- Freeradius-Users - lists.freeradius.org

freeradius-2.0.3 not talking to mysql-5.1
by NPY 14 May '08

14 May '08

Hi, I am struggling to get freeradius-2.0.3 to work with mysql-5.1.24 on a FreeBSD-7.0 machine. Basic PAP auth is working so radiusd is running fine. Below is the 'radiusd -X' output when I did a 'radtest joy happy localhost 1812 testing123' I notice when running 'radiusd -X' that no module rlm_sql_mysql was loaded. Is that a problem? How do I resolve it? Thanks, -Marcus ------------------------------------- FreeRADIUS Version 2.0.3, for host amd64-portbld-freebsd7.0, built on May 13 2008 at 14:48:48 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "freeradius" group = "freeradius" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. User-Name = "joy" User-Password = "happy" NAS-IP-Address = 123.242.231.112 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joy", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [joy/happy] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> joy attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds.

3 3

No authenticate method
by Jean Frontin 14 May '08

14 May '08

Hello, with the help of Alan I eliminated two errors but I always have the error mentioned in the subject. I persent the full log wher I begin the lines I don't understand by a star at the bottom of my mail. My question is : wher do I make a configuration error ? Thanks you for your help Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded Counter counter: filename = "/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 3001 rlm_counter: Current Time: 1210772270 [2008-05-14 15:37:50], Next reset 1210802400 [2008-05-15 00:00:00] Module: Instantiated counter (daily) Module: Loaded LDAP ldap: server = "ldap1.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7a380 Module: Instantiated ldap (ldap1) ldap: server = "ldap2.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7aad0 Module: Instantiated ldap (ldap2) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 11.12.13.14:1896, id=3, length=47 User-Name = "xxxxxx" User-Password = "yyyyyy" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/141.115.16.72/auth-detail-20080514' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/141.115.16.72/auth-detail-20080514 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 * auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user * auth: Failed to validate the user. * Login incorrect: [xxxxxx/yyyyyy] (from client zzzzz port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 141.115.16.72 port 1896 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 482aeb39 Nothing to do. Sleeping until we see a request. -- Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

uninstall freeradius
by Kwok Sianbin 14 May '08

14 May '08

Hi, Thanks for keep assisting me. Right now I want to remove the freeradius from the server and re-intall version 2.0.4. For freeradius-2.0.2 and 2.05, I use CVS command to install it as mention in my previous email. So if I want to remove it by using what command? and for freeradius-1.1.7..I installed by downloaded the file freeradius-1.1.7.tar.bz2 from freeradius.org. I want to uninstall it also! Thanks in advance! ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 13, 2008 11:58:40 PM Subject: Re: EAP-TLS can't get connected..etc. Hi, > I installed the Freeradius 2.0.4 as Mr. Alan DeKok had suggested > I browse www.freeradius.org and run below command. > #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login > CVS password: anoncvs > nothing happen and return to # 'nothing' should happen as all you've done is log into a CVS session > #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd this will download the latest CVS version - '2.0.5' from the main site into a directory called 'radiusd' - which will be put into whereever you were when you ran the command compile problems could be due to having the latest CVS code which might have a problem in it at any time. was there a specific reason not to use eg 2.0.4.tar.bz2 download from the freeradius.org site? > I checked the version in /usr/share/doc/radius/VERSION and it shows 2.0.2 (installed before) > Have I installed freeradius-2.0.4? not from what i've seen you type. what does eg 'radiusd -v' tell you? > If I want to uninstall or remove previous version such Freeradius-1.1.7 ..what command I should run or just simply delete the folder in Freeradius? how did you install it? from RPM or APT etc? or from source? if from source, you will need to look in the binary and library directories for all the files it will have installed...usually /location/to/bin/rad* /location/to/lib/rlm_* /local/to/lib/radius* and then a whole load of things in /usr/share/radius etc etc (just do eg 'make -n install' to see what it puts where. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

FreeRadius 1.1.3 with MySQL
by Brad Furst 14 May '08

14 May '08

I'm attempting to have multiple realms use individual mysql tables in order to seperate the usernames. I've read how to get multiple sql instances going, but how do I tell which realm to use which sql instance?

4 4

Manually Creating a RADIUS Accounting packet
by Etienne Pretorius 14 May '08

14 May '08

Hello List, I have FreeRadius accepting the packet and inserting all the values - except for NAS-Port-Id - into the accounting database. Could someone perhaps point out what attribute is missing.... for it to log the NAS-Port-Id. php code: pack("C",$code). //Packet Type Code (=Accounting-Request) pack("C",$identifier). //Packet identifier pack("CC",$length/256,$length%256). //Packet Length pack("a*",$request_authenticator). //Request Authenticator pack("CCCCCC",40,6,0,0,0,2). //Acct-Status-Type (=Stop) pack("CCCCCC",46,6,0,0,0,1). //Acct-Session-Time (=1) pack("CCa*",44,2+strlen($session),$session). //Acct-Session-Id pack("CCa*",1,2+strlen($username),$username). //User-Name pack("CCCCCC",4,6, $nas_ip[0],$nas_ip[1],$nas_ip[2],$nas_ip[3]). //NAS-IP-Address pack("CCa*",87,2+strlen($port),$port). //NAS-Port-Id pack("CCCCCC",61,6,0,0,0,5); //NAS-Port-Type (=Virtual) -- Kind Regards Etienne Pretorius

