- Freeradius-Users - lists.freeradius.org

Searching for an up to date tutorial for freeRADIUS + Active Directory
by Frederik.Niedernolte＠Bertelsmann.de 08 Oct '08

08 Oct '08

I want to set up a freeRADIUS server to work together with an active directory. The best tutorial I've found is http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO but it seems to be outdated because the part with the "Configuration of radius.conf" is based on an older version of freeRADIUS. I have installed 2.1.1 and there the radius.conf links to other modules / VHosts. What must I change to make it work with version 2.1.1? Thanks in advance. Best regards, F. Niedernolte

2 4

EAP-TLS & computer account(not user)
by Guk Victor 08 Oct '08

08 Oct '08

I use eap-tsl for the registration record of computer. It is necessary to open access to the network to pressure of Ctrl+Alt+Del. I will not understand what is the matter: rad_recv: Access-Request packet from host 10.0.1.2:5007, id=154, length=216 User-Name = "host/cit44" EAP-Message = 0x0202000f01686f73742f6369743434 Message-Authenticator = 0xda5f6a382f76e341ecd76c7fe2eda837 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 154 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x85f944d1ab810baf397561351f4da39d Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=155, length=335 User-Name = "host/cit44" EAP-Message = 0x020300740d800000006a160301006501000061030148eca4801a94d16d54f4d65aa34134bcbd1fb96c22cd0e25ccbbcb4298d76bee000018002f00350005000ac009c00ac013c0140032003800130004010000200000000a00080000056369743434000a00080006001700180019000b00020100 Message-Authenticator = 0x2e81df002f583a191f6f4845ac7caac4 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x85f944d1ab810baf397561351f4da39d Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 116 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0065], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 056e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0074], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 155 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x0104040a0dc00000063b160301004a02000046030148eca6691c134aa5dcae49113ba12777f17184a40c5aa0006278ed9da3dadb3e20ead1859034d686e829341c20201db4c23929ba343e371ace1058d1c5025949f9002f00160301056e0b00056a0005670002503082024c308201b5a003020102020101300d06092a864886f70d01010505003063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72301e170d3038313030313037343430315a EAP-Message = 0x170d3039313030313037343430315a305c310b3009060355040613025541311330110603550408130a5a61706f726f7a736865310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953310f300d0603550403130652414449555330819f300d06092a864886f70d010101050003818d0030818902818100ac35b8809afa0040f3ebc0af9fb56e2a4196f58fe6aee43df306d38e27a8d3da043dfffa300bf8e4b851e88612e6ddce19aaf601912a9a0cb400d736cef53ffdc07950598741653bd839b24e80399c02eaaa48627241d20b20be2df7311ce3b9f7524ffcb03045bcc56d3a0de7d3c382720512 EAP-Message = 0xbfb3d14e7b8418fcdd61f241930203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810037d0d8ed990d72b050cc7c62fb550e65ee8e6115634fa1cd470d344e19c5cf820e0de0c74db9da252d8c2dd9135c32311d9de10d77abe571ceb0c8e8451ba9f06a04aa12b18e917ccd85763f38d7daf3440f4c62c388019f79329d49fb8d2cae40d997db06a8ec8f5b02b92648fc7c9ebd8d75135e4fa4b804e33ec48db919400003113082030d30820276a003020102020900d603ee3f96fc604d300d06092a864886f70d01010505003063310b3009060355040613025541311330110603 EAP-Message = 0x550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72301e170d3038313030313037343330345a170d3130313030313037343330345a3063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f7230819f300d06092a864886f70d010101050003818d00308189028181009b2e0773ff8310e98addfa EAP-Message = 0xb3458c421c935ca651f8f7ca3899d6506d065de4f53f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x475d38bc73179456ecabe627f4c349ab Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=156, length=225 User-Name = "host/cit44" EAP-Message = 0x020400060d00 Message-Authenticator = 0x74221ef1383128241e231013179f3213 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x475d38bc73179456ecabe627f4c349ab Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 156 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x010502450d800000063b4837ac2b653e806f55c44239a6b0fb8de79a837bfe337e34804ee812673f27d00c28fb9735b2e7833b7a4211be3fbb997b2010c63c845b310be1ffd7226f4e9a7a238604f59873c29b47eb3a94fc3255baf8e09bc4580e685d6cef61016acd0203010001a381c83081c5301d0603551d0e041604144883dff930ad8def715cc306a93b716ed1dfa2f03081950603551d2304818d30818a80144883dff930ad8def715cc306a93b716ed1dfa2f0a167a4653063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c30 EAP-Message = 