- Freeradius-Users - lists.freeradius.org

Cleartext Password not clear
by Stéven Le Bras 12 Aug '08

12 Aug '08

Hi there, I'm attempting to log in chillispot with freeradius but when I send the couple username / password with a cleartext password in user-password to freeradius through chillispot, radiusd respond : rad_recv: Access-Request packet from host 127.0.0.1 port 36710, id=47, length=263 ChilliSpot-Version = "1.0.12" User-Name = "testuser" User-Password = "\177\326=\343\017\021e\247B4ޣ\202<6\001" NAS-IP-Address = 10.1.0.1 Service-Type = Login-User Framed-IP-Address = 10.1.0.4 Calling-Station-Id = "00-13-CE-8C-0F-AF" Called-Station-Id = "00-09-6B-D8-9A-C6" NAS-Identifier = "nas01" Acct-Session-Id = "48a18af500000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=SYS_TECH," WISPr-Location-Name = "HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3990/logoff" Message-Authenticator = 0x8bd17fcc4a6acc6cac5026615e4545b5 [...] auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject (the password is "plop") but i want that freeradius can read the password without transform it. Is it possible or do you think it could be chillispot that transform it ? Thank's -- Stéven

2 3

Multiple Attribute checks with sql module
by Alexander Koeppe 12 Aug '08

12 Aug '08

Hello List, I want to set up freeradius as a proxy for cisco management and dot1x. The attribute to check is NAS-Port-Type. If it's "Ethernet" it's a dot1x request and has to be proxied by one realm configured in proxy.conf. Else it has to be proxied to another realm also configured in proxy.conf for one-time-password authentication. Further if a specific NAS requests, the request should be accepted by the proxy itself. I got this already working with the users file looking like DEFAULT NAS-Port-Type==Ethernet,NAS-IP-Address==1.1.1.1,Auth-Type:=Accept DEFAULT NAS-Port-Type==Ethernet,Proxy-To-Realm:=Realm1 DEFAULT NAS-IP-Address==1.1.1.1,Auth-Type:=Accept DEFAULT Proxy-To-Realm:=Realm2 But I doesn't get this working using the sql module. My database structure looks like mysql> select * from radcheck; +----+----------+---------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-------+ | 2 | testuser | Password | == | test | | 4 | DEFAULT | NAS-Port-Type | =* | | +----+----------+---------------+----+-------+ 2 rows in set (0.00 sec) mysql> select * from usergroup; +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 2 | DEFAULT | ProxyMgt | | 3 | DEFAULT | ProxyDOT1x | +----+----------+------------+ 1 row in set (0.00 sec) mysql> select * from radgroupcheck; +----+------------+----------------+----+----------+ | id | GroupName | Attribute | op | Value | +----+------------+----------------+----+----------+ | 4 | ProxyMgt | NAS-Port-Type | == | Virtual | | 5 | ProxyMgt | Proxy-To-Realm | := | Mgt | | 6 | ProxyDOT1x | NAS-Port-Type | == | Ethernet | | 7 | ProxyDOT1x | Proxy-To-Realm | := | PortSec | +----+------------+----------------+----+----------+ 4 rows in set (0.00 sec) mysql> select * from radgroupreply; Empty set (0.00 sec) With this sql configuration, the server proxy management requests but not dot1x requests. In debug it says "No matching entry in the database for request from user". Despite the acceptance of specific NAS requests. The reason I want to realize this configuration with the sql module is, that changes are possible without HUP the process. I've read the documentation which is available for the sql module but the examples described there are not that complex to help with my problem. Can anyone help me to realize the above mentioned configuration of the users file with the sql module? Thanks in advance Cheers Alex

1 0

What is the certificate that I installed on the notebook?
by Martin Silvero 12 Aug '08

12 Aug '08

/certs/ in the folder many licences, what is that I installed on the notebook and as set? thanks!!! -- -- Silvero Martin

