- Freeradius-Users - lists.freeradius.org

list problem?
by Norbert Wegener 13 Sep '07

13 Sep '07

Is there a problem with the list/mailserver? The archives show newer threads, where the last message I received from the list has been from September, 10. It arrived this mornig. If I'm the only one with that problem, sorry. My other mail comes in as usual. Norbert Wegener

2 1

Reply VSA Attributes in a list
by Faqeer ALI 13 Sep '07

13 Sep '07

AOA I am using freradius-1.1.6.. In the response packet i want to add the VPS such that the VSA of one vendor attaches in a specific vendor list, ie specify the vendor once and then the list of attributes in it. By pairadd(&request->reply->vps,vp) the vps are added one after the another, but i want it such that there would be the name of the specific vendor once and list of attributes to follow behind it.. Any hints would be warmly accepted. Thanks Regards FQ ALi _________________________________________________________________ Gear up for Halo® 3 with free downloads and an exclusive offer. http://gethalo3gear.com?ocid=SeptemberWLHalo3_MSNHMTxt_1

2 1

converting pap to chap
by Stefan Kronawithleitner 13 Sep '07

13 Sep '07

Hello, I have a little problem concerning proxying of pap-auths. The existing setup is a freeradius 1.1.6, allowing auth from a NAS and PEAP against an eDirectory (ldap) userbase, which works fine. However, users of another realm should be proxied to another radius-server - which works fine for PEAP, but failes from the NAS, because the NAS can do only PAP - which is not allowed on the other radius-server. It is not possible to make CHAP-Auth from the NAS or allow PAP on the other side (which is not under my control). So far, so bad. But theoretically it should be possible, to convert a PAP-Auth to a CHAP-Auth - so i did a search in the archives and found some threads of users with the exact same problem. There was a conversation in 2003 between someone submitting a patch for a module and Alan DeKok - talking about the best solution, but there never was a conclusion - only that it is not possible without code modification. I read through the changelogs, finding nothing like that - has there been a change? Is it possible to convert PAP to CHAP? Howto? Thanks in advance, Stefan

2 1

Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type
by Rohaizam Abu Bakar 13 Sep '07

13 Sep '07

I've tried as recommended not to set Auth-Type but trying below will works in 1.1.2 but not on my recently upgraded to 1.1.7 Configs:- ############################ a) radiusd.conf authorize { Autz-Type LDAP { ldap1 } Autz-Type ADSL { ldapadsl1 } } authenticate { Auth-Type ldap1 { ldap1 Auth-Type ldapadsl1 { ldapadsl1 } } b) users DEFAULT Huntgroup-Name == "adsl", ldapadsl1-Ldap-Group == "ADSL", Autz-Type := ADSL DEFAULT Autz-Type := LDAP ################################## Results:- In 1.1.2 - (Auth-Type ldap1 => working!!) ############################################ modcall: leaving group authorize (returns ok) for request 18 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 18 modcall: entering group redundant for request 18 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by dialupAccess rlm_ldap: Added password {CRYPT}XXXXXXXX in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: Setting Auth-Type = ldap1 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 18 modcall: leaving group redundant (returns ok) for request 18 modcall: leaving group LDAP (returns ok) for request 18 rad_check_password: Found Auth-Type ldap1 auth: type "ldap1" ###################################### In 1.1.7 (Auth-Type = Local => not working!!) ########################################## modcall: leaving group authorize (returns ok) for request 1 Found Autz-Type LDAP Processing the authorize section of radiusd.conf modcall: entering group LDAP for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by dialupAccess rlm_ldap: Added password {CRYPT}XXXXXXXXXXXXX in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression = Van-Jacobson-TCP-IP rlm_ldap: Adding radiusFramedMTU as Framed-MTU = 1500 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol = PPP rlm_ldap: Adding radiusServiceType as Service-Type = Framed-User rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 modcall: leaving group redundant (returns ok) for request 1 modcall: leaving group LDAP (returns ok) for request 1 auth: type Local auth: user supplied User-Password does NOT match local User-Password ###################################3

