- Freeradius-Users - lists.freeradius.org

Is it possible to use FreeRadius Client with Microsoft IAS?
by Knarkargott 02 Jun '08

02 Jun '08

Hi! I am new to both Linux and RADIUS, but I really want to learn about this. I have been trying to get the FreeRadius client to work with IAS for a while now but without success, so I really need some help with this. My test should be quite basic I think, but somehow I fail. My setup is as follows: Computer A: Active Directory Computer B: Windows IAS server (IP 192.168.0.155) Computer C: FreeRadius Client (this is actually a virtual machine) Computer A contains user DsH with pwd RADIUS. I have configured the IAS (2003) to allow everything on Computer B and secret = RADIUS. I logged in as DSH with pwd RADIUS on Computer C, with secret = RADIUS for the FreeRadius client (v.1.1.6). I have tried both radtest and radclient, with -x for debug; ------------ radtest DsH 123456 192.168.0.155 10 RADIUS -x => Radclient:: Invalid octet string "123456" for attribute name "User-Password" ------------ echo "User-Name = DsH" | .../radclient 192.168.0.155:1812 auth RADIUS => User-Name = "DsH" (several times until timeout: "No response from client ID...") ------------ Anybody have any idea? Did I miss something basic here, or does FreeRadius Client/IAS just doesn't work together? I have tried for a while reading the manuals and browsing the forum, but I just don't get it to work! Any tips will be greatly appreciated! Thanks in advance :) /Knarkargott -- View this message in context: http://www.nabble.com/Is-it-possible-to-use-FreeRadius-Client-with-Microsof… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

MSCHAP V2 + Plain Text
by vijayakumar 02 Jun '08

02 Jun '08

Dear All , 1) Does MSCHAP V2 supports clear text password only ? 2) Can I integrate MSCHAP V2 with LDAP .If so what changes tobe made in configuration file. Thanks &Regards. VIJAY PUNE

3 4

rlm_radutmp: Logout entry for NAS
by Percy Bloomfield Melgar 02 Jun '08

02 Jun '08

Hi, I have this erro message in radius.log Mon Jun 2 03:21:29 2008 : Error: rlm_radutmp: Logout entry for NAS Juniper port 3489661328 has wrong ID Many session has not save the stop query wen a user logout, I think that this error has relation whit this problem. I hope you can help me, thanks. Percy Bloomfield Melgar 591 3-3597471, 591 700-72724 percy.bloomfield(a)gmail.com pecaluro_p(a)hotmail.com pbloomfield(a)solintec.com.bo Gerente del Dpto. Técnico Solintec S.R.L.

1 0

Re: OT: EAP-TTLS - Problem with securew2 and Vista
by Sergio Belkin 01 Jun '08

01 Jun '08

2008/4/27 Tural Kaptan <tural.kaptan(a)alto.com.tr>: > > Dear Sergio, > > Sorry for the delay in the reply, I just wanted to drop you a note related > to the problem that you have mention in your e-mail to freeradius-users > lists on 18th of April .. > > We had experienced the same problem with some Vista machines - especially > 64bit versions .. For this we have used differently compiled version of > SecureW2 that you can download from here http://www.hofhom.nl/securew2/ .. > We are using this version now for some of Vista clients with no any problem > .. If you have already successfully solved the problem in different way, can > you please drop me a note on this .. If you already solved in the same way, > just ignore this e-mail .. > > Thanks and BR, > > Tural Kaptan > Technical Manager > ALTO/IT Solutions > Hi Tural, Sorry for reply to the list, but I think that maybe it's useful for someone. I'll try this version, since enter user and password in securew2 instead of waiting for dialog box appears didn't solve the problem. Thanks in advance. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 1

Authentication with Sonicwall and FreeRadius not quite working...
by aprotector 30 May '08

30 May '08

I have a free radius working and says it's accepting requests. I have put in the ldap server information into the radiusd.conf file and put in a user that's capable of looking up password within the directory. I have also added the Sonicwall to the clients.conf file and the radius server is recognizing it. However, when I go to the sonicwall and test the radius server it comes up on the radius server but says: Ready to process requests. User-Name = "testuser" User-Password = "password" NAS-IP-Address = 192.168.1.251 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [testuser/password] (from client sonicwall port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> landymow attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. Can anyone tell me what configuration I'm missing that is needed to get the radius to pass the request on to the ldap server and then back to the sonicwall so the authentication is successful?? I'm totally stumped here. -- View this message in context: http://www.nabble.com/Authentication-with-Sonicwall-and-FreeRadius-not-quit… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

