- Freeradius-Users - lists.freeradius.org

EAP Auth failing with CVS Head
by Arran Cudbard-Bell 29 Dec '07

29 Dec '07

Hi, EAP Auth appears to be failing for no reason with CVS head. It probably has something to do with " rlm_eap: Request found, released from the list rlm_eap: Response appears to match, but EAP type is wrong. rlm_eap: Failed in handler" and the random "Failed to remember handler" errors in the latter part of the eap conversation. Stripped out all the auth stuff, as nothing interestings happening there. rad_recv: Access-Request packet from host 139.184.9.177 port 1024, id=172, length=205 Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" User-Name = "az50" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00-16-35-15-d9-00" Calling-Station-Id = "00-30-4f-13-c0-d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" EAP-Message = 0x02c9000901617a3530 Message-Authenticator = 0x05c64e6b0dac8c846e05d9b1fd5fa85b rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled } # server default-outer Sending Access-Challenge of id 172 to 139.184.9.177 port 1024 EAP-Message = 0x01ca00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000ca Finished request 4652. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 139.184.9.177 port 1024, id=173, length=326 Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" User-Name = "az50" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00-16-35-15-d9-00" Calling-Station-Id = "00-30-4f-13-c0-d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x000000000000000000000000000000ca EAP-Message = 0x02ca007019800000006616030100610100005d03014767d5da7a32145e74125d7a71e8160a090 Message-Authenticator = 0x17dabfdeff86fc11cf9b67b4cb4a79f7 rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0387], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled } # server default-outer Sending Access-Challenge of id 173 to 139.184.9.177 port 1024 EAP-Message = 0x01cb03ea1900160301004a0200004603014767d4ca221348ec33831b5e1237d96758443c78cc6 EAP-Message = 0x69636174696f6e205365727669636573204469766973696f6e3121301f0603550403131854686 EAP-Message = 0x7365782e61632e756b30819f300d06092a864886f70d010101050003818d0030818902818100b EAP-Message = 0x74655072656d69756d53657276657243412e63726c303206082b0601050507010104263024302 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000cb Finished request 4653. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 139.184.9.177 port 1024, id=174, length=406 Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" User-Name = "az50" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00-16-35-15-d9-00" Calling-Station-Id = "00-30-4f-13-c0-d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x000000000000000000000000000000cb EAP-Message = 0x02cb00c01980000000b61603010086100000820080903b024e4ef1444d865b3ba9fe889d55c51 Message-Authenticator = 0xbb7239c8e5207baf3ee395e1cbd00ed9 rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 182 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled } # server default-outer Sending Access-Challenge of id 174 to 139.184.9.177 port 1024 EAP-Message = 0x01cc003119001403010001011603010020944b4cc1d4e768a91014c75284543d28f718dc21594 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000cc Finished request 4654. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 139.184.9.177 port 1024, id=175, length=220 Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" User-Name = "az50" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00-16-35-15-d9-00" Calling-Station-Id = "00-30-4f-13-c0-d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x000000000000000000000000000000cc EAP-Message = 0x02cc00061900 Message-Authenticator = 0x8fd36e4dd5036fb3db8f1c51d3be8504 server default-outer { rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled } # server default-outer Sending Access-Challenge of id 175 to 139.184.9.177 port 1024 EAP-Message = 0x01cd002019001703010015e57797d900ee292b962234b6f37d92cb3f85c18f61 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000cd Finished request 4655. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 139.184.9.177 port 1024, id=176, length=246 Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" User-Name = "az50" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00-16-35-15-d9-00" Calling-Station-Id = "00-30-4f-13-c0-d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x000000000000000000000000000000cd EAP-Message = 0x02cd002019001703010015e7034ffdee4ee0731618f96749b903e144d03fa5b6 Message-Authenticator = 0x03b0c8eb9f3f7134743039eee658ac84 rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - az50 PEAP: Got tunneled EAP-Message EAP-Message = 0x02cd000901617a3530 PEAP: Got tunneled identity of az50 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to az50 PEAP: Sending tunneled request EAP-Message = 0x02cd000901617a3530 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "az50" Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00163515d900" Calling-Station-Id = "00304f13c0d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" Called-Station-SSID = "" SS-Flags = "0100000000" NAS-Flags = "010000110000000" Supplicant-Flags = "0000000000" server default-inner { +- entering group authorize ++? if (("%{User-Name}" =~ /([^-]+)-emergency-/) || ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum: expand: %{User-Name} -> az50 ?? Evaluating ("%{User-Name}" =~ /([^-]+)-emergency-/) -> FALSE expand: %{User-Name} -> az50 ?? Evaluating ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE ++? if (("%{User-Name}" =~ /([^-]+)-emergency-/) || ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum: ++- entering if (("%{User-Name}" =~ /([^-]+)-emergency-/) || ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([ +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) expand: %{2} -> ? Evaluating "" -> TRUE ? Skipping ("%{2}" == "sussex.ac.uk") +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) -> TRUE +++- entering if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) expand: %{1} -> az50 ++++[request] returns notfound +++- if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) returns notfound +++ ... skipping else for request 4656: Preceding "if" was taken ++- if (("%{User-Name}" =~ /([^-]+)-emergency-/) || ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum: ++ ... skipping else for request 4656: Preceding "if" was taken rlm_ldap: - authorize rlm_ldap: performing user authorization for az50 expand: %{Stripped-User-Name} -> az50 expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=az50) expand: ou=unix ,ou=uscs, o=University of Sussex -> ou=unix ,ou=uscs, o=University of Sussex rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=unix ,ou=uscs, o=University of Sussex, with filter (uid=az50) rlm_ldap: checking if remote access for az50 is allowed by uosRadiusAccountEnabled rlm_ldap: Added Crypt-Password = xxxxxx in check items rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute ntPassword as RADIUS attribute NT-Password == xxxxxxx rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correc rlm_ldap: user az50 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if ("%{Service-Type}" != 'Authenticate-Only') expand: %{Service-Type} -> Framed-User ? Evaluating ("%{Service-Type}" != 'Authenticate-Only') -> TRUE ++? if ("%{Service-Type}" != 'Authenticate-Only') -> TRUE ++- entering if ("%{Service-Type}" != 'Authenticate-Only') expand: %{Stripped-User-Name} -> az50 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> az50 rlm_sql (sql): sql_set_user escaped user --> 'az50' rlm_sql (sql): Reserving sql socket id: 24 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE use expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-N rlm_sql (sql): Released sql socket id: 24 rlm_sql (sql): User az50 not found +++[sql] returns notfound ++- if ("%{Service-Type}" != 'Authenticate-Only') returns notfound expand: %{Stripped-User-Name} -> az50 expand: %{%{Stripped-User-Name}:-%{User-Name}} -> az50 users: Matched entry DEFAULT at line 55 expand: %{Framed-MTU} -> 1480 expand: %{%{Framed-MTU}:-1400}} -> 1480} users: Matched entry DEFAULT at line 63 expand: %{SS-Flags} -> 0100000000 users: Matched entry DEFAULT at line 126 expand: %{Stripped-User-Name} -> az50 expand: %{NAS-Identifier} -> hp-e-lh-opp2-sw1 expand: %{Called-Station-SSID} -> expand: User %{%{Stripped-User-Name}:-%{User-Name}} authenticated for ResNet access on NAS:% ++[files] returns ok rlm_eap: EAP packet type response id 205 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[mschap] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server default-inner PEAP: Got tunneled reply RADIUS code 11 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User az50 authenticated for ResNet access on NAS:hp-e-lh-opp2-sw1 SSID:none EAP-Message = 0x01ce001e1a01ce001910d42070cc55ce5df2a45a688b493da789617a3530 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000ce PEAP: Processing from tunneled session code 0x3cd370 11 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User az50 authenticated for ResNet access on NAS:hp-e-lh-opp2-sw1 SSID:none EAP-Message = 0x01ce001e1a01ce001910d42070cc55ce5df2a45a688b493da789617a3530 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000ce PEAP: Got tunneled Access-Challenge rlm_eap: Failed to remember handler! ++[eap] returns handled } # server default-outer Sending Access-Challenge of id 176 to 139.184.9.177 port 1024 EAP-Message = 0x01ce00351900170301002a1f3ece511d49e35f24c46327f02a781c1d7b4b7fb1b74b4b613e671 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x000000000000000000000000000000ce Finished request 4656. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 139.184.9.177 port 1024, id=177, length=300 Framed-MTU = 1480 NAS-IP-Address = 139.184.9.177 NAS-Identifier = "hp-e-lh-opp2-sw1" User-Name = "az50" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 32 NAS-Port-Type = Ethernet NAS-Port-Id = "32" Called-Station-Id = "00-16-35-15-d9-00" Calling-Station-Id = "00-30-4f-13-c0-d5" Connect-Info = "CONNECT Ethernet 10Mbps Half duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x000000000000000000000000000000ce EAP-Message = 0x02ce00561900170301004bd3fc0b2ab96fbcceb05f1a3ad2ce073af9eb3df121ac4de457cbf72 Message-Authenticator = 0x7118ed090c49f2cb7633ff8477649ca4 rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: Response appears to match, but EAP type is wrong. rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. } # server default-outer Found Post-Auth-Type Reject +- entering group REJECT rlm_sql (sql): Processing sql_postauth expand: %{Stripped-User-Name} -> az50 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> az50 rlm_sql (sql): sql_set_user escaped user --> 'az50' expand: INSERT INTO radpostauth (`us' rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth ' rlm_sql (sql): Reserving sql socket id: 23 rlm_sql (sql): Released sql socket id: 23 ++[sql] returns ok expand: %{User-Name} -> az50 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated rlm_sql (sql_roaming): Processing sql_postauth expand: %{Stripped-User-Name} -> az50 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> az50 rlm_sql (sql_roaming): sql_set_user escaped user --> 'az50' expand: %{NAS-Port} -> 32 expand: INSERT INTO roaming_events (`uid`, `hw_address`,`event_typ rlm_sql (sql_roaming) in sql_postauth: query is INSERT INTO roaming_events rlm_sql (sql_roaming): Reserving sql socket id: 3 rlm_sql (sql_roaming): Released sql socket id: 3 ++[sql_roaming] returns ok Delaying reject of request 4657 for 1 seconds Going to the next request Waking up in 0.8 seconds. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 6