3 4

Netscreen authentication from freeradius.
by ashish verma 12 Sep '07

12 Sep '07

Hi all, I am trying to authenticate netscreen 5gt from a radius server. I have done the following config on netscreen.. set auth-server "radius1" id 1 set auth-server "radius1" server-name "192.168.1.50" set auth-server "radius1" timeout 30 set auth-server "radius1" forced-timeout 60 set auth-server "radius1" radius port 1812 set auth-server "radius1" radius secret "testing123" set auth radius accounting port 1813 and on radius side..i have made a local user. net Cleartext-Password := "net" but i am not able to authenticate...Netscreen is not sending anythin to radius server..i can't see any logs in radius (running in debug mode). Kindly suggest.. Thanks, On 9/10/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius+Active directory - router login authentciation > (Turbo Fredriksson) > 2. two different enable passwords. (ashish verma) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 10 Sep 2007 13:06:29 +0200 > From: Turbo Fredriksson <turbo(a)dagdrivarn.se> > Subject: Re: Freeradius+Active directory - router login authentciation > To: freeradius-users(a)lists.freeradius.org > Message-ID: <878x7eok3u.fsf(a)pumba.bayour.com> > Content-Type: text/plain; charset=us-ascii > > Quoting "Rakesh Jha" <rakesh(a)burgan.com>: > > I'm far from an expert in FreeRADIUS (so take what I say with a > grane of salt), but I instantly noticed this. > > > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > > tls: check_cert_cn = "(null)" > > tls: cipher_list = "(null)" > > tls: check_cert_issuer = "(null)" > > rlm_eap_tls: Loading the certificate file as a chain > > rlm_eap_tls: Unable to open DH file - (null) > > rlm_eap: Failed to initialize type tls > > It can't open the 'DH file' (don't quite know which one that is), > but I would assume that it's some (or maybe all?) of the first > three files. Do they exist? Does the freeradius daemon have the > right to _read_ those files (are you running the daemon under some > user _not_ root). I run (default in Debian GNU/Linux) the daemon > under the 'freerad' user so this user must be able to read the > files mentioned (AND have the right to access all directory paths > before it). > > Also, the 'check_cert_cn' is empty. If you don't use it, uncomment > it in the config file. probably goes for the options 'check_cert_cn' > and 'check_cert_issuer' to. > > I DO use them, and my eap.conf file looks like this: > > ----- s n i p ----- > celia:~# egrep 'check_cert_issuer|check_cert_cn|cipher_list' > /etc/freeradius/eap.conf > check_cert_issuer = "<see below>" > check_cert_cn = %{User-Name} > cipher_list = "DEFAULT" > ----- s n i p ----- > > The 'check_cert_issuer' value is a little personal (something > I wouldn't want to post to the 'Net) but is the value > found in the 'subject' line when running the command: > > openssl x509 -subject -noout -in <cacert> > > ----- s n i p ----- > celia:~# openssl x509 -subject -noout -in /etc/ssl/CA/cacert.pem > subject= <secret> > ----- s n i p ----- > > > radiusd.conf[10]: eap: Module instantiation failed. > > radiusd.conf[1962] Unknown module "eap". > > radiusd.conf[1909] Failed to parse authenticate section. > > These will probably go away once you have fixed the tls parts > above... > > > As you have written 'as are most "helpful" pages not on freeradius.org', > > can you please suggest some links which guide correctly to configure > > radius, openssl and active directory. > > I think Alan is a little 'judgmental' (wrong choice, but I > can't quite get the exact translation of what I meant) if here. > I would to if (since!) people don't think for them self and > only follow external 'documentation' by the letter without > trying to actually understand what it means... > > Following ANY documentation require UNDERSTANDING! Not HOW, > but WHY ('... a certain option is used with a special value'). > > DISCLAIMER (before Alan slaps me :): I'm in no way better > my self - I'm lousy in reading documentation. > I only read a little here and a little there, > but I (almost) always understand the parts that > I DO read :) > > > ------------------------------ > > Message: 2 > Date: Mon, 10 Sep 2007 17:21:34 +0530 > From: "ashish verma" <ashish.scit(a)gmail.com> > Subject: two different enable passwords. > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <11b554120709100451v630a635fj48f54a6660c46216(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi all, > > I have radius-ldap setup for authenticating network devices. > > I have small doubt here. > > Is it possible to have different enable passwords for different > huntgroups? > > For e.g. i have 2 huntgroups. one for cisco switches and one for cisco > routers and I want to have different enable passwords for both. > > Currently i have only one entry for enable password and that is commom for > all the cisco devices. > > > On 9/10/07, freeradius-users-request(a)lists.freeradius.org < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. RE: Freeradius+Active directory - router login authentciation > > (Rakesh Jha) > > 2. