- Freeradius-Users - lists.freeradius.org

Problem with Vista EAP-PEAP Authentication
by debug afone 22 Jan '08

22 Jan '08

Hello, We are trying to authenticate Windows Vista clients using FreeRadius into a HP Procurve architecture. We configured FreeRadius to operate an EAP-PEAP authentication. This works fine with XP SP2 client but the process blocks with Windows Vista at this point : Sending Access-Challenge of id 70 to 10.40.0.114 port 1073 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x668d79caa2854b593ec7e91a8004030b I saw a few posts on the web regarding to this problem. Some users advise to install kb932063 microsoft hotfix but I still have my problem. A patch has been released in 1.1.3 version and then included to 1.1.4 an older. I use 1.1.6 version. The Option SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS take part of rlm_eap_tls.c file. Does anybody have an idea ? Regards, Nicolas SOULEMAN.

2 1

filling in missing attributes
by Duane Cox 22 Jan '08

22 Jan '08

Hello List I'm looking for a suggested solution to this problem. I'm running freeradius 2.0.0 and have a NAS that doesn't supply the NAS-Identifier or Called-Station-Id. I'm using rlm_sql to log acct information and would like to have this missing info filled in. Would it be best to use: rlm_attr_rewrite or use conditional syntax within the sql.conf ie. "%{%{Foo}:-%{Bar}}" Thanks Duane Cox

4 4

Building FreeRadius 2.0 on Mac OS X fails
by Walter Krivanek, VividVisions 22 Jan '08

22 Jan '08

Hi, I'm trying to build the current version of freeradius on my Mac OS X 10.5 Intel 64bit computer. First, I have troubles with the configure script. Even if I show the script my exact location of the MySQL include files using --with-mysql- include-dir and similar, I'm getting warnings that mysql.h has not been found and that the MySQL module will be disabled. BTW: This also happens on my Debian server, where MySQL is installed in the standard directories. Then, when running make, I'm getting the following error: ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (18) cpusubtype (0) is not an object file (bad magic number) ar: internal ranlib command failed Any thoughts? Thanks for your help! Walter

4 11

regarding RFC 2253 UTF-8 String Representation of Distinguished Names support
by Gopinath Reddy N 22 Jan '08

22 Jan '08

Hi, Could anyone let me know whether RFC2253 is implemented in free radius. Iam trying to use special characters in Users name and active directory is expecting UTF-8 string form of the user. However free radius is not encoding it in UTF-8 format. Thanks for the help. -gnr

2 4

Re: MySQL accounting issue
by Andy Smith 21 Jan '08

21 Jan '08

Anyone any ideas? I repost this as the posts are in a messed up order on the forum page... As per my previous mail, my current issue is that with accounting set to sql in radiusd.conf the SQL statements are being written just to /usr/local/var/log/radius/sqltrace.sql and nothing is actually put in the database... What have I done wrong? thank u! ----- Original Message ----- From: "Andy Smith" <a.smith(a)ukgrid.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, January 21, 2008 4:40 PM Subject: Re: MySQL accounting issue > Ok, Im seeing this from radiusd: > > rad_recv: Accounting-Request packet from host 89.107.16.10:35563, id=252, > length=145 > Acct-Status-Type = Failed > Service-Type = IAPP-Register > Attr-102 = 0x00000194 > Error-Cause = 32 > Event-Timestamp = "Jan 21 2008 15:53:44 GMT" > Attr-105 = 0x61733264636462613764 > Acct-Session-Id = "4c0392bd719422d06c5da35312950949(a)89.107.16.9" > Attr-108 = 0x38392e3130372e31362e39 > Attr-109 = 0x35303630 > NAS-Port = 5060 > Acct-Delay-Time = 0 > NAS-IP-Address = 89.107.16.10 > Processing the preacct section of radiusd.conf > modcall: entering group preacct for request 0 > modcall[preacct]: module "preprocess" returns noop for request 0 > rlm_acct_unique: WARNING: Attribute User-Name was not found in request, > unique ID MAY be inconsistent > rlm_acct_unique: Hashing 'NAS-Port = 5060,Client-IP-Address = > 89.107.16.10,NAS-IP-Address = 89.107.16.10,Acct-Session-Id = > "4c0392bd719422d06c5da35312950949(a)89.107.16.9",' > rlm_acct_unique: Acct-Unique-Session-ID = "df36632bb92d5086". > modcall[preacct]: module "acct_unique" returns ok for request 0 > rlm_realm: Proxy reply, or no User-Name. Ignoring. > modcall[preacct]: module "suffix" returns noop for request 0 > modcall[preacct]: module "files" returns noop for request 0 > modcall: leaving group preacct (returns ok) for request 0 > Processing the accounting section of radiusd.conf > modcall: entering group accounting for request 0 > modcall[accounting]: module "unix" returns noop for request 0 > radius_xlat: '/usr/local/var/log/radius/radutmp' > rlm_radutmp: NAS OpenSER port 5060 unknown packet type 15) > modcall[accounting]: module "radutmp" returns noop for request 0 > radius_xlat: '' > radius_xlat: '' > radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' > rlm_sql (sql): Reserving sql socket id: 3 > rlm_sql (sql): Released sql socket id: 3 > modcall[accounting]: module "sql" returns ok for request 0 > modcall: leaving group accounting (returns ok) for request 0 > Sending Accounting-Response of id 252 to 89.107.16.10 port 35563 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 252 with timestamp 4794be17 > Nothing to do. Sleeping until we see a request.

