- Freeradius-Users - lists.freeradius.org

Re: newbie on radiustesting, Buxey and Hood; Nº 2
by Si St 17 Apr '08

17 Apr '08

Probably getting tired of me, but I have tried out output with the different permissions by Hood and Buxey: Changing first certs and demoCA to 640 along with files thereof to 640 as originally, then: linux:/etc/raddb # find /etc/raddb/ -type d -exec chmod ug+x {} \; linux:/etc/raddb # radiusd -X > WOOD.log Then repeating the 640 things..., then: linux:/etc/raddb # chmod -R ugo+x /etc/raddb/certs linux:/etc/raddb # radiusd -X > BUXEY.log linux:/etc/raddb # cksum WOOD.log BUXEY.log 3877618374 5222 WOOD.log 3877618374 5222 BUXEY.log Does this mean that the permission settings by Hood only changing the ./certs and the ./demoCA directories from 640 (drwr-----) to 750 (drwxr-x--) suffices? In Hoods instance the files themselves remained 640. Remember the directories were originally 640 (quote from earlier message): > linux:/etc/raddb/certs # l > insgesamt 53 > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ./ ..................................... > ----- Original Message ----- > From: "Si St" <sigbj-st(a)operamail.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting, Buxey and Hood > Date: Thu, 17 Apr 2008 17:29:36 +0100 > > > By the way: > What would be the difference having the proposal of Andrew Hood performed: > > find /etc/raddb/ -type d -exec chmod ug+x {} \; > > compared to the proposal of Alan Buxey: > > chmod -R ugo+x /etc/raddb/certs > > I am not so familiar with the /-type d/ part of the find command > Would the result be the same? > > > .................................................. > > ----- Original Message ----- > > From: "Andrew Hood" <freeradius(a)andyhood.net> > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Subject: Re: newbie on radiustesting > > Date: Thu, 17 Apr 2008 13:34:08 +1000 > > > > > > Si St wrote: > > > > > linux:/etc/raddb/certs # l > > > insgesamt 53 > > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ./ > > > drwxr-xr-x 5 root root 728 2008-04-16 20:40 ../ > > > -rw-r----- 1 root radiusd 721 2005-09-13 04:15 cert-clt.der > > > -rw-r----- 1 root radiusd 1741 2005-09-13 04:15 cert-clt.p12 > > > -rw-r----- 1 root radiusd 2452 2005-09-13 04:15 cert-clt.pem > > > -rw-r----- 1 root radiusd 717 2005-09-13 04:15 cert-srv.der > > > -rw-r----- 1 root radiusd 1733 2005-09-13 04:15 cert-srv.p12 > > > -rw-r----- 1 root radiusd 2439 2005-09-13 04:15 cert-srv.pem > > > drw-r----- 2 root radiusd 200 2008-03-31 22:53 demoCA/ > > > -rw-r----- 1 root radiusd 0 2005-09-13 04:15 dh > > > -rw-r----- 1 root radiusd 2913 2005-09-13 04:15 newcert.pem > > > -rw-r----- 1 root radiusd 1753 2005-09-13 04:15 newreq.pem > > > -rw-r----- 1 root radiusd 1024 2005-09-13 04:15 random > > > -rw-r----- 1 root radiusd 431 2005-09-13 04:15 README > > > -rw-r----- 1 root radiusd 954 2005-09-13 04:15 root.der > > > -rw-r----- 1 root radiusd 1973 2005-09-13 04:15 root.p12 > > > -rw-r----- 1 root radiusd 2764 2005-09-13 04:15 root.pem > > > > > > linux:/etc/raddb/certs/demoCA # l > > > insgesamt 21 > > > drw-r----- 2 root radiusd 200 2008-03-31 22:53 ./ > > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ../ > > > -rw-r----- 1 root radiusd 1346 2005-09-13 04:15 cacert.pem > > > -rw-r----- 1 root radiusd 276 2005-09-13 04:15 index.txt > > > -rw-r----- 1 root radiusd 140 2005-09-13 04:15 index.txt.old > > > -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial > > > -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial.old > > > > Bad directory perms? > > > > umask 022 > > find /etc/raddb/ -type d -exec chmod ug+x {} \; > > > > -- > > REALITY.SYS not found: Universe halted. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > _______________________________________________ > Surf the Web in a faster, safer and easier way: > Download Opera 9 at http://www.opera.com > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

