- Freeradius-Users - lists.freeradius.org

mod_auth_radius question
by Jeremiah Millay 11 Feb '08

11 Feb '08

I have a question regarding mod_auth_radius which doesn't seem to be addressed by the included documentation or anything I have found with a google search. When configuring the module in the apache configuration (I'm using the latest 1.3 branch) is it possible to specify more than one radius server so that it will fail over in the even that the first is down? Something like this: <IfModule mod_auth_radius.c> # # AddRadiusAuth server[:port] <shared-secret> [ timeout [ : retries ]] # AddRadiusAuth server1.example.com:1645 secret 5:3 AddRadiusAuth server2.example.com:1645 secret 5:3 AddRadiusCookieValid 60 </IfModule> It seems as though this doesn't work or it wants to use only the last one specified. Am I missing something? Anybody have experience trying to use this module in a similar setup? It would be great to be able to get this working with both of my radius servers. Thanks in advance! Jeremiah

1 0

rlm_perl with huge load (~1000-1500 request per minute)
by John S. Doe 11 Feb '08

11 Feb '08

Hello! i use freeradiusd 1.7, rlm_perl with thread conf: thread pool { start_servers = 100 max_servers = 1500 min_spare_servers = 1 max_spare_servers = 10 max_requests_per_server = 10 } rlm_sql uses mysql. All works fine, but sometime, at moment with high load: Error: Discarding duplicate request from client nas_4:63429 - ID: 154 due to unfinished request 2176280 and radiusd like "frozen", take 99% of CPU time, and not response for client's request. FreeBSD 6.3, Hardware is adequate - 2xXeon with 2 Gb Ram. any ideas? Tnx. -- WBR, John mailto:test@bi.com.ua

4 3

Using freeradius integrated with Active Directory to autenticate cisco passwords
by Fernando Coelho 11 Feb '08

11 Feb '08

Hi All! I have several cisco routers and would like to authenticate the logins. For it I am using the following tutorial: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO when I try to authenticate using: bandeira:/etc/raddb # /usr/bin/ntlm_auth --request-nt-key --username=jonny --domain=CELULAR password: NT_STATUS_OK: Success (0x0) It works fine. But when I try with: bandeira:/etc/raddb # /usr/bin/ntlm_auth --request-nt-key --username=jonny --domain=CELULAR --challenge=6151ad29f27eff47 --nt-response=01e42eabc464bf9915883d804457069d4702d95534ce4d53 Logon failure (0xc000006d) I does not work. Also when I try to login in to a router, it shows the log bellow: rad_recv: Access-Request packet from host 10.131.23.252:1645, id=84, length=79 NAS-IP-Address = 10.131.23.252 NAS-Port = 11 NAS-Port-Type = Virtual User-Name = "jonny" Calling-Station-Id = "10.131.23.253" User-Password = "xxxxxx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jonny", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 163 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [jonny/xxxxx] (from client 10.131.23.252 port 11 cli 10.131.23.253) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 84 to 10.131.23.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 84 with timestamp 47a370cf Nothing to do. Sleeping until we see a request. Could any one help me? Or at least indicate me a how to that works? I want to authenticate logins in to routers/switchs cisco in a freeradius integrated with a active directory. Thank you. Fernando

7 12

segmentation fault over perl script.
by Oguzhan Kayhan 11 Feb '08

11 Feb '08

hello i am trying to install freeradius over debian with perl support. I am running the same config with same perl script over ubuntu. I compiled 1.1.7 version, copied config files and script to same folder. and when i try to run it i get the folllowing output. Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded perl Module: Instantiated perl (perl) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to chilli@192.168.10.10:/wireless rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp ------------ It starts waiting here.. When any request submits.. I just receive a message as Segmentation Fault and radiusd quits. I know this script is working without any problem. And the config file is also ok. But i couldnt find the problem Any help would be great.