1 0

MySQL
by Anthony McGarry 21 Jan '08

21 Jan '08

Hi, I have installed MySQL and Freeradius2.0.0. I have updated the schema for MySQL and set the location, username and password in sql.conf. When I start radiusd -X I get the following output. I cannot see any mention of connecting to mysql. root@netservices sbin]# radiusd -X FreeRADIUS Version 2.0.0, for host i686-pc-linux-gnu, built on Jan 19 2008 at 13:59:15 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" stripped_names = yes file = "/usr/local/var/log/radius/radius.log" auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. When I try authenticate from my NAS device cisco router I get the following even though I have entered it into the NAS table in the radius database. Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 10.0.0.1 port 1645 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 10.0.0.1 port 1645 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 10.0.0.1 port 1645 Ready to process requests. I have enabled all logging but I cant find any logs that help me debug why radius is not connecting to mysql. Thanks Anthony

2 1

Support for RFC4372 (Chargeable User Identity)
by Stefan Winter 21 Jan '08

21 Jan '08

Hello, is that implemented in FR, be it 1.1 or 2.0? According to http://wiki.freeradius.org/RFC it shouldn't be. From my reading of the RFC, defining it "by hand" in radreply is not considered good enough, because it has a specific logic behind it: (2.1) If a home RADIUS server that supports the CUI attribute receives an Access-Request packet containing a CUI (set to nul or otherwise), it MUST include the CUI attribute in the Access-Accept packet. Otherwise, if the Access-Request packet does not contain a CUI, the home RADIUS server SHOULD NOT include the CUI attribute in the Access-Accept packet. The Access-Request may be sent either in the initial authentication or during re-authentication. So, always sending it via radreply would ignore the SHOULD NOT. Not defining it at all though makes it difficult for the server to maintain a persistent yet anonymous handle. So something like defining it by hand but only including it if it was asked for would be needed. Is that logic present in FR? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 8

Freeradius +LDAP + Active Directory + Authenticate Only questions
by William Segura 21 Jan '08

