- Freeradius-Users - lists.freeradius.org

sqltrace log
by Søren Schrøder 12 Nov '08

12 Nov '08

Greetings I'm running FreeRadius with mysql backend, and for some reason I cannot get the sqltrace logfile enabled. Im running Freeradius on Freebsd 7.0, and I have tried installing from FreeBSD ports (2.0.5) and a build from source (2.1.1), but with the same result: Running freeradius in debug mode (-X -xx), it outputs: Tue Nov 11 15:24:10 2008 : Debug: Module: Linked to module rlm_sql Tue Nov 11 15:24:10 2008 : Debug: Module: Instantiating sql Tue Nov 11 15:24:10 2008 : Debug: sql { Tue Nov 11 15:24:10 2008 : Debug: driver = "rlm_sql_mysql" Tue Nov 11 15:24:10 2008 : Debug: server = "localhost" Tue Nov 11 15:24:10 2008 : Debug: port = "" Tue Nov 11 15:24:10 2008 : Debug: login = "radius" Tue Nov 11 15:24:10 2008 : Debug: password = "<blanked>" Tue Nov 11 15:24:10 2008 : Debug: radius_db = "radius" Tue Nov 11 15:24:10 2008 : Debug: read_groups = yes Tue Nov 11 15:24:10 2008 : Debug: sqltrace = yes Tue Nov 11 15:24:10 2008 : Debug: sqltracefile = "/var/log/radius/sqltrace.sql" ... ... I touched and 666'ed the logfile to eliminate right-issues [root@server /var/log/radius]# ls -al total 6 drwxr-xr-x 3 freeradius wheel 512 Nov 11 15:26 . drwxr-xr-x 4 root wheel 1536 Nov 11 15:21 .. drwxr-xr-x 3 root wheel 512 Nov 11 15:21 radacct -rw-rw-rw- 1 freeradius wheel 0 Nov 11 15:26 sqltrace.sql but I simply doesnt get anything in the sqltrace logfile I can do auth and acct with the DB, so it actually works, but I would have liked the sqltrace in the debugging phase. Any explanation on why sqltrace doesn't log ??? -- Søren Schrøder, Tecnical Innovation, Cybercity (a Telenor Company). sch(a)cybercity.dk, (+45) 60503045. "Obey Gravity.... It's the LAW!"

2 4

Freeradius proxy
by Siumafua Moala 12 Nov '08

12 Nov '08

Hi, I'm running freeradius 2.0.5+mysql backend. Everything is fine but I want to use the current server to 1. allocate ip address 2. use cisco-avpairs to allocate vrf Then send to another server to check only the username and password. I have gone through the proxy configuration and it seems you can proxy either the auth or acct but I cannot seems to find how to split the authentication. Its seems on the users file you can use pass-through but I am not using the users file! Appreciate any help on this. Thanks

