- Freeradius-Users - lists.freeradius.org

Re: Lost entries from reply with multiple instances of the same attribute
by Konstantin KABASSANOV 12 Aug '08

12 Aug '08

> Konstantin KABASSANOV wrote: > > Some months ago I mentioned a problem observed while sending Access- > Accept > > with multiple Cisco-AVPair="ssid=..." entries. Even if fields are > correctly > > retrieved from the LDAP server, only the first occurrence of the > attribute > > is sent in the packet. Can you tell me if recent developments have > solved > > this issue? > > This issue has been solved for almost 4 years now. Read > ldap.attrmap. > Alan, I'd be very happy if it was true, but: Even if my radius server gets the following from the rlm_ldap: rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = "ssid=mywifi1" rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = "ssid=mywifi2" the outgoing access-accept packet contains only the first entry: rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = "ssid=mywifi1" FYI the version I use for radius is 2.0.4 so I don't think it is more than 4 years old. In an email sent in April 2008, I saw somebody with a similar problem with another attribute and there was an information that the bug was corrected only in unlang. Am I wrong? Konstantin

1 0

rlm_perl not working as expected on 2.0.5
by Henry 12 Aug '08

12 Aug '08

Greetings, I'm busy trying out Freeradius 2.0.5 before upgrading from 1.1.0, and so far everything looks good. I would like to try out rlm_perl since it presents some interesting possibilities, but am having a spot of bother. I followed the howto here: http://wiki.freeradius.org/Rlm_perl rlm_perl isn't event loaded/instantiated unless I add 'perl' to the instantiate section of radiusd.conf. Even if I do, however, I keep getting this error: "Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type" Any pointers on what I'm missing/doing wrong would be appreciated. Thanks Henry Here's the debug: Mon Aug 11 15:58:53 2008 : Info: FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Aug 8 2008 at 18:56:21 Mon Aug 11 15:58:53 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Mon Aug 11 15:58:53 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Aug 11 15:58:53 2008 : Info: PARTICULAR PURPOSE. Mon Aug 11 15:58:53 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Aug 11 15:58:53 2008 : Info: GNU General Public License v2. Mon Aug 11 15:58:53 2008 : Info: Starting - reading configuration files ... Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/radiusd.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/proxy.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/clients.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/snmp.conf Mon Aug 11 15:58:53 2008 : Debug: including files in directory /usr/local/freeradius-2.0.5/etc/raddb/modules/ Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/policy Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/acct_unique Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/unix Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/chap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/preprocess Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/expiration Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/mac2vlan Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/mschap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/ippool Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/files Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/krb5 Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/passwd Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/radutmp Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/attr_rewrite Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/echo Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/etc_group Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/pap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/realm Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/pam Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/always Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/exec Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/logintime Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/sql_log Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/smbpasswd Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/sradutmp Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/counter Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/ldap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/expr Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/attr_filter Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/checkval Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/digest Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/detail Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/detail.log Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/mac2ip Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/eap.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sql.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sql/postgresql/dialup.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sql/postgresql/counter.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/policy.conf Mon Aug 11 15:58:53 2008 : Debug: including files in directory /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/ Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/default Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/inner-tunnel Mon Aug 11 15:58:53 2008 : Debug: including dictionary file /usr/local/freeradius-2.0.5/etc/raddb/dictionary Mon Aug 11 15:58:53 2008 : Debug: main { Mon Aug 11 15:58:53 2008 : Debug: prefix = "/usr/local/freeradius-2.0.5" Mon Aug 11 15:58:53 2008 : Debug: localstatedir = "/usr/local/freeradius-2.0.5/var" Mon Aug 11 15:58:53 2008 : Debug: logdir = "/usr/local/freeradius-2.0.5/var/log/radius" Mon Aug 11 15:58:53 2008 : Debug: libdir = "/usr/local/freeradius-2.0.5/lib" Mon Aug 11 15:58:53 2008 : Debug: radacctdir = "/usr/local/freeradius-2.0.5/var/log/radius/radacct" Mon Aug 11 15:58:53 2008 : Debug: hostname_lookups = no Mon Aug 11 15:58:53 2008 : Debug: max_request_time = 60 Mon Aug 11 15:58:53 2008 : Debug: cleanup_delay = 5 Mon Aug 11 15:58:53 2008 : Debug: max_requests = 1024 Mon Aug 11 15:58:53 2008 : Debug: allow_core_dumps = no Mon Aug 11 15:58:53 2008 : Debug: pidfile = "/usr/local/freeradius-2.0.5/var/run/radiusd/radiusd.pid" Mon Aug 11 15:58:53 2008 : Debug: checkrad = "/usr/local/freeradius-2.0.5/sbin/checkrad" Mon Aug 11 15:58:53 2008 : Debug: debug_level = 0 Mon Aug 11 15:58:53 2008 : Debug: proxy_requests = no Mon Aug 11 15:58:53 2008 : Debug: log { Mon Aug 11 15:58:53 2008 : Debug: stripped_names = no Mon Aug 11 15:58:53 2008 : Debug: auth = yes Mon Aug 11 15:58:53 2008 : Debug: auth_badpass = yes Mon Aug 11 15:58:53 2008 : Debug: auth_goodpass = yes Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: client localhost { Mon Aug 11 15:58:53 2008 : Debug: ipaddr = 127.0.0.1 Mon Aug 11 15:58:53 2008 : Debug: require_message_authenticator = no Mon Aug 11 15:58:53 2008 : Debug: secret = "testing123" Mon Aug 11 15:58:53 2008 : Debug: nastype = "other" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Mon Aug 11 15:58:53 2008 : Debug: proxy server { Mon Aug 11 15:58:53 2008 : Debug: retry_delay = 5 Mon Aug 11 15:58:53 2008 : Debug: retry_count = 3 Mon Aug 11 15:58:53 2008 : Debug: default_fallback = no Mon Aug 11 15:58:53 2008 : Debug: dead_time = 120 Mon Aug 11 15:58:53 2008 : Debug: wake_all_if_all_dead = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: home_server localhost { Mon Aug 11 15:58:53 2008 : Debug: ipaddr = 127.0.0.1 Mon Aug 11 15:58:53 2008 : Debug: port = 1812 Mon Aug 11 15:58:53 2008 : Debug: type = "auth" Mon Aug 11 15:58:53 2008 : Debug: secret = "testing123" Mon Aug 11 15:58:53 2008 : Debug: response_window = 20 Mon Aug 11 15:58:53 2008 : Debug: max_outstanding = 65536 Mon Aug 11 15:58:53 2008 : Debug: zombie_period = 40 Mon Aug 11 15:58:53 2008 : Debug: status_check = "status-server" Mon Aug 11 15:58:53 2008 : Debug: ping_check = "none" Mon Aug 11 15:58:53 2008 : Debug: ping_interval = 30 Mon Aug 11 15:58:53 2008 : Debug: check_interval = 30 Mon Aug 11 15:58:53 2008 : Debug: num_answers_to_alive = 3 Mon Aug 11 15:58:53 2008 : Debug: num_pings_to_alive = 3 Mon Aug 11 15:58:53 2008 : Debug: revive_interval = 120 Mon Aug 11 15:58:53 2008 : Debug: status_check_timeout = 4 Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: home_server_pool my_auth_failover { Mon Aug 11 15:58:53 2008 : Debug: type = fail-over Mon Aug 11 