- Freeradius-Users - lists.freeradius.org

Two Daemons on One Box?
by Kevin J 06 Jun '08

06 Jun '08

Folks, I need to run two different configurations on one box. I guess the only way is to run two daemons on different ports. Any advice or concern? I also want to hear if there is known issues, bugs, or performance matters when more than one daemon run on the same box. Thanks, Kevin

3 2

Need help on FreeRadius & CDR Tool
by Do Nguyen Ha 06 Jun '08

06 Jun '08

Hi manage the Cisco BTS 10200 system, and now i am assigned a task to work with the Radius i choose the FreeRadius to work with Cisco BTS system modify some config in radiusd.conf & clients.conf first, BTS send message Access Request to FreeRadius and then Freeradius send message Access Accept, they working properly when BTS send message Account Start to Radius, there are a lot attribute and freeradius save them in the radacct table this is the account start message structure: Attribute ID Vendor ID Sub Attribute ID Status Attribute Name Type Value 1 M- User-Name String ANI 4 M- NAS-IP-Address IP Address BTS IP address 6 M- Service-Type Integer Service Type = Outbound 25 C+ Class String CLASS Attribute 26 9 1 M- h323-incoming-conf-id=value String A unique number for identifying a calling session on a gateway, where a session is closed when the calling party hangs up. 26 9 24 M+ h323-conf-id String Unique call identifier generated by the BTS. Used to distinguish the separate billable events (calls) within a single calling session. 26 9 25 M- h323-setup-time String hh:mm:ss.mmm ZON DDD MMM ## YYYY Setup time in NTP format. 26 9 28 M- h323-connect-time String hh:mm:ss.mmm ZON DDD MMM ## YYYY Connect time in NTP format. 26 9 27 M+ h323-call-type String Telephony,VOIP 30 C- Called-Station-ID String DNIS 31 C+ Calling-Station-ID String ANI 40 M+ Acct-Status-Type Integer Acct-Status-Type = Start (1) 44 M+ Acct-Session-ID String Accounting Session ID 55 M+ Event-Timestamp Integer Event Time Stamp 61 M- NAS-Port-Type Integer Ethernet (15) but in radacct , there some columm doesn't match with the message Account Start, i want to change the name of some columm to match the message what should i need to edit the sql.conf for this issue On the CDR Tool, what should i need to edit to working properly Thanks Ha`

2 1

/etc/smbpasswd issue
by vijayakumar 06 Jun '08

06 Jun '08

Dear All, I was trying to authenticate MSCHAPV2 with /etc/smbpasswd & am getting following error while doing radiusd -X .Can any body help me out . [root@test rlm_smb]# radiusd -X FreeRADIUS Version 2.0.4, for host i686-pc-linux-gnu, built on May 25 2008 at 02:35:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.7.0/24 { require_message_authenticator = no secret = "testing123" shortname = "corp" } client 196.1.109.0/16 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating reply_log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. User-Name = "ajay" User-Password = "ajay" NAS-IP-Address = 127.0.0.1 NAS-Port = 7 +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080605 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080605 expand: %t -> Thu Jun 5 05:24:03 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "ajay", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "ajay" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [ajay/ajay] (from client localhost port 7) Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. Cleaning up request 0 ID 197 with timestamp +19 Ready to process requests. Regards. VIJAY

