- Freeradius-Users - lists.freeradius.org

rlm_attr_rewrite question
by Evgeniy Kozhuhovskiy 18 Jul '08

18 Jul '08

I have some rewrites like this (in pre-proxy): attr_rewrite fixcboss6 { attribute = NAS-IP-Address searchin = "proxy" searchfor = "172.29.51.24" replacewith = "172.26.64.100" new_attribute = no append = no max_matches = 1 } Radius gets packet generated by radtest: User-Name = "guest" User-Password = "guest" NAS-IP-Address = 172.29.51.24 NAS-Port = 1 [...skipped...] +- entering group pre-proxy expand: 172.29.51.24 -> 172.29.51.24 fixcboss6: Does not match: NAS-IP-Address = ╛?3? fixcboss6: Could not find value pair for attribute NAS-IP-Address ++[fixcboss6] returns ok ++[pre_proxy_log] returns ok User-Name = "guest" User-Password = "guest" NAS-IP-Address = 172.29.51.24 NAS-Port = 1 Proxy-State = 0x3336 Proxying request 1 to home server 172.29.51.10 port 1812 User-Name = "guest" User-Password = "guest" NAS-IP-Address = 172.29.51.24 NAS-Port = 1 Proxy-State = 0x3336 Why it does not works? PS Here is the full debug - http://rafb.net/p/le0HmX69.html and here is parts of config: http://rafb.net/p/UB04Mr14.html -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

