- Freeradius-Users - lists.freeradius.org

The best encryption/access control scheme
by Ian Truelsen 31 Oct '07

31 Oct '07

I have become in charge of a small wireless ISP at my local marina and am looking for the best way to control access and encrypt for security. Currently I have a Linksys WRT54G router running DD-WRT firmware and a PC that I have now converted over to a linux box for freeradius, etc. The major stumbling block is that we have clients with equipment that cannot deal with WPA encryption, and so, I think, I am forced to use WEP key. Now, the main concern is access control, as in the past there have been those in the area abusing the open AP and draining all the bandwidth. So, what would be the best scheme to use for setting this up? Is a freeradius login/pass scheme with WEP key encryption the best that I can manage, or are there other options? Thanks. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com

2 1

Configure authentication via LDAP Group membership issue
by David Hobley 31 Oct '07

31 Oct '07

I have set up a VPN pointing to a FreeRadius server and have it authenticating successfully against my LDAP server, but I would also like to limit access to only those people who are a member of the VPN group. Normally, this would be simple, but because of the LDAP server I am using, the hierarchy looks like this: User Account: ldapsearch -h ldap -x -b "dc=MY,dc=DOMAIN" "(uid=firstname.lastname)" dn: uid=firstname.lastname,ou=people,dc=MY,dc=DOMAIN uidNumber: 1024 ... Group entry is: ldapsearch -h ldap -x -b "dc=MY,dc=DOMAIN" "(cn=VPN Users)" dn: cn=VPN Users,ou=groups,dc=MY,dc=DOMAIN memberUid: 1024 ... So I need to somehow configure Radius to search on me, get my uidNumber and then search on the group. If I skip the searching to get the uidNumber, I can configure the Radius (for this single account) correctly: In the ldap module I include: ... groupname_attribute = cn groupmembership_filter = "(memberUid=1024)" with the following entry in the users file: DEFAULT Auth-Type = LDAP Fall-Through = 1 DEFAULT LDAP-Group == "VPN Users" Service-Type = Administrative-User and this works as expected, but is there any way I can substitute the 1024 for an ldap search result so I can dynamically return the uidNumber for the %{User-Name} field? Thanks! Cheers, David

2 3

Turn of user acc - MySQL
by Marinko Tarlac 31 Oct '07

31 Oct '07

Hello I made small web based application and it uses MySql database. I can add user accounts, create packages, add access points etc and now I need to create script for user control. Question is next. Is it better to remove the username from radcheck table or it is better option to add access-reject atribute for specific user in radreply table. Is there any better solution. Also I'm thinking to create small perl script which I can call during auth process. I'm not sure did you understand me :)

2 1

delayed Access Reject response
by Florin Andrei 30 Oct '07

30 Oct '07

Using freeradius-1.1.7 on Linux Fedora 7. Authentication backend is "unix". Clients so far are Cisco and pam_radius_auth If authentication is correct, the reply from server is sent back to the client quick enough. If the password is incorrect, the Access Reject reply is delayed until the user enters the password the second time. It's like the server waits for the next auth attempt to send back the Reject. What could be the cause? -- Florin Andrei http://florin.myip.org/