1 0

Help needed for radrelay under 1.1.3
by Ryan 12 Aug '08

12 Aug '08

Hi All, Need some help on radrelay for 1.1.3 if possible. I have a radius setup whereby there are two radius, one for authorization/authentication and one for accounting. The one doing authorization/authentication will relay the accounting detail using radrelay to the other radius which will update to sql. Currently I'm having some problem with the relaying, it does not seems to be working as the detail file which is suppose to be cleared as entries are relayed is getting filled up. I noticed that the radrelay process is not forking the detail.work file at all. Have tried running radrelay in debug mode but was not able to find any error other than the following rad_verify: Received Accounting-Response packet from client xxx.xxx.xxx.xxx port 1813 with invalid signature (err=2)! (Shared secret is incorrect.) Both radius are running 1.1.3. The error is rather strange as I'm sure that the shared secret is correct. Best Regards, Ryan

2 1

Why do I need to force Auth-Type?
by sphaero 12 Aug '08

12 Aug '08

In a previous post "PAP what password encryption is used?" I managed to get authentication working with a msssql backend however I need to force Auth-Type := PAP. I read it's bad practice to force the Auth-Type so I was wondering what I could do to let freeradius figure the authentication itself. This is all done on freeradius 1.1.6 (OSS 10.3) I've setup an sql module: sql mssql { driver = "rlm_sql_unixodbc" # Connect info server = "test" login = "Radius_User" password = "blabla" radius_db = "V2" # niet gebruikt wel geset! acct_table1 = "radacct" acct_table2 = "radacct" authcheck_table = "user" authreply_table = "user" # niet gebruikt wel geset! groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "usergroup" # Remove stale session if checkrad does not see a double login deletestalesessions = yes # Print all SQL statements when in debug mode (-x) sqltrace = no sqltracefile = ${logdir}/sqltrace.sql # number of sql connections to make to server num_sql_socks = 5 sql_user_name = "%{Stripped-User-Name:-%{User-Name:-none}}" # Custom query die attributen klaar zet! authorize_check_query = "SELECT UserID,Usernaam,'SHA-Password' AS Attribute, Wachtwoord, ':=' AS Op FROM ${authcheck_table} WHERE Usernaam = '%{SQL-User-Name}' ORDER BY UserID" authorize_reply_query = "SELECT UserID,Usernaam from {authreply_table} WHERE Usernaam = '%{SQL-User-Name}' ORDER BY UserID" } You can see I'm using a custom SQL query to get the right attributes. I can only compare username and password in this database. I actually don't need any groupcheck's etc. I've setup its authorize entry: Autz-Type mssql { mssql } and finally in users file: DEFAULT Realm == mssql.nl", Autz-Type := mssql This setup doesn't work: modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "mssql.nl" for User-Name = "lsa(a)mssql.nl" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "lsa" rlm_realm: Proxying request from user lsa to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 Found Autz-Type mssql Processing the authorize section of radiusd.conf modcall: entering group mssql for request 1 radius_xlat: 'lsa' rlm_sql (mssql): sql_set_user escaped user --> 'lsa' radius_xlat: 'SELECT UserID,Usernaam,'SHA-Password' AS Attribute, Wachtwoord, ':=' AS Op FROM bas_user WHERE Usernaam = 'lsa' ORDER BY UserID' rlm_sql (mssql): Reserving sql socket id: 3 radius_xlat: '' radius_xlat: 'SELECT UserID,Usernaam from {authreply_table} WHERE Usernaam = 'lsa' ORDER BY UserID' rlm_sql_getvpdata: database query error radius_xlat: '' rlm_sql (mssql): Released sql socket id: 3 modcall[authorize]: module "mssql" returns ok for request 1 modcall: leaving group mssql (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 223 to 127.0.0.1 port 32770 Waking up in 4 seconds... rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=223, length=20 If I add Auth-Type in users file it works: DEFAULT Realm == mssql.nl", Autz-Type := mssql, Auth-Type := PAP Rg, Arnaud Loonstra -- View this message in context: http://www.nabble.com/Why-do-I-need-to-force-Auth-Type--tp18925418p18925418… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Re: Lost entries from reply with multiple instances of the same attribute
by Phil Mayers 12 Aug '08