2 3

rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line
by Venkat 18 Jul '08

18 Jul '08

Hi , I'm facing the above said problem can any one please give me the solution. [root@localhost sbin]# ./radiusd -xX Thu Jul 17 18:04:42 2008 : Info: FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Jul 7 2008 at 17:33:14 Thu Jul 17 18:04:42 2008 : Info: Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Thu Jul 17 18:04:42 2008 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Thu Jul 17 18:04:42 2008 : Info: PARTICULAR PURPOSE. Thu Jul 17 18:04:42 2008 : Info: You may redistribute copies of FreeRADIUS under the terms of the Thu Jul 17 18:04:42 2008 : Info: GNU General Public License v2. Thu Jul 17 18:04:42 2008 : Info: Starting - reading configuration files ... Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/snmp.conf Thu Jul 17 18:04:42 2008 : Debug: including files in directory /usr/local/etc/raddb/modules/ Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/always Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/files Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sql.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Thu Jul 17 18:04:42 2008 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Thu Jul 17 18:04:42 2008 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Thu Jul 17 18:04:42 2008 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Thu Jul 17 18:04:42 2008 : Debug: main { Thu Jul 17 18:04:42 2008 : Debug: prefix = "/usr/local" Thu Jul 17 18:04:42 2008 : Debug: localstatedir = "/usr/local/var" Thu Jul 17 18:04:42 2008 : Debug: logdir = "/usr/local/var/log/radius" Thu Jul 17 18:04:42 2008 : Debug: libdir = "/usr/local/lib" Thu Jul 17 18:04:42 2008 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Thu Jul 17 18:04:42 2008 : Debug: hostname_lookups = no Thu Jul 17 18:04:42 2008 : Debug: max_request_time = 30 Thu Jul 17 18:04:42 2008 : Debug: cleanup_delay = 5 Thu Jul 17 18:04:42 2008 : Debug: max_requests = 1024 Thu Jul 17 18:04:42 2008 : Debug: allow_core_dumps = no Thu Jul 17 18:04:42 2008 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Thu Jul 17 18:04:42 2008 : Debug: checkrad = "/usr/local/sbin/checkrad" Thu Jul 17 18:04:42 2008 : Debug: debug_level = 0 Thu Jul 17 18:04:42 2008 : Debug: proxy_requests = yes Thu Jul 17 18:04:42 2008 : Debug: log { Thu Jul 17 18:04:42 2008 : Debug: stripped_names = no Thu Jul 17 18:04:42 2008 : Debug: auth = no Thu Jul 17 18:04:42 2008 : Debug: auth_badpass = no Thu Jul 17 18:04:42 2008 : Debug: auth_goodpass = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: client 192.168.136.55 { Thu Jul 17 18:04:42 2008 : Debug: ipaddr = 192.168.136.55 Thu Jul 17 18:04:42 2008 : Debug: require_message_authenticator = no Thu Jul 17 18:04:42 2008 : Debug: secret = "sharedsecret" Thu Jul 17 18:04:42 2008 : Debug: nastype = "other" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: radiusd: #### Loading Realms and Home Servers #### Thu Jul 17 18:04:42 2008 : Debug: proxy server { Thu Jul 17 18:04:42 2008 : Debug: retry_delay = 5 Thu Jul 17 18:04:42 2008 : Debug: retry_count = 3 Thu Jul 17 18:04:42 2008 : Debug: default_fallback = no Thu Jul 17 18:04:42 2008 : Debug: dead_time = 120 Thu Jul 17 18:04:42 2008 : Debug: wake_all_if_all_dead = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: home_server localhost { Thu Jul 17 18:04:42 2008 : Debug: ipaddr = 127.0.0.1 Thu Jul 17 18:04:42 2008 : Debug: port = 1812 Thu Jul 17 18:04:42 2008 : Debug: type = "auth" Thu Jul 17 18:04:42 2008 : Debug: secret = "testing123" Thu Jul 17 18:04:42 2008 : Debug: response_window = 20 Thu Jul 17 18:04:42 2008 : Debug: max_outstanding = 65536 Thu Jul 17 18:04:42 2008 : Debug: zombie_period = 40 Thu Jul 17 18:04:42 2008 : Debug: status_check = "status-server" Thu Jul 17 18:04:42 2008 : Debug: ping_check = "none" Thu Jul 17 18:04:42 2008 : Debug: ping_interval = 30 Thu Jul 17 18:04:42 2008 : Debug: check_interval = 30 Thu Jul 17 18:04:42 2008 : Debug: num_answers_to_alive = 3 Thu Jul 17 18:04:42 2008 : Debug: num_pings_to_alive = 3 Thu Jul 17 18:04:42 2008 : Debug: revive_interval = 120 Thu Jul 17 18:04:42 2008 : Debug: status_check_timeout = 4 Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: home_server_pool my_auth_failover { Thu Jul 17 18:04:42 2008 : Debug: type = fail-over Thu Jul 17 18:04:42 2008 : Debug: home_server = localhost Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: realm example.com { Thu Jul 17 18:04:42 2008 : Debug: auth_pool = my_auth_failover Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: realm LOCAL { Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: radiusd: #### Instantiating modules #### Thu Jul 17 18:04:42 2008 : Debug: instantiate { Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_exec, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_exec Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating exec Thu Jul 17 18:04:42 2008 : Debug: exec { Thu Jul 17 18:04:42 2008 : Debug: wait = no Thu Jul 17 18:04:42 2008 : Debug: input_pairs = "request" Thu Jul 17 18:04:42 2008 : Debug: shell_escape = yes Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_expr, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_expr Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating expr Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_expiration, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_expiration Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating expiration Thu Jul 17 18:04:42 2008 : Debug: expiration { Thu Jul 17 18:04:42 2008 : Debug: reply-message = "Password Has Expired " Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_logintime, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_logintime Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating logintime Thu Jul 17 18:04:42 2008 : Debug: logintime { Thu Jul 17 18:04:42 2008 : Debug: reply-message = "You are calling outside your allowed timespan " Thu Jul 17 18:04:42 2008 : Debug: minimum-timeout = 60 Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: radiusd: #### Loading Virtual Servers #### Thu Jul 17 18:04:42 2008 : Debug: server inner-tunnel { Thu Jul 17 18:04:42 2008 : Debug: modules { Thu Jul 17 18:04:42 2008 : Debug: Module: Checking authenticate {...} for more modules to load Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_pap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_pap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating pap Thu Jul 17 18:04:42 2008 : Debug: pap { Thu Jul 17 18:04:42 2008 : Debug: encryption_scheme = "auto" Thu Jul 17 18:04:42 2008 : Debug: auto_header = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_chap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_chap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating chap Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_mschap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_mschap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating mschap Thu Jul 17 18:04:42 2008 : Debug: mschap { Thu Jul 17 18:04:42 2008 : Debug: use_mppe = yes Thu Jul 17 18:04:42 2008 : Debug: require_encryption = no Thu Jul 17 18:04:42 2008 : Debug: require_strong = no Thu Jul 17 18:04:42 2008 : Debug: with_ntdomain_hack = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_unix, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_unix Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating unix Thu Jul 17 18:04:42 2008 : Debug: unix { Thu Jul 17 18:04:42 2008 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: (Loaded rlm_eap, checking if it's valid) Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to module rlm_eap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap Thu Jul 17 18:04:42 2008 : Debug: eap { Thu Jul 17 18:04:42 2008 : Debug: default_eap_type = "md5" Thu Jul 17 18:04:42 2008 : Debug: timer_expire = 60 Thu Jul 17 18:04:42 2008 : Debug: ignore_unknown_eap_types = no Thu Jul 17 18:04:42 2008 : Debug: cisco_accounting_username_bug = no Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_md5 Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-md5 Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_leap Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-leap Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_gtc Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-gtc Thu Jul 17 18:04:42 2008 : Debug: gtc { Thu Jul 17 18:04:42 2008 : Debug: challenge = "Password: " Thu Jul 17 18:04:42 2008 : Debug: auth_type = "PAP" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: Module: Linked to sub-module rlm_eap_tls Thu Jul 17 18:04:42 2008 : Debug: Module: Instantiating eap-tls Thu Jul 17 18:04:42 2008 : Debug: tls { Thu Jul 17 18:04:42 2008 : Debug: rsa_key_exchange = no Thu Jul 17 18:04:42 2008 : Debug: dh_key_exchange = yes Thu Jul 17 18:04:42 2008 : Debug: rsa_key_length = 512 Thu Jul 17 18:04:42 2008 : Debug: dh_key_length = 512 Thu Jul 17 18:04:42 2008 : Debug: verify_depth = 0 Thu Jul 17 18:04:42 2008 : Debug: CA_path = "/path/to/directory/with/ca_certs/and/crls/" Thu Jul 17 18:04:42 2008 : Debug: pem_file_type = yes Thu Jul 17 18:04:42 2008 : Debug: private_key_file = "/usr/local/etc/raddb/certs/test_SAI.pem" Thu Jul 17 18:04:42 2008 : Debug: certificate_file = "/usr/local/etc/raddb/certs/test_SAI.pem" Thu Jul 17 18:04:42 2008 : Debug: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" Thu Jul 17 18:04:42 2008 : Debug: private_key_password = "whatever" Thu Jul 17 18:04:42 2008 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Thu Jul 17 18:04:42 2008 : Debug: random_file = "/dev/urandom" Thu Jul 17 18:04:42 2008 : Debug: fragment_size = 1024 Thu Jul 17 18:04:42 2008 : Debug: include_length = yes Thu Jul 17 18:04:42 2008 : Debug: check_crl = no Thu Jul 17 18:04:42 2008 : Debug: cipher_list = "DEFAULT" Thu Jul 17 18:04:42 2008 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Thu Jul 17 18:04:42 2008 : Error: rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/test_SAI.pem Thu Jul 17 18:04:42 2008 : Error: rlm_eap: Failed to initialize type tls Thu Jul 17 18:04:42 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Thu Jul 17 18:04:42 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Thu Jul 17 18:04:42 2008 : Error: /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Debug: } Thu Jul 17 18:04:42 2008 : Error: Errors initializing modules -- regards, Venkat 9885480745 'take the things and as and when the way they come ...'