3 3

Re: Freeradius-Users Digest, Vol 30, Issue 110
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: PAM_RADIUS_AUTH (Sobanbabu Bakthavathsalu) 2. pam_radius_auth updated spec file, please include in future releases (Florin Andrei) 3. Re: pam_radius_auth updated spec file, please include in future releases (Florin Andrei) 4. Cert Problem with EAP-TTSL, SecureW2 (1.0.5-->1.1.7) (Martin Pauly) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Oct 2007 21:31:09 +0530 From: Sobanbabu Bakthavathsalu Subject: RE: PAM_RADIUS_AUTH To: FreeRadius users mailing list Message-ID: <50E6D895B5B13C4FB2D86D295813A4830CECEC9005(a)BLRKECMBX05.ad.infosys.com> Content-Type: text/plain; charset="us-ascii" Hi Nick, Thank you for the response. There is no firewall in between the RADIUS server and Solaris server (RADIUS client), only an Cisco router with standard ACL. I have verified the ACL matches counter and found that the request from the clinet itself is not reachign the router. Is that host entries in /etc/hosts file wont work for this, do I need a DNS server for RADIUS server name authentication to work with pam_radius_auth. The server in question is not configured for any DNS server for name resolution, it uses the hosts file only. Hope this provides more information. Regards Soban ________________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [freeradius-users-bounces(a)lists.freeradius.org] On Behalf Of Nick Owen [nowen(a)wikidsystems.com] Sent: 30 October 2007 15:37 To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH On 10/30/07, Sobanbabu Bakthavathsalu wrote: > > Hi > > I am trying install the PAM_RADIUS_AUTH on a Solaris 10 server to use RADIUS for user authentication. > I have managed to successfully compile and install the pam plugin. > When I tried to telnet to the machine from a different server I am getting the following error. > > Failed looking up IP address for RADIUS server radius1 (errcode=12) > > I have made a host entry for this server name in /etc/hosts file and able to ping the RADIUS server with name. > But still its not working. > > Could you please help on resolving this. > Lots of times this is a firewall issue where the port opening is set for tcp and not UDP. check that. Check that both are using port 1812, if that is what you are using. Have you edited your telnet pam entry? I'm not familiar with solaris, but that is what I would check. More info would be helpful too. HTH, Nick -- -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS*** ------------------------------ Message: 2 Date: Tue, 30 Oct 2007 09:51:56 -0700 From: Florin Andrei Subject: pam_radius_auth updated spec file, please include in future releases To: freeradius-users(a)lists.freeradius.org Message-ID: <4727612C.8090901(a)andrei.myip.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I attached an updated spec file for pam_radius_auth. The original one fails when building as non-root. I fixed that and made a few other minor changes. It would be nice if the build system could generate this spec file from a template, automatically replace the version number inside the spec with the actual version of the pam_radius_auth tarball, and include the automatically generated spec in the tarball. That way, users could generate RPM packages out of the tarball by simply downloading the archive and running: rpmbuild -ta pam_radius...(version number here)...tar.gz Thanks, -- Florin Andrei http://florin.myip.org/ ------------------------------ Message: 3 Date: Tue, 30 Oct 2007 10:04:51 -0700 From: Florin Andrei Subject: Re: pam_radius_auth updated spec file, please include in future releases To: freeradius-users(a)lists.freeradius.org Message-ID: <47276433.7080402(a)andrei.myip.org> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Florin Andrei wrote: > I attached an updated spec file for pam_radius_auth. No, I didn't. _Now_ I did. :-/ -- Florin Andrei http://florin.myip.org/

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 108
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: web based admin (liran tal) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Oct 2007 11:29:38 +0200 From: "liran tal" Subject: Re: web based admin To: "FreeRadius users mailing list" Message-ID: <3ed55890710300229o68359039x7993dd6229412169(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Hey Michael, On 10/29/07, Hawkins, Michael wrote: > What do people recommend I use as a web front end for FreeRadius when > managing AAA on a Cisco network via FreeRadius? > > I've seen daloradius but that is geared to wireless hotspots. I've taken > a quick look at phpRADmin and also ASN but I'm not sure which one is > more mature and would like to know other peoples thoughts. Or is > dailupadmin itself good enough? > > Any advice given is very much appreciated. I personally don't think of daloRADIUS as geared towards hotspots deployment but rather have an integrated support for that. If you find it lacking any "enterprise" scale features or missing some functionality that you require I'd love to hear from you so I can push all efforts for development on those topics. Regards, Liran. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 30, Issue 108 ************************************************* CON CARIÑO MARIBEL HERNÁNDEZ LÓPEZ __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 107
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Cisco sslvpn authentication with freeradius (satish patel) 2. freeRADIUS with Active-derectory (Hangjun He) 3. Re: freeRADIUS with Active-derectory (Alan DeKok) 4. Re: SSL certificate problems (Alan DeKok) 5. Re: Class attribute in accounting record. (Alan DeKok) 6. Re: web based admin (satish patel) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Oct 2007 05:41:30 +0000 (GMT) From: satish patel Subject: Cisco sslvpn authentication with freeradius To: freeradius-users Message-ID: <47025.12580.qm(a)web8405.mail.in.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" Dear all I have cisco SSLVPN gateway and i want to authenticate user freeradius authentication server but i need more input from community what type of control i can done with it ?? Is it possible to control some user session or number of time to control is there anybody have done it ??/ $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- 5, 50, 500, 5000 - Store N number of mails in your inbox. Click here.