12 Aug '08

Konstantin KABASSANOV wrote: >> Konstantin KABASSANOV wrote: >>> Some months ago I mentioned a problem observed while sending Access- >> Accept >>> with multiple Cisco-AVPair="ssid=..." entries. Even if fields are >> correctly >>> retrieved from the LDAP server, only the first occurrence of the >> attribute >>> is sent in the packet. Can you tell me if recent developments have >> solved >>> this issue? >> This issue has been solved for almost 4 years now. Read >> ldap.attrmap. >> > > Alan, I'd be very happy if it was true, but: > > Even if my radius server gets the following from the rlm_ldap: > > rlm_ldap: looking for reply items in directory... > rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = > "ssid=mywifi1" > rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = > "ssid=mywifi2" Read the comments in "ldap.attrmap". Specifically you're going to want: replyItem Cisco-AVPair wireless += i.e. you need to use the "operator" field

1 0

Accounting
by Jonathan Gazeley 12 Aug '08

12 Aug '08

We at Bristol have used FreeRADIUS with no problems for some time, but I would like to alter the way that accounting is performed, but I am unsure of how to do it. Currently all the accounting is sent to a MySQL database. The 'radacct' table tells me the start/stop of each session and the amount of traffic passed in that time. However the traffic figures are only updated when the user's session terminates. Is there a way to get up-to-date statistics that can be polled, say, on an hourly basis? What I'm getting at is that I want each user to have a daily/weekly/etc traffic quota so the radius server should repeatedly check to see if it has been exceeded. Appropriate action will be taken elsewhere is this is exceeded. Does anyone have any pointers? e.g. can the radius server be queried intermittently for traffic figures? Can the radacct table be updated hourly without forcing a disconnection? Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

4 6

Re: Lost entries from reply with multiple instances of the same attribute
by Konstantin KABASSANOV 12 Aug '08

12 Aug '08

> Konstantin KABASSANOV wrote: > > Some months ago I mentioned a problem observed while sending Access- > Accept > > with multiple Cisco-AVPair="ssid=..." entries. Even if fields are > correctly > > retrieved from the LDAP server, only the first occurrence of the > attribute > > is sent in the packet. Can you tell me if recent developments have > solved > > this issue? > > This issue has been solved for almost 4 years now. Read > ldap.attrmap. > Alan, I'd be very happy if it was true, but: Even if my radius server gets the following from the rlm_ldap: rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = "ssid=mywifi1" rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = "ssid=mywifi2" the outgoing access-accept packet contains only the first entry: rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = "ssid=mywifi1" FYI the version I use for radius is 2.0.4 so I don't think it is more than 4 years old. In an email sent in April 2008, I saw somebody with a similar problem with another attribute and there was an information that the bug was corrected only in unlang. Am I wrong? Konstantin

