- Freeradius-Users - lists.freeradius.org

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)
by William Hegardt 23 Aug '08

23 Aug '08

I hate to resurrect this long thread from July 22-28, but I have the same problem and never saw a resolution. I'm using FreeRadius 2.0.5 on CentOS 5.2 with wpa_supplicant 0.6.4 (latest to date). I'm using the bootstrap script to generate example certificates. I also created a client certificate using make client.pem. I configured wpa_supplicant with ca.pem, client.pem and client.key. EAP-TLS authentication fails with the "fatal unknown ca" message. If I hack the Makefile like Sergio mentioned last month to sign the client certificate with the CA key, then authentication succeeds. In last month's thread, Alan DeKok posted: > You need to follow the documentation in eap.conf. > > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > certificate_file = ${certdir}/server.pem > > Have you done that? In my case, CA_file does indeed refer to ca.pem as created by the bootstrap script. So I'm assuming that I don't need to touch the server.pem file as created. I'd really like to understand what's wrong. Could wpa_supplicant be somehow incompatible with the bootstrap certificate chain? Thanks

5 9

3Com 4500 and 5500 local login
by Oxiel 23 Aug '08

23 Aug '08

Hello gurus. Is me again :), trying to authenticate local users to the switch through freeradius 2.0.5, but no success with 3Com 4500/5500. My users file has: admin Cleartext-Password := "XXXXX" Framed-IP-Address = "%{Framed-IP-Address}", 3Com-User-Access-Level = 3Com-Administrator, Reply-Message = "Hola usuario, %{User-Name}" radiusd -X shows this, as you can see i'm getting the access-accept message: rad_recv: Access-Request packet from host 192.168.100.246 port 5001, id=72, length=204 User-Name = "admin" User-Password = "XXXXX" NAS-IP-Address = 192.168.100.246 NAS-Identifier = "001cc53e1b02" NAS-Port = 16809985 NAS-Port-Id = "unit=1;subslot=0;port=8;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Login-User Login-IP-Host = 192.168.100.246 Calling-Station-Id = "0000-0000-0000" Framed-IP-Address = 192.168.100.241 H3C-Connect_Id = 72 H3C-Product-ID = "4500" H3C-Ip-Host-Addr = "192.168.100.241 00:00:00:00:00:00" H3C-NAS-Startup-Timestamp = 954633321 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry admin at line 220 expand: %{Framed-IP-Address} -> 192.168.100.241 expand: Hola usuario, %{User-Name} -> Hola usuario, admin ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "XXXXX" rlm_pap: Using clear text password "XXXXX" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 72 to 192.168.100.246 port 5001 Framed-IP-Address = 192.168.100.241 3Com-User-Access-Level = 3Com-Administrator Reply-Message = "Hola usuario, admin" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 72 with timestamp +15 Ready to process requests. The switch shows me this: debugging radius packet terminal debugging *0.683215396 4500 RDS/8/DEBUG:- 1 -Recv MSG,[MsgType=Normal auth request Index = 72, ulParam3=2185152212] *0.683215397 4500 RDS/8/DEBUG:- 1 -Send attribute list: *0.683215398 4500 RDS/8/DEBUG:- 1 - [1 User-name ] [7 ] [admin] [2 Password ] [18] [B9CE88BA96205FBFF301351E5ED4A8C5] [4 NAS-IP-Address ] [6 ] [192.168.100.246] [32 NAS-Identifier ] [14] [001cc53e1b02] [5 NAS-Port ] [6 ] [16809985] [87 NAS_Port_Id ] [34] [unit=1;subslot=0;port=8;vlanid=1] *0.683215399 4500 RDS/8/DEBUG:- 1 - [61 NAS-Port-Type ] [6 ] [15] [3com-26 Connect_ID ] [6 ] [72] [6 Service-Type ] [6 ] [1] [14 Login-Host ] [6 ] [192.168.100.246] [31 Caller-ID ] [16] [303030302D303030302D30303030] [8 Framed-Address ] [6 ] [192.168.100.241] *0.683215400 4500 RDS/8/DEBUG:- 1 - [3com-255Product-ID ] [6 ] [4500] [3com-60 Ip-Host-Addr ] [35] [192.168.100.241 00:00:00:00:00:00] [3com-59 NAS-Startup-Timestamp ] [6 ] [954633321] *0.683215401 4500 RDS/8/DEBUG:- 1 -Send: IP=[192.168.100.91], UserIndex=[72], ID=[72], RetryTimes=[0], Code=[1], Length=[204] *0.683215401 4500 RDS/8/DEBUG:- 1 -Send Raw Packet is: *0.683215402 4500 RDS/8/DEBUG:- 1 - 01 48 00 cc e4 54 00 00 e7 22 00 00 b1 26 00 00 29 3b 00 00 01 07 61 64 6d 69 6e 02 12 b9 ce 88 ba 96 20 5f bf f3 01 35 1e 5e d4 a8 c5 04 06 c0 a8 64 f6 20 0e 30 30 31 63 63 35 33 65 31 62 30 32 05 06 01 00 80 01 57 22 75 6e 69 74 3d 31 3b 73 75 62 73 6c 6f 74 3d 30 3b 70 6f 72 74 3d 38 3b 76 6c 61 6e 69 64 3d 31 3d 06 00 00 00 0f 06 06 00 00 00 01 0e 06 c0 a8 64 f6 1f 10 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 08 06 c0 a8 64 f1 1a 3b 00 00 63 a2 1a 06 00 00 00 48 ff 06 34 35 30 30 3c 23 31 39 32 2e 31 36 38 2e 31 30 30 2e 32 34 31 20 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3b 06 38 e6 8c 69 *0.683215413 4500 RDS/8/DEBUG:- 1 -Recv MSG,[MsgType=PKT response Index = 59, ulParam3=2182466612] *0.683215414 4500 RDS/8/DEBUG:- 1 -Receive Raw Packet is: *0.683215415 4500 RDS/8/DEBUG:- 1 - 02 48 00 3b 22 a0 e3 77 89 0b 9f f0 0f 82 02 71 a6 81 7b 68 08 06 c0 a8 64 f1 1a 0c 00 00 00 2b 01 06 00 00 00 03 12 15 48 6f 6c 61 20 75 73 75 61 72 69 6f 2c 20 61 64 6d 69 6e *0.683215416 4500 RDS/8/DEBUG:- 1 -Receive:IP=[192.168.100.91],Code=[2],Length=[59] *0.683215417 4500 RDS/8/DEBUG:- 1 - [8 Framed-Address ] [6 ] [192.168.100.241] [3com-1 User_Access_Level ] [6 ] [3] [18 Reply-Message ] [21] [Hola usuario, admin] Has anybody done this?, should i sent something else on the reply? Best regards. Oxiel __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.es

