- Freeradius-Users - lists.freeradius.org

Re: EAP-TLS can't get connected..etc.
by Kwok Sianbin 15 May '08

15 May '08

Hi Everyone, I installed the Freeradius 2.0.4 as Mr. Alan DeKok had suggested I browse www.freeradius.org and run below command. #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login CVS password: anoncvs nothing happen and return to # #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd then under #/usr/share/doc/radiusd ......run #./configure --with-openssl-includes=/usr/include/openssl --with-openssl-libraries=/usr/lib/libxm --with-prefix=/usr/local/radius # make #make install got some errors btool: install: error: cannot install "rlm_acctlog.la" to a directory not ending in /usr/local/lib/lib gmake[6]: *** [install] Error1 gmake[6]: Leaving dictory '/usr/share/doc/radiusd/src/modules/rlm_acctog' gmake[5]: *** Error 2 gmake[5]: Leaving directory '/usr/share/doc/radiusd/src/modules' gmake[4]: *** Error 2 gmake[4]: Leaving directory '/usr/share/doc/radiusd/src/modules' gmake[3]: *** Error 2 gmake[3]: Leaving directory '/usr/share/doc/radiusd/src' gmake[2]: *** Error 2 gmake[2]: Leaving directory '/usr/share/doc/radiusd/src' gmake[1]: *** Error 2 gmake[1]: Leaving directory '/usr/share/doc/radiusd' make: *** [install] Error 2 I checked the version in /usr/share/doc/radius/VERSION and it shows 2.0.2 (installed before) Have I installed freeradius-2.0.4? where it's located? If I want to uninstall or remove previous version such Freeradius-1.1.7 ..what command I should run or just simply delete the folder in Freeradius? thanks in advance. ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 9, 2008 7:50:34 PM Subject: Re: EAP-TLS can't get connected..etc. Kwok Sianbin wrote: > I am newbie to linux and recently I try to implement wireless > connnection with EAP-TLS encryption. I am using Freeradius-1.1.7 > installed into Red Hat Enterprise 4. You should really use 2.0.4. > Here I encounter problems that I can't solve it alone hence I need > advice guru from this forum. > the problem is client just can't get connected and keep request. > ... > Sending Access-Challenge of id 15 to 192.168.0.206 port 1025 >... > Going to the next request > Waking up in 6 seconds... This is in the FAQ. It's also documented in the "eap.conf" file in 2.0.4. > Here I post the CA.certs execution result as I suppect that the errors > might be due to certificate error. > When I run ./CA.certs and I got a few errors. 2.0.4 also contains new scripts for certificate creation. They're MUCH better than what's in 1.1.7. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

How to activate the accounting sub section in perl script
by johnson elangbam 15 May '08

15 May '08

hi, I am doing my AAA in perl script for radius 2.0.3, can anybody please tell how do I activate my accounting subsection in my perl program, I didn't find any execution of my queries in the accounting sub section in my perl script. With Regards, Johnson Elangbam

3 2

Listen port problem
by Hoggins! 15 May '08

15 May '08

Hello, I have a strange problem since I updated my freeradius from 1.x to 2.x, from a simple rpm update. It binds to random ports ! Here is the dump of radiusd -X : ------------------------------------ FreeRADIUS Version 2.0.2, for host i386-redhat-linux-gnu, built on Mar 18 2008 at 13:16:44 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb//radiusd.conf including configuration file /etc/raddb//clients.conf including configuration file /etc/raddb//snmp.conf including configuration file /etc/raddb//eap.conf including configuration file /etc/raddb//sql.conf including configuration file /etc/raddb//sql/mysql/dialup.conf including configuration file /etc/raddb//sql/mysql/counter.conf including configuration file /etc/raddb//policy.conf including files in directory /etc/raddb//sites-enabled/ including configuration file /etc/raddb//sites-enabled/default including dictionary file /etc/raddb//dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "radiusbouffard" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "radiusbouffard" shortname = "wifigates" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb//certs/server.pem" certificate_file = "/etc/raddb//certs/server.pem" CA_file = "/etc/raddb//certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb//certs/dh" random_file = "/etc/raddb//certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb//certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb//huntgroups" hints = "/etc/raddb//hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb//users" acctusersfile = "/etc/raddb//acct_users" preproxy_usersfile = "/etc/raddb//preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb//attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb//attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 45632 Listening on accounting address * port 36936 Ready to process requests. ------------------------------------ I don't really understand why it does that. I checked if there wasn't any other program that would have listened on 1812 before radius. Do you have an idea ? Thanks in advance, Hoggins!