1 0

rlm_perl not working as expected on 2.0.5
by Henry 12 Aug '08

12 Aug '08

Greetings, I'm busy trying out Freeradius 2.0.5 before upgrading from 1.1.0, and so far everything looks good. I would like to try out rlm_perl since it presents some interesting possibilities, but am having a spot of bother. I followed the howto here: http://wiki.freeradius.org/Rlm_perl rlm_perl isn't event loaded/instantiated unless I add 'perl' to the instantiate section of radiusd.conf. Even if I do, however, I keep getting this error: "Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type" Any pointers on what I'm missing/doing wrong would be appreciated. Thanks Henry Here's the debug: Mon Aug 11 15:58:53 2008 : Info: FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Aug 8 2008 at 18:56:21 Mon Aug 11 15:58:53 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Mon Aug 11 15:58:53 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Aug 11 15:58:53 2008 : Info: PARTICULAR PURPOSE. Mon Aug 11 15:58:53 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Aug 11 15:58:53 2008 : Info: GNU General Public License v2. Mon Aug 11 15:58:53 2008 : Info: Starting - reading configuration files ... Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/radiusd.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/proxy.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/clients.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/snmp.conf Mon Aug 11 15:58:53 2008 : Debug: including files in directory /usr/local/freeradius-2.0.5/etc/raddb/modules/ Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/policy Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/acct_unique Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/unix Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/chap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/preprocess Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/expiration Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/mac2vlan Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/mschap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/ippool Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/files Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/krb5 Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/passwd Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/radutmp Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/attr_rewrite Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/echo Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/etc_group Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/pap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/realm Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/pam Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/always Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/exec Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/logintime Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/sql_log Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/smbpasswd Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/sradutmp Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/counter Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/ldap Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/expr Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/attr_filter Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/checkval Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/digest Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/detail Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/detail.log Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/modules/mac2ip Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/eap.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sql.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sql/postgresql/dialup.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sql/postgresql/counter.conf Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/policy.conf Mon Aug 11 15:58:53 2008 : Debug: including files in directory /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/ Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/default Mon Aug 11 15:58:53 2008 : Debug: including configuration file /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/inner-tunnel Mon Aug 11 15:58:53 2008 : Debug: including dictionary file /usr/local/freeradius-2.0.5/etc/raddb/dictionary Mon Aug 11 15:58:53 2008 : Debug: main { Mon Aug 11 15:58:53 2008 : Debug: prefix = "/usr/local/freeradius-2.0.5" Mon Aug 11 15:58:53 2008 : Debug: localstatedir = "/usr/local/freeradius-2.0.5/var" Mon Aug 11 15:58:53 2008 : Debug: logdir = "/usr/local/freeradius-2.0.5/var/log/radius" Mon Aug 11 15:58:53 2008 : Debug: libdir = "/usr/local/freeradius-2.0.5/lib" Mon Aug 11 15:58:53 2008 : Debug: radacctdir = "/usr/local/freeradius-2.0.5/var/log/radius/radacct" Mon Aug 11 15:58:53 2008 : Debug: hostname_lookups = no Mon Aug 11 15:58:53 2008 : Debug: max_request_time = 60 Mon Aug 11 15:58:53 2008 : Debug: cleanup_delay = 5 Mon Aug 11 15:58:53 2008 : Debug: max_requests = 1024 Mon Aug 11 15:58:53 2008 : Debug: allow_core_dumps = no Mon Aug 11 15:58:53 2008 : Debug: pidfile = "/usr/local/freeradius-2.0.5/var/run/radiusd/radiusd.pid" Mon Aug 11 15:58:53 2008 : Debug: checkrad = "/usr/local/freeradius-2.0.5/sbin/checkrad" Mon Aug 11 15:58:53 2008 : Debug: debug_level = 0 Mon Aug 11 15:58:53 2008 : Debug: proxy_requests = no Mon