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 106
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: SSL certificate problems (Walter Gould) 2. Re: web based admin (Peter Nixon) 3. ??? Re: freeRADIUS + Openldap with TLS (Hangjun He) 4. Re: freeRADIUS + Openldap with TLS [sec=unclassified] (Ranner, Frank MR) 5. ??? Re: freeRADIUS + Openldap with TLS [sec=unclassified] (Hangjun He) ---------------------------------------------------------------------- Message: 1 Date: Mon, 29 Oct 2007 10:50:17 -0600 From: Walter Gould Subject: Re: SSL certificate problems To: FreeRadius users mailing list Message-ID: <47260F49.8020909(a)auburn.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: > Walter Gould wrote: > >> I am following the document "FreeRADIUS Active Directory Integration >> HOWTO" from the freeradius Wiki. I am having problems with creating >> SSL certificates. When I follow the instructions at the bottom of this >> doc and run the CA.all script, I see the following errors: >> > > Ugh. > > Download CVS head (see the web page for CVS instructions). > > $ cd raddb/certs > $ vi *.cnf ca.cnf, server.cnf to set your local parameters > $ ./bootstrap > > And you will have certificates than can be used in 1.1.x. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > Alan & list, Sorry to bother you guys again - I created new SSL certificates per your above instructions... After the certs were created, I then: 1. copied them to the /etc/raddb/certs directory 2. updated /etc/raddb/eap.conf with the certificate names & private key password 3. copied and installed the new certificate (server.pem) onto my XP laptop and 4. started radiusd in debug mode, below is the output It is acting as you describe in the FAQ - "the client sends a series of Access-Request messages, the server sends an series of Access-Challenge responses, and then... nothing happens. After a little wait, it all starts again." So, I am wondering will I need to install the hotfix as listed in the FAQ - and, will this have to be done on ALL Windows machines? I am thinking that I still do not have something configured right on my side. If I uncheck the "validate server certs" box on the XP client, I can connect and authenticate successfully. Thanks again - Walter Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server.pem" tls: certificate_file = "/etc/raddb/certs/server.pem" tls: CA_file = "/etc/raddb/certs/ca.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 131.204.xx.xx:1645, id=60, length=221 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0011.2059.66f0" Calling-Station-Id = "0016.ce3a.fe00" Service-Type = Login-User Message-Authenticator = 0xfa42a088611ca8553c138461a5e37da9 EAP-Message = 0x0203005019800000004616030100410100003d03014725fcbbd1cb646792d9608deda83403db296d7cd4d986561c01f5831c20acc500001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 1409 State = 0x727730e02c5807c72421f7f8e37c09ef NAS-IP-Address = 131.204.xx.xx NAS-Identifier = "RadiusTest" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 079c], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 60 to 131.204.xx.xx port 1645 EAP-Message = 0x0104040a19c0000007f9160301004a0200004603014725fd713883c033611cb8b22760eadd8dc008b3777cee4deeb42e53a23e662c203b8004b2a236f218a339af08991fe4da34e9a6afbdf745661c23ec631dd524d6000400160301079c0b0007980007950003bd308203b9308202a1a003020102020101300d06092a864886f70d01010405003081a8310b30090603550406130255533110300e06035504081307416c6162616d61311a30180603550407131141756275726e20556e69766572736974793120301e060355040a13174f4954202d2041756275726e20556e69766572736974793121301f06092a864886f70d0109011612676f756c64 