15:58:53 2008 : Debug: home_server = localhost Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: realm example.com { Mon Aug 11 15:58:53 2008 : Debug: auth_pool = my_auth_failover Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: realm LOCAL { Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: radiusd: #### Instantiating modules #### Mon Aug 11 15:58:53 2008 : Debug: instantiate { Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_exec Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating exec Mon Aug 11 15:58:53 2008 : Debug: exec { Mon Aug 11 15:58:53 2008 : Debug: wait = no Mon Aug 11 15:58:53 2008 : Debug: input_pairs = "request" Mon Aug 11 15:58:53 2008 : Debug: shell_escape = yes Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_perl, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_perl Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating perl Mon Aug 11 15:58:53 2008 : Debug: perl { Mon Aug 11 15:58:53 2008 : Debug: module = "/usr/local/freeradius-2.0.5/etc/raddb/adsl_track.pl" Mon Aug 11 15:58:53 2008 : Debug: func_authorize = "authorize" Mon Aug 11 15:58:53 2008 : Debug: func_authenticate = "authenticate" Mon Aug 11 15:58:53 2008 : Debug: func_accounting = "accounting" Mon Aug 11 15:58:53 2008 : Debug: func_preacct = "preacct" Mon Aug 11 15:58:53 2008 : Debug: func_checksimul = "checksimul" Mon Aug 11 15:58:53 2008 : Debug: func_detach = "detach" Mon Aug 11 15:58:53 2008 : Debug: func_xlat = "xlat" Mon Aug 11 15:58:53 2008 : Debug: func_pre_proxy = "pre_proxy" Mon Aug 11 15:58:53 2008 : Debug: func_post_proxy = "post_proxy" Mon Aug 11 15:58:53 2008 : Debug: func_post_auth = "post_auth" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_expr Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating expr Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_expiration Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating expiration Mon Aug 11 15:58:53 2008 : Debug: expiration { Mon Aug 11 15:58:53 2008 : Debug: reply-message = "Password Has Expired " Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_logintime Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating logintime Mon Aug 11 15:58:53 2008 : Debug: logintime { Mon Aug 11 15:58:53 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Mon Aug 11 15:58:53 2008 : Debug: minimum-timeout = 60 Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: radiusd: #### Loading Virtual Servers #### Mon Aug 11 15:58:53 2008 : Debug: server inner-tunnel { Mon Aug 11 15:58:53 2008 : Debug: modules { Mon Aug 11 15:58:53 2008 : Debug: Module: Checking authenticate {...} for more modules to load Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_pap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating pap Mon Aug 11 15:58:53 2008 : Debug: pap { Mon Aug 11 15:58:53 2008 : Debug: encryption_scheme = "auto" Mon Aug 11 15:58:53 2008 : Debug: auto_header = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_chap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating chap Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_mschap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating mschap Mon Aug 11 15:58:53 2008 : Debug: mschap { Mon Aug 11 15:58:53 2008 : Debug: use_mppe = yes Mon Aug 11 15:58:53 2008 : Debug: require_encryption = no Mon Aug 11 15:58:53 2008 : Debug: require_strong = no Mon Aug 11 15:58:53 2008 : Debug: with_ntdomain_hack = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_unix Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating unix Mon Aug 11 15:58:53 2008 : Debug: unix { Mon Aug 11 15:58:53 2008 : Debug: radwtmp = "/usr/local/freeradius-2.0.5/var/log/radius/radwtmp" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_eap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap Mon Aug 11 15:58:53 2008 : Debug: eap { Mon Aug 11 15:58:53 2008 : Debug: default_eap_type = "md5" Mon Aug 11 15:58:53 2008 : Debug: timer_expire = 60 Mon Aug 11 15:58:53 2008 : Debug: ignore_unknown_eap_types = no Mon Aug 11 15:58:53 2008 : Debug: cisco_accounting_username_bug = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-md5 Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-leap Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-gtc Mon Aug 11 15:58:53 2008 : Debug: gtc { Mon Aug 11 15:58:53 2008 : Debug: challenge = "Password: " Mon Aug 11 15:58:53 2008 : Debug: auth_type = "PAP" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-tls Mon Aug 11 15:58:53 2008 : Debug: tls { Mon Aug 11 15:58:53 2008 : Debug: rsa_key_exchange = no Mon Aug 11 15:58:53 2008 : Debug: dh_key_exchange = yes Mon Aug 11 15:58:53 2008 : Debug: rsa_key_length = 512 Mon Aug 11 15:58:53 2008 : Debug: dh_key_length = 512 Mon Aug 11 15:58:53 2008 : Debug: verify_depth = 0 Mon Aug 11 15:58:53 2008 : Debug: pem_file_type = yes Mon Aug 11 15:58:53 2008 : Debug: private_key_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/server.pem" Mon Aug 11 15:58:53 2008 : Debug: certificate_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/server.pem" Mon Aug 11 15:58:53 2008 : Debug: CA_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/ca.pem" Mon Aug 11 15:58:53 2008 : Debug: private_key_password = "whatever" Mon Aug 11 15:58:53 2008 : Debug: dh_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/dh" Mon Aug 11 15:58:53 2008 : Debug: random_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/random" Mon Aug 11 15:58:53 2008 : Debug: fragment_size = 1024 Mon Aug 11 15:58:53 2008 : Debug: include_length = yes Mon Aug 11 15:58:53 2008 : Debug: check_crl = no Mon Aug 11 15:58:53 2008 : Debug: cipher_list = "DEFAULT" Mon Aug 11 15:58:53 2008 : Debug: make_cert_command = "/usr/local/freeradius-2.0.5/etc/raddb/certs/bootstrap" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_ttls Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-ttls Mon Aug 11 15:58:53 2008 : Debug: ttls { Mon Aug 11 15:58:53 2008 : Debug: default_eap_type = "md5" Mon Aug 11 15:58:53 2008 : Debug: copy_request_to_tunnel = no Mon Aug 11 15:58:53 2008 : Debug: use_tunneled_reply = no Mon Aug 11 15:58:53 2008 : Debug: virtual_server = "inner-tunnel" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-peap Mon Aug 11 15:58:53 2008 : Debug: peap { Mon Aug 11 15:58:53 2008 : Debug: default_eap_type = "mschapv2" Mon Aug 11 15:58:53 2008 : Debug: copy_request_to_tunnel = no Mon Aug 11 15:58:53 2008 : Debug: use_tunneled_reply = no Mon Aug 11 15:58:53 2008 : Debug: proxy_tunneled_request_as_eap = yes Mon Aug 11 15:58:53 2008 : Debug: virtual_server = "inner-tunnel" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-mschapv2 Mon Aug 11 15:58:53 2008 : Debug: mschapv2 { Mon Aug 11 15:58:53 2008 : Debug: with_ntdomain_hack = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Checking authorize {...} for more modules to load Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_realm, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_realm Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating suffix Mon Aug 11 15:58:53 2008 : Debug: realm suffix { Mon Aug 11 15:58:53 2008 : Debug: format = "suffix" Mon Aug 11 15:58:53 2008 : Debug: delimiter = "@" Mon Aug 11 15:58:53 2008 : Debug: ignore_default = no Mon Aug 11 15:58:53 2008 : Debug: ignore_null = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_files, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_files Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating files Mon Aug 11 15:58:53 2008 : Debug: files { Mon Aug 11 15:58:53 2008 : Debug: usersfile = "/usr/local/freeradius-2.0.5/etc/raddb/users" Mon Aug 11 15:58:53 2008 : Debug: acctusersfile = "/usr/local/freeradius-2.0.5/etc/raddb/acct_users" Mon Aug 11 15:58:53 2008 : Debug: preproxy_usersfile = "/usr/local/freeradius-2.0.5/etc/raddb/preproxy_users" Mon Aug 11 15:58:53 2008 : Debug: compat = "no" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/users[1]: Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type Mon Aug 11 15:58:53 2008 : Error: Errors reading /usr/local/freeradius-2.0.5/etc/raddb/users Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/modules/files[7]: Instantiation failed for module "files" Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Error: Errors initializing modules The users file: DEFAULT Auth-Type = Perl Fall-Through = 1 test@realm0 Auth-Type := System Service-Type = Framed-User, Framed-Protocol = PPP, Configuration-Token = test The perl {} section from radiusd.conf: ... module = ${prefix}/etc/raddb/test.pl ... in sites-enabled/default, I added all the 'perl' entries as mentioned in the howto ('files' is also enabled).

