- Freeradius-Users - lists.freeradius.org

FreeRadius question
by Harley Race 18 Feb '08

18 Feb '08

Ladies and Gentlemen, I am trying to find out how I can check what options the freeradius binary available for download was compiled with. I have STFW and RTFM, but still am not sure as to how to check. radiusd -X gives some information, but nothing about what freeradius was compiled with. I am interested in finding out if the binary was compiled with e-Directory support. Thanks for any help. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

3 2

SMUX not registering with FreeRadius 1.1.7 and SNMP 5.1.2 after radiusd -X
by shrinivas alageri 18 Feb '08

18 Feb '08

Hello I wanted to integrate SMUX aith FreeRadius with above version. Tried the steps 1)Compiling FreeRadius with snmp option 2. modified the freeradius snmp.conf file to include smux_password = verysecret 2. modified the radiusd.conf file with snmp = yes $INCLUDE ${confdir}/snmp.conf 3. modified the net-snmp snmpd.conf file to include smuxpeer = 1.3.6.1.4.1.3317.1.3.1 verysecret 4. started the radiusd and snmpd daemons. When I do an 'snmpwalk -v1 -c public localhost system' I get the system info from the MIB (as expected). When I do radiusd -X no SMUX message is displayed Please help Thanks Shrinivas --------------------------------- Now you can chat without downloading messenger. Click here to know how.

1 0

Re: Re: 1.1.7 and rlm_sql_mysql duplicated query
by Georgi Alexandrov 18 Feb '08

18 Feb '08

>Santiago Balaguer García wrote: >> The answer is not totally correct. Because a microcuts in the >> connectibity of hotspot cause that hotspot re-sends the acct request. > >No, because then the Acct-Session-Id would remain the same. > >> In that case, you have to desactivate: >> - accounting_start_query_alt >> - accounting_stop_query_alt > >No. Re-read the original post. The Acct-Session-Id is different, hence 2 >sessions are being inserted into SQL, but no Accounting-Stop ever gets >send for the 1st. > >The NAS is misbehaving. > The problem was in the NAS itself indeed and not in freeradius. Thanks.

1 0

Query regarding Cluster configuration of Radius server
by Kartik CDS 18 Feb '08

18 Feb '08

Hello, I have a cluster setup of radius server. The cluster having ip adress as VIP and the cluster members are having IP1 and IP2. Radius client sends access-request to the ip address VIP The cluster is responding with IP1 or IP2 instead of VIP as the source address, should the radius client allow such a response ? I mean to say whether the radius client should validate the source address ?? [ I couldnt find anything related to this in the RFC, kindly help] Regards, Kartik

3 3

FreeRadius and LDAP/AD username/password check
by Mats Blomgren B 18 Feb '08

18 Feb '08

Hi, Today I check the "etc/passwd" for the usernames and passwords and fetches the users default group from "etc/passwd". In the "users" file I have the rights for each group. My current config: OS: Solaris 10 FreeRadius: 1.1.7 Mysql: 5.0.51 - For logging and NAS clients OS packages installed: db-4.2.52.NC-sol9-sparc-local OS packages installed: freeradius-1.1.7-sol10-sparc-local OS packages installed: gcc-3.4.6-sol10-sparc-local OS packages installed: gdbm-1.8.3-sol9-sparc-local OS packages installed: libiconv-1.11-sol10-sparc-local OS packages installed: libtool-1.5.24-sol10-sparc-local OS packages installed: make-3.81-sol10-sparc-local OS packages installed: mysql-5.0.51-sol10-sparc-local OS packages installed: ncurses-5.6-sol10-sparc-local OS packages installed: netsnmp-5.4.1-sol10-sparc-local OS packages installed: openldap-2.3.35-sol10-sparc-local OS packages installed: openssl-0.9.8f-sol10-sparc-local OS packages installed: perl-5.8.8-sol10-sparc-local OS packages installed: sasl-2.1.21-sol10-sparc-local OS packages installed: zlib-1.2.3-sol10-sparc-local OS packages installed: Freeradius: 1.1.7 #etc/passwd testuser:x:103:500:Test User:/home/testuser:/bin/bash #etc/group admin-network::500: user-network::600: #/usr/local/etc/raddb/users DEFAULT Group == "admin-network", Auth-Type = System Service-Type = Administrative-User, Fall-Through = No #/usr/local/etc/raddb/huntgroups defaultgroup NAS-IP-Address == 192.168.1.20 Group = admin-network, Group = user-network Today the user "testuser" would get Administrative rights on the nas with IP=192.168.1.20 since he is a member of the group "admin-network". I have been browsing the mailing list, wiki and google trying to find out if anyone has done the following: 1. I want to check the username/password against LDAP/AD instead of directly towards "etc/passwd". 2. After that I would like to continue by fetching the user's default group from the Solaris 10 system (/"etc/passwd") to give it rights depending on which group the user belongs to. 3. I know that this means I still have to have the username in the "/etc/passwd" but this will keep the users from having different logins in our infrastructure. Best regards Mats Blomgren B - IP Engineer