EAP-Message = 0x77704061756275726e2e656475312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3037313032363138343132335a170d3038313032353138343132335a307e310b30090603550406130255533110300e06035504081307416c6162616d613120301e060355040a13174f4954202d2041756275726e20556e6976657273697479311830160603550403130f726164322e61756275726e2e6564753121301f06092a864886f70d0109011612676f756c6477704061756275726e2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100cce2a7fd4a1386 EAP-Message = 0xfc43465e2bdba907a0d05c91d17eddb51fde1e39d67ac9253e45d03b5a1d726807f29a41b4ffd828fd4a6a68ae665f1d23ff5ee598ed1c9733a5dc52e149a884d0683b09d90626c47e1346882b4a3758062bfbc81d11014cafdd8ae5fe5b6fbbf2f0cdbe876c626436c3c596b09a179763a3a67d5876dae7ec67bc7df8c61d9307a46597d0cd673673b1b614badfa12eb3fc44c3f9aaa29a355d8e0bf01e386616ee92b8d1a4e97d58a3ef509b08cc1e20390631cf6d744f7c76ffc560388f152c2e4e6eddd46c114f9e06711f04e9efc62138b7b37f13585063d3dcfd5c769a41c37927b033bbb8131904039cc7a611c4510b280b2b36bdbf02030100 EAP-Message = 0x01a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010074cb061838250e4537f80ee16b67a74169886627eae00e18f6a7e8f3e72350d94f286b0599abd0fbd9748b70e2b3d9d044ff342a8f77de5fa4b0b227fc3c453b624d48840b9f2637280592ac20c1a5697a23eb72af6b3fe9ca0ca7bdd7f44a9eb98b8844677107006919a9c7131deca44312d1897c3091564ff915e3f688231ba6207a77e824c3225b3b7e46e1d19d5e4cd7106fcc5a26a0ae848083af27b415d7c419f6d5ecab383d015148f51464464efc8fc248e02a3c341f2011b476100c25c61b18878b7f8b29923bbf6f1cfb EAP-Message = 0x8af640e1e0303b4951607ff084645a1042980ebec1af Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91c30afa94d34c8fd79ff73e842f10d2 Finished request 1 Going to the next request Waking up in 6 seconds... ------------------------------ Message: 2 Date: Mon, 29 Oct 2007 20:19:09 +0200 From: Peter Nixon Subject: Re: web based admin To: FreeRadius users mailing list Message-ID: <200710292019.09827.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-1" On Mon 29 Oct 2007, Hawkins, Michael wrote: > Peter, > > Yes, I was comparing TACACS+ to RADIUS - my mistake. > > Any recommendations on the most appropriate web front end for FreeRadius > when managing a Cisco network that is pointing at a FreeRadius AAA > server? It kind of depends on your backend to be honest. If you use an LDAP backend phpLDAPadmin is pretty good.. -- Peter Nixon http://peternixon.net/ ------------------------------ Message: 3 Date: Tue, 30 Oct 2007 10:38:35 +0800 (CST) From: Hangjun He Subject: ??? Re: freeRADIUS + Openldap with TLS To: FreeRadius users mailing list Message-ID: <163678.99683.qm(a)web15106.mail.cnb.yahoo.com> Content-Type: text/plain; charset="gb2312" Hi, Yes. eap.conf is part of radiusd.conf. But I can not find a variable to set key-file-password in rlm_ldap section. # Lightweight Directory Access Protocol (LDAP) ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" tnt(a)kalik.co.yu ??? You already have. eap.conf is a part of radiusd.conf. Ivan Kalik Kalik Informatika ISP Dana 29/10/2007, "Hangjun He" pi?: >Hi, > > I use freeradius 1.1.6 and Openldap 2.3.32. And now It can authenticate success( freeRADIUS + Openldap with TLS TLS encrypt.) > > My question is how to set private-key password in radiusd.conf? Is there a related variable to set, just like "private_key_password" in eap.conf . > > Thanks. > John > > >--------------------------------- >?????????? > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------- ??????????

