- Freeradius-Users - lists.freeradius.org

Server blown up after move
by John Ellin 20 Dec '07

20 Dec '07

Hi all, Recently had to move free radius 1.1.7 from production server to test/backup server due to failed HD in RAID. config is radius + LDAP and worked fine on the old machine but, on the new machine it works fine when debugging, but not at all when running as a daemon. Output from netstat -l shows that the server is listening on the correct ports on the ('listen'ed) sockets when running as a daemon: [root@nw raddb]# netstat -l | grep radius udp 0 0 nw.4ccompany.com:radius *:* udp 0 0 nw.4ccompany.com:radius *:* udp 0 0 nw.4cco:radius-acct *:* udp 0 0 nw.4cco:radius-acct *:* (doubling up is for lo and eth0) (also tried 'bind_address = *') however output from radtest is: [...] Re-sending Access-Request of id 218 to 192.168.0.16 port 1812 User-Name = "john" User-Password = "removed" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 radclient: no response from server for ID 218 and nothing appearing in radius.log. Using radiusd -X: [root@nw raddb]# radtest john removed 192.168.0.16 0 also_removed Sending Access-Request of id 14 to 192.168.0.16 port 1812 User-Name = "john" User-Password = "removed" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 192.168.0.16:1812, id=14, length=20 Tried running in debug as radius:radius and still worked, so it doesn't appear to be a problem with config directory/file ownership. Any suggestions would be greatly appreciated... Best regards, jona.

3 2

reply from home server
by Дмитрий 20 Dec '07

20 Dec '07

Good afternoon! How to force radius to write from who exactly has not received the answer? tcpdump I see, that inquiries leave, but do not come, and in a broad gully of radius I do not see to whom it sends these inquiries... [oracle@tim6a-aaa0 raddb]$ cat /usr/local/var/log/radius/radius.log | grep Rejecting Sun Dec 2 20:58:18 2007 : Error: Rejecting request 47108 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 20:59:01 2007 : Error: Rejecting request 47114 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 20:59:32 2007 : Error: Rejecting request 47118 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 21:00:05 2007 : Error: Rejecting request 47128 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 21:01:35 2007 : Error: Rejecting request 47137 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 21:03:28 2007 : Error: Rejecting request 47150 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 5 11:43:15 2007 : Error: Rejecting request 2 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 5 11:45:01 2007 : Error: Rejecting request 15 due to lack of any response from home server localhost:10083 Fri Dec 7 08:20:18 2007 : Error: Rejecting request 5055 due to lack of any response from home server pcf:1812 Fri Dec 7 08:20:59 2007 : Error: Rejecting request 5058 due to lack of any response from home server pcf:1812 Mon Dec 10 12:37:50 2007 : Error: Rejecting request 12 due to lack of any response from home server pcf:1812 Mon Dec 10 12:38:43 2007 : Error: Rejecting request 19 due to lack of any response from home server pcf:1812 Mon Dec 10 12:41:32 2007 : Error: Rejecting request 48 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 19 15:29:37 2007 : Error: Rejecting request 38 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 19 15:31:12 2007 : Error: Rejecting request 68 due to lack of any response from home server localhost:11611 Thu Dec 20 10:42:51 2007 : Error: Rejecting request 64 due to lack of any response from home server tim6a-pdsn0:1645 Thu Dec 20 10:45:07 2007 : Error: Rejecting request 107 due to lack of any response from home server tim6a-pdsn0:1645 But home server is not tim6a-pdsn0, home server is another host Сысоев Дмитрий Александрович Сетевой администратор Отдел информационных технологий ЗАО ''Ульяновская Сотовая Связь'' Тел.: +7 (901) 947 17 31 Моб.: +7 (901) 947 02 71 Факс: +7 (8422) 43 51 99