0x0a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72820900d603ee3f96fc604d300c0603551d13040530030101ff300d06092a864886f70d010105050003818100798409d24a31663705ea77a113da2d5283a687cc78561854f7205ff9e565cb2cbd7a133b1361b3bd93f58a0ac03872ca5fefccd451b7e1c7a5827ebe061ec2259436b5c3006895e8c49b356052161f6d3e4b9f7001397ca581bae2b178fc0da21f774a85f1290f71b82ee10bf23604613a0d354556ebf6d1937267a94f3a96ac16030100740d00006c020102006700653063310b3009060355040613025541311330110603550408130a5a61706f EAP-Message = 0x726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f720e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83c05bad6798917fd36b49f983ccfcb8 Finished request 2 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=157, length=1172 User-Name = "host/cit44" EAP-Message = 0x020503b30d80000003a916030103690b0002590002560002533082024f308201b8a003020102020105300d06092a864886f70d01010505003063310b3009060355040613025541311330110603550408130a5a61706f726f7a736845310b3009060355040713025a50310c300a060355040a13035a415a310c300a060355040b13034d4953311630140603550403130d41646d696e6973747261746f72301e170d3038313030383131303833375a170d3039313030383131303833375a305f310b300906035504061302554131123010060355040813094265726b73686972653110300e060355040713074e657762757279310c300a060355040a1303 EAP-Message = 0x7a617a310c300a060355040b13036d6973310e300c06035504031305636974343430819f300d06092a864886f70d010101050003818d0030818902818100b82b614adec29d80e4316eba19ee74db1f2ac3e542f25f193b28af28166a9c4e49321fce20195e01a1fe85977b0e86fa7836226953fff50f42d62d83d16555a0c7b48ab36a2c46edf58c9a1f4427e4a41c3e5e4f6d98cec0626fd0d6e16812ab9e469dd7000e738f037ab7f4c95c74eb627c1cf7adc4d7d42fb3e685ad5783e10203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100610a54b441c6152b00fb776a8833 EAP-Message = 0xfa33aacc278fc6b1f419aecf639a3459edc7450b12285ce1e75053100b955f3012b3f88c7934e0a6016c9c28145b08e0aafb3f581913ee2f24c9c114d470adc9bf591b84e1b9e2d7f1ab04120536145683843cc767aa0589358dec9230469924abe314fa034e47527778eae154b4bdc0fe521000008200800802c992280a9400196f4f6462e392dbb711a5a55d31704ca9492cf35befc97df7d31a9a05de4a01a8c8865125e451412fdabae12a0e94b745535cbb3426f0bbb42961cac7f8952e1a0e847ec175bbfea2f55a419d351a8892cf8290f489df15c478389a1cebcd6a59701fb9fd847a55df834ecf3ed7fdca679becd740db41e60f00008200 EAP-Message = 0x809ff27f75ca3b3daee7c93342cb9535179e2412c5eb27364503da2cc3162abd6ee34e6a6c89c20323c7ed38a52ecb0ec9b48f90078df77a5079b39ac46395bb31fe846f7ad584da3d3cf9d1959e4d70ed4ecbffbcbb22d68f5bb8915fe16de9b2f7899a3d96053f77e586b586af49fab7a378a582f030b3716d5ddcaff33c5ecc14030100010116030100301a884c8358de9a72b0cb658bfe1ffce51786d194e5e2161065e41f350d1fcb6db0f5dcb0e3205984d70521571606f823 Message-Authenticator = 0x0b3ffd5fd267d3e7de9d0ea79faf6edb NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x83c05bad6798917fd36b49f983ccfcb8 Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 025d], Certificate chain-depth=1, error=0 --> User-Name = host/cit44 --> BUF-Name = Administrator --> subject = /C=UA/ST=ZaporozshE/L=ZP/O=ZAZ/OU=MIS/CN=Administrator --> issuer = /C=UA/ST=ZaporozshE/L=ZP/O=ZAZ/OU=MIS/CN=Administrator --> verify return:1 radius_xlat: 'host/cit44' rlm_eap_tls: checking certificate CN (cit44) with xlat'ed value (host/cit44) rlm_eap_tls: Certificate CN (cit44) does not match specified value (host/cit44)! chain-depth=0, error=0 --> User-Name = host/cit44 --> BUF-Name = cit44 --> subject = /C=UA/ST=Berkshire/L=Newbury/O=zaz/OU=mis/CN=cit44 --> issuer = /C=UA/ST=ZaporozshE/L=ZP/O=ZAZ/OU=MIS/CN=Administrator --> verify return:0 rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal certificate_unknown TLS Alert write:fatal:certificate unknown TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 157 to 10.0.1.2 port 5007 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0x010600110d80000000071503010002022e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6422c1f11b093d41a5e6dd774b5b1cc8 Finished request 3 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.2:5007, id=158, length=225 User-Name = "host/cit44" EAP-Message = 0x020600060d00 Message-Authenticator = 0x6405c8b36bf1e85aa28b4856efba37d7 NAS-IP-Address = 10.0.1.2 NAS-Identifier = "001ac1d4ee42" NAS-Port = 117604353 NAS-Port-Id = "unit=7;subslot=0;port=40;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0013-7737-714e" State = 0x6422c1f11b093d41a5e6dd774b5b1cc8 Vendor-25506-Attr-26 = 0x0000001e Vendor-25506-Attr-255 = 0x353530302d4549 Vendor-25506-Attr-60 = 0x302e302e302e302030303a31333a37373a33373a37313a3465 Vendor-25506-Attr-59 = 0x38e68c68 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '\' in User-Name = "host/cit44", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry host/cit44 at line 235 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Login incorrect: [host/cit44/<no User-Password attribute>] (from client 10.0.1.2 port 117604353 cli 0013-7737-714e) Delaying request 4 for 1 seconds Finished request 4