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (Andrew Rowson) > > 3. RE : LOGs of eap-tls authentication (inelec communication) > > 4. Re: Freeradius doesn't detect EAP when authenticating against > > MySQL (Alan DeKok) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Mon, 10 Sep 2007 09:21:42 +0300 > > From: "Rakesh Jha" <rakesh(a)burgan.com> > > Subject: RE: Freeradius+Active directory - router login authentciation > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: > > <A928C53C7FC96746A7C07338F009DCA00C4D37(a)BB-MAIL.main.burgan.bnk> > > Content-Type: text/plain; charset="us-ascii" > > > > Alan, > > > > Please see the complete output of radiusd -X as following - > > > > Starting - reading configuration files ... > > reread_config: reading radiusd.conf > > Config: including file: /usr/local/etc/raddb/proxy.conf > > Config: including file: /usr/local/etc/raddb/clients.conf > > Config: including file: /usr/local/etc/raddb/snmp.conf > > Config: including file: /usr/local/etc/raddb/eap.conf > > Config: including file: /usr/local/etc/raddb/sql.conf > > main: prefix = "/usr/local" > > main: localstatedir = "/usr/local/var" > > main: logdir = "/usr/local/var/log/radius" > > main: libdir = "/usr/local/lib" > > main: radacctdir = "/usr/local/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = no > > main: log_file = "/usr/local/var/log/radius/radius.log" > > main: log_auth = no > > main: log_auth_badpass = no > > main: log_auth_goodpass = no > > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > > main: user = "(null)" > > main: group = "(null)" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/local/sbin/checkrad" > > main: proxy_requests = yes > > proxy: retry_delay = 5 > > proxy: retry_count = 3 > > proxy: synchronous = no > > proxy: default_fallback = yes > > proxy: dead_time = 120 > > proxy: post_proxy_authorize = no > > proxy: wake_all_if_all_dead = no > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > > read_config_files: reading dictionary > > read_config_files: reading naslist > > Using deprecated naslist file. Support for this will go away soon. > > read_config_files: reading clients > > read_config_files: reading realms > > radiusd: entering modules setup > > Module: Library search path is /usr/local/lib > > Module: Loaded exec > > exec: wait = yes > > exec: program = "(null)" > > exec: input_pairs = "request" > > exec: output_pairs = "(null)" > > exec: packet_type = "(null)" > > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > > Module: Instantiated exec (exec) > > Module: Loaded expr > > Module: Instantiated expr (expr) > > Module: Loaded PAP > > pap: encryption_scheme = "crypt" > > pap: auto_header = yes > > Module: Instantiated pap (pap) > > Module: Loaded CHAP > > Module: Instantiated chap (chap) > > Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: with_ntdomain_hack = yes > > mschap: passwd = "(null)" > > mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --domain=%{mschap:NT-D > > omain:-burgan_dom} --username=%{mschap:User-Name:-None} > > --challenge=%{mschap:Cha > > llenge:-00} --nt-response=%{mschap:NT-Response:-00}" > > Module: Instantiated mschap (mschap) > > Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > > Module: Instantiated unix (unix) > > Module: Loaded eap > > eap: default_eap_type = "tls" > > eap: timer_expire = 60 > > eap: ignore_unknown_eap_types = no > > eap: cisco_accounting_username_bug = no > > rlm_eap: Loaded and initialized type md5 > > rlm_eap: Loaded and initialized type leap > > gtc: challenge = "Password: " > > gtc: auth_type = "PAP" > > rlm_eap: Loaded and initialized type gtc > > tls: rsa_key_exchange = no > > tls: dh_key_exchange = yes > > tls: rsa_key_length = 512 > > tls: dh_key_length = 512 > > tls: verify_depth = 0 > > tls: CA_path = "(null)" > > tls: pem_file_type = yes > > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > > tls: private_key_password = "whatever" > > tls: dh_file = "(null)" > > tls: random_file = "/dev/urandom" > > tls: fragment_size = 1024 > > tls: include_length = yes > > tls: check_crl = no > > tls: check_cert_cn = "(null)" > > tls: cipher_list = "(null)" > > tls: check_cert_issuer = "(null)" > > rlm_eap_tls: Loading the certificate file as a chain > > rlm_eap_tls: Unable to open DH file - (null) > > rlm_eap: Failed to initialize type tls > > radiusd.conf[10]: eap: Module instantiation failed. > > radiusd.conf[1962] Unknown module "eap". > > radiusd.conf[1909] Failed to parse authenticate section. > > > > As you have written 'as are most "helpful" pages not on freeradius.org', > > can you please suggest some links which guide correctly to configure > > radius, openssl and active directory. > > > > Thanks a lot, > > Rakesh Jha > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan > > DeKok > > Sent: Monday, September 10, 2007 8:35 AM > > To: FreeRadius users mailing list > > Subject: Re: Freeradius+Active directory - router login authentciation > > > > Rakesh Jha wrote: > > ... > > > After following FreeRADIUS Tutorial for AD integration I am not able > > to > > > start radius daemon as it complains - > > > > > > radiusd.conf[10]: eap: Module instantiation failed. > > > radiusd.conf[1962] Unknown module "eap". > > > radiusd.conf[1909] Failed to parse authenticate section. > > > > I'm at a bit of a loss for why so many people are so insistent on > > removing all useful messages. > > > > Attention: > > Any non-official business related views, opinions and other information > > presented in this electronic mail > > are solely those of the sender/author. > > Burgan Bank does not endorse or accept responsibility for their > opinions. > > If you are not the addressed > > indicated in this mail or responsible for delivering this message to the > > intended, > > you should delete this message and notify the sender immediately. > > ------------------------------------------------------- > > Burgan Bank S.A.K > > www.burgan.com > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Mon, 10 Sep 2007 08:47:09 +0100 > > From: Andrew Rowson <freeradius(a)growse.com> > > Subject: Re: Freeradius doesn't detect EAP when authenticating against > > MySQL > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <b03eaa106466517b3d809c38044273f9(a)ticklemail.mrmen.home> > > Content-Type: text/plain; charset="UTF-8" > > > > > > > > On Mon, 10 Sep 2007 07:31:04 +0200, Alan DeKok < > aland(a)deployingradius.com> > > wrote: > > > Andrew Rowson wrote: > > >> Looking over it, it seems that a problem comes up with the MSCHAP > bit: > > >> > > >> rlm_mschap: No User-Password configured. Cannot create > LM-Password. > > >> rlm_mschap: No User-Password configured. Cannot create > NT-Password. > > >> rlm_mschap: Told to do MS-CHAPv2 for growse with NT-Password > > >> rlm_mschap: FAILED: No NT/LM-Password. Cannot perform > > authentication. > > >> rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > > >> modcall[authenticate]: module "mschap" returns reject for request > 14 > > >> > > >> This appears to imply that there's no User-Password entry found > > anywhere > > >> for the user in the database. This would be correct, as the attribute > > in > > >> the radcheck table is set to Cleartext-Password. Anything other than > > >> Cleartext-Password and freeradius doesn't attempt an auth-type of > EAP, > > >> but Local instead, going back to my original problem. > > > > > > What does the database contain? Cleartext-Password == password, > > > or Cleartext-Password := password ? > > > > > > > The database contains Cleartext-Password == password. I've tried it with > > :=, but if I remember correctly that fails as well, with the Auth-type > > being set to local again. I'll see if I can get a log of that failure as > > well, if it'd be helpful? > > > > Andrew > > > > > > > > ------------------------------ > > > > Message: 3 > > Date: Mon, 10 Sep 2007 10:23:19 +0200 (CEST) > > From: inelec communication <inelec_communication(a)yahoo.fr> > > Subject: RE : LOGs of eap-tls authentication > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <60722.76768.qm(a)web26011.mail.ukl.yahoo.com> > > Content-Type: text/plain; charset="iso-8859-1" > > > > hello, > > running radius in debug mode doesn't give any log file ,i meen it > > doesn't give logs in radiusd.log ; if you give me your result when you > > have rubn radiusd -X -A perhaps i can help > > > > regards > > > > > > anoop_c(a)sifycorp.com a ?crit : > > > > Hi 1 I am using eap-tls authentication.My setup is working well > with > > certificates. I am unable to get logs of user login ok or denied > in > > the radius.log file [root@anoop sbin]# radiusd -X -A Starting - > > reading configuration files ... reread_config: reading radiusd.conf > Config: > > including file: /etc/raddb/proxy.conf Config: including file: > > /etc/raddb/clients.conf Config: including file: > > /etc/raddb/snmp.conf Config: including file: > > /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf > main: > > prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" > main: > > logdir = \"/usr/local/var/log/radius\" main: libdir = > \"/usr/local/lib\" > > main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: > > hostname_lookups = no main: snmp = no main: max_request_time = 30 > > main: cleanup_delay = 5 main: max_requests = 1024 main: > > delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = > no > > main: log_stripped_names > > = yes main: log_file = \"/usr/local/var/log/radius/radius.log\" > main: > > log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass > = > > yes main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: > > user = \"(null)\" main: group = \"(null)\" main: usercollide = no > > main: lower_user = \"no\" main: lower_pass = \"no\" main: > nospace_user = > > \"no\" main: nospace_pass = \"no\" main: checkrad = > > \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: > > retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no > proxy: > > default_fallback = yes proxy: dead_time = 120 proxy: > > post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: > > max_attributes = 200 security: reject_delay = 1 security: > status_server > > = no main: debug_level = 0 read_config_files: reading > > dictionary read_config_files: reading naslist Using deprecated > naslist > > file. Support for this will go away soon. read_config_files: reading > > clients > > read_config_files: reading realms radiusd: entering modules > > setup Module: Library search path is /usr/local/lib Module: Loaded > exec > > exec: wait = yes exec: program = \"(null)\" exec: input_pairs = > > \"request\" exec: output_pairs = \"(null)\" exec: packet_type = > > \"(null)\" rlm_exec: Wait=yes but no output defined. Did you mean > > output=none? Module: Instantiated exec (exec) Module: Loaded > expr Module: > > Instantiated expr (expr) Module: Loaded System unix: cache = no > unix: > > passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = > \"(null)\" > > unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = > > no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: > > Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 > eap: > > ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = > > no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and > > initialized type leap gtc: challenge = \"Password: \" > > gtc: auth_type = \"PAP\" rlm_eap: Loaded and initialized type gtc > tls: > > rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length > = > > 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = > > \"(null)\" tls: pem_file_type = yes tls: private_key_file = > > \"/etc/1x/07xwifi.pem\" tls: certificate_file = > \"/etc/1x/07xwifi.pem\" > > tls: CA_file = \"/etc/1x/root.pem\" tls: private_key_password = > > \"password\" tls: dh_file = \"/etc/1x/DH\" tls: random_file = > > \"/etc/1x/random\" tls: fragment_size = 1024 tls: include_length = > yes > > tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list > = > > \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading > the > > certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH > > parameters. DH cipher suites may not work! WARNING: Fix this by > running > > the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized > > type tls mschapv2: with_ntdomain_hack = no > > rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap > > (eap) Module: Loaded preprocess preprocess: huntgroups = > > \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" > > preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line > = > > 23 preprocess: with_ntdomain_hack = no preprocess: > > with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = > no > > preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess > > (preprocess) Module: Loaded realm realm: format = \"suffix\" realm: > > delimiter = \"@\" realm: ignore_default = no realm: ignore_null = > > no Module: Instantiated realm (suffix) Module: Loaded files files: > > usersfile = \"/etc/raddb/users\" files: acctusersfile = > > \"/etc/raddb/acct_users\" files: preproxy_usersfile = > > \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: > Instantiated > > files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key > = > > \"User-Name, > > Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port\" Module: > > Instantiated acct_unique (acct_unique) Module: Loaded detail detail: > > detailfile = > > \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" > > detail: detailperm = 384 detail: dirperm = 493 detail: locking = > > no Module: Instantiated detail (detail) Module: Loaded radutmp > radutmp: > > filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = > > \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: > check_with_nas = > > yes radutmp: perm = 384 radutmp: callerid = yes Module: > Instantiated > > radutmp (radutmp) Listening on authentication *:1812 Listening on > > accounting *:1813 Ready to process requests. 2 I am using > certificate > > based authentication so do i need to edit anything in the users > > file/ Thanks and regards Anoop > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > --------------------------------- > > Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! > > Mail > >