FreeRadius 2.0.4 - problems with LDAP and Sonicwall...
by aprotector 30 May '08

30 May '08

I've been trying to get my freeradius server to work with an Netscape LDAP server and authenticate users when they connect via VPN to our Sonicwall gateway. I have set the Sonicwall as a client so the radius recognizes it and then adjusted the radiusd.conf. However, when I try to authenticate an LDAP user from the sonicwall it will say the authentication failed and the radius shows the following messages: ---------- (running in radiusd -X) User-Name = "testuser" User-Password = "testing" NAS-IP-Address = sonicwallIP NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [testuser/testing] (from client sonicwall port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. ---------- If I uncomment a local user account on the Radius box and then try authenticating from the Sonicwall with this it will succeed. It just doesn't seem to want to go to the LDAP server and then back to the Sonicwall. Has anyone had any experience with this sort of setup, and might be able to shed some light on how I can set it up to use LDAP for the authentication? -- View this message in context: http://www.nabble.com/FreeRadius-2.0.4---problems-with-LDAP-and-Sonicwall..… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

XP Extensions for PEAP/MSCHAPv2
by Casartello, Thomas 30 May '08

30 May '08

I have everything working, but I believe I've hit the problem with the OIDs windows needs for the SSL cert. I generated a key with openssl and a req and I actually have a real cert assigned for the server. How do I go about modifying my key and cert so that XP users will be able to connect? I can connect with other OSes. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

4 11

rlm_ldap: no dialupAccess attribute - access denied by default
by youness hsina 30 May '08

30 May '08

Hi Lists, sorry for my english and thank you very much in advance for your help. I'm trying to make a test in radius server with a user who is locate in ldap server with this commande : *# radtest yhsina yhsina localhost 0 test *and i'm getting this message : Sending Access-Request of id 36 to 127.0.0.1 port 1812 User-Name = "yhsina" User-Password = "yhsina" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 *rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=36, length=20 *in debugging mode i have this error : * **rlm_ldap: no dialupAccess attribute - access denied by default* * *Have you any ideas please why it doen't work ? here's my debugging message : radius# radiusd -X -A & [1] 4889 radius# Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = yes proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "192.168.33.33" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=iut-velizy,dc=uvsq,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secret" ldap: basedn = "dc=iut-velizy,dc=uvsq,dc=fr" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x2840f290 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) radiusd.conf Auth-Type eap already configured - skipping Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:54433, id=36, length=58 User-Name = "yhsina" User-Password = "yhsina" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "yhsina", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for yhsina radius_xlat: '(uid=yhsina)' radius_xlat: 'dc=iut-velizy,dc=uvsq,dc=fr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.33.33:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=iut-velizy,dc=uvsq,dc=fr/secret to 192.168.33.33:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=iut-velizy,dc=uvsq,dc=fr, with filter (uid=yhsina) *rlm_ldap: no dialupAccess attribute - access denied by default* rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 0 modcall: leaving group authorize (returns userlock) for request 0 Delaying request 0 for 1 seconds Finished request 0 > > > >

2 2

freeradius 2.0.4, rlm_passwd and dhcp
by Evgeniy Kozhuhovskiy 30 May '08

30 May '08

Hi! I've installed freeradius 2.0.4, configured dhcp. In fact, i leave all sample configuration. from modules{} : passwd mac2ip { filename = /usr/local/freeradius204/etc/raddb/dhcppasswd format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," } deb30# cat /usr/local/freeradius204/etc/raddb/dhcppasswd 2a:00:3e:50:32:d2,93.84.246.130 From debug output: server dhcp { modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating mac2ip passwd mac2ip { filename = "/usr/local/freeradius204/etc/raddb/dhcppasswd" format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no Module: Checking dhcp (null) {...} for more modules to load /usr/local/freeradius204/etc/raddb/sites-enabled/dhcp[202]: No name specified for Post-Auth-Type block } } But when packet arrived, rlm_passwd says NOTFOUND: Received DHCP-Discover of id 22424 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 22424 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 2a:00:3e:50:32:d2 DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = 2a:00:3e:50:32:d2 DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Time-Server DHCP-Parameter-Request-List = DHCP-IEN-116-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Log-Server DHCP-Parameter-Request-List = DHCP-Quotes-Server DHCP-Parameter-Request-List = DHCP-LPR-Server DHCP-Parameter-Request-List = DHCP-Impress-Server DHCP-Parameter-Request-List = DHCP-RLP-Server DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Swap-Server DHCP-Parameter-Request-List = DHCP-NIS-Domain-Name DHCP-Parameter-Request-List = DHCP-NIS-Servers DHCP-Parameter-Request-List = DHCP-NTP-Servers DHCP-Parameter-Request-List = DHCP-X-Window-Font-Server DHCP-Parameter-Request-List = DHCP-X-Window-Display-Mgr server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover ++[reply] returns noop ++[reply] returns noop ++[reply] returns noop ++[mac2ip] returns notfound ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id 22424 from 0.0.0.0:67 to 0.0.0.0:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 22424 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 0x2a003e5032d2 DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 93.84.246.129 DHCP-Domain-Name-Server = 82.209.240.241 DHCP-Domain-Name-Server = 82.209.243.241 DHCP-IP-Address-Lease-Time = 60 DHCP-DHCP-Server-Identifier = 93.84.246.129 Finished request 0. Cleaning up request 0 ID 22424 with timestamp +8 Going to the next request Ready to process requests. Also i've tried to add such update section: dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 82.209.240.241 DHCP-Domain-Name-Server = 82.209.243.241 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 93.84.246.129 DHCP-IP-Address-Lease-Time = 60 DHCP-DHCP-Server-Identifier = 93.84.246.129 } # This part ---> update reply { DHCP-Your-IP-Address = 93.84.246.130 DHCP-Client-IP-Address = 93.84.246.130 } # <--- but it updates only DHCP-Your-IP-Address, not DHCP-Client-IP-Address: Sending DHCP-Offer of id 10898 from 0.0.0.0:67 to 0.0.0.0:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 10898 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 93.84.246.130 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 0x2a003e5032d2 DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 93.84.246.129 DHCP-Domain-Name-Server = 82.209.240.241 DHCP-Domain-Name-Server = 82.209.243.241 DHCP-IP-Address-Lease-Time = 60 DHCP-DHCP-Server-Identifier = 93.84.246.129 Finished request 13. Cleaning up request 13 ID 10898 with timestamp +212 What am i doing wrong? -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