21 Jan '08

I am trying to setup Freeradius to authenticate against an active directory server. I do not want it to do a ldapsearch to get authorization. I have looked on the mailing lists but have not found how to do this in my situation. I did read the rlm_ldap manual and am aware of the ldap-UserDN variable. I am unable to get Freeradius to set the bind DN to what I attempt to set the ldap-userdn variable to in the authentication phase. It insists on setting DN to the entire CN. Any clues? Thanks. Here are the relevant files: /etc/raddb/radiusd.conf ***************************************************************************************** prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib64 pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "ldaps://ad-ldap.subdomain.domain.com" port = 636 identity = "username" password = "password" basedn = "ou=North America,dc=subdomain,dc=domain,dc=com" ldap_debug = 0x0028 binddn = "(SamAccountName=%u)" base_filter = "(objectclass=*)" filter = "(SamAccountName=%u)" start_tls = no tls_require_cert = "never" password_radius_attribute = "NT-Password" password_attribute = "userPassword" password_header = "{clear}" #access_attr = "telephoneNumber" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no #default_profile = "ladp-userdn" #groupname_attribute = cn #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member= %{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember= %{Ldap-UserDn})))" #groupmembership_attribute = memberOf timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } } instantiate { exec expr } authorize { preprocess # ldap pap chap mschap suffix ntdomain eap files } authenticate { Auth-Type LDAP { ldap } Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } ***************************************************************************************** /etc/raddb/users ***************************************************************************************** DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Auth-Type = ldap Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP ***************************************************************************************** Radius Log: ***************************************************************************************** Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "ldaps://ad-ldap.subdomain.domain.com" ldap: port = 636 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "username" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "never" ldap: password = "password" ldap: basedn = "ou=North America,dc=subdomain,dc=domain,dc=com" ldap: filter = "(SamAccountName=%u)" ldap: base_filter = "(objectclass=*)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member= %{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember= %{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 40 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x5555558a41e0 Module: Instantiated ldap (ldap) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:35655, id=159, length=58 User-Name = "user1" User-Password = "\204\016V\332\226\325\007\347\254Hm\262}B\321M" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "user1" with password "??V�?�?��Hm�}B�M" radius_xlat: '(SamAccountName=user1)' radius_xlat: 'ou=North America,dc=subdomain,dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://ad-ldap.subdomain.domain.com, authentication 0 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as username/password to ldaps://ad-ldap.subdomain.domain.com TLS certificate verification: Error, unable to get local issuer certificate rlm_ldap: waiting for bind result ... request done: ld 0x5555558b2890 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in ou=North America,dc=subdomain,dc=domain,dc=com, with filter (SamAccountName=user1) request done: ld 0x5555558b2890 msgid 2 rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: CN=William user1,OU=Users,OU=Headquarters,OU=North America,DC=subdomain,DC=domain,DC=com rlm_ldap: (re)connect to ldaps://ad-ldap.subdomain.domain.com, authentication 1 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as CN=William user1,OU=Users,OU=Headquarters,OU=North America,DC=subdomain,DC=domain,DC=com/??V�?�?��Hm�}B�M to ldaps://ad-ldap.subdomain.domain.com TLS certificate verification: Error, unable to get local issuer certificate rlm_ldap: waiting for bind result ... request done: ld 0x5555558badf0 msgid 1 rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group LDAP (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 159 to 127.0.0.1 port 35655 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 159 with timestamp 478fad88 Nothing to do. Sleeping until we see a request. ***************************************************************************************** William Segura | Product Development Lab Manager F5 Networks www.f5.com

2 2

Re: MySQL accounting issue
by A.smith 21 Jan '08

21 Jan '08

Ah, ok, now I see the other post regarding this. The problem is OpenSER and this status type: rlm_sql (sql): Unsupported Acct-Status-Type = 15 Whats the latest on this? Has the incompatibility been addressed in freeradius 2.0? thanks Andy. ________________________________________________ Message sent using UK Grid Webmail 2.7.9

3 2

MySQL
by Anthony McGarry 21 Jan '08

21 Jan '08

Thanks David, that worked. Message: 6 Date: Sun, 20 Jan 2008 17:46:16 +0000 From: "Anthony McGarry" <agtmcgarry(a)gmail.com> Subject: MySQL To: freeradius-users(a)lists.freeradius.org Message-ID: <a2cb32ac0801200946v4a98d251h4cd04f1bdc447ff1(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, I downloaded the latest version 2.0.0. Installed and tested ok. I want to integrate with MySQL. However when I follow the procedure on the howto to create the radius db on mysql I run into a problem. The howto says to enter the following commands mysql -uroot -p CREATE DATABASE radius; GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "radpass"; exit This works fine and I can see the newly created db and user. However then it tells me to run mysql.sql cd /usr/share/doc/packages/freeradius/doc/examples/ mysql -uroot -p radius < mysql.sql I have looked everywhere on my system for this file but it is not present. I checked the tar for 2.0.0 and still no joy I downloaded and checked the tar for 1.1.7 and its in the doc/example folder. Is there a new way of updating the radius db in MySQL or where can I get the mysql.sql script for ver 2.0.0 Thanks Anthony

1 0