1 0

rlm_sql - Different table for User authentication
by rsg 17 Apr '08

17 Apr '08

Hi, I need to use a different auth table for Username/Password check. Here are the modifications I made into config. #raddb/sql.conf : authcheck_table = "authcheck" : . #raddb/sql/mysql/dialup.conf : . ## +++++++++ Here i retain the order of return data but omit some Attributes (2. Attr Name and 4.Attr Operation as described in Authorization Queries) +++++ authorize_check_query = "SELECT id, userid, passwd \ FROM ${authcheck_table} \ WHERE userid = '%{SQL-User-Name}' \ ORDER BY id" ## +++++++++++++I DID NOT TOUCH THE REPLY QUERY ++++++++++++++++++++++++++++++++++++++ authorize_reply_query = "SELECT id, username, attribute, value, op \ FROM ${authreply_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" : . When I tried to authenticate a user I get a segmentation fault as follows; ------ rlm_sql (sql): sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id, userid , password FROM authcheck WHERE userid = '%{SQL-User-Name}' ORDER BY id -> SELECT id, userid, password FROM authcheck WHERE login = 'test' ORDER BY id Segmentation fault ------ Are there any particular parameters/settings that i've missed here? Thanks for the suggestions. rg

4 4

rlm_ldap Auth-Type
by Christian Goebel 17 Apr '08

17 Apr '08

Hi, I have configured a FR 2.0.3 with eap-ttls with an authorize section in the inner-tunnel with the a ldap redundant-load-balance. In the ldap section the set_auth_type = yes is set but it only works if I put: update control { Auth-Type := LDAP } after the ldap in the inner-tunnel config, otherwise I will get an error: ------------- rlm_ldap: user ****** authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap1] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: ------------- Is this behaviour correct? Is that not the job of the rlm_ldap to set the Auth-Type if the set_auth_type is set? Or did I do this completely wrong? Thx, Christian -- Christian Goebel _______________________________________________ Centre de Technologie de l'Education 29 avenue John F. Kennedy L-1855 Luxembourg-Kirchberg tél.: +352 247-85975 fax: +352 333797 _______________________________________________

2 1

accouting detail
by Guillaume Chartrand 17 Apr '08

17 Apr '08

Hi, I'm using freeradius 2.0.3 and I want to make accounting with the detail module. I enable it in the accouting section and the detail module is defined in radiusd.conf Here is the accounting section in site-enabled/default file accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log attr_filter.accounting_response } Here is the detail section. Detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" } But I don't have any file like the detailfile described before. In my radaccdir I have only the sql-relay file. And I check all the debug output and the detail module or the rlm_detail is doesn't call anywhere but it's defined when I start the server. Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/det ail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } So why he doesn't make accounting. Can it be my AP who's doesn't send accounting packet? For my testing purpose I use a sample D-Link router. Thanks ---------------------------- Guillaume Chartrand Technicien informatique Cégep régional de Lanaudière Centre administratif, Repentigny (450) 470-0911 poste 7218