2 1

radsniff
by Lemaster, Rob 23 Aug '08

23 Aug '08

I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples?

2 1

Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi, Can any body respond to my earlier requst please. regards, Venkat ----- Forwarded Message ----- From: "Venkata LK Mula" To: Subject: Certificate problem on Windows XP clinet ... Date: Thu, 21 Aug 2008 00:33:26 +0530 Hi, Regarding the above mentioned subject, we are facing the problem of "Windows was unable to find the certificate to log on to the network Roaming test2". Though the certificates are installed properly, and when we are using the same certificates for 'PEAP-MSCHAPv2' with 'validate server certificate' working fine. Can any one look into the same and respond me back please. regards, Venkat [Attachment: cacert.der] [Attachment: clinet.p12]

2 1

TLS_accept:error in SSLv3 read client certificate A
by Martin Silvero 23 Aug '08

23 Aug '08

hello friends! solved the problem we had, I did a test and works well, but now every time the user wants to connect I get this error in the logs: Thu Aug 21 11:14:56 2008 : Info: rlm_eap_md5: Issuing Challenge Thu Aug 21 11:14:56 2008 : Error: TLS_accept:error in SSLv3 read client certificate A Thu Aug 21 11:14:56 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Thu Aug 21 11:14:56 2008 : Error: TLS Alert read:fatal:bad certificate Thu Aug 21 11:14:56 2008 : Error: TLS_accept:failed in SSLv3 read client certificate A Thu Aug 21 11:14:56 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Thu Aug 21 11:14:56 2008 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. someone could give me a hand please, thank you very much now. -- -- Silvero Martin

2 1

specifying back end to proxy on per-user basis
by Greg Woods 22 Aug '08

22 Aug '08

We have a freeradius instance that talks to the world, and proxies requests to a back end server that does token authentication via the "otp" module. This all works fine. What we need is something we can do when a user forgets or loses their card. We thought to use S/key for this. To that end, I have another back end server that does s/key authentication via a PAM module. This too works, but I have to find a way to specify in the front end proxy on a per-user basis which back end server should be used. The first step to doing this was to set up a realm for the s/key server. In the proxy.conf file for the front end proxy, the NULL realm has authhost and secret are set up for the otp back end server. I created an SKEY realm that sets authhost and secret for the s/key back end server. So far so good; I can run "radtest" against the front end proxy server, and if I specify "user@SKEY" as the username, it proxies to the s/key back end and everything works great. The problem is that I can't figure out the magic incantation for the proxy front end to tell it that certain users should be in the SKEY realm. Am I basically on the right track as to the correct way to accomplish what I want? If so, what is the magic incantation to specify which users should be in the SKEY realm? If somebody could just point me down the right path, I'll be happy to read the relevant documentation to come up with the correct syntax, but I haven't found it yet. Thanks, --Greg

