- Freeradius-Users - lists.freeradius.org

Configuration for Cisco DSL Users
by DFN Systems Office 22 Sep '07

22 Sep '07

I'm new both to freeradius and the *nix operating system. I have successfully implemented freeradius for users dialing in through Portmaster3 Access Servers using FreeRadius 1.0.1-1 on Fedora. I am currently authenticating DSL users locally on a Cisco 7206VXR Router. I would like to authenticate the DSL users on the FreeRadius Server, but attempts have been unsuccessful. The Accounting works. Even now with DSL Users set to Auth locally on the Router, Radius is faithfully logging the activity. With Radius Auth, the DSL modem will not connect and I get no entry in the Radius accounting log. AAA Debug is virtually Identical to the Local Auth output! The only difference was the line "Method=local" changed to "Method=Radius". Both log entry sets have Status = PASS and both show the virtual-access change to up! So now I'm thinking the AAA/Radius is working but I have a communications issue. When a DSL user authenticates locally, he then gets an IP address from the local pool on the Cisco. When the same DSL User authenticates on Radius, all communication seems to stop. Here are the relevant config sections from the Cisco. aaa new-model aaa authentication login default line [*currently set to local] aaa authentication ppp default group radius local [see*above] aaa authorization network default group radius local aaa accounting delay-start aaa accounting network default start-stop group radius interface Loopback1 description DSL ip address 206.206.89.1 255.255.255.0 secondary ip address 206.206.88.161 255.255.255.240 secondary ip address 206.206.86.1 255.255.255.0 interface Virtual-Template2 description DFN NEW Template ip unnumbered Loopback1 ip mroute-cache peer default ip address pool OsoGranDSL OsoGranDsl2 ppp authentication pap radius-server host [omitted] auth-port 1645 acct-port 1646 radius-server host [omitted] auth-port 1645 acct-port 1646 radius-server key [omitted] Heres an example entry from my users file: username Auth-Type := Local, User-Password == "omitted" User-Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP I think I'm close, and I have a hunch the users file settings that work for PortMasters may not be good for Cisco. Any suggestions or sample configs would be appreciated. Bill Green Dfn Systems

2 1

about FreeRADIUS password encrypt
by yangcuilin 22 Sep '07

22 Sep '07

Hello， I will appreciate it very much, if you do me a favour. My customer asks us to store the encrypted password into the FreeRADIUS (DB has Configured Mysql). The password I have passed to FreeRADIUS is clear text. Can the FreeRadius be configured like that? Pls give me some advice . Rock

2 1

Sending Cisco AV Pairs per realm
by Dan Goscomb 21 Sep '07

21 Sep '07

Hi I have a number of realms on my radius server (FreeRADIUS Version 1.1.6). All users are valid in both realms (one is for dialup, one for broadband). e.g. dang(a)dsl.realm dang(a)dial.realm All realm's are stripped so that the user (dang in the examples above) is authenticated. However, on dial.realm I need to return a couple of Cisco-Avpair attributes; how can this be done? I have tried a hints file, however although I get the message on debug: hints: Matched DEFAULT at 17 The data specifies is not sent back in the RADIUS reply. Any help would be greatly appreciated! Cheers Dan

3 3

data limit in Mikrotik with Freeradius and Mysql
by ravi sawant 21 Sep '07

21 Sep '07

Hi Does anyone have solution for limiting users with data traffic. I have working setup of Mikrotik with freeradius and mysql. Have searched on net and found one solution but I can put limit to max 4 GB data. After 4 GB the counter resets to 0. I know the reason of that. It's b'coz of the values stored in protocol are 32 bits only. Awaiting your reply. Thanks & Regards, Ravin

4 3

PAM authenticacion and groups
by Diego Woitasen 21 Sep '07

21 Sep '07

Hi, I have freeradius configured to authenticate users with PAM working fine. Now I want to add group membership checking. I have the followind users entry: DEFAULT Auth-type = PAM, Group-name == "netadmin" Service-Type = Login-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = 0 That doesn't work. I test with Group attribute too. The user that I use in radtest is member of netadmin group. One thing, the group membership must be queryed via nsswitch (getgrnam()), because the users are not local, they are in a LDAP server (I can't user the rlm_ldap now, we are in transition). What am I missing? regards, diegows -- ------------------- Diego Woitasen -------------------

