- Freeradius-Users - lists.freeradius.org

How to forward MAC-authentiation-requests over a FreeRADIUS-proxy to a FreeRADIUS-server?
by r.bruengel＠freenet.de 08 Oct '08

08 Oct '08

Hello everyone, I use MAC-authentication and got some problems by using a FreeRADIUS as a proxy to tunnel requests and answers between my switch and my normal FreeRADIUS-server. When I tested MAC-authentication with my switch and FreeRADIUS-server without anything between it worked fine. The MAC-address has been used as username and cleartext-password. Well, when I set up my FreeRADIUS-proxy and want to use it the following message appears in the radius.log of my FreeRADIUS-proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.58 port 1864 - ID 177 : IGNORED The port and the ID vary the port is counted up by every try and the ID well, I dont know. I just want to forward the MAC-address and the cleartext-password to my FreeRADIUS-server. When this data arrives at my FreeRADIUS-server it should be checked and the authentication answer should be sent back to my FreeRADIUS-proxy which forwards it to my switch. I hope that you can help me I just started to work with FreeRADIUS, so Im just a rookie. Heres some data: FreeRADIUS: V 2.0.4 Operating System: Debian Lenny (testing) Kernel: 2.6.25-2-686 Switch: Foundry EdgeIron 2402CF FreeRADIUS-server: 192.168.1.61 FreeRADIUS-proxy: 192.168.1.80 Switch: 192.168.1.58 The following configuration belongs to my FreeRADIUS-server: radiusd.conf listen { type = auth ipaddr = 192.168.1.61 #FreeRADIUS-server IP port = 1812 } [] proxy_requests = no clients.conf client 192.168.1.80 { secret = testing123 } The following configuration belongs to my FreeRADIUS-proxy: radiusd.conf listen { type = proxy ipaddr = 192.168.1.80 #FreeRADIUS-proxy IP port = 1812 } proxy.conf proxy server { default_fallback = no } home_server RADIUS_SERVER { type = auth ipaddr = 192.168.1.61 #FreeRADIUS-server IP port = 1812 secret = testing123 [] } home_server_pool RADIUS_SERVER_POOL { type = fail-over home_server = RADIUS_SERVER } realm RADIUS_REALM { auth_pool = RADIUS_SERVER_POOL } The following configuration belongs to my switch: RADIUS-Server: 192.168.1.80 #FreeRADIUS-proxy Port: 1812 Key: testing123 So, that should be the way: Switch -> FR-proxy -> FR-server 192.168.1.58 192.168.1.80 192.168.1.61 In advance: Thanks a lot for your help! Best regards from Germany, Raphael Brüngel

3 2

Sql-Group value
by donaldbjames＠suddenlinkmail.com 07 Oct '08

07 Oct '08

Hi, In freeradius 2, where is the value of "Sql-Group" set? I am using the mysql database. Is the value of Sql-Group set in one of the tables? Sincerely, Don James

2 2

freeradius 2 problem
by donaldbjames＠suddenlinkmail.com 07 Oct '08

07 Oct '08

Hi, I have a working radius server using freeradius 1.1.7. I am trying to upgrade to freeradius 2. Using radtest, I get a reply, but the radgroup reply data is not included in the reply. I probably have one of the configuration files done wrong. My question is: which configuration files are necessary when using freeradius 2? Sincerely, Don James