2 1

RE: SALE 70% OFF on Pfizer
by VIAGRA � Official Site 20 Dec '07

20 Dec '07

1 0

Can I get group-name from Active-directory?
by Hangjun He 20 Dec '07

20 Dec '07

FreeRADIUS 1.1.6 + samba-tools + active-directory. Can I get user's group-name by rlm_ldap? How? Following is result of ldap-search.(Using ldap client) # Paul Le, Users, test.com dn: CN=Paul Le,CN=Users,DC=test,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Paul Le sn: Levasseur distinguishedName: CN=Paul Le,CN=Users,DC=test,DC=com instanceType: 4 whenCreated: 20061118204047.0Z whenChanged: 20061120041505.0Z displayName: Paul Levasseur uSNCreated: 53309 memberOf: CN=WirelessUsers,CN=Users,DC=test,DC=com uSNChanged: 61454 name: Paul Levasseur objectGUID:: TWcfmIP0S0KptrqNYMartA== userAccountControl: 512 badPwdCount: 1 codePage: 0 countryCode: 0 badPasswordTime: 128083593151710000 lastLogoff: 0 lastLogon: 0 pwdLastSet: 128084630849843750 primaryGroupID: 513 userParameters:: bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI CAg objectSid:: AQUAAAAAAAUVAAAAFhovX/CrURQfMAbsYQQAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: paull sAMAccountType: 805306368 msNPAllowDialin: TRUE --------------------------------- 天生购物狂，狂抢购物券，你还等什么！

2 3

problem ./configure and MYSql
by Miha Bièek 19 Dec '07

19 Dec '07

Hi I am having troubles setting freeRadius to work with MySql. I 've studied the FAQ at: http://wiki.freeradius.org/index.php/FAQ#It_says_.22Could_not_link_..._file…, followed the instructions but I still can't get it to work. I'm using mysql-5.0.45-linux-i686-glibc23. I just unpacked it to /usr/local ,added a symbolic refference to it (ln -s /usr/local/mysql-5.0.45-linux-i686-glibc23 mysql) and ran the script to set up the database scripts/mysql_install_db --user=mysql. I didn't bother setting up the radius database but that shouldn't matter at this stage. location of mysql_congig: /usr/local/mysql/bin Other configuration: ubuntu linux 6.06.1 on VMWare Player, the latest version of freeRadius from cvs. //I set the path variable so it has the right path in it: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games:/usr/local/mysql/bin //To make sure: miha@virtubuntu:~/radiusd$ echo $PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games:/usr/local/mysql/bin miha@virtubuntu:~/radiusd$ export PATH //the tutorial suggest i should do a export //$PATH, but that doesnt work miha@virtubuntu:~/radiusd$ sudo ./configure | grep mysql_config //it outputs several lines, including unpopular: checking for mysql_config... no configure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: mysql headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: sql submodule 'mysql' disabled //I also tried to use it with lib dir and include-dir: miha@virtubuntu:~/radiusd$ sudo ./configure --with-mysql-lib-dir=/usr/local/mysql/lib -with-mysql-include-dir=/usr/local/mysql/include | grep mysql_config //Result: checking for mysql_config... no configure: WARNING: mysql headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: sql submodule 'mysql' disabled //so it still doesn't find include dir?? Am I missing something ? Please HELP, i'm running out ideas, time and luck. Is it possible that the problem lies in the compiler ? I installed g++, because i was having troubles with gcc. I can change the OS or Mysql version if that is the problem. The official page says that freeRadius works "out of the box" with MySql. Does anyone know a configuration that works ? Miha Bicek ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

With_nt_domain_hack +XPSup +LDAP
by Dow, Corey 19 Dec '07

19 Dec '07

Hi All, I'm trying to setup an XP supplicant that authenticates through my NAS to an OpenLDAP server. The problem is that the native authentication provided by MS shows the user as MYDOMAIN\\user or MYPC\\user. As a result, the LDAP searches fail to find this user. The radiusd.conf file shows with_nt_domain_hack as a way to strip this. I tried this and it works for MD5 but not for PEAP. With PEAP, there is a notification that the eap identity doesn't match. Can someone point me to how to correctly configure this? The radiusd.conf states to use the realm module instead of with_nt_domain_hack, but I couldn't figure out how to set it up properly. I apologize if this has been covered before. I searched but couldn't find anything definitive. An example would be greatly appreciated. Thanks, Corey Corey Dow Solution Test Center Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747 Tel : 1-916-785-8003