3 8

Re: Configuring FreeRADIUS to use ntlm_auth
by charles＠copel.com 21 Sep '07

21 Sep '07

Ok, Alan: Thanks ... It works ... Now I am trying to "Configuring my FreeRadius to use ntlm_auth for MS-CHAP" to authenticate my NT users, ok ? After that I configure the radiusd.conf file with the necessary changes (about ntlm_auth), I am trying to test the authenticate with a valid user of my NT Domain (by radtest) and the FreeRadius reject it. The output of my FreeRadius´s console: [root@FreeRADIUS /usr/local/etc/raddb]# radtest copel\charles password localhost 0 testfreeradius Sending Access-Request of id 123 to 127.0.0.1 port 1812 User-Name = "copelcharles" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=123, length=20 The complete output of Radiusd -X: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:52444, id=67, length=64 User-Name = "copelcharles" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "copelcharles", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 67 to 127.0.0.1 port 52444 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 67 with timestamp 46ea9900 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:50643, id=123, length=64 User-Name = "copelcharles" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "copelcharles", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 123 to 127.0.0.1 port 50643 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 123 with timestamp 46ea9dec Nothing to do. Sleeping until we see a request. My samba is ok , I get to authenticate this user by "ntlm_auth" command line. Any Idea ? Thanks, Charles. Alan DeKok <aland(a)deployingradius.com> Enviado Por: freeradius-users-bounces(a)lists.freeradius.org 14/09/2007 10:32 Favor responder a FreeRadius users mailing list Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc: cco: Charles Alcantara Borba/COPEL Assunto: Re: Configuring FreeRADIUS to use ntlm_auth charles(a)copel.com wrote: > After I configure the users file with "user Auth-Type := > ntlm_auth" (for testing purposes only), my FreeRadius don´t start and > show the followings errors: > > /usr/local/etc/raddb/users[1]: Parse error (check) for entry user: > Unknown value ntlm_auth for attribute Auth-Type You also have to list "ntlm_auth" in the "authenticate" section. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 8

Unresponsive Child Crashing Server 1.1.6
by Reynolds, Walter 21 Sep '07

21 Sep '07

I am having a problem where my Freeradius service is crashing several times a day. It will follow an alert in the log with Unresponsive Child which I know is usually doe to a slow back end authentication method (usually SQL). Well I am using Kerberos as the back end and every time I debug the Kerberos server responds very quickly. I have no programming or database queries to slow things down. Even stranger is that this is a beta server and the load on it is really very light. Last three days however have lots of problems: Tue Sep 18 00:37:03 2007 : Error: WARNING: Unresponsive child (id 1210108256) for request 487 Tue Sep 18 07:27:18 2007 : Error: WARNING: Unresponsive child (id 1210108256) for request 672 Tue Sep 18 10:46:27 2007 : Error: WARNING: Unresponsive child (id 1189128544) for request 173 Tue Sep 18 12:07:55 2007 : Error: WARNING: Unresponsive child (id 1231087968) for request 127 Tue Sep 18 12:55:55 2007 : Error: WARNING: Unresponsive child (id 1210108256) for request 72 Tue Sep 18 14:59:33 2007 : Error: WARNING: Unresponsive child (id 1220598112) for request 86 Tue Sep 18 15:53:20 2007 : Error: WARNING: Unresponsive child (id 1220598112) for request 102 Tue Sep 18 17:04:41 2007 : Error: WARNING: Unresponsive child (id 1220598112) for request 104 Tue Sep 18 21:06:26 2007 : Error: WARNING: Unresponsive child (id 1189128544) for request 305 Wed Sep 19 07:51:26 2007 : Error: WARNING: Unresponsive child (id 1231087968) for request 502 Wed Sep 19 12:26:59 2007 : Error: WARNING: Unresponsive child (id 1231087968) for request 80 Wed Sep 19 14:24:48 2007 : Error: WARNING: Unresponsive child (id 1101056352) for request 76 Wed Sep 19 16:31:49 2007 : Error: WARNING: Unresponsive child (id 1356966240) for request 282 Thu Sep 20 12:47:59 2007 : Error: WARNING: Unresponsive child (id 1252067680) for request 368 Thu Sep 20 16:35:10 2007 : Error: WARNING: Unresponsive child (id 1252067680) for request 336 Thu Sep 20 20:55:50 2007 : Error: WARNING: Unresponsive child (id 1084229984) for request 256 Fri Sep 21 01:37:58 2007 : Error: WARNING: Unresponsive child (id 1325496672) for request 503 Fri Sep 21 10:13:03 2007 : Error: WARNING: Unresponsive child (id 1398925664) for request 766 Running in debug has not really shown anything as it has not shown that error or crashed, so I am unsure of how to proceed. Attached is my radiusd.conf: ========================= prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radius ## Determined by sytem administrator group = radius ## Determined by sytem administrator max_request_time = 3 #changed from default of 30 delete_blocked_requests = no cleanup_delay = 3 max_requests = 750000 # recommends 256 per client listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } listen { ipaddr = * port = 1645 type = auth } listen { ipaddr = * port = 1646 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 50 #Default of 200 to high reject_delay = 0 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 32 max_servers = 64 min_spare_servers = 8 max_spare_servers = 32 max_requests_per_server = 500 } modules { krb5 { keytab = /etc/keytab.radius.wallace service_principal = host } pap { auto_header = yes } $INCLUDE ${confdir}/eap.conf realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/detail-%Y%m%d detailperm = 0600 suppress { User-Password } } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = no perm = 0600 callerid = "yes" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } } instantiate { exec expr } authorize { preprocess suffix eap files pap } authenticate { Auth-Type Kerberos { krb5 } Auth-Type PAP { pap } eap } preacct { preprocess acct_unique suffix files } accounting { detail } session { } post-auth { } pre-proxy { } post-proxy { eap } ======================= Users file: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = `%{User-Name}`, Fall-Through = yes DEFAULT Auth-Type = Kerberos Fall-Through = 1 Can anyone give me any help on what to look at or change. Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