2 3

compiler Error at "radsniff.h"
by Thomas Cornelsen 05 Jun '08

05 Jun '08

Hi all! i can`t compile Freeradius with the "Radius Sniffer Module". If i compile without the "libpcap"-Library the Compiler throws NO Error! Everything seems to be fine. If i install the libpcap Library the Compiler throws Errors at "radsniff.h" I really hope that someone has a suggestion! thanks a lot! -Tom OS: Solaris 9 Freeradius-Version: 2.0.4 libpcap-libaries: Tested Versions: 0.9.8 and 0.9.7 and 0.9.6 (tested as binaries and also tested with source code) compiler: gcc 3.3.1 and also tested with gcc 3.4.6 (binary package) Linker: gnu ld: Version: binutils-2.11.2 0/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.9\" -DRADIUSD_VERSION=\"2.0.4\" -I/soft/ssl/include -DOPENSSL_NO_KRB5 -c radsniff.c -fPIC -DPIC -o .libs/radsniff.o In file included from radsniff.c:34: /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:39: error: parse error before "u_int8_t" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:39: warning: no semicolon at end of struct or union /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:40: warning: type defaults to `int' in declaration of `ethernet_shost' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:40: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:41: error: parse error before "ethernet_type" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:41: warning: type defaults to `int' in declaration of `ethernet_type' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:41: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:56: error: parse error before "u_int8_t" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:56: warning: no semicolon at end of struct or union /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:59: warning: type defaults to `int' in declaration of `ip_tos' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:59: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:60: error: parse error before "ip_len" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:60: warning: type defaults to `int' in declaration of `ip_len' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:60: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:61: error: parse error before "ip_id" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:61: warning: type defaults to `int' in declaration of `ip_id' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:61: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:62: error: parse error before "ip_off" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:62: warning: type defaults to `int' in declaration of `ip_off' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:62: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:66: error: parse error before "ip_ttl" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:66: warning: type defaults to `int' in declaration of `ip_ttl' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:66: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:67: error: parse error before "ip_p" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:67: warning: type defaults to `int' in declaration of `ip_p' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:67: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:68: error: parse error before "ip_sum" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:68: warning: type defaults to `int' in declaration of `ip_sum' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:68: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:70: error: parse error before '}' token /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:77: error: parse error before "u_int16_t" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:77: warning: no semicolon at end of struct or union /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:78: warning: type defaults to `int' in declaration of `udp_dport' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:78: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:79: error: parse error before "udp_ulen" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:79: warning: type defaults to `int' in declaration of `udp_ulen' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:79: warning: data definition has no type or storage class /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:80: error: parse error before "udp_sum" /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:80: warning: type defaults to `int' in declaration of `udp_sum' /export/home/users/cot39070/freeradius-server-2.0.4/src/freeradius-devel/radsniff.h:80: warning: data definition has no type or storage class radsniff.c: In function `got_packet': radsniff.c:135: error: invalid application of `sizeof' to an incomplete type radsniff.c:136: error: invalid application of `sizeof' to an incomplete type radsniff.c:137: error: invalid application of `sizeof' to an incomplete type radsniff.c:157: error: dereferencing pointer to incomplete type radsniff.c:158: error: dereferencing pointer to incomplete type radsniff.c:160: error: dereferencing pointer to incomplete type radsniff.c:161: error: dereferencing pointer to incomplete type radsniff.c:163: warning: assignment discards qualifiers from pointer target type radsniff.c:188: error: dereferencing pointer to incomplete type radsniff.c:188: error: dereferencing pointer to incomplete type radsniff.c:189: error: dereferencing pointer to incomplete type radsniff.c:189: error: dereferencing pointer to incomplete type radsniff.c: In function `main': radsniff.c:315: error: invalid application of `sizeof' to an incomplete type radsniff.c:315: error: invalid application of `sizeof' to an incomplete type radsniff.c:315: error: invalid application of `sizeof' to an incomplete type make[4]: *** [radsniff.lo] Error 1 make[4]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/export/home/users/cot39070/freeradius-server-2.0.4' make: *** [all] Error 2 Schon gehört? Der neue WEB.DE MultiMessenger kann`s mit allen: *http://www.produkte.web.de/messenger/?did=3016* [http://www.produkte.web.de/messenger/?did=3016]