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 105
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: web based admin (Peter Nixon) 2. RE: web based admin (Hawkins, Michael) 3. Class attribute in accounting record. (Mark J Elkins) 4. Re: Class attribute in accounting record. (Michael da Silva Pereira) 5. Re: Class attribute in accounting record. (tnt(a)kalik.co.yu) 6. Re: Class attribute in accounting record. (Mark Elkins) ---------------------------------------------------------------------- Message: 1 Date: Mon, 29 Oct 2007 15:58:13 +0200 From: Peter Nixon Subject: Re: web based admin To: freeradius-users(a)lists.freeradius.org Cc: "Hawkins, Michael" Message-ID: <200710291558.13895.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-1" On Mon 29 Oct 2007, Hawkins, Michael wrote: > Hi all, > > I am very familiar with Cisco Secure ACS for AAA of Cisco devices. I am > considering using FreeRadius at another customer site instead of Cisco > Secure ACS. > > Will I still be able to control command execution (authorization) etc > via FreeRadius? Or would I be restricted to authentication only? By using the word "still" it implies that SecureACS can do this also, but as far as I know, unless something has changed recently, cisco equipment only supports this feature with TACACS+ and not RADIUS.. Comparing a SecureACS TACACS+ server with FreeRADIUS is comparing apples and oranges... FreeRADIUS is generally MUCH more powerfull than SecureACS in its RADIUS functionality.. FreeRADIUS, doe not however support TACACS+ at present.. -- Peter Nixon http://peternixon.net/ ------------------------------ Message: 2 Date: Mon, 29 Oct 2007 10:21:32 -0400 From: "Hawkins, Michael" Subject: RE: web based admin To: Message-ID: <89FC1CD18AC0884B80C7B5E80A10DC0209FCDEB4(a)NYEXCHG1.na.ad.tullib.com> Content-Type: text/plain; charset="us-ascii" Peter, Yes, I was comparing TACACS+ to RADIUS - my mistake. Any recommendations on the most appropriate web front end for FreeRadius when managing a Cisco network that is pointing at a FreeRadius AAA server? Mike Hawkins Office: 212-208-3888 Mobile: 917-887-3614 -----Original Message----- From: Peter Nixon [mailto:listuser@peternixon.net] Sent: Monday, October 29, 2007 9:58 AM To: freeradius-users(a)lists.freeradius.org Cc: Hawkins, Michael Subject: Re: web based admin On Mon 29 Oct 2007, Hawkins, Michael wrote: > Hi all, > > I am very familiar with Cisco Secure ACS for AAA of Cisco devices. I am > considering using FreeRadius at another customer site instead of Cisco > Secure ACS. > > Will I still be able to control command execution (authorization) etc > via FreeRadius? Or would I be restricted to authentication only? By using the word "still" it implies that SecureACS can do this also, but as far as I know, unless something has changed recently, cisco equipment only supports this feature with TACACS+ and not RADIUS.. Comparing a SecureACS TACACS+ server with FreeRADIUS is comparing apples and oranges... FreeRADIUS is generally MUCH more powerfull than SecureACS in its RADIUS functionality.. FreeRADIUS, doe not however support TACACS+ at present.. -- Peter Nixon http://peternixon.net/ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The information contained in this email is confidential and may also contain privileged information. Sender does not waive confidentiality or legal privilege. If you are not the intended recipient please notify the sender immediately; you should not retain this message or disclose its content to anyone. Internet communications are not secure or error free and the sender does not accept any liability for the content of the email. Although emails are routinely screened for viruses, the sender does not accept responsibility for any damage caused. Replies to this email may be monitored. --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ------------------------------ Message: 3 Date: Mon, 29 Oct 2007 16:45:14 +0200 From: Mark J Elkins Subject: Class attribute in accounting record. To: freeradius-users(a)lists.freeradius.org Message-ID: <4725F1FA.6010800(a)posix.co.za> Content-Type: text/plain; charset=ISO-8859-1 My access provider is setting and sending me the "Class" attribute in an accounting record... I use MySQL to store such info in... and I'm using freeradius 1.1.6 in order to Capture the value - I modified all accounting "Insert" statements to.... (as an example) accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Class}')" This captures the info fine.... (yes - also changed the MySQL table) | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | Class | +-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ | 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | 0 | RADIUS | DSL AutoShapedVC | | 0 | 0 | | | | Framed-User | PPP | 1.2.4.99 | 0 | 0 | 0x4e5331 | ... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" Reading the RFC's (with FreeRadius documentation) - this should be a Char Octets kindof field... Should the access provider sent the string in ASCII rather? Did something in FreeRadius convert the ASCII to Hex? What can I do to convert this on the fly into ASCII - save a bit of space in my Database - etc. Reading the mailing-lists archives - I see that it can contain binary data - thus the Hex. Which is "better" - to change the dictionary definition from octet to string or some sort of mysql function call? (better ==> less things to remember/patch between updates) The access provider states that the info provided will always be ascii (or translate to ascii - if decoded). -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496 ------------------------------ Message: 4 Date: Mon, 29 Oct 2007 16:52:41 +0200 From: Michael da Silva Pereira Subject: Re: Class attribute in accounting record. To: FreeRadius users mailing list Message-ID: 1ImVyq-00038W-15 Content-Type: text/plain Hi Mark, The provider is obviously SAIX (ZA based ISP), Looks like SAIX are sending it through as ASCII text, on my side? Tue Sep 18 14:25:53 2007 Acct-Session-Id = "7/0/2/20.557_30429449" Framed-Protocol = PPP Framed-IP-Address = 41.242.121.175 User-Name = "XXXXXXX(a)dsl512.tradepage.co.za" X-Ascend-Connect-Progress = 60 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Virtual NAS-Port = 1913913901 NAS-Port-Id = "7/0/2/20.557" Connect-Info = "AutoShapedVC" Class = "NS1" Service-Type = Framed-User NAS-IP-Address = 196.43.27.23 Check you /share/freeradius/dictionary file and check what you have for the Class Attribute. I have the following: dictionary:ATTRIBUTE Class 25 string Kind Regards, Michael da Silva Pereira Tradepage ;) -----Original Message----- From: Mark J Elkins Reply-To: FreeRadius users mailing list To: freeradius-users(a)lists.freeradius.org Subject: Class attribute in accounting record. Date: Mon, 29 Oct 2007 16:45:14 +0200 My access provider is setting and sending me the "Class" attribute in an accounting record... I use MySQL to store such info in... and I'm using freeradius 1.1.6 in order to Capture the value - I modified all accounting "Insert" statements to.... (as an example) accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Class}')" This captures the info fine.... (yes - also changed the MySQL table) | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | Class | +-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ | 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | 0 | RADIUS | DSL AutoShapedVC | | 0 | 0 | | | | Framed-User | PPP | 1.2.4.99 | 0 | 0 | 0x4e5331 | ... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" Reading the RFC's (with FreeRadius documentation) - this should be a Char Octets kindof field... Should the access provider sent the string in ASCII rather? Did something in FreeRadius convert the ASCII to Hex? What can I do to convert this on the fly into ASCII - save a bit of space in my Database - etc. Reading the mailing-lists archives - I see that it can contain binary data - thus the Hex. Which is "better" - to change the dictionary definition from octet to string or some sort of mysql function call? (better ==> less things to remember/patch between updates) The access provider states that the info provided will always be ascii (or translate to ascii - if decoded). This email and all its contents are subject to the following disclaimer: "http://www.tradepage.net/disclaimer.aspx" ------------------------------ Message: 5 Date: Mon, 29 Oct 2007 16:20:15 +0100 From: Subject: Re: Class attribute in accounting record. To: "FreeRadius users mailing list" Message-ID: Content-Type: text/plain; charset=ISO-8859-2 You can use CHAR() in the sql statement if you recieving Class attribute ASCII encoded. Ivan Kalik Kalik Informatika ISP Dana 29/10/2007, "Mark J Elkins" pi?e: >My access provider is setting and sending me the "Class" attribute in an >accounting record... > >I use MySQL to store such info in... and I'm using freeradius 1.1.6 > >in order to Capture the value - I modified all accounting "Insert" >statements to.... (as an example) > >accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, >AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, >AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, >ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, >CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, >FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) >values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', >'%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', >'%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', >'%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', >'%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', >'%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', >'%{Class}')" > >This captures the info fine.... (yes - also changed the MySQL table) > >| RadAcctId | AcctSessionId | AcctUniqueId | >UserName | Realm | NASIPAddress | >NASPortId | NASPortType | AcctStartTime | AcctStopTime | >AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | >AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId >| AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | >AcctStartDelay | AcctStopDelay | Class | >+-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ >| 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | >xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | >Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | >0 | RADIUS | DSL AutoShapedVC | | >0 | 0 | | >| | Framed-User | PPP | 1.2.4.99 >| 0 | 0 | 0x4e5331 | > > >.... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" > >Reading the RFC's (with FreeRadius documentation) - this should be a >Char Octets kindof field... > >Should the access provider sent the string in ASCII rather? >Did something in FreeRadius convert the ASCII to Hex? >What can I do to convert this on the fly into ASCII - save a bit of >space in my Database - etc. > >Reading the mailing-lists archives - I see that it can contain binary >data - thus the Hex. >Which is "better" - to change the dictionary definition from octet to >string or some sort of mysql function call? >(better ==> less things to remember/patch between updates) >The access provider states that the info provided will always be ascii >(or translate to ascii - if decoded). > >-- > . . ___. .__ Posix Systems - Sth Africa > /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE >/ |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496 > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ Message: 6 Date: Mon, 29 Oct 2007 18:22:04 +0200 From: Mark Elkins Subject: Re: Class attribute in accounting record. To: FreeRadius users mailing list Message-ID: <1193674924.11780.8.camel@localhost> Content-Type: text/plain On Mon, 2007-10-29 at 16:45 +0200, Mark J Elkins wrote: > My access provider is setting and sending me the "Class" attribute in an > accounting record... > > I use MySQL to store such info in... and I'm using freeradius 1.1.6 Wisdom prevails.. (touching the dictionaries is probably a bad* thing to do...) I'm using ... accounting_stop_query_alt = "INSERT.... , UNHEX(SUBSTR('%{Class}',3)))" .. which keeps personal changes to one place (sql.conf and files in /etc/raddb) and saves me from upsetting Alan DeKok's karma* - a bad thing to do. -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496 ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 30, Issue 105 ************************************************* CON CARIÑO MARIBEL HERNÁNDEZ LÓPEZ __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: Access-Reject in a php script
by manIP 30 Oct '07