1 1

Configuring radrelay using proxy.conf in v2.0.1
by Ryan 10 Feb '08

10 Feb '08

Dear Everyone, Need some advise/help on configuring the proxy.conf to replicate the radrelay function that was available in v1.1.3. However was not able to find any information so far as the radrelay has been deprecated in v2.0.1. Previously I had use "/usr/local/bin/radrelay -n name_of_radius_server detail-combined -f" to relay the details to another radius server. How will the configuration be done in proxy.conf in v2.0.1? Thanks/Regards, Ryan

3 6

Freeradius2 and proxing
by Vincent Magnin 10 Feb '08

10 Feb '08

In freeradius 1, if I need to proxy requests whose realm are remote, I put the following in proxy.conf: > realm DEFAULT { > type = radius > authhost = remote.server1.com:1812 > accthost = remote.server1.com:1813 > secret = **************** > ldflag = round_robin > nostrip } > > realm DEFAULT { > type = radius > authhost = remote.server2.com:1812 > accthost = remote.server2.com:1813 > secret = **************** > ldflag = round_robin > nostrip > } I've tried to put the same lines in my freeradius2 config file and it does not work as expected: radius -X output: rlm_realm: Looking up realm "extern.realm.com" for User-Name = "anonymous(a)extern.realm.com" rlm_realm: No such realm "extern.realm.com" Then, the request is done locally. If I put in my proxy.conf file this domain explicitely, it works fine: > realm extern.realm.com { > type = radius > authhost = remote.server2.com:1812 > accthost = remote.server2.com:1813 > secret = **************** > ldflag = round_robin > nostrip > } radius -X output: rlm_realm: Looking up realm "extern.realm.com" for User-Name = "anonymous(a)extern.realm.com" rlm_realm: Found realm "extern.realm.com" rlm_realm: Proxying request from user anonymous to realm extern.realm.com rlm_realm: Adding Realm = "extern.realm.com" rlm_realm: Preparing to proxy accounting request to realm "extern.realm.com" Regards, Vincent Magnin

3 6

lower password in new freeradius versions
by Asaad 10 Feb '08

10 Feb '08

In previous versions of radiusd.conf there has been: lower_user = after lower_pass = after but i cant find like this at FreeRADIUS Version 2.0.1 Is this feature replaced with new one ? what i can used to lower passwords thansk for help _________________________________________________________________ Shed those extra pounds with MSN and The Biggest Loser! http://biggestloser.msn.com/