2 1

1.1.7 to 2.0.2 config for Realms problem
by Dean, Barry 05 Jun '08

05 Jun '08

I have a problem with a realm configuration that used to work with FR 1.1.7, but does not work at all with 2.0.2 and virtual servers. I have a virtual server defined in sites-available/janet-roaming thus: server jrsradius { listen { ipaddr = jrsradius2.liv.ac.uk port = 0 type = auth } listen { ipaddr = jrsradius2.liv.ac.uk port = 0 type = acct } proxy_requests = yes $INCLUDE jrs-proxy.conf $INCLUDE jrs-clients.conf authorize { preprocess chap mschap suffix eap { ok = return } unix files ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } ... some stuff removed for brevity! } jrs-proxy.conf contains: proxy server { default_fallback = no post_proxy_authorize = no } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } realm LOCAL { # If we do not specify a server pool, the realm is LOCAL, and # requests are not proxied to it. type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm liv.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } realm liverpool.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } (stuff for JENET NRPS servers removed) But logging in as testuser(a)liverpool.ac.uk I get: Thu Jun 5 11:57:21 2008 : Debug: rlm_realm: Looking up realm "liverpool.ac.uk" for User-Name = "testuser(a)liverpool.ac.uk" Thu Jun 5 11:57:21 2008 : Debug: rlm_realm: No such realm "liverpool.ac.uk" What have I done wrong in defining the realms for liv.ac.uk and liverpool.ac.uk? Wrong place? Wrong syntax? They are not mentioned during server startup with "-X and -xx" beyond: Thu Jun 5 11:57:16 2008 : Debug: including configuration file /usr/radius/etc/raddb/sites-enabled/janet-roaming Thu Jun 5 11:57:16 2008 : Debug: including configuration file /usr/radius/etc/raddb/jrs-proxy.conf so is the config being ignored because it is wrong? Thanks. --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

2 3

FreeRadius Client - Need help with Authentication Methods
by Knarkargott 05 Jun '08

05 Jun '08

I am using the FreeRadius Client against a IAS server. It works fine without any authentication method, but now I would like to add something like PEAP or MS-CHAP2 or similar. I cannot find this information anywhere, does anybody know how to set up the FreeRadius Client to use some authentication method? Or any idea on where to find this information? I only find information about the FreeRadius Server, not the client. Thanks in advance :) /Knarkargott -- View this message in context: http://www.nabble.com/FreeRadius-Client---Need-help-with-Authentication-Met… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

FreeRadius + VPN Clients
by youness hsina 05 Jun '08

05 Jun '08

Hi all, Thank you in advance for your help. i have users on a LDAP server and i want to make a vpn connection with one of my users using a vpn router. i can make a connection from a radius server to my LDAP server. But i don't now how i can do make a vpn connection with one of my users who is located on an LDAP server. Will you help me please Sorry for my english uness

3 9

rlm_ippool fail
by tg_melo＠bol.com.br 05 Jun '08

05 Jun '08

Hi all. I had a freeradius server 1.1.7 running up with some errors when doing updates in radacct (mysql) some hours after it just started. Since then, I decided to upgrade to 2.0.4. But now, it refuses to start with the error "rlm_ippool: Failed to open file $(raddbdir)/db.ippool: No such file or directory". The system it's running on, is a freebsd 6.3. I also tryed to install the ports version 2.0.3 with the freeradius user and group assignments. But without success in getting it started. All the tryings were almost clean install ones, with both versions. I only modified the essencial conf files in order to set up the database, user, password, ip, etc. And at last, uncommented the main_pool lines in the accounting and post-auth sections in sites-enabled/default. Here is the output of radiusd -X: FreeRADIUS Version 2.0.3, for host i386-portbld-freebsd6.3, built on Jun 5 2008 at 04:51:09 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "freeradius" group = "freeradius" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_ippool Module: Instantiating main_pool ippool main_pool { session-db = "$(raddbdir)/db.ippool" ip-index = "$(raddbdir)/db.ipindex" key = "%{NAS-IP-Address} %{NAS-Port}" range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 override = no maximum-timeout = 0 } rlm_ippool: Failed to open file $(raddbdir)/db.ippool: No such file or directory /usr/local/etc/raddb/radiusd.conf[1746]: Instantiation failed for module "main_pool" /usr/local/etc/raddb/sites-enabled/default[308]: Failed to find module "main_pool". /usr/local/etc/raddb/sites-enabled/default[286]: Errors parsing accounting section. } } Errors initializing modules Finally, /usr/local/etc/raddb/ is with the right permissions to the user freeradius. So, what's wrong? Thanks in advance.