2 1

1.1.7 and rlm_sql_mysql duplicated query
by Georgi Alexandrov 18 Feb '08

18 Feb '08

Hello, I'm seeing duplicated queries made to the database when any (linux/pppoe) user logs in through freeradius 1.1.7. Log from mysql logger: 646 Query INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('47B769162F4300', '66cf2392669a4dc6', 'time160', '', 'xx.xx.xxx.22', '0', 'Async', '2008-02-17 00:52:10', '0', '0', 'RADIUS', '', '', '0', '0', '', '00:13:20:xx.xx.xx', '', 'Framed-User', 'PPP', 'xx.xx.xxx.110', '0', '0', '') 645 Query INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('47B7691A2F4301', '82cd8d24e280bd07', 'time160', '', 'xx.xx.xx.22', '0', 'Async', '2008-02-17 00:52:10', '0', '0', 'RADIUS', '', '', '0', '0', '', '00:13:20:xx.xx.xx', '', 'Framed-User', 'PPP', 'xx.xx.xx.110', '0', '0', '') After user logs off the following query is passed to mysql: 080217 0:54:21 663 Query UPDATE radacct SET AcctStopTime = '2008-02-17 00:54:21', AcctSessionTime = '135', AcctInputOctets = '0' << 32 | '2556', AcctOutputOctets = '0' << 32 | '1486', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '47B7691A2F4301' AND UserName = 'time160' AND NASIPAddress = 'xx.xx.xx.22' So when the user logs I have two queries inserting similar data with different sessions ids: 47B7691A2F4300 and 47B7691A2F4301 And when the user logs off I have only one query that notes the action in the database for session 47B7691A2F4301. So generally I get one "hanging" session in radacct table for a particular user where AcctStopTime is null. sql.conf is a default one with only db connect info changed. Tried to remove some of the insert statements but the only result I'm getting is no insert statement in radacct table at all or the double insert statement pointed above. I would really appreciate some guidance from this point on as I'm pretty much out of ideas. Thanks upfront