2 1

wierd problem with freeradius 2.1.1
by Anatoli Logvinski 12 Nov '08

12 Nov '08

Hi, I have freeradius 2.1.1 configured to handle peap and ttls/mschap2 against AD. It accepts usernames in 3 formats "DOMAIN\username", "username@domain" and "username". The problem is that one of the formats doesn't work. It can be any one of the three and can change when I reboot the machine where the server is running and doesn't change if I only restart the server itself and it can be different for different wireless clients. I have a similarly configured 1.1.7 and it's been working perfectly. 2.1.1 runs on RHEL5 (REd Hat Enterprise Linux) 64-bit and I also tried it on RHEL4 32-bit with the same results. There is no reject from the server but looking at the packet trace I can see that instead of a TLS encrypted handshake message the client gets a PEAP request and replies with Deauthentication This is a packet trace of a successful session: 228 11:45:27.797692 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, Identity [RFC3748] 230 11:45:27.802659 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, PEAP [Palekar] 232 11:45:27.804773 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Client Hello 234 11:45:27.808900 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 236 11:45:27.811647 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 238 11:45:27.814901 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 240 11:45:27.815646 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 242 11:45:27.818397 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 244 11:45:27.820270 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 246 11:45:27.837270 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Change Cipher Spec, Encrypted Handshake Message 248 11:45:27.845145 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 250 11:45:27.848520 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Application Data 252 11:45:27.849269 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Application Data 254 11:45:27.852894 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Application Data 256 11:45:27.862774 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Application Data And this is unsuccessful session: 162 16:12:11.521443 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, Identity [RFC3748] 165 16:12:11.572735 IntelCor_d6:da:d5 Cisco_89:9d:49 EAPOL Start 167 16:12:11.573466 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, Identity [RFC3748] 283 16:12:22.521827 IntelCor_d6:da:d5 Cisco_89:9d:49 IEEE 802.11 QoS Null function (No data), SN=0, FN=0, Flags=.......TC 319 16:12:25.126804 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, Identity [RFC3748] 321 16:12:25.131179 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, PEAP [Palekar] 323 16:12:25.132286 IntelCor_d6:da:d5 Cisco_89:9d:49 SSL Client Hello 325 16:12:25.136419 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 327 16:12:25.140310 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 329 16:12:25.143789 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 331 16:12:25.144547 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 333 16:12:25.147047 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 335 16:12:25.148670 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 337 16:12:25.151045 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, PEAP [Palekar] 339 16:12:25.164296 IntelCor_d6:da:d5 Cisco_89:9d:49 IEEE 802.11 Deauthentication, SN=2842, FN=0, Flags=........C Here is an example of a failed session from the server debug: rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=254, length=378 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020300a719800000009d1603010098010000940301491a294895f3db20fdb54221a9e3f3d6201c394835761953775233784549a7c320d5e5e5c9f84361b56c294e147e0ff1c8402384b74f32f27b9b9e93c46b1da6440018002f00350005000ac009c00ac013c0140032003800130004010000330000001d001b0100186131303032373538406164656c616964652e6564752e6175000a00080006001700180019000b00020100 State = 0x29bd479429be5e064d1acd012c09ab36 Message-Authenticator = 0xf3843f7b19a689f2590496657c26c1c0 Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 3 length 167 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Debug: TLS Length 157 Wed Nov 12 11:24:38 2008 : Info: [peap] Length Included Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 11 Wed Nov 12 11:24:38 2008 : Info: [peap] (other): before/accept initialization Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: before/accept initialization Wed Nov 12 11:24:38 2008 : Info: [peap] <<< TLS 1.0 Handshake [length 0098], ClientHello Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 read client hello A Wed Nov 12 11:24:38 2008 : Info: [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 write server hello A Wed Nov 12 11:24:38 2008 : Info: [peap] >>> TLS 1.0 Handshake [length 090b], Certificate Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 write certificate A Wed Nov 12 11:24:38 2008 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 write server done A Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 flush data Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Wed Nov 12 11:24:38 2008 : Debug: In SSL Handshake Phase Wed Nov 12 11:24:38 2008 : Debug: In SSL Accept mode Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 254 to 10.16.17.33 port 32770 EAP-Message = 0x0104040019c000000948160301002a020000260301491a294e3f610fb297f401436df8548042ce957ae530c81f6d2915e3379992bb00002f00160301090b0b0009070009040004b9308204b53082041ea00302010202033f048e300d06092a864886f70d01010505003081ec310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3130302e060355040b1327687474703a2f2f7777772e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f EAP-Message = 0x06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f72697479312a302806092a864886f70d010901161b70726163746963657340737461726669656c64746563682e636f6d301e170d3036313231333231333931365a170d3038313231333231333931365a3065311f301d060355040a13167261646975732e6164656c616964652e6564752e61753121301f060355040b1318446f6d61696e20436f6e74726f6c2056616c696461746564311f301d060355040313167261646975732e6164656c616964652e6564752e617530819f300d06092a864886f70d010101050003818d003081890281 