2 2

get problem with freeradius with LDAP authenticate
by chenweiting 12 Aug '08

12 Aug '08

Dear all, I am tying to configure freeradius 1.1.7 on Solaris10 to authenticate with ldap server. After I configure it, radiusd -X -A running well, once I run radtest I got the error as below: ============================================================================================================== ./radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: lo! g_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config! _files: reading dictionary read_config_files: reading n aslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "ldap.icpdd.neca.nec.com.au" ldap: port = 389 ldap: net_timeout = 10 ldap: timeout = 30 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)"! ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "ou=people,dc=icpdd,dc=neca,dc=nec,dc=com,dc=au" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 &nbs! p;ldap: compare_check_items = no ldap: access_attr_used_for_a llow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS! -IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap:! LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rl m_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 55300 Module: Instantiated ldap (ldap) ! Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated pre! process (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique! ) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process ! requests. rad_recv: Access-Request packet from host 127.0.0.1:61260, id=86, length=60 User-Name = "testid" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "weitingc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP! modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "testid" with password "password" radius_xlat: '(uid=weitingc)' radius_xlat: 'ou=people,dc=mydomain,dc=com,dc=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.icpdd.neca.nec.com.au:389, authentication 0 ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_ldap-1.1.7.so: symbol ldap_int_tls_config: referenced symbol not found Killed ====================================================== Any idea for this issue? Thanks and regards, Weiting Chen _________________________________________________________________ 一点即聊，MSN推出新功能“点我！” http://im.live.cn/click/

2 1

Multiple NAS
by Rana Dhekial 12 Aug '08

12 Aug '08

Hi, I use different type of VoIP GWYs and SIP servers ( like Cisco, Asterisk, OpenSER ) in our VoIP network. They are writing detail accounting info to the freeradius server fine. But I am having some issues writing the accounting info to backend database like MySQL. For example the radius accounting attributes of Cisco is different from Asterisk or OpenSER. So the idea is to create multiple tables in the database where Freeradius is writing and store Cisco's accounting info to say radacct_1, Asterisk's to radacct_2, OpenSER's to radacct_3 tables. How do I assign a specific NAS like Cisco to use say sql_1.conf, Asterisk to use sql_2.conf and OpenSER to use sql_3.conf. Or if there is any other way to solve this.. thanks in advance Get more from your digital life. Find out how. _________________________________________________________________ Got Game? Win Prizes in the Windows Live Hotmail Mobile Summer Games Trivia Contest http://www.gowindowslive.com/summergames?ocid=TXT_TAGHM

2 3

Re: Lost entries from reply with multiple instances of the same attribute
by Alan DeKok 12 Aug '08

12 Aug '08

Konstantin KABASSANOV wrote: > Some months ago I mentioned a problem observed while sending Access-Accept > with multiple Cisco-AVPair="ssid=..." entries. Even if fields are correctly > retrieved from the LDAP server, only the first occurrence of the attribute > is sent in the packet. Can you tell me if recent developments have solved > this issue? This issue has been solved for almost 4 years now. Read ldap.attrmap. Alan DeKok.

1 0

Scour invite from yawar hadi noshahi
by yawar hadi noshahi 12 Aug '08

12 Aug '08

Did you hear about Scour? It is the next gen search engine with Google/Yahoo/MSN results and user comments all on one page. Best of all we get rewarded for using it by collecting points with every search, comment and vote. The points are redeemable for Visa gift cards It's like earning credit card or airline points just for searching. Hit the link below to join and we will both get points! http://scour.com/invite/yawar/ I know you'll like it! - yawar hadi noshahi If you would prefer not to receive invitations from ANY Scour members please click here - http://www.scour.com/unsub/e/ZnJlZXJhZGl1cy11c2Vyc0BsaXN0cy5mcmVlcmFkaXVzLm… Scour, Inc., 15303 Ventura Blvd. Suite 860, Sherman Oaks, CA 91403, USA.