30 Oct '07

Hi, Have you find out any solutions to that problem? I'm waiting for an answer before modifying the source code... May be, there is a bug and the official source code should be modified as Patric did. Cheers! Khalid :) Hi all, > > Thanks again! > I've tried to put return(2) and it does not work because my client > receives > an Access-Accept. > If I let exit(2), the server does not send anything so the client fall in > time out. The user will not have access but he will make many attempts as > long as he does not receive an Access-Reject packet. Furthermore, he needs > to know what is going on... > BTW, I'm using the "NTRadPing Test Utility" client. > > hereunder is the output debug: > Module: Instantiated realm (suffix) > exec: wait = yes > exec: program = "/home/authentication.php" > exec: input_pairs = "request" > exec: output_pairs = "reply" > exec: packet_type = "Access-Request" > Module: Instantiated exec (myauth) > Module: Instantiated files (files) > exec: wait = yes > exec: program = "/home/accounting.php" > exec: input_pairs = "request" > exec: output_pairs = "reply" > exec: packet_type = "Accounting-Request" > Module: Instantiated exec (myacct) > > > rad_recv: Access-Request packet from host x.x.x.x:2658, id=49, length=58 > User-Name = "xxx" > User-Password = "xxx" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: Looking up realm "xxx" for User-Name = "xxx" > rlm_realm: No such realm "xxxx" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > Exec-Program output: > Exec-Program: returned: 2 > rlm_exec (myauth): External script failed > modcall[authorize]: module "myauth" returns fail for request 0 > modcall: leaving group authorize (returns fail) for request 0 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host xxxxx, id=49, length=58 > Discarding duplicate request from client xxxx - ID: 49 > --- Walking the entire request list --- > Waking up in 2 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 49 with timestamp 4721d900 > Nothing to do. Sleeping until we see a request. > > Thank you very much anyway! > > Patric wrote: > > > Something just occurred to me that I dont think I tried before. > > > What happens if instead of doing an > > > > > > exit(2); > > > > > > you do a > > > > > > return(2); > > > > > > This way your script will still exit clean, so freeradius wont pick it > > > up as a script failure, but hopefully will still get the result? > > > > No. If the script succeeds, the output is either a text message, or > > RADIUS attributes that go into an Access-Accept. > > > > If the script fails, the server sends an Access-Reject. > > > > Stop playing games with PHP and post the output of "radiusd -X". I'll > > bet money that the solution is right there in the debug output. > > > > Alan DeKok. > > >

3 4