3 3

vocera(with Peap)+AP+freeRADIUS
by Hangjun He 18 Feb '08

18 Feb '08

Hi, I am using freeRADIUS 1.1.7. Notebook with odyssey client (peap mschap-v2) can talk to freeRADUS well. But when I use Vocera client, which can support peap + mschap-v2, It does not work. debug message (see more debug message in attachment): ... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=55, length=233 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020a003919800000002f14030100010116030100248393f1d6391a86ab0605df998e0336f7c651a560328bf621b1ddebbfad332d8ea8796c49 State = 0xfd6f3b2761e20233acdc5d29ec63d11f Message-Authenticator = 0xc4ee170f5d47ee55bead80b4a36580cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 40 modcall[authorize]: module "preprocess" returns ok for request 40 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 40 modcall[authorize]: module "chap" returns noop for request 40 modcall[authorize]: module "mschap" returns noop for request 40 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 40 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 40 rlm_eap: EAP packet type response id 10 length 57 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 40 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 40 modcall: leaving group authorize (returns updated) for request 40 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 40 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 40 modcall: leaving group authenticate (returns reject) for request 40 auth: Failed to validate the user. Delaying request 40 for 1 seconds Finished request 40 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=56, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0x834864649ecf9fba4cbd71673b5bb042 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 41 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 41 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns ok) for request 41 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 41 for 1 seconds Finished request 41 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=57, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0xfe7dea9b1f1eb6e620980f6f09a97012 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 42 modcall[authorize]: module "chap" returns noop for request 42 modcall[authorize]: module "mschap" returns noop for request 42 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 42 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 42 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 42 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 42 modcall: leaving group authorize (returns ok) for request 42 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 42 for 1 seconds Finished request 42 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 51 to 10.50.1.38 port 1034 Sending Access-Reject of id 55 to 10.50.1.38 port 1034 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject of id 56 to 10.50.1.38 port 1034 --------------------------------- 雅虎邮箱传递新年祝福，个性贺卡送亲朋！ rad_recv: Access-Request packet from host 10.50.1.38:1034, id=51, length=184 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0205000819801503 State = 0xe84cfd135516709bf6abae7113b60657 Message-Authenticator = 0xa133f6434f2160a46099f9e0b27ed064 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 36 modcall[authorize]: module "preprocess" returns ok for request 36 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 36 modcall[authorize]: module "chap" returns noop for request 36 modcall[authorize]: module "mschap" returns noop for request 36 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 36 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 36 rlm_eap: EAP packet type response id 5 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 36 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 36 modcall: leaving group authorize (returns updated) for request 36 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 36 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 36 modcall: leaving group authenticate (returns invalid) for request 36 auth: Failed to validate the user. Delaying request 36 for 1 seconds Finished request 36 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=52, length=168 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0207000a016c77616e67 Message-Authenticator = 0xd91d607c57472b2b534944a8d6630d0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 37 modcall[authorize]: module "preprocess" returns ok for request 37 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 37 modcall[authorize]: module "chap" returns noop for request 37 modcall[authorize]: module "mschap" returns noop for request 37 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 37 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 37 rlm_eap: EAP packet type response id 7 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 37 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 37 modcall: leaving group authorize (returns updated) for request 37 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 37 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 37 modcall: leaving group authenticate (returns handled) for request 37 Sending Access-Challenge of id 52 to 10.50.1.38 port 1034 EAP-Message = 0x0108001604104a82c158ba7bb7e572bf085b0ae2a3ce Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b52e8b66679defae03d024f61db78a4 Finished request 37 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=53, length=184 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0208000803199fbb State = 0x5b52e8b66679defae03d024f61db78a4 Message-Authenticator = 0xf6e209d24fc80cc9a970212ec3452143 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 38 modcall[authorize]: module "preprocess" returns ok for request 38 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 38 modcall[authorize]: module "chap" returns noop for request 38 modcall[authorize]: module "mschap" returns noop for request 38 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 38 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 38 rlm_eap: EAP packet type response id 8 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 38 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 38 modcall: leaving group authorize (returns updated) for request 38 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 38 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 38 modcall: leaving group authenticate (returns handled) for request 38 Sending Access-Challenge of id 53 to 10.50.1.38 port 1034 EAP-Message = 0x010900061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1f71ceb729cf8dd843503ad3d1143fbd Finished request 38 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=54, length=270 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0209005e198000000054160301004f0100004b030100000b2e660b4d53b6904c9388b8333940d93bc9ddd92253aab97b6a046d003d2039ea6005dca4832f4ca678e7364aa617fa1a73d878d6d18fadd5214fe89e87d30004000500040100 State = 0x1f71ceb729cf8dd843503ad3d1143fbd Message-Authenticator = 0x9a47dcdd414b0e3405f5ba80472d5996 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 39 rlm_eap: EAP packet type response id 9 length 94 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 004f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read finished A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 39 modcall: leaving group authenticate (returns handled) for request 39 Sending Access-Challenge of id 54 to 10.50.1.38 port 1034 EAP-Message = 0x010a00841900160301004a02000046030147b20435b84f8a3cf519ad0182abd419e199aedc74339134db68fdaded807fb22039ea6005dca4832f4ca678e7364aa617fa1a73d878d6d18fadd5214fe89e87d30005001403010001011603010024ca6d41fd9f4101a29f5cf01683b78485d2275ea68bc1b30b0c5b0e7021280ae33c84373b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd6f3b2761e20233acdc5d29ec63d11f Finished request 39 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=55, length=233 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020a003919800000002f14030100010116030100248393f1d6391a86ab0605df998e0336f7c651a560328bf621b1ddebbfad332d8ea8796c49 State = 0xfd6f3b2761e20233acdc5d29ec63d11f Message-Authenticator = 0xc4ee170f5d47ee55bead80b4a36580cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 40 modcall[authorize]: module "preprocess" returns ok for request 40 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 40 modcall[authorize]: module "chap" returns noop for request 40 modcall[authorize]: module "mschap" returns noop for request 40 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 40 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 40 rlm_eap: EAP packet type response id 10 length 57 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 40 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 40 modcall: leaving group authorize (returns updated) for request 40 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 40 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 40 modcall: leaving group authenticate (returns reject) for request 40 auth: Failed to validate the user. Delaying request 40 for 1 seconds Finished request 40 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=56, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0x834864649ecf9fba4cbd71673b5bb042 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 41 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 41 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns ok) for request 41 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 41 for 1 seconds Finished request 41 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.50.1.38:1034, id=57, length=156 User-Name = "lwang" NAS-IP-Address = 10.50.1.38 NAS-Identifier = "QA-AP1-21f0" NAS-Port = 0 Called-Station-Id = "00-19-77-00-21-F5:vocera_test" Calling-Station-Id = "00-16-41-F7-F7-75" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0xfe7dea9b1f1eb6e620980f6f09a97012 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail-20080212' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/auth-detail-20080212 modcall[authorize]: module "auth_log" returns ok for request 42 modcall[authorize]: module "chap" returns noop for request 42 modcall[authorize]: module "mschap" returns noop for request 42 rlm_realm: No '@' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 42 rlm_realm: No '\' in User-Name = "lwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 42 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 42 users: Matched entry lwang at line 95 modcall[authorize]: module "files" returns ok for request 42 modcall: leaving group authorize (returns ok) for request 42 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 42 for 1 seconds Finished request 42 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 51 to 10.50.1.38 port 1034 Sending Access-Reject of id 55 to 10.50.1.38 port 1034 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject of id 56 to 10.50.1.38 port 1034