2 1

finally its working, but still no authentication againts AD
by luis a 07 Oct '08

07 Oct '08

hello again , finally my freeradius its working following all the steps from http://deployingradius.com/documents/configuration/active_directory.html but i have the same issue check my radius debug , thanks for read Luis. radiusd -X FreeRADIUS Version 2.1.1, for host x86_64-unknown-linux-gnu, built on Sep 27 2008 at 11:05:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/openradius/raddb/radiusd.conf including configuration file /etc/openradius/raddb/proxy.conf including configuration file /etc/openradius/raddb/clients.conf including files in directory /etc/openradius/raddb/modules/ including configuration file /etc/openradius/raddb/modules/exec including configuration file /etc/openradius/raddb/modules/etc_group including configuration file /etc/openradius/raddb/modules/mschap including configuration file /etc/openradius/raddb/modules/files including configuration file /etc/openradius/raddb/modules/logintime including configuration file /etc/openradius/raddb/modules/digest including configuration file /etc/openradius/raddb/modules/pap including configuration file /etc/openradius/raddb/modules/radutmp including configuration file /etc/openradius/raddb/modules/preprocess including configuration file /etc/openradius/raddb/modules/detail.example.com including configuration file /etc/openradius/raddb/modules/attr_filter including configuration file /etc/openradius/raddb/modules/always including configuration file /etc/openradius/raddb/modules/detail including configuration file /etc/openradius/raddb/modules/mac2ip including configuration file /etc/openradius/raddb/modules/smbpasswd including configuration file /etc/openradius/raddb/modules/krb5 including configuration file /etc/openradius/raddb/modules/passwd including configuration file /etc/openradius/raddb/modules/detail.log including configuration file /etc/openradius/raddb/modules/sradutmp including configuration file /etc/openradius/raddb/modules/attr_rewrite including configuration file /etc/openradius/raddb/modules/echo including configuration file /etc/openradius/raddb/modules/ippool including configuration file /etc/openradius/raddb/modules/checkval including configuration file /etc/openradius/raddb/modules/acct_unique including configuration file /etc/openradius/raddb/modules/pam including configuration file /etc/openradius/raddb/modules/expr including configuration file /etc/openradius/raddb/modules/sql_log including configuration file /etc/openradius/raddb/modules/inner-eap including configuration file /etc/openradius/raddb/modules/mac2vlan including configuration file /etc/openradius/raddb/modules/unix including configuration file /etc/openradius/raddb/modules/policy including configuration file /etc/openradius/raddb/modules/realm including configuration file /etc/openradius/raddb/modules/linelog including configuration file /etc/openradius/raddb/modules/wimax including configuration file /etc/openradius/raddb/modules/ldap including configuration file /etc/openradius/raddb/modules/chap including configuration file /etc/openradius/raddb/modules/expiration including configuration file /etc/openradius/raddb/modules/counter including configuration file /etc/openradius/raddb/eap.conf including configuration file /etc/openradius/raddb/sql.conf including configuration file /etc/openradius/raddb/sql/mysql/dialup.conf including configuration file /etc/openradius/raddb/sql/mysql/counter.conf including configuration file /etc/openradius/raddb/policy.conf including files in directory /etc/openradius/raddb/sites-enabled/ including configuration file /etc/openradius/raddb/sites-enabled/default including configuration file /etc/openradius/raddb/sites-enabled/inner-tunnel including dictionary file /etc/openradius/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=MINZ --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MINZ} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/openradius/raddb/certs/server.pem" certificate_file = "/etc/openradius/raddb/certs/server.pem" CA_file = "/etc/openradius/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/openradius/raddb/certs/dh" random_file = "/etc/openradius/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/openradius/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/openradius/raddb/users" acctusersfile = "/etc/openradius/raddb/acct_users" preproxy_usersfile = "/etc/openradius/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/openradius/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/openradius/raddb/huntgroups" hints = "/etc/openradius/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/openradius/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 43374, id=139, length=72 User-Name = "luis" User-Password = "test" NAS-IP-Address = 172.16.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "luis", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> luis attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 43374 Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +3 Ready to process requests.

2 3

Dynamic Clients with FreeRADIUS
by jasoneswan 07 Oct '08

07 Oct '08

Has anyone gotten dynamic-clients working with freeradius yet? I'm trying to accept clients from ANY IP, then looks up the IP in sql 'nas' table to see if it exists -- View this message in context: http://www.nabble.com/Dynamic-Clients-with-FreeRADIUS-tp19384912p19384912.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 11