2 1

PEAP version 1 is supported in freeradius?
by Raghavendra. S 19 Dec '07

19 Dec '07

Hi, Does latest snapshot release of freeradius supports PEAP versions 0 and 1 ? or only 0 is supported? -- Regards & Thanks Raghavendra. S

2 3

Re: Help w/ pam radius
by Jeff Fishbaugh 19 Dec '07

19 Dec '07

Seems like I am getting closer possibly, but I see an error in radius.log -- could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow. Basically, I go to login to my pam_radius host, user exists in local password file with no pass, user/pass in RADIUS/LDAP, and when I login the SSH session immediately exits and I see the below in radius.log. If I use a login not in the local password file, but it is in RADIUS/LDAP then I get an access denied and no mention of the below error. I am not even starting TLS so why is it even complaining about it??? I am also curious what this means -- rlm_exec: Wait=yes but no output defined. Did you mean output=none? Appreciate any help. Thanks! Tue Dec 18 19:32:48 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Dec 18 19:32:48 2007 : Info: Ready to process requests. Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:35:55 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:36:03 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow ----- Original Message ----- From: Jeff Fishbaugh To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, December 18, 2007 2:13 PM Subject: Help w/ pam radius Hello: I am having trouble getting pam_radius working and was wondering if someone might be of help since I followed the INSTALL instructions as well as a howto (as provided by the Wikid folks) and I am still coming up short getting it working. Here are some of my details - My PAM is such it is by service (Fedora 7 -- 0.99.7.1-5.1)....sshd being what I am most interested in, the default config for it looks like the below on a host I want talking to radius. What does this need to look like in terms of the pam_radius_auth.so related stanzas to get it working? Neither the INSTALL instructions or a howto I found would work. /etc/pam.d/sshd (default below) #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so - My Radius box runs freeradius (freeradius-1.1.7-3.1) with LDAP (fedora-ds) backending it with the user/pass info, got it working for Cisco's but have yet to get PAM working. I just get 'Access denied' -- tried the later with a user defined on the host with no password or with a password and won't work. Pretty simple, no huntgroups or anythig like that just plain and simple binding against LDAP. I think what I am looking for are... 1- Pam configuration on the host (ie- /etc/pam.d/sshd) 2- Pam configuration requirements as far as the radius server is concerned. Be helpful to see what all I might need that I am possibly missing in conf files. Thank you!