1 0

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 17 Jul '08

17 Jul '08

well... i am not sure, but it might be: the fact that peap needs user/password and i just sent username... or that realm is null... i read the entire output and am still no sure. anyway, i'll check it as soon as i will be in front of the machine again! thank you - ----- Message d'origine ---- De : Reveal MAP <revealmapp(a)yahoo.fr> À : Freeradius Mailing-List <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 17 Juillet 2008, 12h35mn 15s Objet : EAP-TLS OK - EAP-PEAP KO!! why that? Why could EAP-TLS run OK and not EAP-PEAP, giving a message like that: "rlm_eap_peap: Received EAP-TLV response." below is the entire output. Thanx for the response!! --------------------------------------- rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=99, length=194 User-Name = "maman" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b97054012345511dfddf34251f30af4349bfda0f83797d643a3cea1 State = 0x766398ac716b81afdd1454abb61d46ce Message-Authenticator = 0xf76a88f5654802fac4faed08e055d5fb +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> maman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 99 to 10.10.44.246 port 1027 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 91 with timestamp +139 Cleaning up request 1 ID 92 with timestamp +139 Cleaning up request 2 ID 93 with timestamp +139 Cleaning up request 3 ID 94 with timestamp +139 Cleaning up request 4 ID 95 with timestamp +139 Cleaning up request 5 ID 96 with timestamp +140 Cleaning up request 6 ID 97 with timestamp +140 Cleaning up request 7 ID 98 with timestamp +140 Cleaning up request 8 ID 99 with timestamp +140 Ready to process requests. ________________________________ Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : Re : silly question of framed IP address
by Joel MBA OYONE 17 Jul '08

17 Jul '08

lol!! sometimes, peeps use to turn the questions and the answers... to be sure!! but what a shame!! i don't have hand on the dhcp server!! thank you guys!! MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 17 Juillet 2008, 14h07mn 38s Objet : Re: Re : silly question of framed IP address >But, is there a way to oblige some comp to use a specific IP address using radius attribute?? "I refer the Honourable Member to the answer given before." :) > The Framed-IP-Address assigns IP addresses for PPP sessions. It does >*nothing* for 802.1x sessions. The fact you don't like the answer doesn't change a thing. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : silly question of framed IP address
by Reveal MAP 17 Jul '08