NTLM_auth active directory - what is wrong?
by Santiago Matiz V 07 Oct '08

07 Oct '08

Hi all I follow the instructions of Alan : <http://deployingradius.com/documents/configuration/active_directory.html> to authenticate ntlm_auth with radius but appers the following message: " WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user." what is wrong? Please help. Santiago FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Sep 3 2008 at 15:55:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log_auth = yes log_auth_badpass = no log_auth_goodpass = no log_stripped_names = no } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.100.16.11 { require_message_authenticator = no secret = "123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DOMAIN.LOC { authhost = LOCAL accthost = LOCAL } realm DOMAIN { authhost = LOCAL accthost = LOCAL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-DOMAIN} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating realmslash realm realmslash { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.100.16.11 port 1308, id=0, length=217 Message-Authenticator = 0x92d1b860b93a1c6d28f08eaa37697101 Service-Type = Framed-User User-Name = "DOMAIN\\user\000" Framed-MTU = 1488 Called-Station-Id = "00-16-E0-04-FE-44:pcountry" Calling-Station-Id = "00-1B-77-4D-1A-74" NAS-Identifier = "PISO 7 UG SISTEMAS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001601434c49434f554e5452595c736d6174697a NAS-IP-Address = 192.100.16.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\user" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. ++[realmslash] returns ok rlm_realm: Request already proxied. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry user at line 178 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [DOMAIN\\user\000] (from client 192.100.16.11 port 1 cli 00-1B-77-4D-1A-74) Sending Access-Reject of id 0 to 192.100.16.11 port 1308 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.100.16.11 port 1310, id=0, length=217 Message-Authenticator = 0xf829fc414e9407ab04ede033d5a60941 Service-Type = Framed-User User-Name = "DOMAIN\\user\000" Framed-MTU = 1488 Called-Station-Id = "00-16-E0-04-FE-44:pcountry" Calling-Station-Id = "00-1B-77-4D-1A-74" NAS-Identifier = "PISO 7 UG SISTEMAS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001601434c49434f554e5452595c736d6174697a NAS-IP-Address = 192.100.16.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\user" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. ++[realmslash] returns ok rlm_realm: Request already proxied. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry user at line 178 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [DOMAIN\\user\000] (from client 192.100.16.11 port 1 cli 00-1B-77-4D-1A-74) Sending Access-Reject of id 0 to 192.100.16.11 port 1310 Finished request 1. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.100.16.11 port 1312, id=0, length=217 Message-Authenticator = 0xef8314925f34ccf891d91ca6fa18857d Service-Type = Framed-User User-Name = "DOMAIN\\user\000" Framed-MTU = 1488 Called-Station-Id = "00-16-E0-04-FE-44:pcountry" Calling-Station-Id = "00-1B-77-4D-1A-74" NAS-Identifier = "PISO 7 UG SISTEMAS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200001601434c49434f554e5452595c736d6174697a NAS-IP-Address = 192.100.16.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\user" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. ++[realmslash] returns ok rlm_realm: Request already proxied. Ignoring. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry user at line 178 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [DOMAIN\\user\000] (from client 192.100.16.11 port 1 cli 00-1B-77-4D-1A-74) Sending Access-Reject of id 0 to 192.100.16.11 port 1312 Finished request 2. Going to the next request Waking up in 4.4 seconds. Cleaning up request 0 ID 0 with timestamp +113 Waking up in 0.2 seconds. Cleaning up request 1 ID 0 with timestamp +113 Waking up in 0.2 seconds. Cleaning up request 2 ID 0 with timestamp +114 Ready to process requests. Santiago Matiz (santimatiz(a)yahoo.com) Systems Engineer Bogotá, Colombia (South America)

4 8

$ORIGIN run-time path & libtool problem
by John Center 07 Oct '08

07 Oct '08

Hi, I'm having a problem compiling FreeRADIUS 2.1.1 on Solaris 10 using the Sun Studio 12 compiler. I'm trying to specify the run-time library path like: -R'$ORIGIN/../lib' But I'm getting the following error: libtool: link: only absolute run-paths are allowed If I remove the $ORIGIN run-time option, it compiles. Is there a setting for libtool I can make to fix this? Thanks. -John -- John Center Villanova University

2 2

How to implement Disconnect Request on Freeradius.
by Piero Santi 07 Oct '08

07 Oct '08

Hi, Could some body help me to know whether Radius disconnect and Ack messages are supported in freeradius as defined in RFC 2822 ? If it's supported how can i implement it on my freeradius ? Thanks, piero