1 0

LDAP auth then file auth
by Ancalagon 18 Dec '07

18 Dec '07

Hi, I want to have the following authentication path. First I check in the ldap to see if a user is defined. If yes, I check his userPassword If the password is good, allow access (send access-accept packet) Else if the password is bad, reject access (send access-reject packet) If the user is not defined in the ldap, I check in the users file for an entry. During testing period, I add an DEFAULT section that allow access. At the end of the users file, I had another DEFAULT section for a reject. But, when I made a test with a valid user in the LDAP, even if the password is valid the users file is also checked. How could I avoid that? I try with Fall-Through yes or no but I was unable to get a valid status (if ldap is ok, then stop, if not, go to default users entry) Here my configuration and the logs: Thanks for any help users file : ------------ DEFAULT Auth-Type := CHAP Reply-Message := "Valid MAC-ADDRESS, access granted -> %{Calling-station-Id} [ %{NAS-IP-ADDRESS}::%{NAS-PORT} ]", Exec-Program = /etc/raddb/scripts/radius_access_request.sh, Fall-Through = yes DEFAULT Auth-Type := Accept Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 1, Reply-Message := "Access Granted (temporary) -> %{Calling-station-Id} [ %{NAS-IP-ADDRESS}::%{NAS-PORT} ]", Exec-Program = /etc/raddb/scripts/radius_access_request.sh, Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message := "Access denied -> %{Calling-station-Id} [ %{NAS-IP-ADDRESS}::%{NAS-PORT} ]", Fall-Through = no radius.conf file : ------------------ ldap { server = "ip.address" identity = "valid cn that work" password = ***** basedn = "dc=comiteri,dc=be" basefilter = "(objectclass=radiusProfile)" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" #access_attr = "userPassword" password_attribute = userPassword dictionary_mapping = ${raddbdir}/ldap.attrmap compare_check_items = yes ldap_connections_number = 5 edir_account_policy_check=no start_tls = no timeout = 4 timelimit = 3 net_timeout = 1 } # ######### # # AUTHORIZE # # ######### # authorize { preprocess chap #mschap #suffix ldap eap #pap checkval-Calling-Station-Id checkval-Called-Station-Id checkval-NAS-Port checkval-NAS-IP-Address checkval-NAS-Identifier files } # ############ # # AUTHENTICATE # # ############ # authenticate { #Auth-Type PAP { # pap #} Auth-Type LDAP { ldap } Auth-Type CHAP { chap } #Auth-Type MS-CHAP { # mschap #} #unix eap } ldap.attr file : ---------------- checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem Calling-Station-Id radiusCallingStationId checkItem User-Password userPassword replyItem Reply-Message description replyItem User-Password userPassword LOG : (-X -A) --------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/clients.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/eap.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/sql.conf main: prefix = "/usr/local/freeradius-1.1.7" main: localstatedir = "/usr/local/freeradius-1.1.7/var" main: logdir = "/usr/local/freeradius-1.1.7/var/log/radius" main: libdir = "/usr/local/freeradius-1.1.7/lib" main: radacctdir = "/usr/local/freeradius-1.1.7/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/freeradius-1.1.7/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/freeradius-1.1.7/var/run/radiusd/radiusd.pid" main: bind_address = ip.address IP address [ip.address] main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/freeradius-1.1.7/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius-1.1.7/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "ip.address" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=validcn,dc=be" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "+jvvS2psV9kYN5ylTneJhcZoI+Q+uxjfPtEKYKVv3PeGn6MvBwRvMQ==" ldap: basedn = "dc=comiteri,dc=be" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/freeradius-1.1.7/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = yes ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius-1.1.7/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP description mapped to RADIUS Reply-Message rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x5555557a49d0 Module: Instantiated ldap (ldap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/freeradius-1.1.7/etc/raddb/cacerts/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/BALIN.pem" tls: certificate_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/BALIN.pem" tls: CA_file = "(null)" tls: private_key_password = "ggA7cOHR0rdjfg==" tls: dh_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/dh" tls: random_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/freeradius-1.1.7/etc/raddb/huntgroups" preprocess: hints = "/usr/local/freeradius-1.1.7/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval-Calling-Station-Id) checkval: item-name = "Called-Station-Id" checkval: check-name = "Called-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Called-Station-Id for attribute 30 Module: Instantiated checkval (checkval-Called-Station-Id) checkval: item-name = "NAS-Port" checkval: check-name = "NAS-Port" checkval: data-type = "integer" checkval: notfound-reject = no rlm_checkval: Registered name NAS-Port for attribute 5 Module: Instantiated checkval (checkval-NAS-Port) checkval: item-name = "NAS-IP-Address" checkval: check-name = "NAS-IP-Address" checkval: data-type = "ipAddr" checkval: notfound-reject = no rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Instantiated