17 Jul '08

Thanx Alan, it is clearer! But, is there a way to oblige some comp to use a specific IP address using radius attribute?? ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 17 Juillet 2008, 6h21mn 00s Objet : Re: silly question of framed IP address Reveal MAP wrote: > I wonder if the attribute 8 (framed Ip address) of RADIUS acts like a > dhcp server, giving the IP to the supplicant or just verify/compare if > is conform to the Anthentication request ?? The Framed-IP-Address assigns IP addresses for PPP sessions. It does *nothing* for 802.1x sessions. You will need to run a DHCP server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 17 Jul '08

17 Jul '08

Why could EAP-TLS run OK and not EAP-PEAP, giving a message like that: "rlm_eap_peap: Received EAP-TLV response." below is the entire output. Thanx for the response!! --------------------------------------- rad_recv: Access-Request packet from host 10.10.44.246 port 1027, id=99, length=194 User-Name = "maman" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F8:MoJo" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b97054012345511dfddf34251f30af4349bfda0f83797d643a3cea1 State = 0x766398ac716b81afdd1454abb61d46ce Message-Authenticator = 0xf76a88f5654802fac4faed08e055d5fb +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> maman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 99 to 10.10.44.246 port 1027 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 91 with timestamp +139 Cleaning up request 1 ID 92 with timestamp +139 Cleaning up request 2 ID 93 with timestamp +139 Cleaning up request 3 ID 94 with timestamp +139 Cleaning up request 4 ID 95 with timestamp +139 Cleaning up request 5 ID 96 with timestamp +140 Cleaning up request 6 ID 97 with timestamp +140 Cleaning up request 7 ID 98 with timestamp +140 Cleaning up request 8 ID 99 with timestamp +140 Ready to process requests. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

(no subject)
by jonas m 17 Jul '08

17 Jul '08

Hello! My Question is about the documentation that I found on the net.http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmi… anybody know if this is the best documentation there is.This differs from other guides that I have found. For example this document describes that you in should export your certificate from the eDirectory server and put it in the Freeradius server. Then edit the radius.conf tls_cacertfile with the path to the imported certificate. I have to do some schema changes if I should follow this documentation and before I do that I would like to be shore that this is the best guide. For starters we don’t use universal passwords today, and I am afraid that implementing this could have some negative affects on our live site. My goal is to use this in a “secure” wireless solution. Hop somebody can bring me some light in this matter. Regards /Jonas Magné _________________________________________________________________ Utmana dina kompisar i Sten, sax, påse! http://www.live.msn.se/messenger/#/News/

2 3

silly question of framed IP address
by Reveal MAP 17 Jul '08

17 Jul '08

Hello! I read this doc http://www.cisco.com/en/US/docs/ios/12_1t/12_1t5/feature/guide/dtrattr8.html and don't really understand. maybe cause of english style so i am expecting for an answer here: I wonder if the attribute 8 (framed Ip address) of RADIUS acts like a dhcp server, giving the IP to the supplicant or just verify/compare if is conform to the Anthentication request ?? ex: 1. if my client is radius database has framedip address == 192.168.0.10 or framed ip:= 192.168.0.10 and its ream Ip address during the authentication attempt is 192.168.0.9 instead of 192.168.0.10, what will happen? - thank you for the response! _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

How to cut the realm from a username before it is sent to authenticate against ldap with ttls/pap
by Andy An 16 Jul '08

16 Jul '08

Hi Alan/Ivan: Thanks for your useful posts on this mailing list so I could configured all basic stuff to work finally(though it's still a little challenging for me as a beginner) . Now two more specific problems would like to get your further help/guide: 1. How could I get a username/password authenticated against ldap without its realm if there is one(i.e. cut away the realm @something.ca)? I used Freeradius 2.0.5. We need this to see if: * A user is a home user and log in from home NAS/AP (in this case he may not use any realm at all) * or a user is a home user but log in from other colleage/university and proxied home by our upper eduroam proxy server at the guest college/university * or a user is a roaming user from other college/university and we need to proxy the request to the upper eduroam radius server and finally back to his home college/university for authenticating. 2. How could I get the client IP addresses to fill the "framedipaddress" field in the table raddacc? I used mysql as my accounting DB and the client ip addresses assigned by a dhcp server sitting in the LAN/VLAN. Now the field "framedipaddress" or "client-ip_address" is empty. Thank you in advance for your great help! -- Andy An Junior Programmer Information Technology Services Emily Carr University of Art and Design Tel: 604-630-4556 Fax: 604-844-3801 SB Room 341

2 1

freeradius in windows
by sanjeev.kumarroy＠wipro.com 16 Jul '08

16 Jul '08

Hi, Has anyone ever done the porting of freeradius from Linux to Windows? I need this as I am not getting the source code for the Windows version of freeradius. If that can be got from some location or in case someone has it. Please let me know. I am really stuck-up. Any help would be great in this regard. Thanks. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

5 4