2 1

Re: 2 different authorization?
by Evgeney Bakhtin 18 Feb '08

18 Feb '08

Hello, I just need to configure FreeRadius to manage auth & acct for 2 different users too. I have create 2 instances of the sql module, in my sql.conf: sql instance1 { ... } sql instance2 { ... } But I don't understand how and where I can use this instances. In radiusd.conf I have: [authorize] { ... instance1 ... } [accounting] { ... instance1 ... } Where I need to indicate different sql instances for different users? Regards, Evgeney Bakhtin.

1 0

Wifi and Client-Side authentication
by Bill Farina 18 Feb '08

18 Feb '08

Here's the scenario, I have a Linksys WRT54GS running DD-WRT RC5 which is fully configured for Radius. I have a small FreeBSD server running FreeRadius-1.1.7_2. HTTPD (or Apache) has not been installed on the system and in it's current configuration would be difficult to do so. The BSD box is also running PAP which makes it very easy to configure accounts and it's a account creation method that I'm familiar and comfortable with. The two machines are currently communicating. What I'm trying to do is figure out a way that I can authenticate enduser machines using this setup. What I would like to see is upon the initial login attempt, a popup comes up and asks for username and password. From that point on, everything would be automatic on the user-side and individual client machines would store all of the login information. I'm not opposed to adding software to client machines to facilitate the login.

3 2

rlm_python & freeradiusd 2.0.2
by Alexander Demidoff 17 Feb '08

17 Feb '08

Hello all! I want to use python possibilities to authorize users with freeradius. So, I compiled freeradius with options: --with-experimental-modules \ --with-rlm_python created config files and my pythom module "radiusd_isp", put it python path freeradius -X out me: python { mod_instantiate = "radiusd_isp" func_instantiate = "instantiate" mod_authorize = "radiusd_isp" func_authorize = "authorize" mod_authenticate = "radiusd_isp" func_authenticate = "authenticate" mod_preacct = "radiusd_isp" func_preacct = "preacct" mod_accounting = "radiusd_isp" func_accounting = "accounting" mod_detach = "radiusd_isp" func_detach = "detach" } exceptions.ImportError: No module named radiusd_isp Failed to import python module "radiusd_isp" /etc/freeradius/python.conf[32]: Instantiation failed for module "python" /etc/freeradius/radiusd.conf[1824]: Failed to find module "python". /etc/freeradius/radiusd.conf[1793]: Errors parsing authorize section. help me anybody, please !?

3 5