2 1

Different configuration upon realm
by Dejan Markic 08 Oct '08

08 Oct '08

Hello all! I have a quick question. I have SQL based setup, little bit modified to suit our needs. Everything works well! We have username scheme like that: USER(a)OURDOMAIN.com<mailto:USER@OURDOMAIN.com> which goes through our SQL based authentication. Now, I would like to configure radius, to return different attributes for different domains (without SQL). So if user comes in with: Service-Type: Framed-User User-Name: USER(a)OTHERDOMAIN.com<mailto:USER@OTHERDOMAIN.com> ... I would like to reply with some AVPairs, without any password checks ... So, OURDOMAIN.com should go through normal process, but other domains, should go through this process. How is that possible to implement?! I was looking for examples, but didn't find any - or maybe I don't know what I'm looking for. Thanks for your help! Kind regards, Dejan Markic

2 1

Unresponsive Child in component authorize
by kesm0724 08 Oct '08

08 Oct '08

Does the "Unresponsive Child in module files component authorize" allude to something I have misconfigured in the virtual server or a process that is hung? I can certainly post the debug if it is necessary to troubleshoot this issue... Tue Oct 7 12:14:26 2008 : Error: Discarding duplicate request from client PCS port 1645 - ID: 4 due to unfinished request 8 Tue Oct 7 12:14:43 2008 : Error: WARNING: Unresponsive child (id 3054615440) for request 8, in module files component authorize Tue Oct 7 12:15:13 2008 : Error: Discarding duplicate request from client Chambersburg-Switch port 1645 - ID: 3 due to unfinished request 9 Tue Oct 7 12:15:19 2008 : Error: Discarding duplicate request from client Chambersburg-Switch port 1645 - ID: 3 due to unfinished request 9 Tue Oct 7 12:15:24 2008 : Error: Discarding duplicate request from client Chambersburg-Switch port 1645 - ID: 3 due to unfinished request 9 Tue Oct 7 12:15:40 2008 : Error: WARNING: Unresponsive child (id 3044125584) for request 9, in module files component authorize -- View this message in context: http://www.nabble.com/Unresponsive-Child-in-component-authorize-tp19864007p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Primary key in radacct table
by Santiago Balaguer García 08 Oct '08

08 Oct '08

Hi, I am using a freeradius 1.1.7 + postgres since 3 years ago. The AAA service works fine, however my radacct table has sonetimes duplicate registers. I realize that it happens when a NAS does not have a realiable Internet conection, so NAS send the accounting packets several times. My radacct table has 'radacctid' as primary key. I realize that two (or more) duplicate registers share 'acctsessionid' and 'acctuniqueid' fields amog others. I know 'acctsessionid' field can be the same in diferent NASes. Would be a good idea change the primery key by 'acctuniqueid' ? Santiago _________________________________________________________________ Llega la nueva temporada. Consulta las nuevas tendencias en MSN Estilo http://estilo.es.msn.com/moda/

6 8

Re: mschap No Cleartext-Password configured
by alois blasbichler 08 Oct '08

08 Oct '08

>> ablasbichler Cleartext-Password == "ablasbichler" >> With no success > > Should be := not ==. Hello Thank you for the the answers. I changed how you suggested but without success. Another thing : we use md5 encrypted passwords in our Ldap-DB for userpasswords - is it right that the line above in users overwrite this ? Here my log (tested with user test password alois) Why pap use CRYPT encryption not it should be cleartext ? by luis -------------------------------------------- server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop request done: ld 0x81a0ba8 msgid 7 ++[unix] returns updated [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test at line 3 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "alois" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CRYPT password check failed): [test] (from client ciscosw port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [test] (from client ciscosw port 29 cli 00-40-96-B4-5B-0F) Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 6 to 10.53.240.10 port 32769 EAP-Message = 0x04100004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.4 seconds.