2 1

RE: Newslists
by Keith Dovale - HostworX.co.za 10 Feb '08

10 Feb '08

I did explain what I was trying to do with the failover and the attr_rewrite function, what more can a person say about the attrib rewrite, other than the attribute rewrite is supposed to check for an attribute in a packet in this case the reply packet, if it finds the attribute, change it and basically carry on But when it checks for the attribute in the reply packet, it says it can't find it, but it still does the attrib-rewrite changes the values and then moans it couldn’t find the value pair. This is obviously not normal in my opinion, and thus I asked about a specific problem. I only attached the debug portion as it is specific to the problem. When you take your car to the garage for a brake problem, you don’t explain how the engine, fan, wheels, boot opener works, you say the car does not stop when I push the breaks. If the mechanic asks for more info then you tell him. rlm_attr_rewrite: No match found for attribute Configuration-Token with > value 'SHAPED_NORMAL' > > radius_xlat: 'UNSHAPED_NORMAL' > > radius_xlat: 'SHAPED_NORMAL' > > rlm_attr_rewrite: Changed value for attribute Configuration-Token from > 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' > > rlm_attr_rewrite: Could not find value pair for attribute > Configuration-Token Regards Keith Dovale -----Original Message----- From: freeradius-users-bounces+keith=hostworx.co.za(a)lists.freeradius.org [mailto:freeradius-users-bounces+keith=hostworx.co.za@lists.freeradius.org] On Behalf Of Edvin Seferovic Sent: Friday, February 08, 2008 12:14 PM To: 'FreeRadius users mailing list' Subject: RE: Newslists Constructive answer like always is to analyze what you want to achieve with freeradius. Rethink the configuration, read the documentation for you setup needs and ask straight-forward question. You cannot just post the debug output and hope that someone can understand what you actually need. Try to elaborate your setup, the steps you have already done and of course the debugging output. Alan will probably give you simple answer like yes/no and point to the right direction. But again - you cannot expect someone to do the installation and setup for you ! People are usually paid for that ! Although Alan might be sarcastic, he has never let anyone down who was willing to learn and accept the mistakes ( including myself ). Regards, E:S -----Original Message----- From: freeradius-users-bounces+edvin.seferovic=kolp.at(a)lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic=kolp.at@lists.freeradius.org] On Behalf Of Keith Dovale - HostworX.co.za Sent: Freitag, 08. Februar 2008 10:46 To: 'FreeRadius users mailing list' Subject: RE: Newslists No not at all, and I don’t expect it. But at least someone like yourself, who seems to be the guru on freeradius, could at least reply with a constructive answer rather than replying with sarcastic comments. My question is where did I announce I don’t read the documentation that is the first thing I went to. I have gone through the read me's, faq's etc and have followed their directions regarding this, it’s the debug that is giving the error. And responding with weird checks, that is exactly why I posted here as there is no google results / faqs, etc that answer my question. Regards Keith -----Original Message----- From: freeradius-users-bounces+keith=hostworx.co.za(a)lists.freeradius.org [mailto:freeradius-users-bounces+keith=hostworx.co.za@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, February 08, 2008 9:44 AM To: FreeRadius users mailing list Subject: Re: Newslists Keith Dovale - HostworX.co.za wrote: > My Honest opinion of this news list / user group is that it is not > helpful at all, it seems if you are not in the click, no one helps, does > anyone moderate this or not ? I have posted twice now and no one replies… Is there a contractual obligation requiring people to support you? In any case, you haven't followed the instructions in the FAQ, README, INSTALL, etc. You've already announced that you don't read the documentation people write, so why would anyone write more on this list? > > > Regards > > > > Keith > > > > *From:* Keith Dovale - HostworX.co.za [mailto:keith@HostworX.co.za] > *Sent:* Thursday, February 07, 2008 9:08 PM > *To:* ' > *Subject:* attr rewrite issue > > > > Hi Guys, some help please . > > > > I am trying to do a attr rewrite to change an Attribute value then do a > check based on the attribute that is changed, if the check fails do > another attrib rewrite to the next value and do another check, until > either the check fails or passes. There is basically only 4 checks in > the group statement in the authorise section which do > > > > Attrib rewrite > > Do check > > (If it fails do) > > > > Attrib rewrite > > Do check > > (If it fails do) > > > > Attrib check > > Do rewrite > > (If it fails do) > > > > Attrib check > > Do rewrite > > Reject > > Pass > > > > When it runs it checks the reply packet for an attribute > Configuration-Token which is defined in the radgroupreply for the users > but it seems it cannot find it and gives an error. As below > > > > rlm_sqlcounter: (Check item - counter) is less than zero > > rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 > > modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 > > radius_xlat: 'UNSHAPED_NORMAL' > > rlm_attr_rewrite: No match found for attribute Configuration-Token with > value 'SHAPED_NORMAL' > > radius_xlat: 'UNSHAPED_NORMAL' > > radius_xlat: 'SHAPED_NORMAL' > > rlm_attr_rewrite: Changed value for attribute Configuration-Token from > 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' > > rlm_attr_rewrite: Could not find value pair for attribute > Configuration-Token > > modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns > ok for request 2 > > > > can anyone help > > > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 16

