- Freeradius-Users - lists.freeradius.org

Failing to authenticate users
by butteryak 12 Nov '08

12 Nov '08

Hmmmm....my eyes are bugging out. This is a new freeradius install/mysql/daloradius/ubuntu. I fail to find any specific as to why my users are failing to authenticate, via a simple radcheck. anyone have another eye and take a peek, and see somthing I'm missing.....the first part of this is all config loading. the access request is located towards the bottem....... I'm pretty sure everything is talking to everything it needs to, but I'm obviously missing somthing most likely obvious. if anyone sees anything.....please let me know..... thanks guys.... cg Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "XXXXXXX" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/freeradius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=testing123 rlm_sql (sql): Adding client 127.0.0.1 (localhost) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:33575, id=29, length=47 User-Name = "sqltest" User-Password = "testpwd" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "sqltest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'sqltest' rlm_sql (sql): sql_set_user escaped user --> 'sqltest' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'sqltest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqltest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'sqltest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqltest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 29 to 127.0.0.1 port 33575 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 29 with timestamp 491a1ba8 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/Failing-to-authenticate-users-tp20451334p20451334.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

FreeRadius working as a ProxyRadius using PAP protocol
by NGUYEN DANG LUAN, Eric 12 Nov '08

12 Nov '08

Hello, I'm trying to use FreeRadius (server-2.1.1) as a Proxy Radius with PAP protocol. peap,eap,pap pap Client <----------------------> AP <-------------> FreeRadius <--------------> Radius server There's what i have had in my conf files: client.conf: client ***.***.***.*** { secret = pass shortname = LinksysWRT54G nastype = other } proxy.conf: realm NULL { authhost = ***.***.***.***:1645 accthost = ***.***.***.***:1646 secret = pass } users: DEFAULT FreeRADIUS-Proxied-To == ***.***.***.***, Auth-Type := PAP I don't think my proxy radius use the right protocol. I want it to use PAP protocol whe it tries to contact radius server. < radiusd: #### Opening IP addresses and Ports #### < listen { < type = "auth" < ipaddr = * < port = 1645 < } < listen { < type = "acct" < ipaddr = * < port = 1646 < } < Listening on authentication address * port 1645 < Listening on accounting address * port 1646 < Listening on proxy address * port 1647 < Ready to process requests. < < rad_recv: Access-Request packet from host ***.***.***.*** port 1405, id=0, length=180 < Message-Authenticator = 0x1ad77a29ef17ee966a8521f57795f231 < Service-Type = Framed-User < User-Name = "enguyend\000" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < +- entering group authorize {...} < ++[preprocess] returns ok < ++[chap] returns noop < ++[mschap] returns noop < [suffix] No '@' in User-Name = "enguyend", looking up realm NULL < [suffix] Found realm "NULL" < [suffix] Adding Stripped-User-Name = "enguyend" < [suffix] Adding Realm = "NULL" < [suffix] Proxying request from user enguyend to realm NULL < [suffix] Preparing to proxy authentication request to realm "NULL" < ++[suffix] returns updated < [eap] Request is supposed to be proxied to Realm NULL. Not doing EAP. < ++[eap] returns noop < ++[unix] returns notfound < ++[files] returns noop < ++[expiration] returns noop < ++[logintime] returns noop < ++[pap] returns noop < Sending Access-Request of id 210 to ***.***.***.*** port 1645 < Message-Authenticator = 0x00000000000000000000000000000000 < Service-Type = Framed-User < User-Name = "enguyend" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < Proxy-State = 0x30 < Proxying request 0 to home server ***.***.***.*** port 1645 < Sending Access-Request of id 210 to ***.***.***.*** port 1645 < Message-Authenticator = 0x00000000000000000000000000000000 < Service-Type = Framed-User < User-Name = "enguyend" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < Proxy-State = 0x30 < Going to the next request < Waking up in 0.9 seconds. < Waking up in 13.0 seconds. < rad_recv: Access-Request packet from host ***.***.***.*** port 1405, id=0, length=180 < Sending duplicate proxied request to home server ***.***.***.*** port 1645 - ID: 210 < Sending Access-Request of id 210 to ***.***.***.*** port 1645 < Message-Authenticator = 0x00000000000000000000000000000000 < Service-Type = Framed-User < User-Name = "enguyend" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < Proxy-State = 0x30 < Waking up in 11.0 seconds. < Rejecting request 0 due to lack of any response from home server ***.***.***.*** port 1645 < There was no response configured: rejecting request 0 < Using Post-Auth-Type Reject < +- entering group REJECT {...} < [attr_filter.access_reject] expand: %{User-Name} -> enguyend < attr_filter: Matched entry DEFAULT at line 11 < ++[attr_filter.access_reject] returns updated < Sending Access-Reject of id 0 to ***.***.***.*** port 1405 < Finished request 0. < PROXY: Marking home server ***.***.***.*** port 1645 as zombie (it looks like it is dead). < Waking up in 4.9 seconds. < Cleaning up request 0 ID 0 with timestamp +15 < Ready to process requests. Does anyone have on idea? Thanks Eric NGUYEN