checkval (checkval-NAS-IP-Address) checkval: item-name = "NAS-Identifier" checkval: check-name = "NAS-Identifier" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name NAS-Identifier for attribute 32 Module: Instantiated checkval (checkval-NAS-Identifier) Module: Loaded files files: usersfile = "/usr/local/freeradius-1.1.7/etc/raddb/users" files: acctusersfile = "/usr/local/freeradius-1.1.7/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/freeradius-1.1.7/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/freeradius-1.1.7/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/usr/local/freeradius-1.1.7/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication ip.address:1812 Listening on accounting ip.address:1813 Ready to process requests. rad_recv: Access-Request packet from host ip.address.NAS:1024, id=170, length=185 Framed-MTU = 9178 NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 15 NAS-Port-Type = Ethernet NAS-Port-Id = "15" Called-Station-Id = "Called-Station-Id-MAC" Calling-Station-Id = "Calling-Station-Id-MAC" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" CHAP-Password = 0x11f16451432a20e7684564ce9cba7a82b0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for mac-client-stripped radius_xlat: '(uid=mac-client-stripped)' radius_xlat: 'dc=comiteri,dc=be' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ip.address:389, authentication 0 rlm_ldap: bind as cn=validcn/***** to ip.address:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=comiteri,dc=be, with filter (uid=mac-client-stripped) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: Calling-Station-Id-MAC rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval-Calling-Station-Id" returns notfound for request 0 rlm_checkval: Item Name: Called-Station-Id, Value: Called-Station-Id-MAC rlm_checkval: Could not find attribute named Called-Station-Id in check pairs modcall[authorize]: module "checkval-Called-Station-Id" returns notfound for request 0 rlm_checkval: Item Name: NAS-Port, Value: rlm_checkval: Could not find attribute named NAS-Port in check pairs modcall[authorize]: module "checkval-NAS-Port" returns notfound for request 0 rlm_checkval: Item Name: NAS-IP-Address, Value: ip.address.NAS rlm_checkval: Could not find attribute named NAS-IP-Address in check pairs modcall[authorize]: module "checkval-NAS-IP-Address" returns notfound for request 0 rlm_checkval: Item Name: NAS-Identifier, Value: switch-8-00-1 rlm_checkval: Could not find attribute named NAS-Identifier in check pairs modcall[authorize]: module "checkval-NAS-Identifier" returns notfound for request 0 users: Matched entry DEFAULT at line 9 radius_xlat: 'Valid MAC-ADDRESS, access granted -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' users: Matched entry DEFAULT at line 14 radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' Login OK: [mac-client-stripped] (from client switch-8-00-1 port 15 cli Calling-Station-Id-MAC) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[post-auth]: module "detail" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 170 to ip.address.NAS port 1024 Reply-Message := "Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host ip.address.NAS:1025, id=171, length=118 Acct-Session-Id = "002100002E6F" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 15 Calling-Station-Id = "Calling-Station-Id-MAC" Service-Type = Framed-User NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 15,Client-IP-Address = ip.address.NAS,NAS-IP-Address = ip.address.NAS,Acct-Session-Id = "002100002E6F",User-Name = "mac-client-stripped"' rlm_acct_unique: Acct-Unique-Session-ID = "d89c04f3e92e2152". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "mac-client-stripped", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radutmp' radius_xlat: 'mac-client-stripped' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 171 to ip.address.NAS port 1025 Finished request 1 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 170 with timestamp 4767e9aa Cleaning up request 1 ID 171 with timestamp 4767e9aa Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host ip.address.NAS:1025, id=172, length=154 Acct-Session-Id = "002100002E6F" Acct-Status-Type = Stop Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 15 Calling-Station-Id = "Calling-Station-Id-MAC" Service-Type = Framed-User NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Acct-Terminate-Cause = 0 Acct-Session-Time = 25 Acct-Input-Octets = 1280 Acct-Output-Octets = 2907 Acct-Input-Packets = 20 Acct-Output-Packets = 25 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 15,Client-IP-Address = ip.address.NAS,NAS-IP-Address = ip.address.NAS,Acct-Session-Id = "002100002E6F",User-Name = "mac-client-stripped"' rlm_acct_unique: Acct-Unique-Session-ID = "d89c04f3e92e2152". modcall[preacct]: module "acct_unique" returns ok for request 2 rlm_realm: No '@' in User-Name = "mac-client-stripped", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 2 modcall[preacct]: module "files" returns noop for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[accounting]: module "detail" returns ok for request 2 modcall[accounting]: module "unix" returns ok for request 2 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radutmp' radius_xlat: 'mac-client-stripped' modcall[accounting]: module "radutmp" returns ok for request 2 modcall: leaving group accounting (returns ok) for request 2 Sending Accounting-Response