(no subject)
by Oguzhan Kayhan 29 Dec '07

29 Dec '07

Hello all, I am trying to figure out how to use rlm_perl module for authentication purposes. Whats in my mind is to use my existing IMAP server to check if account exists or not. On the wiki page of rlm_perl i see an example script as : # Function to handle accounting sub accounting { # For debugging purposes only # &log_request_attributes; # You can call another subroutine from here &test_call; return RLM_MODULE_OK; } Ok... Now.. what should be my return value for test_call subroutine to make it work. I am planning to call an Imap module here and as a return value i should return what? Im not good at perl so, any tiny help will be appreciated. I am planning to make smthing like this but i am really not sure if it works or not: sub imapLogin { my $host = shift; my $account = shift; my $password = shift; my $server = shift; # open a connection to the IMAP server if (! ($server = new Net::IMAP::Simple($host))) { return "cannot connect IMAP server"; } # login, if success return 1 (true?) and 0 (false?) if ($server->login( $account, $password )) { return RLM_MODULE_OK; } else { return RLM_MODULE_REJECT; } }

3 4

Re: I have some problem about dialup_admin , need help .
by David Wood 28 Dec '07

28 Dec '07

Hi there, In message <006601c848f9$3e710530$7301000a(a)int.ntt.co.th>, watthanachai <watthanachai(a)ntt.co.th> writes >Dear Radius Team , Radius User > >I install freeradius in freebsd 6.2 install by port > >#cd /usr/ports/sysutils/freeradius >#make install clean I think you mean /usr/ports/net/freeradius - though that doesn't change anything. I am the maintainer of net/freeradius in FreeBSD. >everything look fine , no error and can start to daemon.. > >So I install dialup admin for management radius . The port doesn't attempt to install dialup_admin at all - in fact, it completely ignores it. It is a set of scripts, really, but there is a fairly well defined FreeBSD way to install such items ready for use (see, for example, the phpMyAdmin port). If there was any demand, I could produce a dialup_admin port, though I'm not sure I have any use for it. I'm heading towards putting my user database in LDAP. >I have some problem when I want to select user information like error in this site >http://golfreeze.packetlove.com/download/error_dialup.JPG > >How could I fix this problem ? It looks as if the PHP scripts are being served rather than executed. As the README says, the scripts are PHP 4 despite having a php3 extension. In httpd.conf (/usr/local/etc/apacheXX on FreeBSD, where XX is 22 on my machines as I have Apache 2.2 installed) look for the: AddType application/x-httpd-php line. Add .php3 to the end. Restart Apache; graceful will probably be OK, but a restart will definitely work. Does it work now? Is there any reason why the dialup_admin scripts can't be renamed as .php rather than .php3? They'd work 'out of the box' on more people's systems if this was done. What is the current status of dialup_admin - does it work with PHP 5? PHP 4 is end of life, with development ceasing as of the end of this month. Best wishes, David -- David Wood david(a)wood2.org.uk

2 1

Freeradius + Postgres not working with init.d script
by Baltazar Ruiz 27 Dec '07

27 Dec '07

Hello everyone, I'm running: Freeradius 1.1.3 + Postgresql Version: 8.1.9, Release: 1.el5 on CentOS 5 My problem is that when I execute: radiusd -sxxx everything runs fine, but, when I execute: /etc/init.d/radiusd start I get the following error: Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server user@localhost:database Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (pgsql-voip): Failed to connect DB handle #0 To me it seems that everything is configured properly because it runs fine when executed manually, but I just can't find the way to make it work with the init.d script.. Thanks for your help.