EAP-Message = 0x8100d7fbf50a4906fe53cda9cb3597730e36b640eaad16028c68cc317ec62b4c9d2351ba870cb637a42f51f30c29ba6ee783df929b0a430589c9e719ad6f35be2fa2ef652e78f202201aef69a218ff9c7a88abb3caf692912d3e3be9e97f2d027906627102787b3f4229a5fc0ce71daa1a5688b489b0590cf631297649b57e1021af0203010001a38201e9308201e530090603551d1304023000300b0603551d0f0404030205a0301d0603551d250416301406082b0601050507030106082b0601050507030230560603551d1f044f304d304ba049a0478645687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f EAP-Message = 0x6d2f7265706f7369746f72792f737461726669656c6469737375696e672e63726c30520603551d20044b30493047060b6086480186fd6d010717013038303606082b06010505070201162a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f727930818006082b0601050507010104743072302906082b06010505073001861d687474703a2f2f6f6373702e737461726669656c64746563682e636f6d304506082b060105050730028639687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f73665f69737375696e672e637274301d060355 EAP-Message = 0x1d0e04160414fe709c5e71bf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd479428b95e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 45. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=255, length=217 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020400061900 State = 0x29bd479428b95e064d1acd012c09ab36 Message-Authenticator = 0xf2794b5e43df427c07ab233e76e5ae0f Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 4 length 6 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Info: [peap] Received TLS ACK Wed Nov 12 11:24:38 2008 : Info: [peap] ACK handshake fragment handler Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 1 Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 255 to 10.16.17.33 port 32770 EAP-Message = 0x010503fc1940137b8a796c791f63339cc98f1d7e301f0603551d23041830168014ac55deb7ea13ebfc9868e253601ef1253e8ceee7303d0603551d110436303482167261646975732e6164656c616964652e6564752e6175821a7777772e7261646975732e6164656c616964652e6564752e6175300d06092a864886f70d010105050003818100029139d07b6cae175ece69c94e0e5c8d4505577787beb56df5b14c2086a078c1e8565a656b3165ad14078cde6ad2dfe34172b2b9d94296e8880e1639729ae30997b70330a191278675379c25005a767105d3bbf27c1d134dcff7a23ef8f5b8b39f724cf468b03a35964f97e3a97b40e1cbc6b8e177f9 EAP-Message = 0x992b30457d2fbaf4407e00044530820441308203aaa00302010202020104300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3034303131343231303532315a17 EAP-Message = 0x0d3234303130393231303532315a3081ec310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3130302e060355040b1327687474703a2f2f7777772e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f72697479312a302806092a864886f70d010901161b70726163746963657340737461726669656c64746563682e636f6d EAP-Message = 0x30819d300d06092a864886f70d010101050003818b0030818702818100db11436bdcd169785949e86e74140874116c7eb72aa822d8423c7acf9f50b246aea6671a2322be0fb334fbacac90aa5b28c270f6b68a802ae09b9c52e091a872a016e1c44e7d1109b39eb9d4f3b250c46d4808bdbc2a970c6da38a6a3c9acf4a34dc1edeea5a26c0a1a282a94afb862212903ab282d492919fa9459fc3a4dbfb020103a38201213082011d300c0603551d13040530030101ff300b0603551d0f040403020106304a0603551d1f04433041303fa03da03b8639687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f72 EAP-Message = 0x65706f7369746f72 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd47942bb85e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 46. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=0, length=217 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020500061900 State = 0x29bd47942bb85e064d1acd012c09ab36 Message-Authenticator = 0x0d141b37c603c7d45fa85a8a89de8c6c Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 5 length 6 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Info: [peap] Received TLS ACK Wed Nov 12 11:24:38 2008 : Info: [peap] ACK handshake fragment handler Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 1 Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.16.17.33 port 32770 EAP-Message = 0x010601621900792f726f6f742e63726c304f0603551d20044830463044060b6086480186f845010717033035303306082b060105050702011627687474703a2f2f7777772e737461726669656c64746563682e636f6d2f7265706f7369746f7279303906082b06010505070101042d302b302906082b06010505073001861d687474703a2f2f6f6373702e737461726669656c64746563682e636f6d301d0603551d0e04160414ac55deb7ea13ebfc9868e253601ef1253e8ceee730090603551d2304023000300d06092a864886f70d0101050500038181007e1c98bead038d2585ee7c9088222bfe27f442b2ec7fb5fc726805a47d91ef28d17d2039 EAP-Message = 0x3b790837681852d58f03d2894f1e11d1e9a5744bfc5f67658471847859b7d6c9d7d79335e613ab943c8e9340898cc0d7f2e70752d1708f988ceba06dd1365390a08f16301edec3bf7f46a5952af9c8de3bdb77f4f232b13361a2303516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd47942abb5e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 47. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=1, length=217 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020600061900 State = 0x29bd47942abb5e064d1acd012c09ab36 Message-Authenticator = 0x17ceb443a291e862980fc4971fdc4a91 Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 6 length 6 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Info: [peap] Received TLS ACK Wed Nov 12 11:24:38 2008 : Info: [peap] ACK handshake fragment handler Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 1 Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 1 to 10.16.17.33 port 32770 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd47942dba5e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 48. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 44 ID 253 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 45 ID 254 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 46 ID 255 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 47 ID 0 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 48 ID 1 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Debug: Ready to process requests. Any help would be appreciated -- Anatoli

