- Freeradius-Users - lists.freeradius.org

CA certificates
by jehan procaccia 05 Sep '08

05 Sep '08

hello, we are running our own PKI with a 3 level hierarchy: it-master-class1(self-signed) -> it-ca-class2 -> it-ca-class3. it-ca-class3 signed our radius server (radiux-pkiit-2008.pem) In eap.conf file in the tls section I have tls { private_key_password = secret private_key_file = ${certdir}/radiux-pkiit-2008.key.pass.pem certificate_file = ${certdir}/radiux-pkiit-2008.pem CA_file = ${certdir}/ca-chain-institut-telecom_long.crt } unfortunaltly, securew2 windows clients configure to check certificates and having it-master-class1 in it's CA list don't accept our TLS security :-( . It tells that it received a bad certificate from the server !?. I wonder if I didn't made a misconfiguration in radiusd/eap/tls section above . certificate_file point to our radius SSL-server certificate CN=radius.it-sudparis.eu but what the CA_file should point what in our case ? the it-master-class1 CA root certificate ? the it-ca-class3 CA which signed our radius server ? a bundle of the 3 CA (as it is now !) ? , in which order class1-2-3 ? class 3-2-1 ? in pem ? , der ? short or long CA files (by these I mean only what is between --BEGIN CERTIFICATE-- and --END CERTIFICATE-- or plus the "blabla" above ) ?. Perhaps only certificate_file = ${certdir}/radiux-pkiit-2008.pem could be used, but in that case radiux-pkiit-2008.pem should contain the radius server certificate + a bundle of the 3 CA, in which order ? short or long ? ... You see I have lots of possibilities and interogation !. I'am much more used to configure SSL in apache ssl.conf, to me it is clear as the directive are self explained : SSLCertificateFile /etc/pki/tls/certs/server-2008.pem SSLCertificateKeyFile /etc/pki/tls/private/server-2008.key SSLCertificateChainFile /etc/pki/tls/certs/ca-chain-institut-telecom.crt SSLCACertificateFile /etc/pki/tls/certs/itrootca-class1.crt in eap.conf I don't see any distinction between the httpd equivalents : SSLCertificateChainFile and SSLCACertificateFile I also use openssl s-client to test my servers certs setting openssl s_client -host mutuel.it-sudparis.eu -port 443 But I cannot do the same for radius ? openssl s_client -host radius.it-sudparis.eu -port 1812 => socket: Connection refused :-( . Thanks for your help .

1 0

huntgroup question
by Hans Bornemann 05 Sep '08

05 Sep '08

Hi, For some NAS i want to restrict the access for a single realm. For other NAS every realm is allowed. So I put in huntgroups: huntgroups: notebook NAS-IP-Address == 123.123.123.123, User-Name =~(a)willi.de This is only working, if the user has a Huntgroup-Name entry in the users file. users: bob Cleartext-Password := "hello", Huntgroup-Name =~note Is that correct? I understand the docs so, that the radius first looks into the hints file, than huntgroup and after that the realm is looked up. Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