3 7

control panel
by Allan Patrick Ksiaskiewcz 12 Nov '08

12 Nov '08

Hello how are? I would some indication of the control panel, use the dial_up admin, but it is bad, I tested the phpradmin. Outside the two anyone could spend some more? Thanks Allan Patrick Ksiaskiewcz Brazil Guarapuava/PR Novos endereços, o Yahoo! que você conhece. Crie um email novo com a sua cara @ymail.com ou @rocketmail.com. http://br.new.mail.yahoo.com/addresses

4 3

client windows xp machine-only authentication
by alois blasbichler 12 Nov '08

12 Nov '08

Hello I implemented successfully a wireless-access for clients windows xp with authentication of the machine (in a samba domain) and the users (in a samba-domain) to my openldap-DB with freeradius. This works fine. My question : somebody have configured windows xp(SP3) to make only a machine authentication ? I was not able to restrict this. My windows xp-clients makes first a machine-authentication and then allways a user- authentication. It is more a windows-question for a microsoft-mailinglist - i now - but i think a lot of freeradius-users use like me windows-clients and certainly somebody have a solution for me. by luis

1 0

Weird logic issue...
by Arran Cudbard-Bell 12 Nov '08

12 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Got a weird condition evaluation issue elsif(\ ("%{Supplicant-Flags}" =~ /^10........$/) || \ (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && \ (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check'))) \ ){ Gets processed as: ++? if ("%{Supplicant-Flags}" == 'notfound') expand: %{Supplicant-Flags} -> ? Evaluating ("%{Supplicant-Flags}" == 'notfound') -> FALSE ++? if ("%{Supplicant-Flags}" == 'notfound') -> FALSE ++? if ("%{Supplicant-Flags}" =~ /^.1........$/) expand: %{Supplicant-Flags} -> ? Evaluating ("%{Supplicant-Flags}" =~ /^.1........$/) -> FALSE ++? if ("%{Supplicant-Flags}" =~ /^.1........$/) -> FALSE ++? elsif (("%{Supplicant-Flags}" =~ /^10........$/) || (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) )) expand: %{Supplicant-Flags} -> ?? Evaluating ("%{Supplicant-Flags}" =~ /^10........$/) -> FALSE expand: %{Supplicant-Flags} -> ??? Evaluating ("%{Supplicant-Flags}" == 'notfound') -> FALSE ??? Skipping ("%{Realm}" == 'local') ??? Skipping ("%{Huntgroup-Name}" != 'auth-proxy') ???? Skipping ("%{Service-Type}" == 'Framed-User') ???? Skipping ("%{Service-Type}" == 'Call-Check') ++? elsif (("%{Supplicant-Flags}" =~ /^10........$/) || (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) )) -> TRUE So the first condition: ("%{Supplicant-Flags}" =~ /^10........$/) returns false Instead of processing the rest of the conditions FR skips the rest of the conditions and returns true for the entire condition... Interestingly if you take out the nested: (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) Condition and replace it with: ("%{Service-Type}" == 'Framed-User') All is well. So only happens with multiple levels of nesting. This has been a bug since at least version 2.0.4. Thanks, Arran - -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkka/MsACgkQcaklux5oVKI5DQCfVWJqHf8uOWsVqEKHWPZpFHvc FlcAn14qXPIwsHOOme+q7jT7cNqy9TkK =JXk/ -----END PGP SIGNATURE-----