1 0

LDAP & MSCHAP errors
by Simon Palmer 11 Nov '08

11 Nov '08

Hi, We are trying to set up freeRADIUS 2.1.1 against eDirectory LDAP and getting problems. (Trying SLES 10 SP2 32bit and 64 bit) pap against LDAP works fine chap against LDAP works fine (With ntradping) BUT - MSCHAPv2 gives "FAILED: MS-CHAP2-Response is incorrect" Am I missing something required for MSCHAP to work? The NT-Password seems to be retrieved... Working CHAP debug from ntradping: Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for check items in directory... Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: acctFlags -> SMB-Account-CTRL-TEXT == "[UX ]" Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374133413937333342303139423034323645363933373332 Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaLmPassword -> LM-Password == 0x3635423939303044343142344533363831394631304139333344343836384443 Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for reply items in directory... Tue Nov 11 10:10:26 2008 : Info: [ldap] user testuser authorized to use remote access Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 11 10:10:26 2008 : Info: ++[ldap] returns ok Tue Nov 11 10:10:26 2008 : Info: ++[expiration] returns noop Tue Nov 11 10:10:26 2008 : Info: ++[logintime] returns noop Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing NT-Password from hex encoding Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing LM-Password from hex encoding Tue Nov 11 10:10:26 2008 : Info: [pap] Found existing Auth-Type, not changing it. Tue Nov 11 10:10:26 2008 : Info: ++[pap] returns noop Tue Nov 11 10:10:26 2008 : Info: Found Auth-Type = CHAP Tue Nov 11 10:10:26 2008 : Info: +- entering group CHAP {...} Tue Nov 11 10:10:26 2008 : Info: [chap] login attempt by "testuser" with CHAP password Tue Nov 11 10:10:26 2008 : Info: [chap] Using clear text password "ommitted" for user testuser authentication. Tue Nov 11 10:10:26 2008 : Info: [chap] chap user testuser authenticated succesfully Tue Nov 11 10:10:26 2008 : Info: ++[chap] returns ok Tue Nov 11 10:10:26 2008 : Info: +- entering group post-auth {...} Tue Nov 11 10:10:26 2008 : Info: ++[exec] returns noop Sending Access-Accept of id 13 to 194.82.224.117 port 1958 Debug from it not working using MSCHAP2: Tue Nov 11 10:06:10 2008 : Info: [ldap] looking for check items in directory... Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: acctFlags -> SMB-Account-CTRL-TEXT == "[UX ]" Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374123413937333342303139423034323445363933373332 Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: sambaLmPassword -> LM-Password == 0x3635423939303044342142344533363831394631304139353344343836384443 Tue Nov 11 10:06:10 2008 : Info: [ldap] looking for reply items in directory... Tue Nov 11 10:06:10 2008 : Info: [ldap] user testuser authorized to use remote access Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 11 10:06:10 2008 : Info: ++[ldap] returns ok Tue Nov 11 10:06:10 2008 : Info: ++[expiration] returns noop Tue Nov 11 10:06:10 2008 : Info: ++[logintime] returns noop Tue Nov 11 10:06:10 2008 : Info: [pap] Normalizing NT-Password from hex encoding Tue Nov 11 10:06:10 2008 : Info: [pap] Normalizing LM-Password from hex encoding Tue Nov 11 10:06:10 2008 : Info: [pap] Found existing Auth-Type, not changing it. Tue Nov 11 10:06:10 2008 : Info: ++[pap] returns noop Tue Nov 11 10:06:10 2008 : Info: Found Auth-Type = MSCHAP Tue Nov 11 10:06:10 2008 : Info: +- entering group MS-CHAP {...} Tue Nov 11 10:06:10 2008 : Info: [mschap] Found LM-Password Tue Nov 11 10:06:10 2008 : Info: [mschap] Found NT-Password Tue Nov 11 10:06:10 2008 : Info: [mschap] Told to do MS-CHAPv2 for testuser with NT-Password Tue Nov 11 10:06:10 2008 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Tue Nov 11 10:06:10 2008 : Info: ++[mschap] returns reject Tue Nov 11 10:06:10 2008 : Info: Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} ++[ldap] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to 192.168.100.25 port 32834 MS-CHAP-Error = "\000E=691 R=1" modules/ldap extract: ldap { server = "192.168.1.1" port = 636 identity = "cn=admin,o=csg" password = "password" basedn = "O=csg" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" ... # start_tls = yes tls_mode = yes # cacertfile = /path/to/cacert.pem # I don't think we need to check the certs so put require_cert below to never # cacertdir = /usr/local/etc/raddb/certs # certfile = /usr/local/etc/raddb/certs/certs.b64 # keyfile = /path/to/radius.key #randfile = /usr/local/etc/raddb/random require_cert = "never" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = nspmPassword edir_account_policy_check = no #I've tried this with yes - and enabling the option in sites-enabled/default and it's no different Default configuration in modules/mschap and modules/chap In sites-enabled/default authorize { ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } post-auth { # ldap Post-Auth-Type REJECT { # attr_filter.access_reject ldap } Some help would be most appreciated. Cheers Simon Simon Palmer Systems Development Officer Colegsirgâr e-mail: simon.palmer(a)colegsirgar.ac.uk tel: 01554 748088 Mae'r e-bost hwn ac unrhyw ffeiliau atodedig yn gyfrinachol ac at sylw'r unigolyn neu'r sefydliad a enwir uchod. Bydd unrhyw farn neu sylwadau a fynegir yn perthyn i'r awdur yn unig ac ni chynrychiolant o anghenraid farn Coleg Sir Gâr. Os ydych chi wedi derbyn yr e-bost hwn ar gam, rhowch sylw i'r gweinyddwr ar y cyfeiriad canlynol: postmaster(a)colegsirgar.ac.uk Cysidrwch yr amgylchedd - a oes wir angen argraffu'r ebost hwn? This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Coleg Sir Gâr. If you have received this email in error please notify the administrator on the following address: postmaster(a)colegsirgar.ac.uk Please consider the environment - do you really need to print this email?

2 1

unix accounts
by John Dakos [ Enovation Technologies ] 11 Nov '08

11 Nov '08

hello all i have freebsd with freeradius 2.0 i want accounts from my /etc/passwd for logins on freeradius i dont want to use users file on raddb how can i do that ? any idea thanks John