Aug 11 15:58:53 2008 : Debug: log { Mon Aug 11 15:58:53 2008 : Debug: stripped_names = no Mon Aug 11 15:58:53 2008 : Debug: auth = yes Mon Aug 11 15:58:53 2008 : Debug: auth_badpass = yes Mon Aug 11 15:58:53 2008 : Debug: auth_goodpass = yes Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: client localhost { Mon Aug 11 15:58:53 2008 : Debug: ipaddr = 127.0.0.1 Mon Aug 11 15:58:53 2008 : Debug: require_message_authenticator = no Mon Aug 11 15:58:53 2008 : Debug: secret = "testing123" Mon Aug 11 15:58:53 2008 : Debug: nastype = "other" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Mon Aug 11 15:58:53 2008 : Debug: proxy server { Mon Aug 11 15:58:53 2008 : Debug: retry_delay = 5 Mon Aug 11 15:58:53 2008 : Debug: retry_count = 3 Mon Aug 11 15:58:53 2008 : Debug: default_fallback = no Mon Aug 11 15:58:53 2008 : Debug: dead_time = 120 Mon Aug 11 15:58:53 2008 : Debug: wake_all_if_all_dead = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: home_server localhost { Mon Aug 11 15:58:53 2008 : Debug: ipaddr = 127.0.0.1 Mon Aug 11 15:58:53 2008 : Debug: port = 1812 Mon Aug 11 15:58:53 2008 : Debug: type = "auth" Mon Aug 11 15:58:53 2008 : Debug: secret = "testing123" Mon Aug 11 15:58:53 2008 : Debug: response_window = 20 Mon Aug 11 15:58:53 2008 : Debug: max_outstanding = 65536 Mon Aug 11 15:58:53 2008 : Debug: zombie_period = 40 Mon Aug 11 15:58:53 2008 : Debug: status_check = "status-server" Mon Aug 11 15:58:53 2008 : Debug: ping_check = "none" Mon Aug 11 15:58:53 2008 : Debug: ping_interval = 30 Mon Aug 11 15:58:53 2008 : Debug: check_interval = 30 Mon Aug 11 15:58:53 2008 : Debug: num_answers_to_alive = 3 Mon Aug 11 15:58:53 2008 : Debug: num_pings_to_alive = 3 Mon Aug 11 15:58:53 2008 : Debug: revive_interval = 120 Mon Aug 11 15:58:53 2008 : Debug: status_check_timeout = 4 Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: home_server_pool my_auth_failover { Mon Aug 11 15:58:53 2008 : Debug: type = fail-over Mon Aug 11 15:58:53 2008 : Debug: home_server = localhost Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: realm example.com { Mon Aug 11 15:58:53 2008 : Debug: auth_pool = my_auth_failover Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: realm LOCAL { Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: radiusd: #### Instantiating modules #### Mon Aug 11 15:58:53 2008 : Debug: instantiate { Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_exec Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating exec Mon Aug 11 15:58:53 2008 : Debug: exec { Mon Aug 11 15:58:53 2008 : Debug: wait = no Mon Aug 11 15:58:53 2008 : Debug: input_pairs = "request" Mon Aug 11 15:58:53 2008 : Debug: shell_escape = yes Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_perl, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_perl Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating perl Mon Aug 11 15:58:53 2008 : Debug: perl { Mon Aug 11 15:58:53 2008 : Debug: module = "/usr/local/freeradius-2.0.5/etc/raddb/adsl_track.pl" Mon Aug 11 15:58:53 2008 : Debug: func_authorize = "authorize" Mon Aug 11 15:58:53 2008 : Debug: func_authenticate = "authenticate" Mon Aug 11 15:58:53 2008 : Debug: func_accounting = "accounting" Mon Aug 11 15:58:53 2008 : Debug: func_preacct = "preacct" Mon Aug 11 15:58:53 2008 : Debug: func_checksimul = "checksimul" Mon Aug 11 15:58:53 2008 : Debug: func_detach = "detach" Mon Aug 11 15:58:53 2008 : Debug: func_xlat = "xlat" Mon Aug 11 15:58:53 2008 : Debug: func_pre_proxy = "pre_proxy" Mon Aug 11 15:58:53 2008 : Debug: func_post_proxy = "post_proxy" Mon Aug 11 15:58:53 2008 : Debug: func_post_auth = "post_auth" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_expr Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating expr Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_expiration Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating expiration Mon Aug 11 15:58:53 2008 : Debug: expiration { Mon Aug 11 15:58:53 2008 : Debug: reply-message = "Password Has Expired " Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_logintime Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating logintime Mon Aug 11 15:58:53 2008 : Debug: logintime { Mon Aug 11 15:58:53 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Mon Aug 11 15:58:53 2008 : Debug: minimum-timeout = 60 Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: radiusd: #### Loading Virtual Servers #### Mon Aug 11 15:58:53 2008 : Debug: server inner-tunnel { Mon Aug 11 15:58:53 2008 : Debug: modules { Mon Aug 11 15:58:53 2008 : Debug: Module: Checking authenticate {...} for more modules to load Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_pap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating pap Mon Aug 11 15:58:53 2008 : Debug: pap { Mon Aug 11 15:58:53 2008 : Debug: encryption_scheme = "auto" Mon Aug 11 15:58:53 2008 : Debug: auto_header = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_chap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating chap Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_mschap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating mschap Mon Aug 11 15:58:53 2008 : Debug: mschap { Mon Aug 11 15:58:53 2008 : Debug: use_mppe = yes Mon Aug 11 15:58:53 2008 : Debug: require_encryption = no Mon Aug 11 15:58:53 2008 : Debug: require_strong = no Mon Aug 11 15:58:53 2008 : Debug: with_ntdomain_hack = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_unix Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating unix Mon Aug 11 15:58:53 2008 : Debug: unix { Mon Aug 11 15:58:53 2008 : Debug: radwtmp = "/usr/local/freeradius-2.0.5/var/log/radius/radwtmp" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_eap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap Mon Aug 11 15:58:53 2008 : Debug: eap { Mon Aug 11 15:58:53 2008 : Debug: default_eap_type = "md5" Mon Aug 11 15:58:53 2008 : Debug: timer_expire = 60 Mon Aug 11 15:58:53 2008 : Debug: ignore_unknown_eap_types = no Mon Aug 11 15:58:53 2008 : Debug: cisco_accounting_username_bug = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-md5 Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-leap Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-gtc Mon Aug 11 15:58:53 2008 : Debug: gtc { Mon Aug 11 15:58:53 2008 : Debug: challenge = "Password: " Mon Aug 11 15:58:53 2008 : Debug: auth_type = "PAP" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-tls Mon Aug 11 15:58:53 2008 : Debug: tls { Mon Aug 11 15:58:53 2008 : Debug: rsa_key_exchange = no Mon Aug 11 15:58:53 2008 : Debug: dh_key_exchange = yes Mon Aug 11 15:58:53 2008 : Debug: rsa_key_length = 512 Mon Aug 11 15:58:53 2008 : Debug: dh_key_length = 512 Mon Aug 11 15:58:53 2008 : Debug: verify_depth = 0 Mon Aug 11 15:58:53 2008 : Debug: pem_file_type = yes Mon Aug 11 15:58:53 2008 : Debug: private_key_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/server.pem" Mon Aug 11 15:58:53 2008 : Debug: certificate_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/server.pem" Mon Aug 11 15:58:53 2008 : Debug: CA_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/ca.pem" Mon Aug 11 15:58:53 2008 : Debug: private_key_password = "whatever" Mon Aug 11 15:58:53 2008 : Debug: dh_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/dh" Mon Aug 11 15:58:53 2008 : Debug: random_file = "/usr/local/freeradius-2.0.5/etc/raddb/certs/random" Mon Aug 11 15:58:53 2008 : Debug: fragment_size = 1024 Mon Aug 11 15:58:53 2008 : Debug: include_length = yes Mon Aug 11 15:58:53 2008 : Debug: check_crl = no Mon Aug 11 15:58:53 2008 : Debug: cipher_list = "DEFAULT" Mon Aug 11 15:58:53 2008 : Debug: make_cert_command = "/usr/local/freeradius-2.0.5/etc/raddb/certs/bootstrap" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_ttls Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-ttls Mon Aug 11 15:58:53 2008 : Debug: ttls { Mon Aug 11 15:58:53 2008 : Debug: default_eap_type = "md5" Mon Aug 11 15:58:53 2008 : Debug: copy_request_to_tunnel = no Mon Aug 11 15:58:53 2008 : Debug: use_tunneled_reply = no Mon Aug 11 15:58:53 2008 : Debug: virtual_server = "inner-tunnel" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_peap Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-peap Mon Aug 11 15:58:53 2008 : Debug: peap { Mon Aug 11 15:58:53 2008 : Debug: default_eap_type = "mschapv2" Mon Aug 11 15:58:53 2008 : Debug: copy_request_to_tunnel = no Mon Aug 11 15:58:53 2008 : Debug: use_tunneled_reply = no Mon Aug 11 15:58:53 2008 : Debug: proxy_tunneled_request_as_eap = yes Mon Aug 11 15:58:53 2008 : Debug: virtual_server = "inner-tunnel" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating eap-mschapv2 Mon Aug 11 15:58:53 2008 : Debug: mschapv2 { Mon Aug 11 15:58:53 2008 : Debug: with_ntdomain_hack = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: Module: Checking authorize {...} for more modules to load Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_realm, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_realm Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating suffix Mon Aug 11 15:58:53 2008 : Debug: realm suffix { Mon Aug 11 15:58:53 2008 : Debug: format = "suffix" Mon Aug 11 15:58:53 2008 : Debug: delimiter = "@" Mon Aug 11 15:58:53 2008 : Debug: ignore_default = no Mon Aug 11 15:58:53 2008 : Debug: ignore_null = no Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: (Loaded rlm_files, checking if it's valid) Mon Aug 11 15:58:53 2008 : Debug: Module: Linked to module rlm_files Mon Aug 11 15:58:53 2008 : Debug: Module: Instantiating files Mon Aug 11 15:58:53 2008 : Debug: files { Mon Aug 11 15:58:53 2008 : Debug: usersfile = "/usr/local/freeradius-2.0.5/etc/raddb/users" Mon Aug 11 15:58:53 2008 : Debug: acctusersfile = "/usr/local/freeradius-2.0.5/etc/raddb/acct_users" Mon Aug 11 15:58:53 2008 : Debug: preproxy_usersfile = "/usr/local/freeradius-2.0.5/etc/raddb/preproxy_users" Mon Aug 11 15:58:53 2008 : Debug: compat = "no" Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/users[1]: Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type Mon Aug 11 15:58:53 2008 : Error: Errors reading /usr/local/freeradius-2.0.5/etc/raddb/users Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/modules/files[7]: Instantiation failed for module "files" Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". Mon Aug 11 15:58:53 2008 : Error: /usr/local/freeradius-2.0.5/etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Debug: } Mon Aug 11 15:58:53 2008 : Error: Errors initializing modules The users file: DEFAULT Auth-Type = Perl Fall-Through = 1 test@realm0 Auth-Type := System Service-Type = Framed-User, Framed-Protocol = PPP, Configuration-Token = test The perl {} section from radiusd.conf: ... module = ${prefix}/etc/raddb/test.pl ... in sites-enabled/default, I added all the 'perl' entries as mentioned in the howto ('files' is also enabled).