3 9

Fw: Invalid user (rlm_ldap: Access Attribute denies access) - Digest Authentication With FreeRADIUS and OpenLDAP
by Hoa But 30 May '08

30 May '08

-----Forwarded Message----- >From: Hoa But <hoabut(a)earthlink.net> >Sent: May 29, 2008 12:13 PM >To: freeradius-users(a)lists.freeradius.org >Cc: hoabut(a)earthlink.net >Subject: Invalid user (rlm_ldap: Access Attribute denies access) - Digest Authentication With FreeRADIUS and OpenLDAP > >Hello, > >Thank you for your support. > >I am getting "Invalid user (rlm_ldap: Access Attribute denies access)" when authenticating against >OpenLDAP. I can pull up the authentication credentials with OpenLDAP clients against the OpenLDAP server separately fine. >The cleartext User-Password is in OpenLDAP. > >Any assistance is greatly appreciated. The debugging messages are below. > >Thank you and best regards, > >Hoa > > >------------------------------------------------------ > >[root@pops-ldap ~]# radiusd -X >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file: /etc/raddb/proxy.conf >Config: including file: /etc/raddb/clients.conf >Config: including file: /etc/raddb/snmp.conf >Config: including file: /etc/raddb/eap.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/lib" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: snmp = no > main: max_request_time = 5 > main: cleanup_delay = 5 > main: max_requests = 10240 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = "/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = no > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library search path is /usr/lib >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" > pap: auto_header = yes >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded DIGEST >Module: Instantiated digest (digest) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "/etc/shadow" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded LDAP > ldap: server = "ldap://localhost" > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 4 > ldap: timelimit = 3 > ldap: identity = "cn=manager,dc=test,dc=com" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "qchat123" > ldap: basedn = "dc=test,dc=com" > ldap: filter = "(uid=%u)" > ldap: base_filter = "(objectclass=radiusprofile)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "radiusProfileDn" > ldap: password_header = "(null)" > ldap: password_attribute = "userPassword" > ldap: access_attr = "dialupAccess" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 40 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > ldap: set_auth_type = yes >rlm_ldap: Registering ldap_groupcmp for Ldap-Group >rlm_ldap: Registering ldap_xlat with xlat_name ldap >rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap >rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ >rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ >rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type >rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use >rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id >rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id >rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password >rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password >rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT >rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration >rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address >rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type >rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol >rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address >rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask >rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route >rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing >rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id >rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU >rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression >rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host >rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service >rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port >rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number >rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id >rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network >rlm_ldap: LDAP radiusClass mapped to RADIUS Class >rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout >rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout >rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action >rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service >rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node >rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group >rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link >rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network >rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone >rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit >rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port >rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message >conns: 0x99eef30 >Module: Instantiated ldap (ldap) >Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/raddb/huntgroups" > preprocess: hints = "/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no >Module: Instantiated realm (suffix) >Module: Loaded files > files: usersfile = "/etc/raddb/users" > files: acctusersfile = "/etc/raddb/acct_users" > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. >rad_recv: Access-Request packet from host 10.8.140.21:7251, id=201, length=306 > User-Name = "popsffa64(a)test.com" > NAS-Identifier = "qcs-qchat-ops-2-3.qln.test.com.