2 1

undefined symbol: rlm_sql_query
by Rasmus Paarlberg 11 Nov '08

11 Nov '08

Hi After upgrading to FreeRadius 2.1.1 I get the following error after running the service for a while. I suspect it being a result of a malfunction during accounting data exchange. /usr/local/sbin/radiusd: symbol lookup error: /usr/local/lib/rlm_sqlippool-2.1.1.so: undefined symbol: rlm_sql_query The below is the debug print up until the error. Anyone knowing what the problem might be? Maybe just point me into the right direction? Thanks in advance. ./rasmus rad_recv: Accounting-Request packet from host 192.168.7.9 port 1223, id=222, length=212 NAS-IP-Address = 192.168.7.9 NAS-Identifier = "xxx" Called-Station-Id = "xxxt" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual Acct-Status-Type = Start Framed-IP-Address = 192.168.0.4 Acct-Session-Id = "3E87A45A1B7DE62F" User-Name = "xxx" 3GPP-IMSI = "xxx" Calling-Station-Id = "xxx" 3GPP-PDP-Type = 0 3GPP-GPRS-Negotiated-QoS-profile = "99-13921f739697b074821040" 3GPP-SGSN-Address = xxx 3GPP-Selection-Mode = "0" Acct-Authentic = RADIUS Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',Client-IP-Address = 192.168.7.9,NAS-IP-Address = 192.168.7.9,Acct-Session-Id = "3E87A45A1B7DE62F",User-Name = "xxx"' [acct_unique] Acct-Unique-Session-ID = "6156897ce44b112f". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "xxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.7.9/detail-20081111 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.7.9/detail-20081111 [detail] expand: %t -> Tue Nov 11 14:41:29 2008 ++[detail] returns ok ++[unix] returns noop [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> xxx rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[radutmp] returns noop [main_pool] This is not an Accounting-Stop. Return NOOP. ++[main_pool] returns noop [sql] expand: %{User-Name} -> xxx [sql] sql_set_user escaped user --> 'xxx' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', [sql] expand: /usr/local/var/log/radius/sqltrace.sql -> /usr/local/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('3E87A45A1B7DE62F', '6156897ce44b112f', 'xxx', '', '192.168.7.9', '', 'Virtual', '2008-11-11 14:41:29', NULL, '0', 'RADIUS', '', '', '0', '0', 'xxx', 'xxx', '', 'Framed-User', 'GPRS-PDP-Context', '192.168.0.4', '0', '0', '') rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_sql (sql): Reserving sql socket id: 3 [sqlippool] expand: %{User-Name} -> xxx [sqlippool] sql_set_user escaped user --> 'xxx' [sqlippool] expand: START TRANSACTION -> START TRANSACTION /usr/local/sbin/radiusd: symbol lookup error: /usr/local/lib/rlm_sqlippool-2.1.1.so: undefined symbol: rlm_sql_query