3 4

Re: newbie on radiustesting !
by Si St 17 Apr '08

17 Apr '08

> ----- Original Message ----- > From: "Si St" <sigbj-st(a)operamail.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting > Date: Thu, 17 Apr 2008 11:04:46 +0100 > > > > ----- Original Message ----- > > From: A.L.M.Buxey(a)lboro.ac.uk > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Subject: Re: newbie on radiustesting > > Date: Wed, 16 Apr 2008 21:52:38 +0100 > > > > > > Hi, > > > > > A: All running, both radiusd -X and rcradiusd start, is done as > > > root, and unfortunately all messages comes from the user root. > > > > okay. so definately a permission issue for a non root user. > > ...its late now so if noone else steps in you'll have to wait > > to hear from me again. (in radiusd.conf the user is set to > > radiusd, yes?) > > > > alan > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > YES, the user is set to radiusd in radiusd.conf: > > # user/group: The name (or #number) of the user/group to run radiusd as. > # > # If these are commented out, the server will run as the user/group > # that started it. In order to change to a different user/group, you > # MUST be root ( or have root privleges ) to start the server. > # > # We STRONGLY recommend that you run the server with as few permissions > # as possible. That is, if you're not using shadow passwords, the > # user and group items below should be set to 'nobody'. > # > # On SCO (ODT 3) use "user = nouser" and "group = nogroup". > # > # NOTE that some kernels refuse to setgid(group) when the value of > # (unsigned)group is above 60000; don't use group nobody on these systems! > # > # On systems with shadow passwords, you might have to set 'group = shadow' > # for the server to be able to read the shadow password file. If you can > # authenticate users while in debug mode, but not in daemon mode, it may be > # that the debugging mode server is running as a user that can read the > # shadow info, and the user listed below can not. > # > user = radiusd > group = radiusd > ....................................... > > By the way does this excerpt from the top page of radiusd.conf tell > anything about the problem? > > If the server builds and installs, but fails at execution time > # with an 'undefined symbol' error, then you can use the libdir > # directive to work around the problem. > # > # The cause is usually that a library has been installed on your > # system in a place where the dynamic linker CANNOT find it. When > # executing as root (or another user), your personal environment MAY > # be set up to allow the dynamic linker to find the library. When > # executing as a daemon, FreeRADIUS MAY NOT have the same > # personalized configuration. > > > ...Remembering now that the output of rcradiusd start with the > uncomment eap.conf\TLS partis: > > linux:/etc/raddb # rcradiusd start > Starting RADIUS daemon 8188:error:0200100D:system > library:fopen:Permission > denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') > 8188:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: > 8188:error:0B084002:x509 certificate > routines:X509_load_cert_crl_file:system lib:by_file.c:274: > startproc: exit status of parent of /usr/sbin/radiusd: 1 > failed > ....which is pretty much identical to the error messages from radiusd -X: > > 8215:error:0200100D:system library:fopen:Permission > denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') > 8215:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: > 8215:error:0B084002:x509 certificate > routines:X509_load_cert_crl_file:system lib:by_file.c:274: > rlm_eap_tls: Error reading Trusted root CA list > rlm_eap: Failed to initialize type tls > radiusd.conf[9]: eap: Module instantiation failed. > > Does this help you? WAIT A SEC! While changing the eap.conf by accident the group was changed to root instead staying on group radiusd.( I changed betw 2 files: the orig eap.conf and changed eap.conf) So after doing chgrp radiusd eap.conf now the error message has changed to this: linux:/etc/raddb # rcradiusd start Starting RADIUS daemon 8682:error:0200100D:system library:fopen:Permission denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') 8682:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: 8682:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:274: startproc: exit status of parent of /usr/sbin/radiusd: 1 failed REALLY SORRY FOR THIS, but I did not notice it immediately -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

SQL log accounting and post_auth
by Guillaume Chartrand 17 Apr '08

17 Apr '08

Hi, I want to log accounting information and post-auth information in my sql database. I have an MSSQL database. In my accounting section I uncomment sql and sql_log. In post_auth section I uncomment sql and sql_log too. Here is the result I receive with debug mode Login OK: [guillaume\000/<via Auth-Type = EAP>] (from client AP1 port 1 cli 00-0E-35-99-F3-E9) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> guillaume rlm_sql (sql): sql_set_user escaped user --> 'guillaume' ++[sql] returns noop rlm_sql_log (sql_log): Processing sql_log_postauth expand: %{User-Name} -> guillaume expand: %{%{User-Name}:-DEFAULT} -> guillaume rlm_sql_log (sql_log): sql_set_user escaped user --> 'guillaume' WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('guillaume', 'Chap-Password', 'Access-Accept', '2008-04-16 09:40:46'); expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok MS-MPPE-Recv-Key = 0xddbdd27124caa81a4d0abacd8aa22d99cff95b591717efff32054bbeec88959c MS-MPPE-Send-Key = 0x1326576688892a9369c4e6f3246aca4a65b572b1767232847b10a93935535b70 EAP-Message = 0x034f0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "guillaume" Finished request 9. So why the sql module return noop... And didn't insert anything in my table. With the sql_log module, I've just insert the post_auth command, not the other, but in my sql_log section I have other thing like that. sql_log { path = "${radacctdir}/sql-relay" acct_table = "radacct" postauth_table = "radpostauth" sql_user_name = "%{%{User-Name}:-DEFAULT}" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S');" } And for the warning for := I look in man unlang but I didn't find where to change the := in the sql_log module The sql_relay file contains this line INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('guillaume', 'Chap-Password','Access-Accept', '2008-04-16 10:04:59'); And if I take that line and put in my sql query, it's work and succcesfully insert the info Thanks ---------------------------- Guillaume