2 2

EAP TLS Authentication with eToken
by Riccardo Veraldi 15 May '08

15 May '08

Hello, anyone has used eToken Aladdin 64k with EAP-TLS authentication using wpa_supplicant ? thank you Rick

1 0

No authenticate method
by Jean Frontin 15 May '08

15 May '08

Hello, I run FreeRadius 1.1.7 under Fedora core 8. Here is the radiusd.conf extract and below a session log. In the log I put a start at the beginning of lines which I don't understand. I want that the FreeRadius looks for user password in the ldap. Thanks you for your help ---- radiusd.conf extracts modules { ... ldap ldap1 { ... } ldap ldap2 { ... } ... } authorize { ... Autz-Type ldap1 { ldap1 } Autz-Type ldap2 { ldap2 } ... } authenticate { ... Auth-Type ldap1 { ldap1 } Auth-Type ldap2 { ldap2 } ... } ... ----------- log extracts Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded Counter counter: filename = "/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 3001 rlm_counter: Current Time: 1210772270 [2008-05-14 15:37:50], Next reset 1210802400 [2008-05-15 00:00:00] Module: Instantiated counter (daily) Module: Loaded LDAP ldap: server = "ldap1.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7a380 Module: Instantiated ldap (ldap1) ldap: server = "ldap2.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7aad0 Module: Instantiated ldap (ldap2) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 11.12.13.14:1896, id=3, length=47 User-Name = "xxxxxx" User-Password = "yyyyyy" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/141.115.16.72/auth-detail-20080514' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/141.115.16.72/auth-detail-20080514 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 * auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user * auth: Failed to validate the user. * Login incorrect: [xxxxxx/yyyyyy] (from client zzzzz port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 141.115.16.72 port 1896 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 482aeb39 Nothing to do. Sleeping until we see a request.

2 1

Custom properties check
by Sascha Kiefer 14 May '08

14 May '08

Hi, I'm freeradius combined with mysql. Is it possible to check custom property values of existens. Like "let the user logon iff xyz == 1" I guess it is just a matter of writing the sql. But which queries do i have to customize? Regards, Sascha