1 0

User-Password formats
by niall el-assaad 14 May '08

14 May '08

Hi, I have a setup with freeradius where it is launching an external script to authenticate users. When doing PAP authentication against the radius server I receive the %{User-Password} and pass it to my script. However when using a cisco wireless lan controller it seems not to pass User-Password as the text, it encodes it in another format. I'm wondering if anyone knows what format this is. >From a radiusd -X I get the following when it works rad_recv: Access-Request packet from host 10.10.76.3:32769, id=12, length=119 User-Name = "cisco(a)cisco.com" User-Password = "password" Service-Type = Login-User NAS-IP-Address = 10.10.76.2 NAS-Identifier = "Franciscan-2" Airespace-Wlan-Id = 1 Calling-Station-Id = "10.10.76.135" Called-Station-Id = "10.10.76.3" So it passes my script the password in plain text and when I use the Cisco WLC it fails and I get rad_recv: Access-Request packet from host 10.10.76.2:32769, id=12, length=119 User-Name = "cisco(a)cisco.com" User-Password = "]\313\347C\223\240\350\351\275!\307L\300\210" Service-Type = Login-User NAS-IP-Address = 10.10.76.2 NAS-Identifier = "Franciscan-2" Airespace-Wlan-Id = 1 Calling-Station-Id = "10.10.76.135" Called-Station-Id = "10.10.76.2" My script obviously gets passed "]\313\347C\223\240\350\351\275!\307L\300\210" Does anyone know what format this is? Or how I can convert it to get the password in plain text format? thanks, niall

3 10

RE:huntgroups are failing auth - missing Chap Password
by Terry Pelley 14 May '08

14 May '08

OK, I must be missing something here, likely due to my limited experience with FreeRADIUS. After re-reading the instructions in the users file the only thing I can see that is relevant when using huntgroups is an entry for a user that has no User-Password attribute assigned which I assume means that the default Auth-Type System will kick in and look the password up in an other file someplace. What I don't know is the location of this file and how to go about adding the password for my users. Is the use of a huntgroups file the best way for me to accomplish what I am trying to do? I want to limit user Bob so that he can only login from one specific access point. Thanks for the previous advice and in advance for any more. BTW: Sorry if this posting has broken the original thread. >Read instructions in users file about which password attribute should you >be using. User-Password is wrong for 1.1.7. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 14/9/2007, "Terry Pelley" <Terry.Pelley at ocdsb.ca> pie: > >FreeRADIUS Version 1.1.7 > >I am using the FreeRADIUS.net Windows version of the software. at least >for the time being. > >I am trying to set up a very basic single user account for a very specific >purpose and have created the account as follows. > >hunttest User-Password == "hunttest", Huntgroup-Name == "hunttest" > >My huntgroups file has a huntgroup called hunttest with a single NAS IP >Address listed as follows. > >public NAS-IP-Address == 10.252.9.2 > >when the user huntest attempts to authenticate it fails. My RADIUS Log >shows the following entry. > >Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text >password not available): [hunttest/<CHAP-Password>] (from client NAS04 >port 5 cli 00-1E-8C-0E-8E-70) >Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text >password not available): [hunttest/<CHAP-Password>] (from client NAS04 >port 5 cli 00-1E-8C-0E-8E-70) > >Can some one tell me what is wrong. I am simply trying to create a config >that will allow the user hunttest to authenticate only if the request >comes from the client NAS04. Perhaps a huntgroup is not the best way to do >this.

3 5

RADIUS Attribute: NAS-Port what is the true Length?
by Etienne Pretorius 14 May '08

14 May '08

Hello List, Probably not the right place to ask but I would like to know if someone could explain to me the following: According to RFC2138, the maximum range for the NAS-Port is 16 bits, so with the Type and Length fields to total length is 6 octets. But with FreeRadius's SQL Schema the NAS-PortId field is a varchar(15) and I see it being used. The dictionary.rfc2138 just states it is an integer so what is the maximum range on the NAS-Port field? If it has been changed, could someone point me to the correct RFC. -- Kind Regards Etienne Pretorius

1 1

Multiple ldap servers
by Jean Frontin 14 May '08

14 May '08

Hello, After several hours of research I don't understand howto configure FreeRadius to use two ldap servers. With only one ldap server all is OK ! I run FreeRadius 1.1.7 under Fedora core 8. Below I present you a radiusd.conf extract and a logof a session. In the og I put a start at the beginning of lines which I don't understand. Thanks you for your help ---- radiusd.conf extracts modules { ldap ldap1 { ... } ldap ldap2 { ... } ... } authorize { ... Autz-Type ldap_1 { ldap1 } Autz-Type ldap_2 { ldap2 } ... } authenticate { ... Auth-Type ldap_1 { ldap1 } Auth-Type ldap_2 { ldap2 } ... } ... ----------- log extracts rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 * rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. ... rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 * rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. ... modcall: leaving group authorize (returns ok) for request 0 * auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [myname/password] (from client XXX port 0) -- Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

Version 2 running on Red Hat 5
by Dubreuil, Gilles 14 May '08

14 May '08

All, Is someone being able to run version 2 on Red Hat 5.x? ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. ********************************************************************** _____________________________________________________________________ This e-mail has been scanned for viruses by MCI's Internet Managed Scanning Services - powered by MessageLabs. For further information visit http://www.mci.com

3 2