1 0

MSCHAP Authentication and LDAP Group Membership checking
by kesm0724 05 Sep '08

05 Sep '08

Hello All, I am very, very new to Freeradius (as well as Radius) ;) - disclaimer. We are trying to move away from using IAS to Freeradius. We have approx 50 switches/routers which I have not had a problem with getting to work with Freeradius including group checking using LDAP. The issue I have is getting our Cisco VPN Concentrator to authenticate users who are in a certain Active Directory group. I have configured Samba to join our domain - all that is working without issue. The problem apparently is when logging in via the Cisco VPN client: Here is my debug: ad_recv: Access-Request packet from host 10.2.1.6 port 1059, id=83, length=191 User-Name = "voila\\webtest" NAS-Port = 1151 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "123.201.6.78" Calling-Station-Id = "123.201.6.76" Tunnel-Client-Endpoint:0 = "123.201.6.76" MS-CHAP-Challenge = 0x0ebafb8a5ab6b2be73f9a983a6a3f5d3 MS-CHAP2-Response = 0x0000db98fa3162973c0f68121500631c0c8d00000000000000005808068d4047ef8a58e79d488a62d41e89128aabd6d88c52 NAS-IP-Address = 10.2.1.6 NAS-Port-Type = Virtual +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.2.1.6/auth-detail-20080904 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.2.1.6/auth-detail-20080904 expand: %t -> Thu Sep 4 17:55:54 2008 ++[auth_log] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "voila\webtest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '"' in User-Name = "voila\webtest", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=voila\5cwebtest) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=voila\5cwebtest) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=voila\5cwebtest) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=voila\5cwebtest) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for voila\webtest WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=voila\5cwebtest) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=voila\5cwebtest) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type mschap auth: type "MSCHAP" +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for webtest with NT-Password expand: --domain=%{mschap:NT-Domain} -> --domain=voila expand: --username=%{mschap:User-Name} -> --username=webtest mschap2: 0e expand: --challenge=%{mschap:Challenge:-00} -> --challenge=dcdc37024aecaec1 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=5808068d4047ef8a58e79d488a62d41e89128aabd6d88c52 Exec-Program output: NT_KEY: 1E79BE41DB018B9E293DA357E6E5EA0D Exec-Program-Wait: plaintext: NT_KEY: 1E79BE41DB018B9E293DA357E6E5EA0D Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok Login OK: [voila\\webtest] (from client VPN port 1151 cli 123.111.6.76) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 83 to 10.2.1.6 port 1059 MS-CHAP2-Success = 0x00533d31364230314341364638323331333730333334393432393943303539423539334346434433314336 MS-MPPE-Recv-Key = 0x5e34def484a9a9c160f712e90322bca0 MS-MPPE-Send-Key = 0x2f644ea60d80525ed0b13527ca916aae MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 83 with timestamp +888 Ready to process requests. It appears that MSCHAP is used to verify the password but LDAP is not properly checking the "VPN-Users" AD group....I believe it is not stripping the domain portion off correctly as I see the domain name appended to (sAMAccountName=voila\5cwebtest) My users File entries: (The first entry I would like to be used by the concentrator to search the group and if the user is a member allow them access - of course authenticating the provided password) DEFAULT LDAP-Group == "vpn-users" Fall-Through = Yes This entry is for our network switches/routers - this appears to be working without any issue. DEFAULT LDAP-Group == "Radius-Admin" Service-Type = Login-User, cisco-avpair = "shell:priv-lvl=15", Fall-Through = Yes If I login from my network devices it performs the ldap searches without issue and authenticates/authorizes the user - You can see this below: rlm_ldap: performing search in dc=voila,dc=com, with filter (&(cn=vpn-users)(|(&(objectClass=group)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))(&(objectClass=GroupOfNames)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group vpn-users rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 178 rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com expand: (|(&(objectClass=group)(member=%{check:LDAP-UserDn}))(&(objectClass=GroupOfNames)(member=%{check:LDAP-UserDn}))) -> (|(&(objectClass=group)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))(&(objectClass=GroupOfNames)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (&(cn=Radius-Admin)(|(&(objectClass=group)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))(&(objectClass=GroupOfNames)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group Radius-Admin rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 181 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for zkms WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=zkms) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=zkms) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user zkms authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: login attempt by "zkms" with password "Omitted" rlm_ldap: user DN: CN=zkms,CN=Users,DC=voila,DC=com rlm_ldap: (re)connect to control.voila.com:389, authentication 1 rlm_ldap: bind as CN=zkms,CN=Users,DC=voila,DC=com/Omitted to control.voila.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user zkms authenticated succesfully Thanks in advance for any pointers..... -- View this message in context: http://www.nabble.com/MSCHAP-Authentication-and-LDAP-Group-Membership-check… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius Question - how to replicate accounting packets to another server radius
by Piero Santi 04 Sep '08

04 Sep '08

Hi all, i've installed freeradius-2.0.5 on Red-Hat 5.0 and i want to configure my radius server to replicate (i think NOT to proxy...waht is the different?) only accounting packets to another radius server based on apn name (NOT for user realm); always based on apn name attribute i want to assign different pool (defined on radippool table on mysql). Usually APN name is valorized in Called-Station-ID attribute ? The pool assignment works fine but i'm not able to replicate based on Called-Station-ID. Can you help me, please ? These are my config files: users DEFAULT Auth-Type := Accept, Called-Station-ID == 'apn1', Pool-Name := 'main_pool', Simultaneous-Use := 1 Fall-Through = Yes DEFAULT Auth-Type := Accept, Called-Station-ID == 'apn2', Pool-Name := 'second_pool', Simultaneous-Use := 1 Fall-Through = Yes radiusd.conf proxy_requests = yes Thanks in advance, Piero

2 3

Need Help Debugging
by Kirk Wallace 04 Sep '08

04 Sep '08

Hello, quite a while ago I got freeradius working with PoPToP using this link as a guide: http://poptop.sourceforge.net/dox/radius_mysql.html except I didn't use SQL, just a users list for my user account passwords. I tried to move this to a new Ubuntu install but I am having trouble getting it to work. I disabled the radius plug-in by commenting out the radius line in /etc/ppp/pptpd.options and I was able to login okay, so I suspect my problem is in radius. I don't know enough to know what in the freeradius -X output below might indicate a problem. If someone sees a problem, please let me know or where to look for more help. I am using mschap-v2. "freeradius -X" output ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:56867, id=190, length=69 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "kwallace" Calling-Station-Id = "192.168.8.103" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "kwallace", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry kwallace at line 2 modcall[authorize]: module "files" returns ok for request 2 rlm_pap: No clear-text password in the request. Not performing PAP. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 190 to 127.0.0.1 port 56867 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 190 with timestamp 48bf213b Nothing to do. Sleeping until we see a request.