1 0

snmp problem
by Oguzhan Kayhan 12 Nov '08

12 Nov '08

Hi, I am trying snmp on debian 32 bit. With freeradius 2.0.5. and net-snmp 5.4.1 I did all just like on http://wiki.freeradius.org/SNMP_HOWTO. Changed radiusd.conf as snmp = yes $INCLUDE snmp.con and remove comment on line smux_password = verysecret and added the line on snmpd.conf of snmpdaemon "smuxpeer .1.3.6.1.4.1.11344.1.1.1 verysecret" Enabled smux on snmpd too by removing -smux parameter. But i got the following error on freeradius debug.. SMUX connect try 1 SMUX SMUX open oid: 1.3.6.1.4.1.11344.1.1.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register message send failed: Broken pipe And also snmpd gives the following error: refused smux peer: oid SNMPv2-SMI::enterprises.11344.1.1.1, descr radiusd Is it a bug regarding to snmp or freeradius? Or did i miss something?

2 2

Re: LDAP & MSCHAP errors
by Simon Palmer 12 Nov '08

12 Nov '08

>>pap against LDAP works fine >>chap against LDAP works fine (With ntradping) > >They used different password. Do you mean chap and MSCHAPv2 require passwords in different formats or something? I can auth CHAP, but with the same username and password can't auth CHAPv2 (with no config change on freeradius) My two debugs show that Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374123413937333342303139423034323445363933373332 So the NT-Password is being retrieved from LDAP in both cases. > >>BUT - MSCHAPv2 gives "FAILED: MS-CHAP2-Response is incorrect" >>Am I missing something required for MSCHAP to work? The NT-Password >>seems to be retrieved... >> > >A coorect password. Do you think the has being retrieved from LDAP is wrong then? If I do put in an incorrect password I do get the same error message. Does anyone have Freeradius working with MSCHAP against eDir? > >>Working CHAP debug from ntradping: >> >>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for check items in >>directory... >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: acctFlags -> >>SMB-Account-CTRL-TEXT == "[UX ]" >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaNtPassword -> >>NT-Password == >>0x4145394341303636374133413937333342303139423034323645363933373332 >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaLmPassword -> >>LM-Password == >>0x3635423939303044343142344533363831394631304139333344343836384443 >>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for reply items in >>directory... >>Tue Nov 11 10:10:26 2008 : Info: [ldap] user testuser authorized to use >>remote access >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: ldap_release_conn: Release >>Id: 0 >>Tue Nov 11 10:10:26 2008 : Info: ++[ldap] returns ok >>Tue Nov 11 10:10:26 2008 : Info: ++[expiration] returns noop >>Tue Nov 11 10:10:26 2008 : Info: ++[logintime] returns noop >>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing NT-Password from hex >>encoding >>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing LM-Password from hex >>encoding >>Tue Nov 11 10:10:26 2008 : Info: [pap] Found existing Auth-Type, not >>changing it. >>Tue Nov 11 10:10:26 2008 : Info: ++[pap] returns noop >>Tue Nov 11 10:10:26 2008 : Info: Found Auth-Type = CHAP >>Tue Nov 11 10:10:26 2008 : Info: +- entering group CHAP {...} >>Tue Nov 11 10:10:26 2008 : Info: [chap] login attempt by "testuser" >>with CHAP password > >***** >>Tue Nov 11 10:10:26 2008 : Info: [chap] Using clear text password >>"ommitted" for user testuser authentication. >***** > >>Where did that come from? I don't know - inside tha chap module? It's retrieved from LDAP. I'm using the default modules/chap - it just says: chap { # no configuration } > >>Tue Nov 11 10:10:26 2008 : Info: [chap] chap user testuser >>authenticated succesfully > >>Default configuration in modules/mschap and modules/chap >>In sites-enabled/default >>authorize { >>ldap >>} > >That is obviously untrue from your debug. Just checked again, modules/mschap has nothing unhashed. modules/chap has as above with # no configuration > >Try doing pap with that NT-Password from ldap (remove clear text password >entry wherever it is). Yeah - PAP works perfectly, chap works perfectly, MSCHAP doesn't. Thanks > >Ivan Kalik >Kalik Informatika ISP Mae'r e-bost hwn ac unrhyw ffeiliau atodedig yn gyfrinachol ac at sylw'r unigolyn neu'r sefydliad a enwir uchod. Bydd unrhyw farn neu sylwadau a fynegir yn perthyn i'r awdur yn unig ac ni chynrychiolant o anghenraid farn Coleg Sir Gâr. Os ydych chi wedi derbyn yr e-bost hwn ar gam, rhowch sylw i'r gweinyddwr ar y cyfeiriad canlynol: postmaster(a)colegsirgar.ac.uk Cysidrwch yr amgylchedd - a oes wir angen argraffu'r ebost hwn? This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any views or opinions expressed are solely those of the author an d do not necessarily represent those of Coleg Sir Gâr. If you have received this email in error please notify the administrator on the following address: postmaster(a)colegsirgar.ac.uk Please consider the environment - do you really need to print this email?