3 2

NAS-IP-Address groupcheck item
by Jeff Crowe 27 Dec '07

27 Dec '07

Hi all, I am trying to deny a user from logging in through a couple of nas I have on my network. I am using freeradius 1.1.3 with mysql. In my table radgroupcheck, I have added Groupname Attribute Op Value Dial-Up NAS-IP-Address != 1.1.1.1 Dial-Up NAS-IP-Address != 2.2.2.2 The SQL check always seems to return the last value of 2.2.2.2 and never compare against the 1.1.1.1. If my user is connecting to 1.1.1.1, they will authenticate and be allowed online. Can someone please point me in the correct direction to allow me to define multiple nas servers that I can deny authentication from? Thanks and happy holidays Jeff

2 2

Re: freeradius + OpenWrt
by tran thang 27 Dec '07

27 Dec '07

Hello I am using Freeradius with Cisco AP and MS AD, Regards Thang ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, December 26, 2007 10:17:22 PM Subject: Re: freeradius + OpenWrt Hi, > Hi, > I want to know is someone is using freeradius with APs with OpenWRT > installed. I'd like to hear experiences about it. works. i wouldnt get a too complex system though - unless you are fortunate enough to have one of the routers with 32Mb of RAM and 16Mb of storage.... alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Configure Cisco Aironet 1130 with PEAP/Ms-Chap2
by Julian Stöver 27 Dec '07

27 Dec '07

Hi, after solving my problem with creating certificates i got another problem: I enabled MsCHAP in the Radius configuration and added the server as an radius authentication and accounting server and also enables aes-ccmp and wpa2 mendatory key. but if i want to login, i get the message "login faild" on the login prompt. and the radius server didn't get any requests... whats wrong in the configuration? radtest succes when i run it from my notebook from the same subnet, so it can't be the firewall... thanks for help and some hints ;) julian

3 4

Perl problem When restarting FreeRadius Deamon after adding some perl module
by Ram Akuka 27 Dec '07

27 Dec '07

Hi, i trying to configure mac-address authentication system with FreeRadius and FreeNAC. after installing the FreeRadius and FreeNAC (ubuntu 7.10) i added the following to the Radius configuration: modules: perl check_mac { module = "/opt/nac/bin/rad2vmps" } authorize: # Enable MAC lookup via VMPS: collect request data from radius check_mac authenticate: Auth-Type MAC-Auth-Bypass { check_mac } post-auth # Enable MAC lookup via VMPS: query vmps and assign vlan or deny check_mac when trying to start the radius server i get the following error: # /etc/init.d/freeradius start * Starting FreeRADIUS daemon freeradius Thu Dec 27 10:28:34 2007 : Info: Starting - reading configuration files ... /usr/sbin/freeradius: symbol lookup error: /usr/lib/perl/5.8/auto/Fcntl/Fcntl.so: undefined symbol: Perl_Tstack_sp_ptr [ OK ] when trying to run the rad2vmps script independently is working fine, heres some details : # freeradius -version freeradius: FreeRADIUS Version 1.1.6, for host i486-pc-linux-gnu, built on Jun 8 2007 at 17:17:46 Copyright (C) 2000-2007 The FreeRADIUS server project. perl -V Summary of my perl5 (revision 5 version 8 subversion 8) configuration: Platform: osname=linux, osvers=2.6.15.7, archname=i486-linux-gnu-thread-multi uname='linux terranova 2.6.15.7 #1 smp thu jul 12 14:27:56 utc 2007 i686 gnulinux ' config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=i486-linux-gnu -Dprefix=/usr -Dprivlib=/usr/share/perl/5.8 -Darchlib=/usr/lib/perl/5.8 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.8.8 -Dsitearch=/usr/local/lib/perl/5.8.8 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Uusesfio -Uusenm -Duseshrplib -Dlibperl=libperl.so.5.8.8 -Dd_dosuid -des' hint=recommended, useposix=true, d_sigaction=define usethreads=define use5005threads=undef useithreads=define usemultiplicity=define useperlio=define d_sfio=undef uselargefiles=define usesocks=undef use64bitint=undef use64bitall=undef uselongdouble=undef usemymalloc=n, bincompat5005=undef Compiler: cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64', optimize='-O2', cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include' ccversion='', gccversion='4.1.3 20070929 (prerelease) (Ubuntu 4.1.2-16ubuntu2)', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234 d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12 ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8 alignbytes=4, prototype=define Linker and Libraries: ld='cc', ldflags =' -L/usr/local/lib' libpth=/usr/local/lib /lib /usr/lib libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt perllibs=-ldl -lm -lpthread -lc -lcrypt libc=/lib/libc-2.6.1.so, so=so, useshrplib=true, libperl=libperl.so.5.8.8 gnulibc_version='2.6.1' Dynamic Linking: dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E' cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib' Characteristics of this binary (from libperl): Compile-time options: MULTIPLICITY PERL_IMPLICIT_CONTEXT PERL_MALLOC_WRAP THREADS_HAVE_PIDS USE_ITHREADS USE_LARGE_FILES USE_PERLIO USE_REENTRANT_API Built under linux Compiled at Sep 29 2007 05:57:38 @INC: /etc/perl /usr/local/lib/perl/5.8.8 /usr/local/share/perl/5.8.8 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl uname -a Linux XXXXXX 2.6.22-14-generic #1 SMP Tue Dec 18 08:02:57 UTC 2007 i686 GNU/Linx any ideas how can i fix this ? thanks in advance -- Ram