Re: weird error
by Joe Vieira 09 Feb '08

09 Feb '08

Is anyone else running freeradius 2.0.1 on rhel5 x86-64? I am consistently getting a segfault (~every 45minutes or so) from line 1319 of rlm_ldap.c , gdb debugging shows me that vals[0] is not a valid memory location. (always 0xffffffffb00020e0) this occurs on two physically different servers (different make and model as well) this only seems to occur when the server is run THREADED, when i run in `radiusd -X` it DOES NOT segfault. however in `radiusd -fxxxx` (threaded debug) it DOES segfault attached seems to be the request that is causing a segfault.... (threaded debug mode) as well as a backtrace and some other gdb info. rad_recv: Access-Request packet from host 10.5.5.3 port 32770, id=198, length=192 Fri Feb 8 08:55:09 2008 : Debug: Waking up in 0.9 seconds. Fri Feb 8 08:55:09 2008 : Debug: Thread 8 got semaphore Fri Feb 8 08:55:09 2008 : Debug: Thread 8 handling request 1112, (139 handled so far) User-Name = "STUDENTS\\kcook" Calling-Station-Id = "00-90-96-C7-15-7C" Called-Station-Id = "00-19-07-06-68-40:ClarkWiFi" NAS-Port = 29 NAS-IP-Address = 10.5.5.3 NAS-Identifier = "WISM1-8B" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "177" EAP-Message = 0x023e00130153545544454e54535c6b636f6f6b Message-Authenticator = 0xa49c3013a1518db03e9dd79520678670 Fri Feb 8 08:55:09 2008 : Debug: +- entering group authorize Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: hints: Matched DEFAULT at 65 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for reques t 1112 Fri Feb 8 08:55:09 2008 : Debug: ++[preprocess] returns ok Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: ++[mschap] returns noop Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: EAP packet type response id 62 length 19 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: ++[eap] returns updated Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: users: Matched entry DEFAULT at line 17 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (uid=%{mschap:User-Name}) -> (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in ou=Users, dc=clarku, dc=edu , with filter (ui d=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=Administrators,ou=Groups,dc=clarku,dc=edu, with filter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=Administrators,ou=Groups,dc=clarku,dc=edu not found or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=ITS_Staff,ou=groups,dc=clarku,dc=edu, with filter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=ITS_Staff,ou=groups,dc=clarku,dc=edu not f ound or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=Idrisi,ou=groups,dc=clarku,dc=edu, with fi lter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=Idrisi,ou=groups,dc=clarku,dc=edu not foun d or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: users: Matched entry DEFAULT at line 46 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: ++[files] returns ok Fri Feb 8 08:55:09 2008 : Debug: Found Autz-Type WIRELESS Fri Feb 8 08:55:09 2008 : Debug: +- entering group WIRELESS Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling wirlss_erebus (rlm_ldap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: - authorize Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing user authorization for STUDENTS\kcook Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (uid=%{mschap:User-Name}) -> (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in ou=Users, dc=clarku, dc=edu , with filter (ui d=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: checking if remote access for STUDENTS\kcook is allowed by clarkuW irelessAccess Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: looking for check items in directory... Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: LDAP attribute acctFlags as RADIUS attribute SMB-Account-CTRL-TEXT == "[UX ]" Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: LDAP attribute ntPassword as RADIUS attribute NT-Password == 0x453 2413742414631434436454630303242423643393134394141343135303241 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: LDAP attribute lmPassword as RADIUS attribute LM-Password == 0x323 9434135333838313132374541413233363037374137313843434446343039 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: looking for reply items in directory... Fri Feb 8 08:55:09 2008 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: user STUDENTS\kcook authorized to use remote access Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from wirlss_erebus (rlm_ldap) for request 1 112 Fri Feb 8 08:55:09 2008 : Debug: ++[wirlss_erebus] returns ok Fri Feb 8 08:55:09 2008 : Debug: rad_check_password: Found Auth-Type EAP Fri Feb 8 08:55:09 2008 : Debug: auth: type "EAP" Fri Feb 8 08:55:09 2008 : Debug: +- entering group authenticate Fri Feb 8 08:55:09 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: EAP Identity Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: processing type tls Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: Initiate Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: Start returned 1 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1112 Fri Feb 8 08:55:09 2008 : Debug: ++[eap] returns handled Sending Access-Challenge of id 198 to 10.5.5.3 port 32770 Reply-Message = "Welcome %u, to Clark University's network #AUTHORIZED USE ONLY#" Tunnel-Private-Group-Id:0 = "177" EAP-Message = 0x013f00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x00000000003f19000000000000000000 Fri Feb 8 08:55:09 2008 : Debug: Finished request 1112. Fri Feb 8 08:55:09 2008 : Debug: Going to the next request Fri Feb 8 08:55:09 2008 : Debug: Thread 8 waiting to be assigned a request rad_recv: Access-Request packet from host 10.5.5.3 port 32770, id=199, length=303 Fri Feb 8 08:55:09 2008 : Debug: Waking up in 0.9 seconds. Fri Feb 8 08:55:09 2008 : Debug: Thread 3 got semaphore Fri Feb 8 08:55:09 2008 : Debug: Thread 3 handling request 1113, (140 handled so far) User-Name = "STUDENTS\\kcook" Calling-Station-Id = "00-90-96-C7-15-7C" Called-Station-Id = "00-19-07-06-68-40:ClarkWiFi" NAS-Port = 29 NAS-IP-Address = 10.5.5.3 NAS-Identifier = "WISM1-8B" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "177" EAP-Message = 0x023f007019800000006616030100610100005d030147ac5f3c5179e17d35b42bc56df35948036b613210aa debf5f96d9e2faad5884202e2d387d86b210c5bbdf85b23ec813d4d267822e615dc82a424ea0f3c505779f001600040005000a00090064 0062000300060013001200630100 State = 0x00000000003f19000000000000000000 Message-Authenticator = 0xf579dbd1bdc44c5815dfdb87e1ad17e3 Fri Feb 8 08:55:09 2008 : Debug: +- entering group authorize Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: hints: Matched DEFAULT at 65 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for reques t 1113 Fri Feb 8 08:55:09 2008 : Debug: ++[preprocess] returns ok Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: ++[mschap] returns noop Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: EAP packet type response id 63 length 112 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: Continuing tunnel setup. Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: ++[eap] returns ok Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: users: Matched entry DEFAULT at line 17 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (uid=%{mschap:User-Name}) -> (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in ou=Users, dc=clarku, dc=edu , with filter (ui d=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=Administrators,ou=Groups,dc=clarku,dc=edu, with filter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=Administrators,ou=Groups,dc=clarku,dc=edu not found or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=ITS_Staff,ou=groups,dc=clarku,dc=edu, with filter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=ITS_Staff,ou=groups,dc=clarku,dc=edu not f ound or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=Idrisi,ou=groups,dc=clarku,dc=edu, with fi lter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=Idrisi,ou=groups,dc=clarku,dc=edu not foun d or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: users: Matched entry DEFAULT at line 46 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: ++[files] returns ok Fri Feb 8 08:55:09 2008 : Debug: Found Autz-Type WIRELESS Fri Feb 8 08:55:09 2008 : Debug: +- entering group WIRELESS Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling wirlss_erebus (rlm_ldap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: - authorize Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing user authorization for STUDENTS\kcook Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'U ser-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (uid=%{mschap:User-Name}) -> (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in ou=Users, dc=clarku, dc=edu , with filter (ui d=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: checking if remote access for STUDENTS\kcook is allowed by clarkuW irelessAccess Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: looking for check items in directory... Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: LDAP attribute acctFlags as RADIUS attribute SMB-Account-CTRL-TEXT == "[UX ]" Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: LDAP attribute ntPassword as RADIUS attribute NT-Password == 0x453 2413742414631434436454630303242423643393134394141343135303241 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: LDAP attribute lmPassword as RADIUS attribute LM-Password == 0x323 9434135333838313132374541413233363037374137313843434446343039 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: looking for reply items in directory... Fri Feb 8 08:55:09 2008 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: user STUDENTS\kcook authorized to use remote access Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from wirlss_erebus (rlm_ldap) for request 1 113 Fri Feb 8 08:55:09 2008 : Debug: ++[wirlss_erebus] returns ok Fri Feb 8 08:55:09 2008 : Debug: rad_check_password: Found Auth-Type EAP Fri Feb 8 08:55:09 2008 : Debug: auth: type "EAP" Fri Feb 8 08:55:09 2008 : Debug: +- entering group authenticate Fri Feb 8 08:55:09 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: Request found, released from the list Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: EAP/peap Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: processing type peap Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_peap: Authenticate Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: processing TLS Fri Feb 8 08:55:09 2008 : Debug: TLS Length 102 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: Length Included Fri Feb 8 08:55:09 2008 : Debug: eaptls_verify returned 11 Fri Feb 8 08:55:09 2008 : Debug: (other): before/accept initialization Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: before/accept initialization Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: SSLv3 read client hello A Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: SSLv3 write server hello A Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 02f6], Certificate Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: SSLv3 write certificate A Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: SSLv3 write server done A Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: SSLv3 flush data Fri Feb 8 08:55:09 2008 : Debug: TLS_accept: Need to read more data: SSLv3 read client certificate A Fri Feb 8 08:55:09 2008 : Debug: In SSL Handshake Phase Fri Feb 8 08:55:09 2008 : Debug: In SSL Accept mode Fri Feb 8 08:55:09 2008 : Debug: eaptls_process returned 13 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap_peap: EAPTLS_HANDLED Fri Feb 8 08:55:09 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1113 Fri Feb 8 08:55:09 2008 : Debug: ++[eap] returns handled Sending Access-Challenge of id 199 to 10.5.5.3 port 32770 Reply-Message = "Welcome %u, to Clark University's network #AUTHORIZED USE ONLY#" Tunnel-Private-Group-Id:0 = "177" EAP-Message = 0x014003591900160301004a02000046030147ac5f3da6e97785406e9452b989754ea503af327c691c27dce6 65d64ff4616c20e95922022ef4cb7c0d43ee3ad781f42936ae850d6572456fc5bf0c3480b9808e00040016030102f60b0002f20002ef00 02ec308202e830820251a0030201020203078e97300d06092a864886f70d0101050500304e310b30090603550406130255533110300e06 0355040a130745717569666178312d302b060355040b132445717569666178205365637572652043657274696669636174652041757468 6f72697479301e170d3037303631313135323131355a170d3039303631313135323131355a3073310b30090603 EAP-Message = 0x55040613025553311630140603550408130d4d617373616368757365747473311230100603550407130957 6f7263657374657231193017060355040a1310436c61726b20556e6976657273697479311d301b060355040313147261646975732e6974 