2 2

get problem with freeradius with LDAP authenticate
by chenweiting 12 Aug '08

12 Aug '08

Dear all, I am tying to configure freeradius 1.1.7 on Solaris10 to authenticate with ldap server. After I configure it, radiusd -X -A running well, once I run radtest I got the error as below: ============================================================================================================== ./radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: lo! g_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config! _files: reading dictionary read_config_files: reading n aslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "ldap.icpdd.neca.nec.com.au" ldap: port = 389 ldap: net_timeout = 10 ldap: timeout = 30 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)"! ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "ou=people,dc=icpdd,dc=neca,dc=nec,dc=com,dc=au" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 &nbs! p;ldap: compare_check_items = no ldap: access_attr_used_for_a llow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS! -IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap:! LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rl m_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 55300 Module: Instantiated ldap (ldap) ! Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated pre! process (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique! ) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process ! requests. rad_recv: Access-Request packet from host 127.0.0.1:61260, id=86, length=60 User-Name = "testid" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "weitingc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP! modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "testid" with password "password" radius_xlat: '(uid=weitingc)' radius_xlat: 'ou=people,dc=mydomain,dc=com,dc=au' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.icpdd.neca.nec.com.au:389, authentication 0 ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_ldap-1.1.7.so: symbol ldap_int_tls_config: referenced symbol not found Killed ====================================================== Any idea for this issue? Thanks and regards, Weiting Chen _________________________________________________________________ 一点即聊，MSN推出新功能“点我！” http://im.live.cn/click/

2 1