2 1

Re: freeradius-2.0.3 not talking to mysql-5.1
by NPY 14 May '08

14 May '08

Hi Chris, Thanks for the hint. It helped to resolve the problem. -Marcus ----- Original Message ----- From: "Chris" <cjl(a)viptalk.net> To: "NPY" <npy(a)pdog-vpn.com> Sent: Thursday, May 15, 2008 12:57 AM Subject: Re: freeradius-2.0.3 not talking to mysql-5.1 > Uncommenting it in instantiate is okay (probably unnecessary), but if you > want it to authorize using sql, you have to uncomment it in authorize > { }. If you want to authenticate using sql, you have to uncomment it in > authenticate { }. Want to do sql accounting? uncomment in accounting > { }. > > See raddb/sites-enabled/default > > On May 14, 2008, at 9:42 AM, NPY wrote: > >> OK, I added a line 'sql' to 'instantiate' section of radiusd.conf and >> radiusd is finally loading rlm_sql_mysql. >> Only the authentication is still not going through ..... sigh >> >> Anything else I have missed? Do I need to modify 'users' file etc? >> >> Below is the new 'radiusd -X' output for 'radtest joy happy localhost >> 1812 testing123' >> --------------------------------------------- >> >> FreeRADIUS Version 2.0.3, for host amd64-portbld-freebsd7.0, built on >> May 13 2008 at 14:48:48 >> Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. >> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >> PARTICULAR PURPOSE. >> You may redistribute copies of FreeRADIUS under the terms of the >> GNU General Public License. >> Starting - reading configuration files ... >> including configuration file /usr/local/etc/raddb/radiusd.conf >> including configuration file /usr/local/etc/raddb/proxy.conf >> including configuration file /usr/local/etc/raddb/clients.conf >> including configuration file /usr/local/etc/raddb/snmp.conf >> including configuration file /usr/local/etc/raddb/eap.conf >> including configuration file /usr/local/etc/raddb/sql.conf >> including configuration file /usr/local/etc/raddb/sql/mysql/ dialup.conf >> including configuration file /usr/local/etc/raddb/sql/mysql/ counter.conf >> including configuration file /usr/local/etc/raddb/policy.conf >> including files in directory /usr/local/etc/raddb/sites-enabled/ >> including configuration file /usr/local/etc/raddb/sites-enabled/ default >> including configuration file /usr/local/etc/raddb/sites-enabled/ >> inner-tunnel >> including dictionary file /usr/local/etc/raddb/dictionary >> main { >> prefix = "/usr/local" >> localstatedir = "/var" >> logdir = "/var/log" >> libdir = "/usr/local/lib" >> radacctdir = "/var/log/radacct" >> hostname_lookups = no >> max_request_time = 30 >> cleanup_delay = 5 >> max_requests = 1024 >> allow_core_dumps = no >> pidfile = "/var/run/radiusd/radiusd.pid" >> user = "freeradius" >> group = "freeradius" >> checkrad = "/usr/local/sbin/checkrad" >> debug_level = 0 >> proxy_requests = yes >> security { >> max_attributes = 200 >> reject_delay = 1 >> status_server = yes >> } >> } >> client localhost { >> ipaddr = 127.0.0.1 >> require_message_authenticator = no >> secret = "testing123" >> nastype = "other" >> } >> radiusd: #### Loading Realms and Home Servers #### >> proxy server { >> retry_delay = 5 >> retry_count = 3 >> default_fallback = no >> dead_time = 120 >> wake_all_if_all_dead = no >> } >> home_server localhost { >> ipaddr = 127.0.0.1 >> port = 1812 >> type = "auth" >> secret = "testing123" >> response_window = 20 >> max_outstanding = 65536 >> zombie_period = 40 >> status_check = "status-server" >> ping_check = "none" >> ping_interval = 30 >> check_interval = 30 >> num_answers_to_alive = 3 >> num_pings_to_alive = 3 >> revive_interval = 120 >> status_check_timeout = 4 >> } >> home_server_pool my_auth_failover { >> type = fail-over >> home_server = localhost >> } >> realm example.com { >> auth_pool = my_auth_failover >> } >> realm LOCAL { >> } >> radiusd: #### Instantiating modules #### >> instantiate { >> Module: Linked to module rlm_exec >> Module: Instantiating exec >> exec { >> wait = yes >> input_pairs = "request" >> shell_escape = yes >> } >> Module: Linked to module rlm_expr >> Module: Instantiating expr >> Module: Linked to module rlm_expiration >> Module: Instantiating expiration >> expiration { >> reply-message = "Password Has Expired " >> } >> Module: Linked to module rlm_logintime >> Module: Instantiating logintime >> logintime { >> reply-message = "You are calling outside your allowed timespan " >> minimum-timeout = 60 >> } >> Module: Linked to module rlm_sql >> Module: Instantiating sql >> sql { >> driver = "rlm_sql_mysql" >> server = "localhost" >> port = "" >> login = "radius" >> password = "pie=3.14" >> radius_db = "radius" >> read_groups = yes >> sqltrace = no >> sqltracefile = "/var/log/sqltrace.sql" >> readclients = no >> deletestalesessions = yes >> num_sql_socks = 5 >> sql_user_name = "%{User-Name}" >> default_user_profile = "" >> nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" >> authorize_check_query = "SELECT id, username, attribute, value, op FROM >> radcheck WHERE username = '%{SQL-User- Name}' ORDER >> BY id" >> authorize_reply_query = "SELECT id, username, attribute, value, op FROM >> radreply WHERE username = '%{SQL-User- Name}' ORDER >> BY id" >> authorize_group_check_query = "SELECT id, groupname, attribute, Value, >> op FROM radgroupcheck WHERE groupname = '% >> {Sql-Group}' ORDER BY id" >> authorize_group_reply_query = "SELECT id, groupname, attribute, value, >> op FROM radgroupreply WHERE groupname = '% >> {Sql-Group}' ORDER BY id" >> accounting_onoff_query = " UPDATE radacct SET >> acctstoptime = '%S', acctsessiontime = >> unix_timestamp('%S') - unix_timestamp(acctstarttime), >> acctterminatecause = '%{Acct-Terminate-Cause}', >> acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE >> acctsessiontime = 0 AND acctstoptime = NULL >> AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime >> <= '%S'" >> accounting_update_query = " UPDATE radacct SET >> framedipaddress = '%{Framed-IP-Address}', acctsessiontime >> = '%{Acct-Session-Time}', acctinputoctets = >> '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{% {Acct-Input-Octets}:-0}', >> acctoutputoctets = '%{% {Acct-Output-Gigawords}:-0}' << 32 | >> '%{%{Acct-Output- Octets}:-0}' WHERE acctsessionid = >> '%{Acct-Session- Id}' AND username = '%{SQL-User-Name}' >> AND nasipaddress = '%{NAS-IP-Address}'" >> accounting_update_query_alt = " INSERT INTO radacct >> (acctsessionid, acctuniqueid, username, realm, >> nasipaddress, nasportid, nasporttype, >> acctstarttime, acctsessiontime, acctauthentic, >> connectinfo_start, acctinputoctets, acctoutputoctets, >> calledstationid, callingstationid, servicetype, >> framedprotocol, framedipaddress, acctstartdelay, >> xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '% >> {Acct-Unique-Session-Id}', '%{SQL-User-Name}', '% {Realm}', >> '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS- Port-Type}', >> DATE_SUB('%S', INTERVAL (%{%{Acct-Session- Time}:-0} + >> %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session- Time}', >> '%{Acct-Authentic}', '', '%{%{Acct-Input- Gigawords}:-0}' << 32 | >> '%{%{Acct-Input-Octets}:-0}', '% >> {%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output- >> Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '% >> {Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', >> '0', '%{X-Ascend-Session-Svr-Key}')" >> accounting_start_query = " INSERT INTO radacct (acctsessionid, >> acctuniqueid, username, realm, nasipaddress, >> nasportid, nasporttype, acctstarttime, acctstoptime, >> acctsessiontime, acctauthentic, connectinfo_start, >> connectinfo_stop, acctinputoctets, acctoutputoctets, >> calledstationid, callingstationid, acctterminatecause, >> servicetype, framedprotocol, framedipaddress, >> acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES >> ('% {Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL- >> User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS- >> Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '% >> {Connect-Info}', '', '0', '0', '%{Called-Station-Id}', >> '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed- Protocol}', >> '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', >> '%{X-Ascend-Session-Svr-Key}')" >> accounting_start_query_alt = " UPDATE radacct SET >> acctstarttime = '%S', acctstartdelay = '%{%{Acct- >> Delay-Time}:-0}', connectinfo_start = '%{Connect- Info}' >> WHERE acctsessionid = '%{Acct-Session-Id}' AND username = >> '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" >> accounting_stop_query = " UPDATE radacct SET acctstoptime >> = '%S', acctsessiontime = '%{Acct- Session-Time}', >> acctinputoctets = '%{%{Acct-Input- Gigawords}:-0}' << 32 | >> '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = >> '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{% {Acct-Output-Octets}:-0}', >> acctterminatecause = '%{Acct- Terminate-Cause}', >> acctstopdelay = '%{%{Acct-Delay- Time}:-0}', >> connectinfo_stop = '%{Connect- Info}' WHERE acctsessionid = >> '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' >> AND nasipaddress = '%{NAS-IP-Address}'" >> accounting_stop_query_alt = " INSERT INTO radacct >> (acctsessionid, acctuniqueid, username, realm, >> nasipaddress, nasportid, nasporttype, acctstarttime, >> acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, >> connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, >> callingstationid, acctterminatecause, servicetype, framedprotocol, >> framedipaddress, acctstartdelay, acctstopdelay) >> VALUES ('%{Acct-Session-Id}', '% {Acct-Unique-Session-Id}', >> '%{SQL-User-Name}', '% {Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', >> '%{NAS-Port- Type}', DATE_SUB('%S', >> INTERVAL (%{% {Acct-Session-Time}:-0} + >> %{%{Acct-Delay-Time}:-0}) SECOND), '%S', >> '%{Acct-Session-Time}', '%{Acct- Authentic}', '', '%{Connect-Info}', >> '%{%{Acct-Input- Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', >> '% {%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output- >> Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '% >> {Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed- >> Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct- >> Delay-Time}:-0}')" >> group_membership_query = "SELECT groupname FROM radusergroup >> WHERE username = '%{SQL-User-Name}' ORDER BY priority" >> connect_failure_retry_delay = 60 >> simul_count_query = "" >> simul_verify_query = "SELECT radacctid, acctsessionid, username, >> nasipaddress, nasportid, framedipaddress, callingstationid, >> framedprotocol FROM radacct WHERE >> username = '%{SQL-User-Name}' AND >> acctstoptime = NULL" >> postauth_query = "INSERT INTO radpostauth (username, pass, reply, >> authdate) VALUES ( >> '%{User-Name}', '%{%{User-Password}:-% {Chap-Password}}', >> '%{reply:Packet-Type}', '%S')" >> safe-characters = >> "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- _: /" >> } >> rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and >> linked >> rlm_sql (sql): Attempting to connect to radius@localhost:/radius >> rlm_sql (sql): starting 0 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 >> rlm_sql_mysql: Starting connect to MySQL server for #0 >> rlm_sql (sql): Connected new DB handle, #0 >> rlm_sql (sql): starting 1 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 >> rlm_sql_mysql: Starting connect to MySQL server for #1 >> rlm_sql (sql): Connected new DB handle, #1 >> rlm_sql (sql): starting 2 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 >> rlm_sql_mysql: Starting connect to MySQL server for #2 >> rlm_sql (sql): Connected new DB handle, #2 >> rlm_sql (sql): starting 3 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 >> rlm_sql_mysql: Starting connect to