2 4

VMPS - Initial project ideas
by Hairy51 12 Nov '08

12 Nov '08

Hi all, I am just about to start a project to remove the VMPS system from an aging catalyst switch and i would like to investigate the possibilty of using FreeRadius for this. We currently have about 1500 hosts that rely on VMPS for dynamic assignment and an ideal solution would be to move the VMPS service onto a server (Or multiple servers) with as little interuptions to users as possible. Also, for simplicities sake it would be great if we could re-use the current Static VMPS file that the catalyst switch uses. I have looked into FreeNAC as a solution, but want to investigate other ways of acheiving this. We do not really need to do anything other than assign (or block) VLANs, so the extra functionality of FreeNAC is not needed at this point. Considering i am coming from a limited Linux background, how hard would it be for me to acheive this using FreeRADIUS? Does it sound feasible? I am really looking for a bit of advice from those with experience of the FreeRADIUS application and who know of the potential pit-falls and complications that we may face! Many thanks - any comments or idea's much appreciated... Cheers Jonathan -- View this message in context: http://www.nabble.com/VMPS---Initial-project-ideas-tp20264221p20264221.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Freeradius/MySQL - Dynamic IP address, help pls?
by Lucio Godoy 12 Nov '08

12 Nov '08

Hi All; I have been for sometime now trying to get Freeradius to assign Dynamic IP Addresses to my users, with no luck! I can authenticate users and give static ip address without a hint of problem. I am using Freeradius Version 2.1.1 with MySQL backend with a Cisco VPN3000; I have read all about: Pool-Name := main_pool, Fall-Through = Yes, the Freeradius WIKI, etc, etc; but can't get anything to work. Could any body help me to add the right entries on the sql tables for user: TEST Group called: DYNAMIC ip pool called: MAIN_POOL IP range of 192.168.2.1 till 192.168.2.10 I am seriously burn-out! Thanks Lucio _________________________________________________________________ Win £1000 John Lewis shopping sprees with BigSnapSearch.com http://clk.atdmt.com/UKM/go/117442309/direct/01/

2 4

RE: Zithromax is your choice to fight any bacteria.
by freeradius-users＠list.xs4all.nl 12 Nov '08

12 Nov '08

1 0