2 7

Re: newbie on radiustesting
by Si St 17 Apr '08

17 Apr '08

> ----- Original Message ----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting > Date: Wed, 16 Apr 2008 21:52:38 +0100 > > > Hi, > > > A: All running, both radiusd -X and rcradiusd start, is done as > > root, and unfortunately all messages comes from the user root. > > okay. so definately a permission issue for a non root user. > ...its late now so if noone else steps in you'll have to wait > to hear from me again. (in radiusd.conf the user is set to > radiusd, yes?) > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html YES, the user is set to radiusd in radiusd.conf: # user/group: The name (or #number) of the user/group to run radiusd as. # # If these are commented out, the server will run as the user/group # that started it. In order to change to a different user/group, you # MUST be root ( or have root privleges ) to start the server. # # We STRONGLY recommend that you run the server with as few permissions # as possible. That is, if you're not using shadow passwords, the # user and group items below should be set to 'nobody'. # # On SCO (ODT 3) use "user = nouser" and "group = nogroup". # # NOTE that some kernels refuse to setgid(group) when the value of # (unsigned)group is above 60000; don't use group nobody on these systems! # # On systems with shadow passwords, you might have to set 'group = shadow' # for the server to be able to read the shadow password file. If you can # authenticate users while in debug mode, but not in daemon mode, it may be # that the debugging mode server is running as a user that can read the # shadow info, and the user listed below can not. # user = radiusd group = radiusd ....................................... By the way does this excerpt from the top page of radiusd.conf tell anything about the problem? If the server builds and installs, but fails at execution time # with an 'undefined symbol' error, then you can use the libdir # directive to work around the problem. # # The cause is usually that a library has been installed on your # system in a place where the dynamic linker CANNOT find it. When # executing as root (or another user), your personal environment MAY # be set up to allow the dynamic linker to find the library. When # executing as a daemon, FreeRADIUS MAY NOT have the same # personalized configuration. ...Remembering now that the output of rcradiusd start with the uncomment eap.conf\TLS partis: linux:/etc/raddb # rcradiusd start Starting RADIUS daemon 8188:error:0200100D:system library:fopen:Permission denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') 8188:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: 8188:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:274: startproc: exit status of parent of /usr/sbin/radiusd: 1 failed ....which is pretty much identical to the error messages from radiusd -X: 8215:error:0200100D:system library:fopen:Permission denied:bss_file.c:104:fopen('/etc/raddb/certs/demoCA/cacert.pem','r') 8215:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:109: 8215:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:274: rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed. Does this help you? -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

LDAP module problem in 2.0.3
by Jason Alderfer 17 Apr '08

17 Apr '08

Hello, I'm testing upgrading to 2.0.3 from 1.1.7 and it appears that the LDAP module in 2.0.3 is not setting the Ldap-UserDn in a way that is available for further analysis. The problem shows up when using "edir_account_policy_check = yes" and PEAP. This is the error from the debug output. +- entering group post-auth rlm_ldap: User's FQDN not in config items list. ++[ldap] returns fail PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE The problem also shows up when checking the Ldap-UserDn with unlang or from the Files module. Here is my unlang config and the resulting error. if (Ldap-UserDn =~ /ou=is,ou=n,o=emu/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 3 } } Error: ++? if (Ldap-UserDn =~ /ou=is,ou=n,o=emu/i) (Attribute Ldap-UserDn was not found) Here is the users file config I use in version 1.1.7. It also does not work in 2.0.3; the files module returns noop. DEFAULT Ldap-UserDn =~ "ou=is,ou=n,o=emu" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 3 I've tried setting both "copy_request_to_tunnel = yes" and "use_tunneled_reply = yes" but it makes no difference. I looked at the source file rlm_ldap.c and found this code at line 1306: /* * Adding new attribute containing DN for LDAP object associated with * given username */ pairadd(check_pairs, pairmake("Ldap-UserDn", user_dn, T_OP_EQ)); But in the code for version 1.1.7 the line is pairadd(&request->packet->vps, pairmake("Ldap-UserDn", user_dn, T_OP_EQ)); If I change it to the old way, everything works. Is this a bug in 2.0.3 or might I have overlooked a configuration detail? Jason