1 0

Strange Problem with chap.
by Oguzhan Kayhan 11 Nov '08

11 Nov '08

Hello, I am using chilli-coova as hotspot and making its authentication via freeradius. I dont know if you have any experience with this software but, It has 2 kind of login pages. One is a cgi page with clean password, other is a java script making chap authentication. here is the problem. On freeradius i am using rlm_perl authentication for my users. When i use cgi page or radtest tool and send clean password, everything works flawless... But if i decide to use chap somthing strange happens.. If i type correct user/pass freeradus denies it.. But it i type the password wrong, freeradius accepts it.. Heres the debug for freeradius.. 7798-1 is with the right user/pass comination 7798 is the wrong user/pass combination rad_recv: Access-Request packet from host 139.179.14.250 port 33545, id=30, length=285 Vendor-14559-Attr-8 = 0x312e302e3131 User-Name = "7798-1" CHAP-Challenge = 0x091c2ecc9622c2b8072a20db2a85840e CHAP-Password = 0x001143a4c3f8a192f89b9ff9e7f6f85fe0 NAS-IP-Address = 192.168.182.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-14-22-A1-BB-AB" Called-Station-Id = "00-0E-0C-6E-6E-7C" NAS-Identifier = "nas01" Acct-Session-Id = "491944cd00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Message-Authenticator = 0xcf009790c3d4d941242929020db19b43 server lojnet { +- entering group authorize ++[preprocess] returns ok users: Matched entry DEFAULT at line 72 ++[files] returns ok ++[control] returns ok perl_pool: item 0xbe7fd00 asigned new request. Handled so far: 1 found interpetator at address 0xbe7fd00 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair CHAP-Password = 0x001143a4c3f8a192f89b9ff9e7f6f85fe0 rlm_perl: Added pair WISPr-Logoff-URL = http://192.168.182.1:3990/logoff rlm_perl: Added pair Acct-Session-Id = 491944cd00000001 rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Vendor-14559-Attr-8 = 0x312e302e3131 rlm_perl: Added pair Called-Station-Id = 00-0E-0C-6E-6E-7C rlm_perl: Added pair Message-Authenticator = 0xcf009790c3d4d941242929020db19b43 rlm_perl: Added pair CHAP-Challenge = 0x091c2ecc9622c2b8072a20db2a85840e rlm_perl: Added pair NAS-IP-Address = 192.168.182.1 rlm_perl: Added pair Calling-Station-Id = 00-14-22-A1-BB-AB rlm_perl: Added pair WISPr-Location-ID = isocc=,cc=,ac=,network=Coova, rlm_perl: Added pair User-Name = 7798-1 rlm_perl: Added pair NAS-Identifier = nas01 rlm_perl: Added pair Framed-IP-Address = 192.168.182.2 rlm_perl: Added pair NAS-Port = 1 rlm_perl: Added pair WISPr-Location-Name = My_HotSpot rlm_perl: Added pair Reply-Message = Unknown Username Or Password rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Auth-Type = Perl perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xbe7fd00 ++[perl_lojnet] returns reject Invalid user: [7798-1/<CHAP-Password>] (from client wireless-client port 1 cli 00-14-22-A1-BB-AB) } # server lojnet Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 7798-1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 21 for 1 seconds Going to the next request Waking up in 0.7 seconds. Sending delayed reject for request 21 Sending Access-Reject of id 30 to 139.179.14.250 port 33545 Reply-Message = "Unknown Username Or Password" Waking up in 4.9 seconds. Cleaning up request 21 ID 30 with timestamp +1299 Ready to process requests. rad_recv: Access-Request packet from host 139.179.14.250 port 56290, id=34, length=283 Vendor-14559-Attr-8 = 0x312e302e3131 User-Name = "7798" CHAP-Challenge = 0xf5a327d969a14458fc8e232dc2b2dd0e CHAP-Password = 0x00754c55931928ae23c86ffc791482d963 NAS-IP-Address = 192.168.182.