of id 172 to ip.address.NAS port 1025 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 172 with timestamp 4767e9c4 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host ip.address.NAS:1024, id=173, length=185 Framed-MTU = 9178 NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 15 NAS-Port-Type = Ethernet NAS-Port-Id = "15" Called-Station-Id = "Called-Station-Id-MAC" Calling-Station-Id = "Calling-Station-Id-MAC" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" CHAP-Password = 0x12cbd98b2407d03051341a5bd92aaeaf4a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for mac-client-stripped radius_xlat: '(uid=mac-client-stripped)' radius_xlat: 'dc=comiteri,dc=be' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=comiteri,dc=be, with filter (uid=mac-client-stripped) rlm_ldap: Added password mac-client-stripped in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "mac-client-stripped" rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id == "Calling-Station-Id-MAC" rlm_ldap: extracted attribute Calling-Station-Id from generic item Calling-Station-Id == "Calling-Station-Id-MAC" rlm_ldap: extracted attribute Called-Station-Id from generic item Called-Station-Id == "Called-Station-Id-MAC" rlm_ldap: extracted attribute NAS-Port from generic item NAS-Port == "15" rlm_ldap: extracted attribute NAS-IP-Address from generic item NAS-IP-Address == "ip.address.NAS" rlm_ldap: extracted attribute NAS-Identifier from generic item NAS-Identifier == "switch-8-00-1" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding userPassword as User-Password = "mac-client-stripped" rlm_ldap: Adding description as Reply-Message = "Server" rlm_ldap: extracted attribute Tunnel-Type from generic item tunnel-type = "VLAN" rlm_ldap: extracted attribute Tunnel-Medium-Type from generic item tunnel-medium-type = "6" rlm_ldap: extracted attribute Tunnel-Private-Group-Id from generic item tunnel-private-group-ID = "4" rlm_ldap: user mac-client-stripped authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 rlm_checkval: Item Name: Calling-Station-Id, Value: Calling-Station-Id-MAC rlm_checkval: Value Name: Calling-Station-Id, Value: Calling-Station-Id-MAC modcall[authorize]: module "checkval-Calling-Station-Id" returns ok for request 3 rlm_checkval: Item Name: Called-Station-Id, Value: Called-Station-Id-MAC rlm_checkval: Value Name: Called-Station-Id, Value: Called-Station-Id-MAC modcall[authorize]: module "checkval-Called-Station-Id" returns ok for request 3 rlm_checkval: Item Name: NAS-Port, Value: rlm_checkval: Value Name: NAS-Port, Value: 15 modcall[authorize]: module "checkval-NAS-Port" returns ok for request 3 rlm_checkval: Item Name: NAS-IP-Address, Value: ip.address.NAS rlm_checkval: Value Name: NAS-IP-Address, Value: ip.address.NAS modcall[authorize]: module "checkval-NAS-IP-Address" returns ok for request 3 rlm_checkval: Item Name: NAS-Identifier, Value: switch-8-00-1 rlm_checkval: Value Name: NAS-Identifier, Value: switch-8-00-1 modcall[authorize]: module "checkval-NAS-Identifier" returns ok for request 3 users: Matched entry DEFAULT at line 9 radius_xlat: 'Valid MAC-ADDRESS, access granted -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' users: Matched entry DEFAULT at line 14 radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' Login OK: [mac-client-stripped] (from client switch-8-00-1 port 15 cli Calling-Station-Id-MAC) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[post-auth]: module "detail" returns ok for request 3 modcall: leaving group post-auth (returns ok) for request 3 Sending Access-Accept of id 173 to ip.address.NAS port 1024 User-Password = "mac-client-stripped" Reply-Message := "Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host ip.address.NAS:1025, id=174, length=118 Acct-Session-Id = "002100002E70" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 15 Calling-Station-Id = "Calling-Station-Id-MAC" Service-Type = Framed-User NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 4 modcall[preacct]: module "preprocess" returns noop for request 4 rlm_acct_unique: Hashing 'NAS-Port = 15,Client-IP-Address = ip.address.NAS,NAS-IP-Address = ip.address.NAS,Acct-Session-Id = "002100002E70",User-Name = "mac-client-stripped"' rlm_acct_unique: Acct-Unique-Session-ID = "72d16234c91ae248". modcall[preacct]: module "acct_unique" returns ok for request 4 rlm_realm: No '@' in User-Name = "mac-client-stripped", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 4 modcall[preacct]: module "files" returns noop for request 4 modcall: leaving group preacct (returns ok) for request 4 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 4 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[accounting]: module "detail" returns ok for request 4 modcall[accounting]: module "unix" returns ok for request 4 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radutmp' radius_xlat: 'mac-client-stripped' modcall[accounting]: module "radutmp" returns ok for request 4 modcall: leaving group accounting (returns ok) for request 4 Sending Accounting-Response of id 174 to ip.address.NAS port 1025 Finished request 4 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 173 with timestamp 4767e9ca Cleaning up request 4 ID 174 with timestamp 4767e9ca Nothing to do. Sleeping until we see a request. ---------------------------------------------------------------------- Free pop3 email with a spam filter. http://www.bluebottle.com/tag/5