1 0

Lost entries from reply with multiple instances of the same attribute
by Konstantin KABASSANOV 11 Aug '08

11 Aug '08

Hi, Some months ago I mentioned a problem observed while sending Access-Accept with multiple Cisco-AVPair="ssid=..." entries. Even if fields are correctly retrieved from the LDAP server, only the first occurrence of the attribute is sent in the packet. Can you tell me if recent developments have solved this issue? Thanks. Konstantin _____________________________________________________________________ Konstantin KABASSANOV LIP6/CNRS 104, avenue du Président Kennedy, 75016 Paris, France Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html _____________________________________________________________________

1 0

problem with fall-through
by Wayne Lee 11 Aug '08

11 Aug '08

Hello All We are using version 2.0.5 with a mysql backend. 99.9% of the radius service is working as expected :-) However I'm trying to also use the "users" file so I can give some default answers back to a particular NAS, I have set "fall-through = No" but it still falls through to the sql server and provides the sql info back too, if the user is not also in the sql table it only provides the correct info. from my users file DEFAULT Client-IP-Address =~ "82.1x.x.130\$", Auth-Type := Accept Tunnel-Type = "L2TP", Tunnel-Medium-Type = "IP", Service-Type := Framed-User, Tunnel-Password := "radadmin", Tunnel-Server-Endpoint := "82.x.x.253", # Tunnel-Client-Auth-ID := "", Fall-Through = No Should it fall through to the sql module even with fall-through set at no or have I misunderstood it. Thanks Wayne

2 1

FreeRadius MAC address authorization (no authentication)
by Ramot Lubis 11 Aug '08

11 Aug '08

Hi, I'm trying to implement FreeRadius to authenticate Wireless CLient based on MAC address only, unfortunately all my wireless client using EAP/TLS (Windows XP SP2) . I found that tutorials and doc are not leading me to the right direction. Besides, I will not burden my Windows XP SP2 client to search hotfix for EAP/TLS compatibility with FreeRadius. After digging more, I realize that Authorization using checkval module is enough to verified valid MAC address from Wireless Client. But my question is how can I use only Authorization where Authentication will always return Access-Accept. Here is my radiusd -X output: Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.2 port 1027, id=183, length=199 User-Name = "PIDEL-3C5B30E9C\\Administrator" NAS-IP-Address = 10.0.0.2 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-61-85:DEL_LR1" Calling-Station-Id = "00-21-00-0B-68-E3" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201002201504944454c2d3343354233304539435c41646d696e6973747261746f72 Message-Authenticator = 0x891b437263cd48909255484bb081c823 +- entering group authorize ++[preprocess] returns ok .... .... rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-00-0B-68-E3 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-00-0B-68-E3 ++[checkval] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Sending Access-Reject of id 183 to 10.0.0.2 port 1027 Finished request 0. Thanks in advance. Ramot Lubis.

7 19

[OT] radius, pam and ts
by Vittore Zen 11 Aug '08

11 Aug '08

Hi, to everyone. I know this is an OT post but i don't know where post. I have a freeradius server that's work fine. I have a tslp that's work fine (with passwd user) (it's and ubuntu 8.04 with ltsp correctly installed) Now I want use freeradius to autenticate user in tslp desktop. So, I think to install http://freeradius.org/pam_radius_auth but no request is sent to freeradius server. The questions: 1. where install pam_radius_auth? In /etc or in /opt/ltsp/i386/etc? 2. how to configure for ltsp? Thanks in advance v.

2 1