3 6

Linksys SLM248G
by David Blackman 07 Oct '08

07 Oct '08

I have a lab that has wired ports that connect to a Linksys SLM248G switch that supports 802.1x. What I want to do do is to set this switch up to make the users authenticate to gain access to the network. The users will have an accounts on the radius server which is a FreeBSD 7.0 system running FreeRadius 2.06. I would like them to be able to enter their username and password to access the network. Should this be possible? I get nothing from the radiusd -X if I have the windows xp EAP type: set to MD5-Challenge or Smart card or other Certificates. I get the following if I have the windows xp supplicant EAP type: set to Protected EAP (PEAP) and Select Authentication Method: set to Secured password (EAP-MSCHAP v2) configured to automatically use my windows logon name... rad_recv: Access-Request packet from host 128.227.232.133 port 49154, id=0, length=83 NAS-IP-Address = 128.227.232.133 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DB3\\dblac" EAP-Message = 0x0201000e014442335c64626c6163 Message-Authenticator = 0x829bab10f0c399313b4946fc47f6aa9c +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DB3\dblac", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DB3\dblac at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 128.227.232.133 port 49154 EAP-Message = 0x01020016041081b9c6b3f031cce93aac863f3383a0c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec6255ecec605113c816ac1ff80419e2 Finished request 12. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 128.227.232.133 port 49154, id=0, length=93 Cleaning up request 12 ID 0 with timestamp +190 NAS-IP-Address = 128.227.232.133 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DB3\\dblac" State = 0xec6255ecec605113c816ac1ff80419e2 EAP-Message = 0x020200060319 Message-Authenticator = 0x3156b6e297a2d81c38042450074ffa81 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DB3\dblac", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DB3\dblac at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 128.227.232.133 port 49154 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec6255eced614c13c816ac1ff80419e2 Finished request 13. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 128.227.232.133 port 49154, id=0, length=167 Cleaning up request 13 ID 0 with timestamp +190 NAS-IP-Address = 128.227.232.133 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DB3\\dblac" State = 0xec6255eced614c13c816ac1ff80419e2 EAP-Message = 0x0203005019800000004616030100410100003d030148eb44b1c52d912b11d4d2bbd04b61fd302b03d22ba373beb33f2aa37b24248200001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xd3f4489233cacc67f8a062f7e24b05f7 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DB3\dblac", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 128.227.232.133 port 49154 EAP-Message = 0x0104040019c0000008bb160301004a02000046030148eb4379e9bfdee521dcb3928d8ca625b7d1f2cdfd1561c5deafbe6ce7ed6a52203eb5a90289c645a44ae02464f658a92024e0030a6fa06680d2536fc60819f4cf000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303931393135303335315a170d3039303931393135303335315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bf1135e7403c91fce2e032ecca3a6a145563d12900aee0f492557dcd151f EAP-Message = 0xa5ae2d8204eed48117170b963f923ff0fffd0912fe9e8e16684e410daf483f046ca000e41b7610d935f03d3a108b7ecd148dbd0aa410f35e72e1372195bbe307fa3d90482745b2bf0eb8bc8e6328c6c9947bb4f4ce24dde218475416ca55361c2e88a3647214ad165f70da12b0f40d754dc357ca812ab8f94bd8a58acf78a2280c478e0b9b403fe7d1ab55296b22869c581feb0c07a4ba0106e66e82025d210c9d6363a02e740f627e85446b7aeb29eed663768ba9c5e3463d97fe7f4790c562b9e3d28032bc09a448b0e9d65c08f0ef85c4e1d3710e9aa36e8d5f19b41bdd05a9750203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101006b001b9f369b704d4eb7b8720d3db79dae602ca5eaa73ce38b8e8167e4da5a54762304a9a622f9381a8c2af8fe4ea5a0104e4a593a4ee607dc108d898d2c93122290c3c9948f20a19a3b8cbfb251d37e0b8cc0171270427639644546c71ccbfe8b1e64025ce560c70e030625349089138e8e08dc1a2b7d0d92c032b80fe1626a948789619ed1de6fc5a26dba9e978a12395b905b5d2f1e12428a58c75bbc3e0149bb3b724a3d866e2581656e6c939e6571570c67207ed46bfbbe7d37ac5b468ad6bb72d9b9aae7fd587679a814d47fdd15f5aecb6e3d20dc66effa359bf7ceb24db46b5f65bd EAP-Message = 0xdd8b0d1ffbd9cfc10c334d0c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec6255ecee664c13c816ac1ff80419e2 Finished request 14. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 128.227.232.133 port 49154, id=0, length=93 Cleaning up request 14 ID 0 with timestamp +190 NAS-IP-Address = 128.227.232.133 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DB3\\dblac" State = 0xec6255ecee664c13c816ac1ff80419e2 EAP-Message = 0x020400061900 Message-Authenticator = 0x886a8775435f25263f2aca201609785c +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DB3\dblac", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 128.227.232.133 port 49154 EAP-Message = 0x010503fc19407595a82abeae63e145f572782b550004ab308204a73082038fa003020102020900d9e21f5ee6835c3a300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303931393135303335305a170d3038313031393135303335305a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c1f6ababdbb11157e01222cd06effd53fe6bbe93ccef710728fa7dbd748861ec895fafaed33ce581aa8d1988705e6360c00d238ed22cf23e36983af70411268f912abb3591519c8665e808d69c6774 EAP-Message = 0x13a97fa387a88c4ba3af3b53dee51a15e58864b9f5d1abc8522b091963193e3bf9d303e0860e906a3f0662c75696658f9fd91e6c0943c5cbeadd38a4646b121fa301031dcb90e1b03d6a01be8b525909dcd2225cb29b42a48c191403788b1e27a69e1af0dc87a25de82f549956980b3aba56984fde3a6f5cb88d4319de879f42595fd3e2836e4b8e0024ee3939197c5f2151c9399ba835599f1dbd01b8577bb8d1369c1498e80a47b784f6536e8f718c1d0203010001a381fb3081f8301d0603551d0e04160414dc814088224053f83c7a5b13a01af9512eb5deb93081c80603551d230481c03081bd8014dc814088224053f83c7a5b13a01af9512eb5 EAP-Message = 0xdeb9a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900d9e21f5ee6835c3a300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010046ad1161afb688a9d15f6d856da942a6be08e914cb3e9ddcaf9170ef68be87b02567b291878202d4c903dbacdfbe311c6d3b EAP-Message = 0x0be93902225236ba Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec6255ecef674c13c816ac1ff80419e2 Finished request 15. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 128.227.232.133 port 49154, id=0, length=93 Cleaning up request 15 ID 0 with timestamp +190 NAS-IP-Address = 128.227.232.133 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DB3\\dblac" State = 0xec6255ecef674c13c816ac1ff80419e2 EAP-Message = 0x020500061900 Message-Authenticator = 0x676ce9988ddab71abb71ddbca2554610 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DB3\dblac", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 128.227.232.133 port 49154 EAP-Message = 0x010600d51900e0f91c11fb297731a6efe3a48a6be62f005b0571eab2bef69625fcc1ebc94d4d3b7ceeecc5977de9b83a4eb22ce44bf4388f8cc6f0ece7443e2f0ecd971251bebd2d70b3eef75100b2d2af7d217c3a674b984010ded7f1095ffc4d1aeff0efe8b7e948df9e3ada1ee3f8fcbeb7023a143772a3cfb077de90f7a7a7cf2d6e06f933be6b917795777e74e9e6691d5a95100b1a610e16cda1c2f8e3661c231aa6d2cb1ce8ed5096b5789a61ea5aef84d10e9dded9b338a826e950075ee8797f4099e6c1748e1d8716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec6255ece8644c13c816ac1ff80419e2 Finished request 16. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 128.227.232.133 port 49154, id=0, length=93 Cleaning up request 16 ID 0 with timestamp +190 NAS-IP-Address = 128.227.232.133 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DB3\\dblac" State = 0xec6255ece8644c13c816ac1ff80419e2 EAP-Message = 0x020600061900 Message-Authenticator = 0xd07720185412598787e85c2a753d4855 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "DB3\dblac", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 128.227.232.133 port 49154 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec6255ece9654c13c816ac1ff80419e2 Finished request 17. Going to the next request Waking up in 4.9 seconds. Cleaning up request 17 ID 0 with timestamp +190 Ready to process requests.

2 1

EAP-TLS and use of dynamic vlan
by Guk Victor 07 Oct '08

07 Oct '08

Whether it is possible to use the file "users" for determination of attributes at the use of EAP-TLS. Me interisuet: Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 2 Prompt me as must be described user in this case. Now I get such attributes: Login OK: [test_user/<no User-Password attribute>] (from client 10.0.1.2 port 117604353 cli 0013-7737-714e) Sending Access-Accept of id 29 to 10.0.1.2 port 5007 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-MPPE-Recv-Key = 0x7583f59293cfa05710f3c0414baa414818cd7c210e9c03bcd587a0201bbbdf1d MS-MPPE-Send-Key = 0x0eb94c5347aef770fea54e15c6e3b4fa17e638d52e94033b4c6eb55b1405fb41 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test_user" Finished request 4

2 1