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-14-22-A1-BB-AB" Called-Station-Id = "00-0E-0C-6E-6E-7C" NAS-Identifier = "nas01" Acct-Session-Id = "491944cd00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Message-Authenticator = 0x8ccc91235f97010a7c09802979e2cdea server lojnet { +- entering group authorize ++[preprocess] returns ok users: Matched entry DEFAULT at line 72 ++[files] returns ok ++[control] returns ok perl_pool: item 0xc1dfb10 asigned new request. Handled so far: 1 found interpetator at address 0xc1dfb10 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair CHAP-Password = 0x00754c55931928ae23c86ffc791482d963 rlm_perl: Added pair WISPr-Logoff-URL = http://192.168.182.1:3990/logoff rlm_perl: Added pair Acct-Session-Id = 491944cd00000001 rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Vendor-14559-Attr-8 = 0x312e302e3131 rlm_perl: Added pair Called-Station-Id = 00-0E-0C-6E-6E-7C rlm_perl: Added pair Message-Authenticator = 0x8ccc91235f97010a7c09802979e2cdea rlm_perl: Added pair CHAP-Challenge = 0xf5a327d969a14458fc8e232dc2b2dd0e rlm_perl: Added pair NAS-IP-Address = 192.168.182.1 rlm_perl: Added pair Calling-Station-Id = 00-14-22-A1-BB-AB rlm_perl: Added pair WISPr-Location-ID = isocc=,cc=,ac=,network=Coova, rlm_perl: Added pair User-Name = 7798 rlm_perl: Added pair NAS-Identifier = nas01 rlm_perl: Added pair Framed-IP-Address = 192.168.182.2 rlm_perl: Added pair NAS-Port = 1 rlm_perl: Added pair WISPr-Location-Name = My_HotSpot rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Auth-Type = Perl perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xc1dfb10 ++[perl_lojnet] returns ok rad_check_password: Found Auth-Type Perl auth: type "Perl" +- entering group Perl perl_pool: item 0xc53f920 asigned new request. Handled so far: 1 found interpetator at address 0xc53f920 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair CHAP-Password = 0x00754c55931928ae23c86ffc791482d963 rlm_perl: Added pair Acct-Session-Id = 491944cd00000001 rlm_perl: Added pair WISPr-Logoff-URL = http://192.168.182.1:3990/logoff rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Vendor-14559-Attr-8 = 0x312e302e3131 rlm_perl: Added pair Called-Station-Id = 00-0E-0C-6E-6E-7C rlm_perl: Added pair Message-Authenticator = 0x8ccc91235f97010a7c09802979e2cdea rlm_perl: Added pair CHAP-Challenge = 0xf5a327d969a14458fc8e232dc2b2dd0e rlm_perl: Added pair NAS-IP-Address = 192.168.182.1 rlm_perl: Added pair Calling-Station-Id = 00-14-22-A1-BB-AB rlm_perl: Added pair WISPr-Location-ID = isocc=,cc=,ac=,network=Coova, rlm_perl: Added pair User-Name = 7798 rlm_perl: Added pair NAS-Identifier = nas01 rlm_perl: Added pair Framed-IP-Address = 192.168.182.2 rlm_perl: Added pair NAS-Port = 1 rlm_perl: Added pair WISPr-Location-Name = My_HotSpot rlm_perl: Added pair Acct-Interim-Interval = 60 rlm_perl: Added pair WISPr-Bandwidth-Max-Up = 25600000 rlm_perl: Added pair WISPr-Bandwidth-Max-Down = 100000000 rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Auth-Type = Perl perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xc53f920 ++[perl_lojnet] returns ok +- entering group session ++[sql_lojnet] returns noop Login OK: [7798/<CHAP-Password>] (from client wireless-client port 1 cli 00-14-22-A1-BB-AB) +- entering group post-auth ++[exec] returns noop } # server lojnet Sending Access-Accept of id 34 to 139.179.14.250 port 56290