2 1

DEFAULT entry in users file and LDAP, again
by Martin Pauly 18 Dec '07

18 Dec '07

Sorry to bother you guys again: a couple of weeks ago, I asked > > With a users file like > > DEFAULT > > User-Name = `%{User-Name}` > > > > the server complains loudly about the missing Auth-Type when asking with > > radtest > >So how do I direct the server to use LDAP without setting Auth-Type? > >Or is radtest somehow the wrong test tool in the new scenario?? Ivan advised me > Uncomment ldap in authorize and authenticate sections of radiusd.conf. and it worked. Now I'm going for a new production host and thought I'd simply copy the working radiusd.conf (with minor adjustments, of course). But again freeradius is unable to determine the proper auth-type. Static user entries and those with Auth-Type = System work fine. In radiusd.conf I have: modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } ldap ldap1 { server = "xxxxx.uni-marburg.de" identity = "uid=xxxxx,ou=xxxxx,o=Universitaet Marburg,c=DE" password = "xxxxx" basedn = "ou=people,ou=Staff,ou=Accounts,o=Universitaet Marburg,c=DE" filter = "(&(uid:caseExactMatch:=%{Stripped-User-Name:-%{User-Name}}) (!(UniMrDarfRadius=0)))" start_tls = yes tls_cacertdir = /etc/ssl/certs tls_require_cert = "demand" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 100 #timeout: # seconds to wait for LDAP query to finish default: 20 timeout = 60 #timelimit: # of seconds server has to process the query (server-side #time limit) default: 20 timelimit = 60 #net_timeout: # of seconds to wait for response of the server (network #failures) default: 10 net_timeout = 60 } [same for ldap2, ldap3] [...] } # end of modules [...] instantiate { ldap1 ldap2 ldap3 eap mschap } authorize { preprocess chap mschap suffix eap files redundant { ldap1 ldap2 ldap3 } pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant { ldap1 ldap2 ldap3 } } eap } #end of authenticate The debug output shows a successfull LDAP dialog about authorization, but then no Auth-Type is found: rad_recv: Access-Request packet from host 137.248.3.11:51358, id=100, length=57 User-Name = "pauly" User-Password = "xxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "pauly", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 64 radius_xlat: 'pauly' modcall[authorize]: module "files" returns ok for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for pauly radius_xlat: '(&(uid:caseExactMatch:=pauly) (!(UniMrDarfRadius=0)))' radius_xlat: 'ou=people,ou=Staff,ou=Accounts,o=Universitaet Marburg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to auth1.staff.uni-marburg.de:389, authentication 0 rlm_ldap: setting TLS CACert Directory to /etc/ssl/certs rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as uid=xxxxx,ou=xxxxx,o=Universitaet Marburg,c=DE/xxxxxx to auth1.staff.uni-marburg.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,ou=Staff,ou=Accounts,o=Universitaet Marburg,c=DE, with filter (&(uid:caseExactMatch:=pauly) (!(UniMrDarfRadius=0))) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user pauly authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 100 to 137.248.xxx.xxx port 51358 Thanks for help, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 7