2e636c61726b752e65647530819f300d06092a864886f70d010101050003818d0030818902818100c3ae41e4a71f4c0b9571dd8820a7c8 cdfbee310216157ec0c9bd84980dc83e770a497addcba409b050ff528bc349c7ad6d91c84ce18618e93ec08ec8a1456c1c2ae405d58105 cebc68df124389451338ff0ded9d98ecb2b4c88a626081a834c9a464a8428451383ac681c63ba253761da2cd7b EAP-Message = 0x16b3c23f5f7fcecef587971e570203010001a381ae3081ab300e0603551d0f0101ff0404030204f0301d06 03551d0e04160414b1dc00af1a89c7939f9b382619cc9f1f8edfaf59303a0603551d1f04333031302fa02da02b8629687474703a2f2f63 726c2e67656f74727573742e636f6d2f63726c732f73656375726563612e63726c301f0603551d2304183016801448e668f92bd2b295d7 47d82320104f3398909fd4301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d010105 050003818100258c15a8e13b417f09719aa339b5d8ff4b38df6607d6441ce41653ffdc29b742acee64a3df671e EAP-Message = 0xc31ec0c96d3b48d004af81f38087e32655d9ca8bcc93a11c2b9a0fff6118e1c78b5ff8860b038e541d7555 d0e3f47a6e972f8a672eca7e4de1af549bd879c25c4c08ee57525859c065b6296bb0dffdfb9ca4a4ac083c03a1d616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x00000000014019000000000000000000 Fri Feb 8 08:55:09 2008 : Debug: Finished request 1113. Fri Feb 8 08:55:09 2008 : Debug: Going to the next request Fri Feb 8 08:55:09 2008 : Debug: Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 10.5.5.3 port 32770, id=200, length=383 Fri Feb 8 08:55:09 2008 : Debug: Waking up in 0.9 seconds. Fri Feb 8 08:55:09 2008 : Debug: Thread 1 got semaphore Fri Feb 8 08:55:09 2008 : Debug: Thread 1 handling request 1114, (140 handled so far) User-Name = "STUDENTS\\kcook" Calling-Station-Id = "00-90-96-C7-15-7C" Called-Station-Id = "00-19-07-06-68-40:ClarkWiFi" NAS-Port = 29 NAS-IP-Address = 10.5.5.3 NAS-Identifier = "WISM1-8B" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "177" EAP-Message = 0x024000c01980000000b6160301008610000082008048a1b8f7224e5687bab7781160089c293dc10d9a7666 5b16ad5d8f924f5c2b056e2080978b26291221b5e67e4250efd2d2476c01f4fa1b6cd5ee14876aeca84eb032473c89693458fffa60787e a4352a2f70e24c949e7d464d28b894d60f9f52ca35ca022f8d4ed0236332bb33ce9f804eef044740f4d4ec9353eb81b56cd30a14030100 01011603010020ee3e58c58f4a09c290c273c058353b50d4ec407155a3b8086ffc3b3e047e05dc State = 0x00000000014019000000000000000000 Message-Authenticator = 0x810656c4ecaf53974ec51e777f956ea5 Fri Feb 8 08:55:09 2008 : Debug: +- entering group authorize Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: hints: Matched DEFAULT at 65 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: ++[preprocess] returns ok Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: ++[mschap] returns noop Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: EAP packet type response id 64 length 192 Fri Feb 8 08:55:09 2008 : Debug: rlm_eap: Continuing tunnel setup. Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: ++[eap] returns ok Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: users: Matched entry DEFAULT at line 17 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (uid=%{mschap:User-Name}) -> (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in ou=Users, dc=clarku, dc=edu , with filter (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=Administrators,ou=Groups,dc=clarku,dc=edu, with filter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=Administrators,ou=Groups,dc=clarku,dc=edu not found or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=ITS_Staff,ou=groups,dc=clarku,dc=edu, with ilter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=ITS_Staff,ou=groups,dc=clarku,dc=edu not found or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: Entering ldap_groupcmp() Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (&(objectClass=posixGroup)(memberUid=%{mschap:User-Name})) -> (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in cn=Idrisi,ou=groups,dc=clarku,dc=edu, with filter (&(objectClass=posixGroup)(memberUid=kcook)) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: object not found or got ambiguous search result Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap::ldap_groupcmp: Group cn=Idrisi,ou=groups,dc=clarku,dc=edu not found or user is not a member. Fri Feb 8 08:55:09 2008 : Debug: users: Matched entry DEFAULT at line 46 Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: ++[files] returns ok Fri Feb 8 08:55:09 2008 : Debug: Found Autz-Type WIRELESS Fri Feb 8 08:55:09 2008 : Debug: +- entering group WIRELESS Fri Feb 8 08:55:09 2008 : Debug: modsingle[authorize]: calling wirlss_erebus (rlm_ldap) for request 1114 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: - authorize Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing user authorization for STUDENTS\kcook Fri Feb 8 08:55:09 2008 : Debug: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Fri Feb 8 08:55:09 2008 : Debug: expand: (uid=%{mschap:User-Name}) -> (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: expand: ou=Users, dc=clarku, dc=edu -> ou=Users, dc=clarku, dc=edu Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: performing search in ou=Users, dc=clarku, dc=edu , with filter (uid=kcook) Fri Feb 8 08:55:09 2008 : Debug: rlm_ldap: checking if remote access for STUDENTS\kcook is allowed by clarkuWirelessAccess Segmentation fault Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1157658944 (LWP 3794)] 0x00002aaaac516d85 in ldap_authorize (instance=0x4077b30, request=0x4202a30) at rlm_ldap.c:1319 1319 if (!strncmp(vals[0], "FALSE", 5)) { (gdb) bt #0 0x00002aaaac516d85 in ldap_authorize (instance=0x4077b30, request=0x4202a30) at rlm_ldap.c:1319 #1 0x0000000000411d13 in modcall (component=<value optimized out>, c=<value optimized out>, request=0x4202a30) at modcall.c:248 #2 0x000000000040ee59 in indexed_modcall (comp=1, idx=<value optimized out>, request=0x4202a30) at modules.c:446 #3 0x000000000040711b in rad_authenticate (request=0x4202a30) at auth.c:546 #4 0x0000000000418b4b in radius_handle_request (request=0x4202a30, fun=0x407000 <rad_authenticate>) at event.c:2707 #5 0x0000000000413f78 in request_handler_thread (arg=<value optimized out>) at threads.c:488 #6 0x0000003da1c062f7 in start_thread () from /lib64/libpthread.so.0 #7 0x0000003da0cce85d in clone () from /lib64/libc.so.6 (gdb) print vals $1 = (char **) 0xffffffffb00020e0 (gdb) print vals[0] Cannot access memory at address 0xffffffffb00020e0 (gdb) print inst->access_attr No symbol "inst" in current context. (gdb) print instance $2 = (void *) 0x4077b30 (gdb) print instance->access_attr Attempt to dereference a generic pointer. (gdb) print ((ldap_instance *)instance)->access_attr $3 = 0x4077d90 "clarkuWirelessAccess" (gdb) print ((ldap_instance *)instance)->default_allow $4 = 1 (gdb) print msg $5 = (LDAPMessage *) 0x2aaab0002710 (gdb) print conn->ld Cannot access memory at address 0x0 (gdb) print conn $6 = <value optimized out> Joe Vieira UNIX Systems Administrator Clark University - ITS Alan DeKok wrote: > Joe Vieira wrote: > >> So, i just attached gdb to the running server and ended with this seg >> fault. >> > > It's likely a side-effect of some other memory issue. > > If it's an AMD 64-bit system, then "valgrind" should work. > > You can also run the server with more debugging as: > > $ radiusd -fxxxx > > In which case it won't daemonize itself, but it *will* start multiple > threads. It looks like the issue is related to threading, if it works > when '-X' is used. > > Alan DeKok. >

3 10

help in basic configuration in connection mysql with freeradius
by johnson elangbam 08 Feb '08

08 Feb '08

hi, I am trying to use mysql database with free radius 2.0.0 for the first time. I am using centOS 4.5 and mysql 4.1.2.The authentication works fine if I am using the unix username and password. I modified some configurations in radiusd.conf and sql.conf but it doesn't work. Please tell me the most basic steps to configure freeradius with mysql. Here is the log file while running in debugging mode: [root@adore ~]# radiusd -X FreeRADIUS Version 2.0.0, for host i686-pc-linux-gnu, built on Jan 29 2008 at 12:25:11 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" user = "root" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log { syslog_facility = "daemon" stripped_names = no file = "/usr/local/var/log/radius/radius.log" auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "johnson123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "johnson123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "NULL" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. with Regards Elangbam Johnson

4 3