2 3

Accepting all terminal-server logins from a specific unix group
by J B Bell 11 Nov '08

11 Nov '08

Hi folks, Following the FAQ, I have added a line like this to my users file: DEFAULT Group == eng, Auth-Type := Accept I do have "usegroup = yes" set in my radiusd.conf. Now, just below that, as the final entry, is this: DEFAULT Auth-Type := Accept Extreme-Security-Profile = "port100full LOGOFF-PROFILE=port100full;", Extreme-Netlogin-Vlan = guest So, we have both Extreme switches and terminal servers authenticating to our radius server. Prior to this attempt I've had individual user entries for the terminal servers, of the form: joeuser Auth-Type := Accept Service-Type = Administrative If I add the Service-Type line to my default group line, it breaks authentication and also slows it way down, taking about 20-30 seconds. With the "DEFAULT Group" line by itself, however, *all* users, including nonexistent ones, get accepted. This isn't ideal, obviously. I'm also concerned that my guest vlan logins may not be making it past that first default group entry. Any ideas how to make this work? --JB

2 1

radiusd crash after startup
by Daniel Kaminski 11 Nov '08

11 Nov '08

hi list, i have problems with a self-compiled freeradius-2.11 on solaris10 (sparc v240). freeradius works perfectly in debugging-mode (radius -X) also with my config and my mysql-db. but when i start radiusd without -X it starts and crashs directly. here a snip of the radius.log: Fri Nov 7 17:17:59 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Nov 7 17:17:59 2008 : Info: rlm_sql (sql): Attempting to connect to radius@XX.XX.XXX.XX:3306/radius Fri Nov 7 17:17:59 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Nov 7 17:17:59 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Nov 7 17:17:59 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Fri Nov 7 17:17:59 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Fri Nov 7 17:17:59 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 no error entry or anything else. can anyone help me? thanks daniel

2 1

Need help to use 802.1x with WEP and WPA/AES
by Le Sang 10 Nov '08

10 Nov '08

Hello All, Now, I'm using 802.1x for authenticating wireless user. But unfortunately, I cannot use 802.1x with WEP and WPA(WPA2)/AES. Can anybody help me and tell me why I cannot use 802.1x with methods encryption above. Best Regard, SangLee

2 1