MySQL server for #3 >> rlm_sql (sql): Connected new DB handle, #3 >> rlm_sql (sql): starting 4 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 >> rlm_sql_mysql: Starting connect to MySQL server for #4 >> rlm_sql (sql): Connected new DB handle, #4 >> } >> radiusd: #### Loading Virtual Servers #### >> server inner-tunnel { >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Linked to module rlm_pap >> Module: Instantiating pap >> pap { >> encryption_scheme = "auto" >> auto_header = no >> } >> Module: Linked to module rlm_chap >> Module: Instantiating chap >> Module: Linked to module rlm_mschap >> Module: Instantiating mschap >> mschap { >> use_mppe = yes >> require_encryption = no >> require_strong = no >> with_ntdomain_hack = no >> } >> Module: Linked to module rlm_unix >> Module: Instantiating unix >> unix { >> radwtmp = "/var/log/radwtmp" >> } >> Module: Linked to module rlm_eap >> Module: Instantiating eap >> eap { >> default_eap_type = "md5" >> timer_expire = 60 >> ignore_unknown_eap_types = no >> cisco_accounting_username_bug = no >> } >> Module: Linked to sub-module rlm_eap_md5 >> Module: Instantiating eap-md5 >> Module: Linked to sub-module rlm_eap_leap >> Module: Instantiating eap-leap >> Module: Linked to sub-module rlm_eap_gtc >> Module: Instantiating eap-gtc >> gtc { >> challenge = "Password: " >> auth_type = "PAP" >> } >> Module: Linked to sub-module rlm_eap_tls >> Module: Instantiating eap-tls >> tls { >> rsa_key_exchange = no >> dh_key_exchange = yes >> rsa_key_length = 512 >> dh_key_length = 512 >> verify_depth = 0 >> pem_file_type = yes >> private_key_file = "/usr/local/etc/raddb/certs/server.pem" >> certificate_file = "/usr/local/etc/raddb/certs/server.pem" >> CA_file = "/usr/local/etc/raddb/certs/ca.pem" >> private_key_password = "whatever" >> dh_file = "/usr/local/etc/raddb/certs/dh" >> random_file = "/usr/local/etc/raddb/certs/random" >> fragment_size = 1024 >> include_length = yes >> check_crl = no >> cipher_list = "DEFAULT" >> make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" >> } >> Module: Linked to sub-module rlm_eap_ttls >> Module: Instantiating eap-ttls >> ttls { >> default_eap_type = "md5" >> copy_request_to_tunnel = no >> use_tunneled_reply = no >> virtual_server = "inner-tunnel" >> } >> Module: Linked to sub-module rlm_eap_peap >> Module: Instantiating eap-peap >> peap { >> default_eap_type = "mschapv2" >> copy_request_to_tunnel = no >> use_tunneled_reply = no >> proxy_tunneled_request_as_eap = yes >> virtual_server = "inner-tunnel" >> } >> Module: Linked to sub-module rlm_eap_mschapv2 >> Module: Instantiating eap-mschapv2 >> mschapv2 { >> with_ntdomain_hack = no >> } >> Module: Checking authorize {...} for more modules to load >> Module: Linked to module rlm_realm >> Module: Instantiating suffix >> realm suffix { >> format = "suffix" >> delimiter = "@" >> ignore_default = no >> ignore_null = no >> } >> Module: Linked to module rlm_files >> Module: Instantiating files >> files { >> usersfile = "/usr/local/etc/raddb/users" >> acctusersfile = "/usr/local/etc/raddb/acct_users" >> preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" >> compat = "no" >> } >> Module: Checking session {...} for more modules to load >> Module: Linked to module rlm_radutmp >> Module: Instantiating radutmp >> radutmp { >> filename = "/var/log/radutmp" >> username = "%{User-Name}" >> case_sensitive = yes >> check_with_nas = yes >> perm = 384 >> callerid = yes >> } >> Module: Checking post-proxy {...} for more modules to load >> Module: Checking post-auth {...} for more modules to load >> Module: Linked to module rlm_attr_filter >> Module: Instantiating attr_filter.access_reject >> attr_filter attr_filter.access_reject { >> attrsfile = "/usr/local/etc/raddb/attrs.access_reject" >> key = "%{User-Name}" >> } >> } >> } >> server { >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Checking authorize {...