3 5

Newbie question
by Jair Santos 08 Oct '08

08 Oct '08

Hi all, I just got into this list and I am trying to instal in a RedHat ES 5.2, 64 bits. I ran ./configure and when I ran make I got the following error. cc -o .libs/radmin .libs/radmin.o /usr/lib/libreadline.so /usr/lib/libtermcap.so .libs/util.o .libs/log.o .libs/conffile.o /home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src/lib/.libs /libfreeradius-radius.so -lnsl -lresolv -lpthread -lreadline -ltermcap -Wl,--rpath -Wl,/usr/local/lib /usr/lib/libreadline.so: could not read symbols: File in wrong format collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/jsantos8890/downloads/freeradius/freeradius-server-2.1.1' make: *** [all] Error 2 Does anybody know if it works with 64 bits OS. Any help will be very much appreciated. thank you Jair Santos

9 32

How to forward MAC-authentiation-requests over a FreeRADIUS-proxy to a FreeRADIUS-server?
by r.bruengel＠freenet.de 08 Oct '08

08 Oct '08

Hello everyone, I use MAC-authentication and got some problems by using a FreeRADIUS as a proxy to tunnel requests and answers between my switch and my normal FreeRADIUS-server. When I tested MAC-authentication with my switch and FreeRADIUS-server without anything between it worked fine. The MAC-address has been used as username and cleartext-password. Well, when I set up my FreeRADIUS-proxy and want to use it the following message appears in the radius.log of my FreeRADIUS-proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.58 port 1864 - ID 177 : IGNORED The port and the ID vary the port is counted up by every try and the ID well, I dont know. I just want to forward the MAC-address and the cleartext-password to my FreeRADIUS-server. When this data arrives at my FreeRADIUS-server it should be checked and the authentication answer should be sent back to my FreeRADIUS-proxy which forwards it to my switch. I hope that you can help me I just started to work with FreeRADIUS, so Im just a rookie. Heres some data: FreeRADIUS: V 2.0.4 Operating System: Debian Lenny (testing) Kernel: 2.6.25-2-686 Switch: Foundry EdgeIron 2402CF FreeRADIUS-server: 192.168.1.61 FreeRADIUS-proxy: 192.168.1.80 Switch: 192.168.1.58 The following configuration belongs to my FreeRADIUS-server: radiusd.conf listen { type = auth ipaddr = 192.168.1.61 #FreeRADIUS-server IP port = 1812 } [] proxy_requests = no clients.conf client 192.168.1.80 { secret = testing123 } The following configuration belongs to my FreeRADIUS-proxy: radiusd.conf listen { type = proxy ipaddr = 192.168.1.80 #FreeRADIUS-proxy IP port = 1812 } proxy.conf proxy server { default_fallback = no } home_server RADIUS_SERVER { type = auth ipaddr = 192.168.1.61 #FreeRADIUS-server IP port = 1812 secret = testing123 [] } home_server_pool RADIUS_SERVER_POOL { type = fail-over home_server = RADIUS_SERVER } realm RADIUS_REALM { auth_pool = RADIUS_SERVER_POOL } The following configuration belongs to my switch: RADIUS-Server: 192.168.1.80 #FreeRADIUS-proxy Port: 1812 Key: testing123 So, that should be the way: Switch -> FR-proxy -> FR-server 192.168.1.58 192.168.1.80 192.168.1.61 In advance: Thanks a lot for your help! Best regards from Germany, Raphael Brüngel

3 2

Sql-Group value
by donaldbjames＠suddenlinkmail.com 07 Oct '08

07 Oct '08

Hi, In freeradius 2, where is the value of "Sql-Group" set? I am using the mysql database. Is the value of Sql-Group set in one of the tables? Sincerely, Don James

2 2

freeradius 2 problem
by donaldbjames＠suddenlinkmail.com 07 Oct '08

07 Oct '08

Hi, I have a working radius server using freeradius 1.1.7. I am trying to upgrade to freeradius 2. Using radtest, I get a reply, but the radgroup reply data is not included in the reply. I probably have one of the configuration files done wrong. My question is: which configuration files are necessary when using freeradius 2? Sincerely, Don James

2 1