2 3

eDirectory + peap + LDAP + Cisco AP1242 + Windows XP(SP3)
by Bruce_M_Richardson＠biscuits.com 04 Sep '08

04 Sep '08

Hi, having read scores of posts to this and other lists I am almost there, many of you have helped already without knowing it. I'm using FreeRADIUS Version 2.0.5, compiled with the eDir extension. I can get it to work if I un-tick the box on XP that says "Automatically use my Windows login name and password (if any)" but if I tick that box then my PC sends the user name as host\name Obviously I need to use "Stripped-User-Name" and apparently this gets filled in by the realms module. But I can't see what to change so that the Stripped-User-Name gets filled in correctly. Any ideas would be appreciated. Regards, Bruce Richardson Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

4 9

Re: Date and Time based authorization ???
by Marcelo Freitas 04 Sep '08

04 Sep '08

Thanks Kirk for the response ... I was asking because I didn't know about Login-Time and that solves my problem ... But I didn't understanding your solution ... Checking for holidays would be nice ... but how would I implement that ? how would this script be called at the arrival of the request's packet ? Thanks again, ----- Original Message ----- From: kwallace(a)wallacecompany.com Sent: Thu, September 4, 2008 2:04 Subject:Re: Date and Time based authorization ??? On Wed, 2008-09-03 at 23:47 -0500, Marcelo Freitas wrote: > Hello, > > I'm researching to switch my WISP authentication to a RADIUS style ... > > I was reading the docs and found a solution for almost all my > requirements ... besides one ... > I have an access plan that is based on nights and weekends ... So on > this plan I would just authorize based on this criteria ... I know > that some variables comes with the request, like, date and time of the > request (or I could even use the server's date and time) but I'd like > to know if it's possible to check if it's a weekend with a function or > something ... > > I couldn't find it in the docs ... > > Thanks in advance, > > > Marcelo > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hello, I'm new to this list, but would the date command help? Maybe from a script, "date +%A" and then check for a return of "Saturday" or "Sunday"? Are you going to need to check for holidays? Kirk ----- End of original message -----

3 2

No authenticate method (Auth-Type) configuration found for the request :(
by Jim Hillier 04 Sep '08

04 Sep '08

I would love some help getting freeradius to authenticate from my windows 2003 server. I am running freeradius Version 2.0.5 on a VMware instance with CentOS 5.1. I get the following error "No authenticate method (Auth-Type) configuration found for the request" when trying to authenticate a Cisco 7200 router with freeradius and active directory. I followed the instructions from: http://deployingradius.com/documents/configuration/active_directory.html after looking at http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO (it seems out dated). I have SAMBA all set up and can authenticate using "ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password". I have modules/mschap configured with: with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" I have radiusd.conf (modules) configured with: exec ntlm_auth { wait = no program = "/usr/bin/ ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } sites-enabled/default has ntlm_auth in the authenticate section. In clients I have: client 10.0.0.0/8 { secret = testing shortname = my-network } I assume there is something blatantly obvious I have missed but I have been struggling with this for 2 days and I need to this up and running. I have set the 7200 to use port 1812 and 1813 but freeradius says it is still using 1645, it still seems to want to work though? Hi Here is the debug: [root@RADIUS ~]# radiusd -X FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Sep 3 2008 at 21:25:44 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.0.0.0/8 { require_message_authenticator = no secret = "testing" shortname = "my-network" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm MYDOMAIN..LOCAL { authhost = LOCAL accthost = LOCAL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {....} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.2.0.4 port 1645, id=2, length=63 NAS-IP-Address = 10.2.0.4 NAS-Port = 0 NAS-Port-Type = Async User-Name = "admin" User-Password = "admin" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> admin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 2 to 10.2.0.4 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 2 with timestamp +34 Ready to process requests.

2 1

Problems with the authentication of users and certificates TLS
by Martin Silvero 04 Sep '08

04 Sep '08

oh ok! but the user whit i trying to run radiusd is root, why say that? is posible? thanks you!

1 0

(no subject)
by Piero Santi 04 Sep '08

04 Sep '08

1 0