3 5

Re: exec-program-wait problem with freeradius 2.0.3
by Emmanuel Willems 17 Apr '08

17 Apr '08

2 1

Re: newbie on radiustesting
by Si St 17 Apr '08

17 Apr '08

> ----- Original Message ----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting > Date: Wed, 16 Apr 2008 19:37:44 +0100 > > > Hi, > > > linux:/etc/raddb # id radiusd > > uid=105(radiusd) gid=104(radiusd) Gruppen=104(radiusd) > > > > ls -l: > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 certs/ > > and the files within? > > alan The files within seem to have the same permission setup: linux:/etc/raddb/certs # l insgesamt 53 drw-r----- 3 root radiusd 472 2008-03-31 22:53 ./ drwxr-xr-x 5 root root 728 2008-04-16 20:40 ../ -rw-r----- 1 root radiusd 721 2005-09-13 04:15 cert-clt.der -rw-r----- 1 root radiusd 1741 2005-09-13 04:15 cert-clt.p12 -rw-r----- 1 root radiusd 2452 2005-09-13 04:15 cert-clt.pem -rw-r----- 1 root radiusd 717 2005-09-13 04:15 cert-srv.der -rw-r----- 1 root radiusd 1733 2005-09-13 04:15 cert-srv.p12 -rw-r----- 1 root radiusd 2439 2005-09-13 04:15 cert-srv.pem drw-r----- 2 root radiusd 200 2008-03-31 22:53 demoCA/ -rw-r----- 1 root radiusd 0 2005-09-13 04:15 dh -rw-r----- 1 root radiusd 2913 2005-09-13 04:15 newcert.pem -rw-r----- 1 root radiusd 1753 2005-09-13 04:15 newreq.pem -rw-r----- 1 root radiusd 1024 2005-09-13 04:15 random -rw-r----- 1 root radiusd 431 2005-09-13 04:15 README -rw-r----- 1 root radiusd 954 2005-09-13 04:15 root.der -rw-r----- 1 root radiusd 1973 2005-09-13 04:15 root.p12 -rw-r----- 1 root radiusd 2764 2005-09-13 04:15 root.pem linux:/etc/raddb/certs/demoCA # l insgesamt 21 drw-r----- 2 root radiusd 200 2008-03-31 22:53 ./ drw-r----- 3 root radiusd 472 2008-03-31 22:53 ../ -rw-r----- 1 root radiusd 1346 2005-09-13 04:15 cacert.pem -rw-r----- 1 root radiusd 276 2005-09-13 04:15 index.txt -rw-r----- 1 root radiusd 140 2005-09-13 04:15 index.txt.old -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial.old ....................................... More output: What I have done now is to start the radiusd with /rcradiusd start/ first with the uchanged eap.conf, and then copy the uncommented eap.conf(EAP-TLS_Part) back to where it should be and run /radeapclient/ in debugmode: Does the rlm_eap message tell you anything: linux:/etc/raddb # radeapclient -x -f /usr/share/doc/packages/freeradius/tmp/radius.test 127.0.0.1:1812 auth testing123 +++> About to send encoded packet: User-Name = "qvnu" User-Password = "ygd" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" Sending Access-Request of id 244 to 127.0.0.1:1812 User-Name = "qvnu" User-Password = "ygd" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" Re-sending Access-Request of id 244 to 127.0.0.1:1812 User-Name = "qvnu" User-Password = "\351\371V6$\024\t\315\263\271.\037\003\311\325\320" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=244, length=20 rlm_eap: EAP-Message not found <+++ EAP decoded packet: +++> About to send encoded packet: User-Name = "eaoqk" User-Password = "uroco" NAS-IP-Address = 127.0.0.1 -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

3 2