randomly crashing
by Matt Ashfield 21 Sep '07

21 Sep '07

Hi, We're running FR to authenticate users on our wireless network. It appears that radius is randomly stopping/crashing. I have checked logs, but have been unable to locate the problem and am wondering if someone could point me in a good location to look for reasons for the failure. I've checked the radius.log file for the past 2 failures, and all I see are: For the 2nd to last failure: Mon Sep 17 00:30:24 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Sep 17 00:31:30 2007 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Sep 17 00:31:30 2007 : Auth: Login incorrect: [s3n14] (from client hh2380 port 18045 cli 00-1B-63-C1-7E-00) Mon Sep 17 00:34:49 2007 : Auth: Login OK: [nagios] (from client nagios port 0) Mon Sep 17 00:34:58 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Sep 17 00:34:58 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Sep 17 00:36:03 2007 : Error: Discarding duplicate request from client hh2380:20008 - ID: 173 due to unfinished request 36 And for the latest failure: Mon Sep 17 12:40:25 2007 : Auth: Login incorrect (rlm_ldap: Bind as user failed): [s8r1z] (from client localhost port 30831 c li 00-1A-73-82-59-7C) Mon Sep 17 12:40:25 2007 : Auth: Login incorrect: [s8r1z] (from client hh2380 port 30831 cli 00-1A-73-82-59-7C) Mon Sep 17 12:40:33 2007 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Sep 17 12:40:33 2007 : Auth: Login incorrect: [c264c] (from client hh2380 port 30784 cli 00-11-24-C6-90-7E) In my /var/log/messages file there's nothing related to the failures. We use the following to start FR: /usr/local/sbin/radiusd -y Any advice is appreciated. Matt mda(a)unb.ca

4 6

unsubscribe
by Jacob Jarick 21 Sep '07

21 Sep '07

thanks for all the help guys, Im no longer using freeradius at work. Big thanks to every1 (excluding Alan Dekok, sorry we had our diff). Take it easy. unsubscribe

2 1

EAP (PEAP) problem with MS Win XP
by WAYNE VANDERMERWE 20 Sep '07

20 Sep '07

** High Priority ** ** Reply Requested When Convenient ** Hi, I have configure freeradius ver 1.1.5 on an MS XP Box. I need to authenticate and authorize MS Windows XP clients (people connect to Access Point manage by an 3Com wireless switch). I have set up the windos box's for EAP-PEAP and MSCHAP Here is the resaults from the debug Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.crt" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-CA.crt" tls: private_key_password = "demo" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "../etc/raddb/huntgroups" preprocess: hints = "../etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.log" detail: detailperm = 511 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "../etc/raddb/users" files: acctusersfile = "../etc/raddb/acct_users" files: preproxy_usersfile = "../etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d.log" detail: detailperm = 511 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded Counter counter: filename = "../etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1190188203 [2007-09-19 09:50:03], Next reset 1190239200 [2007-09-20 00:00:00] Module: Instantiated counter (daily) Module: Loaded radutmp radutmp: filename = "../var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 511 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d.log" detail: detailperm = 511 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d.log" detail: detailperm = 511 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (post_proxy_log) detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d.log" detail: detailperm = 511 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.219.157.232:20000, id=63, length=149 NAS-Port-Id = "2/1" Calling-Station-Id = "00-0F-CB-FA-D4-63" Called-Station-Id = "00-18-6E-95-A2-C0:ELHC" Service-Type = Framed-User EAP-Message = 0x0201001401434e393030305c3533393836303637 User-Name = "CN9000\\53986067" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 10.219.157.232 Message-Authenticator = 0x9e21864de4c626d3cfdac3077ceda7bb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '../var/log/radius/radacct/10.219.157.232/auth-detail-20070919.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.log expands to ../var/log/radius/radacct/10.219.157.232/auth-detail-20070919.log modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "53986067", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry 53986067 at line 84 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [53986067/<no User-Password attribute>] (from client elhc-network port 0 cli 00-0F-CB-FA-D4-63) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 63 to 10.219.157.232 port 20000 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 63 with timestamp 46f0d4b4 Nothing to do. Sleeping until we see a request.

3 2