3 4

Freeradius with MS Active directory
by tran thang 27 Dec '07

27 Dec '07

Hello all, I am configuring freeradius with Cisco AP as access device and Microsoft AD as User database for users authentication by email and password but still having some bugs. So if anyone have used familiar solution please kindly guide me config radiusd.conf file so FreeRadius can communicate with MS AD. Yours Respectfully, Tran Nam Thang. ----- Original Message ---- From: Oguzhan Kayhan <oguzhank(a)bilkent.edu.tr> To: Peter Nixon <listuser(a)peternixon.net> Cc: freeradius-users(a)lists.freeradius.org Sent: Thursday, December 27, 2007 7:16:21 AM Subject: Re: Hello Peter and all, Yes i managed to work authentication via rlm_perl. I can get accept or reject without a problem. WHat i wonder is can i use it as a hybrid system as, to keep radacct logs in sql, or to get some info data from radgrouprelpy or smwhere? Or some stuff similar like this. I just wanna use rlm_perl for user/pass matching thats all. Rest should be by mysql. Or do i have to write all this modules manually in my perl script too? > Selam Oguzhan > > You need to be aware of a few things: > > Firstly, unless your clients use PAP you will not have a plain text > password > to use when loging into the IMAP server. > > Secondly, It is almost always a better idea to directly check the same > backend credential store that yoru IMAP server uses than going via the > IMAP > protocol. If its a large mail server (At bilkent for example ;-) then you > probably have an LDAP tree or SQL server at the backend which FreeRADIUS > can > directly talk to which would save several steps and protocol conversions > and > be much faster than going via IMAP. (You would also likely not have to > write > a perl module..) > > Ä°yi Ã§alÄ±Å�malar > > Peter > > On Mon 24 Dec 2007, Oguzhan Kayhan wrote: >> Hello all, >> I am trying to figure out how to use rlm_perl module for authentication >> purposes. >> Whats in my mind is to use my existing IMAP server to check if account >> exists or not. >> On the wiki page of rlm_perl i see an example script as : >> >> # Function to handle accounting >> sub accounting { >> # For debugging purposes only >> # &log_request_attributes; >> >> # You can call another subroutine from here >> &test_call; >> >> return RLM_MODULE_OK; >> } >> >> Ok... >> Now.. what should be my return value for test_call subroutine to make it >> work. I am planning to call an Imap module here and as a return value i >> should return what? >> Im not good at perl so, any tiny help will be appreciated. >> >> I am planning to make smthing like this but i am really not sure if it >> works or not: >> >> sub imapLogin { >> my $host = shift; >> my $account = shift; >> my $password = shift; >> my $server = shift; >> >> # open a connection to the IMAP server >> if (! ($server = new Net::IMAP::Simple($host))) { >> return "cannot connect IMAP server"; >> } >> >> # login, if success return 1 (true?) and 0 (false?) >> if ($server->login( $account, $password )) { >> return RLM_MODULE_OK; >> } else { >> return RLM_MODULE_REJECT; >> } >> } >> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > > -- > > Peter Nixon > http://peternixon.net/ > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

freeradius + OpenWrt
by Sergio Belkin 26 Dec '07

26 Dec '07

Hi, I want to know is someone is using freeradius with APs with OpenWRT installed. I'd like to hear experiences about it. Thanks in advance. -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1