat Nov 22 20:14:19 2008 : Info: Found Auth-Type = PAP Sat Nov 22 20:14:19 2008 : Info: +- entering group PAP {...} Sat Nov 22 20:14:19 2008 : Info: [pap] login attempt with password "testing123" Sat Nov 22 20:14:19 2008 : Info: [pap] Using CRYPT encryption. Sat Nov 22 20:14:19 2008 : Info: [pap] Passwords don't match Sat Nov 22 20:14:19 2008 : Info: ++[pap] returns reject Sat Nov 22 20:14:19 2008 : Info: Failed to authenticate the user. Sat Nov 22 20:14:19 2008 : Info: Using Post-Auth-Type Reject Sat Nov 22 20:14:19 2008 : Info: +- entering group REJECT {...} Sat Nov 22 20:14:19 2008 : Debug: expand: %{User-Name} -> vf5 Sat Nov 22 20:14:19 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Nov 22 20:14:19 2008 : Info: ++[attr_filter.access_reject] returns updated Sat Nov 22 20:14:19 2008 : Info: Delaying reject of request 0 for 3 seconds Sat Nov 22 20:14:19 2008 : Debug: Going to the next request Sat Nov 22 20:14:19 2008 : Debug: Waking up in 0.9 seconds. Sat Nov 22 20:14:20 2008 : Debug: Waking up in 1.9 seconds. Sat Nov 22 20:14:22 2008 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 214 to 127.0.0.1 port 53924 Reply-Message = "Hello, vf5" Sat Nov 22 20:14:22 2008 : Debug: Waking up in 4.9 seconds. Sat Nov 22 20:14:27 2008 : Info: Cleaning up request 0 ID 214 with timestamp +10 Sat Nov 22 20:14:27 2008 : Debug: Ready to process requests.

2 2

HELP: Windows IAS / FreeRADIUS Proxy problem
by clive gould 23 Nov '08

23 Nov '08

Can anybody help please? We use a FreeRADIUS proxy for authenticating DSpace with MS AD via MS IAS Our ITNS team have just rebuilt the IAS server after it suffered a hardware failure failed and since the rebuild it is now rejecting FreeRADIUS proxy requests. IAS will still respond to my Moodle PHP RADIUS authentication module, but since the rebuild is rejecting authentication requests from the FreeRADIUS proxy (yes the new shared secret is correct and I'm logging on with the same id to both systems :) I'm using MSCHAP for authentication with FreeRADIUS. I am wondering if the problem could be to do with http://technet.microsoft.com/en-us/library/cc786978.aspx#BKMK_5 ? Comments/suggestions very gratefully received :))) Thanks Clive

2 1

rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf
by hsuan 23 Nov '08

23 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. But when I using "radius -X" to start the radius server ,and in the client I using "radtest ldapuser ldapuser radius_server_ip 0 secret" , The server shown the message : rad_recv: Access-Request packet from host radius_client_ip port 35833, id=168, length=60 User-Name = "ldapuser" User-Password = "ldapuser" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ldapuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[unix] returns updated [sql] expand: %{User-Name} -> ldapuser [sql] sql_set_user escaped user --> 'ldapuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ldapuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ldapuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User ldapuser not found ++[sql] returns notfound [ldap] performing user authorization for ldapuser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldapuser) [ldap] expand: o=My Org,c=UA -> o=My Org,c=UA rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,o=My Org,c=UA/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [ldapuser/ldapuser] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 168 to radius_server_ip port 35833 Waking up in 4.9 seconds. Cleaning up request 2 ID 168 with timestamp +1020 The error looks like "rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed , what's the problem ?? " Regards, Vicky

2 7

Re: Problem in setting up radius database in sql
by Alexandre Chapellon 22 Nov '08

22 Nov '08

your freeradius seems to be compiled/installed without the mysql extensions rlm_sql_mysql

5 8

rlm_chap: Password check failed
by Marwan Sultan 21 Nov '08

21 Nov '08

Hello All, I'm installing a new FreeBSD server. MySql4.1 php5, Chillispot All working fine. I have installed freeradius-1.1.7_2 when I authinticate throu chillispot it always fails with follow rlm_chap: Setting 'Auth-Type := CHAP'rlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "manager" with CHAP password rlm_chap: Using clear text password "emanager09" for user manager authentication. rlm_chap: Password check failedrad_recv: Access-Request packet from host 127.0.0.1:61467, id=0, length=217Sending Access-Reject of id 0 to 127.0.0.1 port 61467 When password..Ofcourse is correct. Please note i have copied radiusd.conf clients.conf and sql.conf from a diffrent server which is working perfectly. into this new server "identical servers" but its not working anymore.. when I use ntradping for test use..password works fine I have tried to search FAQ i couldnot find it..sorry. Im sure its a small tweak somewhere..PLEASE advise where is excatly as i need this server to be uptonight :( What makes me wonder...the same configuration works on diffrent server and here doesnot ..but its same files.. THANK YOU M. SUltan. _________________________________________________________________ Access your email online and on the go with Windows Live Hotmail. http://windowslive.com/Explore/Hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_access…

1 0

ldap backend and Realm
by Mustapha Bouikhif 21 Nov '08

21 Nov '08

Hi folk, I have Freeradius 2.1.1 and openldap 2.3.27-8 installed in 2 diff servers. My radius server is used to authenticate users from differents relams (lets say 8) against one ldap server. My ldap server has 8 different basedn which holds users from the realms. I want to use unlang to configure radiusd to use a specific ldap module configuration based on the realm of the user connected to the wireless network. Can I use unlang with (switch %{Realm}statement) to do so ? Thanks for any clues and help. -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

6 19

New entry for Interim packet
by Tony Spencer 20 Nov '08

20 Nov '08

Hello Our setup is as follows: Centos 5.2 FreeRADIUS Version 2.0.2 MySQL Version: 4.1.20 We are using FreeRadius for our ADSL users and its working fine. Except when it comes to working out the usage stats for each user at the end of each month. Its easy to do with all sessions that started in the previous month and have a Stop status. But it's difficult when a session rolled over to the next month because the status is Alive. We're trying to find a why to make FreeRadius: Enter a new entry into the Radacct table for a session for an Interim update Mark the previous session with a stop Status and update the OctetsIn and OctetsOut for that session with the current value. Set the new session OctetsIn and OctetsOut at zero until the next update and then it starts from the beginning again. However we can't find a way of making FreeRadius: Run 2 sql statements in the same update. Set the new session counter to zero and not roll over the next updates Octets. We have found the following site: http://www.netexpertise.eu/en/freeradius/daily-accounting.html with a way of doing this within MySQL with procedures, but apparently this only works with MySQL 5. Having installed MySQL 5 on a test server and importing our Radius database we tried running the first procedure but get an error: ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DECLARE COUNTER_LIMIT BIGINT(12)' at line 1 mysql> SET COUNTER_LIMIT = POW(2,32); ERROR 1193 (HY000): Unknown system variable 'COUNTER_LIMIT Has anyone any ideas on how to do what we require or has anyone had any luck with the instructions on the URL? Thanks in advance. Tony

5 9