3 6

RE: clients.conf - identifying a "client" - sql/ldap
by Johan Meiring 22 Aug '08

22 Aug '08

Hi all, Received no responses to the post below. Any ideas would be greatly appreciated! Thanks, Johan Meiring Cape PC Services CC / Amobia Communications Tel: (021) 883-8271 / (0861) AMOBIA Fax: (021) 886-7782 / (0861) AMOFAX > -----Original Message----- > From: Johan Meiring [mailto:jmeiring@pcservices.co.za] > Sent: 28 July 2008 11:55 AM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: clients.conf - identifying a "client" - sql/ldap > > > Hi, > > I have the following setup. > > Various clients (chillispot) behind broadband (read: dynamic > IP) connections. > Basically I am selling AAA services. > > I would like to authotize a nas to use my services in the > first place by using the NAS-Identifier and the radius secret. > > Both the NAS SQL table and the clients.conf file seem to > identify the client by IP address. > > As my clients can be from ANY address, it seems that the only > way is to create an entry in clients.conf is as follows: > > client 0.0.0.0/0 { > shortname = myclient > secret = abcde > } > > This now implies again that all clients have to have the same secret. > > I am using the perl modules, but according to another post > you cannot use perl as replacement for clients.conf. > Also the sql nas table simply mimics the clients. (I.e. > still uses IP address to find entry). > > Is there any way to handle clients with dynamic IPs, and use > the NAS-Identifier and radius secret to allow/disallow the NAS? > > Thanks! > > Cheers, > > Johan Meiring > Cape PC Services CC / Amobia Communications > Tel: (021) 883-8271 / (0861) AMOBIA > Fax: (021) 886-7782 / (0861) AMOFAX > >

3 6

Compiling pam_radius_auth.so on MacOS 10.3.9 (PPC)
by Alex Coco 22 Aug '08

22 Aug '08

Nevermind, I was on the right track, in md5.c I had to: #define HIGHFIRST I suspect on an intel Mac I won't have to. AGC

1 0

Compiling pam_radius_auth.so on MacOS 10.3.9 (PPC)
by Alex Coco 22 Aug '08

22 Aug '08

Hello, I have an older eMac in my lab I am using to test the PAM module (pam_radius-1.3.17) and have been able to compile by changing the Makefile to use: gcc -bundle pam_radius_auth.o md5.o -lpam -lc -o pam_radius_auth.so for the final linking of the shared object. The resulting .so seems to work except the password hashing comes out garbled on the server side and debug output indicates: Server Side: WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Client Side: pam_radius_auth: packet from RADIUS server 192.168.2.4 fails verification: The shared secret is probably incorrect However I've gone over the secrets on both side more times than I can remember, I even slipped in a debug message into pam_radius_auth.c to report the secret to make sure the file (/etc/raddb/server) was parsing properly. The secrets are identical, which leaves me to think that there's something about the crypto algorithm that's not matching between the client and server and I have successfully tested using PAM on the Linux machine that hosts the server (Ubuntu 7.10). Any suggestions or pointers as to where the problem may lie are greatly appreciated. -alex

2 1

FreeRadius Basic Authentication Problem
by Syed Anwarul Hasan 22 Aug '08

22 Aug '08

FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Jul 21 2008 at 15:35:42 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 1029, id=10, length=56 User-Name = "John" User-Password = "hello" NAS-IP-Address = 192.168.1.131 NAS-Port = 1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "John", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> John attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 10 to 127.0.0.1 port 1029 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +7 Ready to process requests. And my radtest command *radtest John hello localhost 1 testing123 Users file # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. John Auth-Type :=System,Huntgroup-Name == John,User-Password := "hello" Reply-Message = "Hello, %{User-Name}", Fall-Through = Yes ** And in Huntgroup file I have added this line John NAS-IP-Address == 127.0.0.1 Clients.conf I have not modified client being localhost. radiusd.conf : I have not modified , the listening IP address is * (wildcard) with port 0 for /etc/services 1812 and 1813 ports. In the sites-enabled directory , in the Authorize section, the files section is included . Hence this is the scenario, I have been trying to authenticate RADIUS server with a single user entry in User file but i am unable to do. I hope you all help me in this regard. SYED *

3 3