- Freeradius-Users - lists.freeradius.org

weird error
by Joe Vieira 07 Feb '08

07 Feb '08

Wed Feb 6 10:43:44 2008 : Error: TLS Alert write:fatal:bad record mac Wed Feb 6 10:43:44 2008 : Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Wed Feb 6 10:43:44 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. could someone help me figure out what that means exactly? thanks, -- Joe Vieira UNIX Systems Administrator Clark University - ITS

3 4

Proxying VMPS requests
by Phil Mayers 06 Feb '08

06 Feb '08

I'm looking at using FreeRadius 2.0.1 to merge out old VMPS switches into the radius-based (SQL-backed) MAC auth. For various reasons, the easiest thing for me would be to proxy the VMPS requests as PAP to our existing mac auth servers. The comments in raddb/sites-available/vmps imply that the packets can be proxied, but I'm not seeing that: # VMPS server server vmps { listen { # FIXME: should be .202 for production ipaddr = 192.168.x.y port = 1589 type = vmps } # And the REAL contents. This section is just like the # "post-auth" section of radiusd.conf. In fact, it calls the # "post-auth" component of the modules that are listed here. # But it's called "vmps" to highlight that it's for VMPS. vmps { # we cheat, and proxy to the MACAUTH radius servers update control { Proxy-To-Realm := "MACAUTH" } } post-proxy { # FIXME: log to sql_log actually detail } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on vmps address 155.198.63.122 port 1589 as server vmps Ready to process requests. VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 234881024 VMPS-Client-IP-Address = 155.198.51.130 VMPS-Port-Name = "4 " VMPS-VLAN-Name = "--NONE--" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:1b:24:a1:cf:2e server vmps { Doing VMPS Done VMPS } # server vmps Failed encoding packet: Failed to find VQP-Packet-Type in response packet Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 3.9 seconds. Cleaning up request 0 ID 234881024 with timestamp +1 Ready to process requests. Looking at the source code, it seems the vmps code only runs the post-auth section and doesn't check any control variables, so Proxy-To-Realm is unlikely to work. If this is intentional, could we remove the comments about proxying and pre/post proxy from sites-available/vmps? Is there any reason the code doesn't run: authorize then either post-auth or pre-proxy post-proxy post-auth ?

3 3

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. with regards Elangbam Johnson

3 3

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. Debug of the server startup display like this [root@adore etc]# radiusd -X FreeRADIUS Version 2.0.0, for host i686-pc-linux-gnu, built on Jan 29 2008 at 12:25:11 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" stripped_names = no file = "/usr/local/var/log/radius/radius.log" auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "johnson123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "johnson123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "NULL" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response " key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests.

1 0

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. the debug log display like this Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 32771, id=218, length=56 User-Name = "john" User-Password = "radpass" NAS-IP-Address = 192.168.1.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated rlm_realm: No '@' in User-Name = "john", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "radpass" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 218 to 127.0.0.1 port 32771 Waking up in 4.9 seconds. Cleaning up request 0 ID 218 with timestamp +34 Ready to process requests. with regards Elangbam Johnson

3 2

ip pool problem
by Luis Galan 06 Feb '08

06 Feb '08

Hi! I am using freeradius 1.1.3 and I have some problems with dial-up users using a dynamic pool of ip adresses. When user A are logged in with ip address 1, its ip is marked as used in the pool only for 2/3 minutes. After that if an user B logs in, then this new user can received the same ip address that user A was using. Could it be a problem from the NAS params sent to radius? What attributes are used to control the pool assignment? Could someone help me? . . . ippool poolJazDialup { range-start = 1.1.1.129 range-stop = 1.1.1.254 netmask = 255.255.255.255 cache-size = 126 session-db = ${raddbdir}/db.ippool.poolDialup ip-index = ${raddbdir}/db.ipindex.poolDialup override = no maximum-timeout = 0 } . . . accounting { detail poolJazDialup group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } } post-auth { # Get an address from the IP Pool. poolJazDialup reply_log group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } Post-Auth-Type REJECT { group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } } }

2 2

help required
by sanjeev.kumarroy＠wipro.com 06 Feb '08

06 Feb '08

Hi, I am completely new to using freeradius 1.1.7. Can you please give me an insight to how we can test MSCHAP V2 using this? Thanks Please do not print this email unless it is absolutely necessary. Spread environmental awareness. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Can use "auth" with radclient but not "status"
by Stephane Bortzmeyer 06 Feb '08

06 Feb '08

I believe that my Free Radius server is working, since I can query it successfully with "auth": % echo "User-Name = bortzmeyer\nUser-Password = foobar" | radclient jezabel auth mysharedsecret Received response ID 187, code 2, length = 44 Service-Type = Framed-User ... % echo "User-Name = bortzmeyer\nUser-Password = wrong" | radclient jezabel auth mysharedsecret Received response ID 189, code 3, length = 20 But "status" always fail: % echo "NAS-port = 1" | radclient jezabel status mysharedsecret radclient: no response from server for ID 198 (Same thing with 12 instead of status) On the server, running with -X, I just get: WARNING: Insecure packet from host 10.1.82.1: Packet does not contain required Message-Authenticator attribute Free Radius 1.1.7, Debian "lenny" OS

2 3

New bee to FreeRadius; need help in configuration
by Deepak Panigrahy 06 Feb '08

06 Feb '08

Hi, I have successfully configured the Freeradius server. The one thing that I noticed is: Everytime I modify the Clients.conf file to include a client, I have to stop the server and then start it gain so that the client is picked up. I am wondering if there is any other way so that the server can refresh itself everytime I add a client, automatically. Can anybody help me out? Thanks, Deepak

6 6

Detail cisco logging
by Vijay Avarachen 05 Feb '08

05 Feb '08

Hello, I have successfully configured freeradius 2.x to do AAA for my Cisco Catalyst 3560. Using modules rlm_detail I am able to log when the session starts and ends, however I am also interested in logging exactly what commands were issued by the user. Does anyone know how I can accomplish this? Thank you, Vijay Avarachen -- "Knowledge is the only wealth that grows as you spend it, and diminishes as you save it."

4 7