3 2

FreeRadius client with IAS server; Wireshark - Code: Access Reject (3)
by Knarkargott 05 Jun '08

05 Jun '08

Hi! I use FreeRadius as a client to a IAS server. I get connection but as soon as I set the IAS to authenticate on the server, I only get "User-Name = "DsH"" several times until timeout: "No response from client ID..."). When I sniff with Wireshark, I get the error code: Access Reject (3). My test should be quite basic I think, but somehow I fail. My setup is as follows: Computer A: Active Directory Computer B: Windows IAS server (IP 192.168.0.155) Computer C: FreeRadius Client (this is actually a virtual machine) Computer A contains user DsH with pwd RADIUS. I have configured the IAS (2003) to allow everything on Computer B and secret = RADIUS. I logged in as DSH with pwd RADIUS on Computer C, with secret = RADIUS for the FreeRadius client (v.1.1.6). I have tried both radtest and radclient, with -x for debug; ------------ radtest DsH 123456 192.168.0.155 10 RADIUS -x => Radclient:: Invalid octet string "123456" for attribute name "User-Password" ------------ echo "User-Name = DsH" | .../radclient 192.168.0.155:1812 auth RADIUS => User-Name = "DsH" (several times until timeout: "No response from client ID...") ------------ Anybody have any idea? I have tried for a while reading the manuals and browsing the forum, but I just don't get it to work! Any tips will be greatly appreciated! Thanks in advance :) /Knarkargott -- View this message in context: http://www.nabble.com/FreeRadius-client-with-IAS-server--Wireshark---Code%3… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Help with FreeRadius + Switch + Mac Based Auth - question
by Daniel Machado Grilo 05 Jun '08

05 Jun '08

Hi, I'm hopping that you can help me, because i'm trying this for a lot of time I'm testing an SMC6248M switch to check if radius support is fine, so I configured a freeradius server in one fedora 8. I've made some tests adding clients to clients.conf and making requests via radtest to ensure that the radius is well configured, ex: [root@black ~]# radtest 003084-87faf2 ********* 192.168.1.13 1812 oincoinc Sending Access-Request of id 116 to 192.168.1.13 port 1812 User-Name = "003084-87faf2" User-Password = "*************" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 116 to 192.168.1.13 port 1812 User-Name = "003084-87faf2" User-Password = "omGtkKyB" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 192.168.1.13:1812, id=116, length=20 rad_verify: Received Access-Reject packet from client 192.168.1.13 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) If i change switch configuration to Auth by Local,RADIUS and then try to access the administration interface with a password that i only have in RADIUS config i get: Username: dmgrilo Password: CLI session with the Tiger Stack 10/100 is opened. To end the CLI session, enter [Exit]. logs show: rad_recv: Access-Request packet from host 192.168.1.251:1815, id=204, length=55 User-Name = "dmgrilo" User-Password = "12345" NAS-IP-Address = 192.168.1.251 NAS-Identifier = "" Sending Access-Accept of id 204 to 192.168.1.251 port 1815 which is ok. But now i have a computer in ethernet 1/35 that i want to auth via RADIUS, so i changed the port to "dot1x port-control auto" and make the interface re-auth, i loose connection to that machine and switch claims that it is not authenticated. So, my question is, in the users from FreeRadius I have the mac-address for the machine and passowrd: # Green 000244-09a361 Auth-Type := Local, User-Password == "****" Tunnel-Medium-Type = IEEE-802, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = 1 So why does the switch don't ask the RADIUS to get access? (nothing appears in logs) I don't want to have supplicants installed in client, because i want to connect phones too, but i guess with auth via MAC-Address it wouldn't need supplicants, right? One important thing is that when i check the show dot1x in the switch it doesn't determine the supplicant mac-address.. i guess it should right? 802.1X is enabled on port 1/35 reauth-enabled: Enable reauth-period: 3600 quiet-period: 60 tx-period: 30 supplicant-timeout: 30 server-timeout: 10 reauth-max: 2 max-req: 2 Status Unauthorized Operation mode Single-Host Max count 5 Port-control Auto Supplicant 00-00-00-00-00-00 Current Identifier 1 Authenticator State Machine State Connecting Reauth Count 2 Backend State Machine State Idle Request Count 0 Identifier(Server) 0 Reauthentication State Machine State Initialize So My real (resumed) question: Do I need to have supplicants even so i want to authenticate with the mac-address, or could it be that this switch doesn't support this, and the normal behaviour should be that the switch asks RADIUS to have access showing the machine credentials (MAC Address)!? Tks in Adv. Daniel

2 1