} for more modules to load >> Module: Linked to module rlm_preprocess >> Module: Instantiating preprocess >> preprocess { >> huntgroups = "/usr/local/etc/raddb/huntgroups" >> hints = "/usr/local/etc/raddb/hints" >> with_ascend_hack = no >> ascend_channels_per_line = 23 >> with_ntdomain_hack = no >> with_specialix_jetstream_hack = no >> with_cisco_vsa_hack = no >> with_alvarion_vsa_hack = no >> } >> Module: Checking preacct {...} for more modules to load >> Module: Linked to module rlm_acct_unique >> Module: Instantiating acct_unique >> acct_unique { >> key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- Address, >> NAS-Port" >> } >> Module: Checking accounting {...} for more modules to load >> Module: Linked to module rlm_detail >> Module: Instantiating detail >> detail { >> detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" >> header = "%t" >> detailperm = 384 >> dirperm = 493 >> locking = no >> log_packet_header = no >> } >> Module: Instantiating attr_filter.accounting_response >> attr_filter attr_filter.accounting_response { >> attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" >> key = "%{User-Name}" >> } >> Module: Checking session {...} for more modules to load >> Module: Checking post-proxy {...} for more modules to load >> Module: Checking post-auth {...} for more modules to load >> } >> } >> radiusd: #### Opening IP addresses and Ports #### >> listen { >> type = "auth" >> ipaddr = * >> port = 0 >> } >> listen { >> type = "acct" >> ipaddr = * >> port = 0 >> } >> Listening on authentication address * port 1812 >> Listening on accounting address * port 1813 >> Listening on proxy address * port 1814 >> Ready to process requests. >> User-Name = "joy" >> User-Password = "happy" >> NAS-IP-Address = 123.242.231.112 >> NAS-Port = 1812 >> +- entering group authorize >> ++[preprocess] returns ok >> ++[chap] returns noop >> ++[mschap] returns noop >> rlm_realm: No '@' in User-Name = "joy", looking up realm NULL >> rlm_realm: No such realm "NULL" >> ++[suffix] returns noop >> rlm_eap: No EAP-Message, not doing EAP >> ++[eap] returns noop >> ++[unix] returns notfound >> ++[files] returns noop >> ++[expiration] returns noop >> ++[logintime] returns noop >> rlm_pap: WARNING! No "known good" password found for the user. >> Authentication may fail because of this. >> ++[pap] returns noop >> auth: No authenticate method (Auth-Type) configuration found for the >> request: Rejecting the user >> auth: Failed to validate the user. >> Login incorrect: [joy/happy] (from client localhost port 1812) >> Found Post-Auth-Type Reject >> +- entering group REJECT >> expand: %{User-Name} -> joy >> attr_filter: Matched entry DEFAULT at line 11 >> ++[attr_filter.access_reject] returns updated >> Delaying reject of request 0 for 1 seconds >> Going to the next request >> Waking up in 0.9 seconds. >> Sending delayed reject for request 0 >> Waking up in 4.9 seconds. >> >> >> ----- Original Message ----- From: "Alan DeKok" >> <aland(a)deployingradius.com >> > >> To: "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org >> > >> Sent: Wednesday, May 14, 2008 11:51 PM >> Subject: Re: freeradius-2.0.3 not talking to mysql-5.1 >> >> >>> NPY wrote: >>>> I notice when running 'radiusd -X' that no module rlm_sql_mysql was >>>> loaded. Is that a problem? >>>> How do I resolve it? >>> >>> Ensure that the MySQL client libraries and headers are installed, and >>> then re-build the server. >>> >>> Also, un-comment the references to SQL in the configuration files. It >>> appears you haven't done that, so I have no idea why you would expect >>> it >>> to use SQL. >>> >>> If you do un-comment the reference to SQL in the config files, the >>> server will look for the MySQL libraries. If they've been built, the >>> server will use them. If not, it will complain. >>> >>> Alan DeKok. >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > >

1 0

freeradius-2.0.3 not talking to mysql-5.1
by NPY 14 May '08

14 May '08

Hi, I am struggling to get freeradius-2.0.3 to work with mysql-5.1.24 on a FreeBSD-7.0 machine. Basic PAP auth is working so radiusd is running fine. Below is the 'radiusd -X' output when I did a 'radtest joy happy localhost 1812 testing123' I notice when running 'radiusd -X' that no module rlm_sql_mysql was loaded. Is that a problem? How do I resolve it? Thanks, -Marcus ------------------------------------- FreeRADIUS Version 2.0.3, for host amd64-portbld-freebsd7.0, built on May 13 2008 at 14:48:48 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "freeradius" group = "freeradius" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. User-Name = "joy" User-Password = "happy" NAS-IP-Address = 123.242.231.112 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joy", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [joy/happy] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> joy attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds.

3 3

No authenticate method
by Jean Frontin 14 May '08

14 May '08

Hello, with the help of Alan I eliminated two errors but I always have the error mentioned in the subject. I persent the full log wher I begin the lines I don't understand by a star at the bottom of my mail. My question is : wher do I make a configuration error ? Thanks you for your help Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded Counter counter: filename = "/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 3001 rlm_counter: Current Time: 1210772270 [2008-05-14 15:37:50], Next reset 1210802400 [2008-05-15 00:00:00] Module: Instantiated counter (daily) Module: Loaded LDAP ldap: server = "ldap1.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7a380 Module: Instantiated ldap (ldap1) ldap: server = "ldap2.XXX.fr" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapread,ou=special,dc=XXX,dc=fr" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "our_password" ldap: basedn = "dc=XXX,dc=fr" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP carLicense mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT conns: 0xbae7aad0 Module: Instantiated ldap (ldap2) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 11.12.13.14:1896, id=3, length=47 User-Name = "xxxxxx" User-Password = "yyyyyy" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/141.115.16.72/auth-detail-20080514' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/141.115.16.72/auth-detail-20080514 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 * auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user * auth: Failed to validate the user. * Login incorrect: [xxxxxx/yyyyyy] (from client zzzzz port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 141.115.16.72 port 1896 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 482aeb39 Nothing to do. Sleeping until we see a request. -- Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

uninstall freeradius
by Kwok Sianbin 14 May '08

14 May '08

Hi, Thanks for keep assisting me. Right now I want to remove the freeradius from the server and re-intall version 2.0.4. For freeradius-2.0.2 and 2.05, I use CVS command to install it as mention in my previous email. So if I want to remove it by using what command? and for freeradius-1.1.7..I installed by downloaded the file freeradius-1.1.7.tar.bz2 from freeradius.org. I want to uninstall it also! Thanks in advance! ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 13, 2008 11:58:40 PM Subject: Re: EAP-TLS can't get connected..etc. Hi, > I installed the Freeradius 2.0.4 as Mr. Alan DeKok had suggested > I browse www.freeradius.org and run below command. > #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login > CVS password: anoncvs > nothing happen and return to # 'nothing' should happen as all you've done is log into a CVS session > #cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd this will download the latest CVS version - '2.0.5' from the main site into a directory called 'radiusd' - which will be put into whereever you were when you ran the command compile problems could be due to having the latest CVS code which might have a problem in it at any time. was there a specific reason not to use eg 2.0.4.tar.bz2 download from the freeradius.org site? > I checked the version in /usr/share/doc/radius/VERSION and it shows 2.0.2 (installed before) > Have I installed freeradius-2.0.4? not from what i've seen you type. what does eg 'radiusd -v' tell you? > If I want to uninstall or remove previous version such Freeradius-1.1.7 ..what command I should run or just simply delete the folder in Freeradius? how did you install it? from RPM or APT etc? or from source? if from source, you will need to look in the binary and library directories for all the files it will have installed...usually /location/to/bin/rad* /location/to/lib/rlm_* /local/to/lib/radius* and then a whole load of things in /usr/share/radius etc etc (just do eg 'make -n install' to see what it puts where. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1