(none)" > NAS-Port-Type = Virtual > Service-Type = 200 > Digest-Response = "b7b36bac8060d1688fdb3a4e7d4bceb9" > Digest-Attributes = 0x010e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x02226632396366616434303130323732653337333162393237626266373665333462 > Digest-Attributes = 0x031051434841542d5245474953544552 > Digest-Attributes = 0x040e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x050661757468 > Digest-Attributes = 0x060a4d44352d73657373 > Digest-Attributes = 0x08226665386661626333396437613030616230626335616130373963393635633530 > Digest-Attributes = 0x090331 > Digest-Attributes = 0x0a18706f70736666613634407175616c636f6d6d2e636f6d > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 >rlm_digest: Adding Auth-Type = DIGEST > modcall[authorize]: module "digest" returns ok for request 0 > rlm_realm: Looking up realm "test.com" for User-Name = "popsffa64(a)test.com" > rlm_realm: No such realm "test.com" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry popsffa64(a)test.com at line 103 > modcall[authorize]: module "files" returns ok for request 0 >rlm_ldap: - authorize >rlm_ldap: performing user authorization for popsffa64(a)test.com >radius_xlat: '(uid=popsffa64(a)test.com)' >radius_xlat: 'dc=test,dc=com' >rlm_ldap: ldap_get_conn: Checking Id: 0 >rlm_ldap: ldap_get_conn: Got Id: 0 >rlm_ldap: attempting LDAP reconnection >rlm_ldap: (re)connect to ldap://localhost, authentication 0 >rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow >rlm_ldap: bind as cn=manager,dc=test,dc=com/qchat123 to ldap://localhost >rlm_ldap: waiting for bind result ... >request 1 done >rlm_ldap: Bind was successful >rlm_ldap: performing search in dc=test,dc=com, with filter (uid=popsffa64(a)test.com) >request 2 done >rlm_ldap: no dialupAccess attribute - access denied by default >rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns userlock for request 0 >modcall: leaving group authorize (returns userlock) for request 0 >Invalid user (rlm_ldap: Access Attribute denies access): [popsffa64(a)test.com/<no User-Password attribute>] (from client qcs-qchat-ops-2-3 port 0) >Delaying request 0 for 1 seconds >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Sending Access-Reject of id 201 to 10.8.140.21 port 7251 >Waking up in 4 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 201 with timestamp 483cb7b5 >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.8.140.21:7252, id=195, length=306 > User-Name = "popsffa64(a)test.com" > NAS-Identifier = "qcs-qchat-ops-2-3.qln.test.com.(none)" > NAS-Port-Type = Virtual > Service-Type = 200 > Digest-Response = "a4ebf865f9abea9d590bdd95f5d81f5e" > Digest-Attributes = 0x010e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x02223464303339383763636661353637393938326461323237313735656638663930 > Digest-Attributes = 0x031051434841542d5245474953544552 > Digest-Attributes = 0x040e7175616c636f6d6d2e636f6d > Digest-Attributes = 0x050661757468 > Digest-Attributes = 0x060a4d44352d73657373 > Digest-Attributes = 0x08226530653061383666616133656238643532313161376636326133653662303937 > Digest-Attributes = 0x090331 > Digest-Attributes = 0x0a18706f70736666613634407175616c636f6d6d2e636f6d > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 >rlm_digest: Adding Auth-Type = DIGEST > modcall[authorize]: module "digest" returns ok for request 1 > rlm_realm: Looking up realm "test.com" for User-Name = "popsffa64(a)test.com" > rlm_realm: No such realm "test.com" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 1 > users: Matched entry popsffa64(a)test.com at line 103 > modcall[authorize]: module "files" returns ok for request 1 >rlm_ldap: - authorize >rlm_ldap: performing user authorization for popsffa64(a)test.com >radius_xlat: '(uid=popsffa64(a)test.com)' >radius_xlat: 'dc=test,dc=com' >rlm_ldap: ldap_get_conn: Checking Id: 0 >rlm_ldap: ldap_get_conn: Got Id: 0 >rlm_ldap: performing search in dc=test,dc=com, with filter (uid=popsffa64(a)test.com) >request 3 done >rlm_ldap: no dialupAccess attribute - access denied by default >rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns userlock for request 1 >modcall: leaving group authorize (returns userlock) for request 1 >Invalid user (rlm_ldap: Access Attribute denies access): [popsffa64(a)test.com/<no User-Password attribute>] (from client qcs-qchat-ops-2-3 port 0) >Delaying request 1 for 1 seconds >Finished request 1 >Going to the next request >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Sending Access-Reject of id 195 to 10.8.140.21 port 7252 >Waking up in 4 seconds... >--- Walking the entire request list --- >Cleaning up request 1 ID 195 with timestamp 483cb7c0 >Nothing to do. Sleeping until we see a request. > >---------------------------------------------------------------------------

2 2