2 1

How to get a Radius Client for Radius Server in Red Hat Enterprise Linux ES 3
by ravishanker_12＠zapak.com 12 Sep '07

12 Sep '07

hi all,can any one please tell me where can i get radius client for radius server suitable to Red Hat Enterprise Linux ES 3.Also please give the details of different types of radius clients available for radius server in Red Hat Linux ES 3.Also please tell me how to install and configure the radius client.......Thanks and Regards,Ravi Shanker.P

2 1

RE: Freeradius+Active directory - router login authentciation
by Rakesh Jha 12 Sep '07

12 Sep '07

Thanks a lot Fredriksson. I managed to start radius daemon successfully with your suggestions, now my next problem to test user authentication from Active directory. Using ntlm_auth I can test user authentication. When I do following - radtest ActDirectUser ActDirectUserPassword 127.0.0.1 1812 testing123 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "ActDirectUser" User-Password = "ActDirectUserPassword" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=178, length=20 And when I use IP address x.x.x.x in place of 127.0.0.1, requests are kept on being resent and ultimately I get " radclient: no response from server for ID nnn" Need more help. THANKS -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Turbo Fredriksson Sent: Monday, September 10, 2007 2:06 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: Freeradius+Active directory - router login authentciation Quoting "Rakesh Jha" <rakesh(a)burgan.com>: I'm far from an expert in FreeRADIUS (so take what I say with a grane of salt), but I instantly noticed this. > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: check_cert_cn = "(null)" > tls: cipher_list = "(null)" > tls: check_cert_issuer = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap_tls: Unable to open DH file - (null) > rlm_eap: Failed to initialize type tls It can't open the 'DH file' (don't quite know which one that is), but I would assume that it's some (or maybe all?) of the first three files. Do they exist? Does the freeradius daemon have the right to _read_ those files (are you running the daemon under some user _not_ root). I run (default in Debian GNU/Linux) the daemon under the 'freerad' user so this user must be able to read the files mentioned (AND have the right to access all directory paths before it). Also, the 'check_cert_cn' is empty. If you don't use it, uncomment it in the config file. probably goes for the options 'check_cert_cn' and 'check_cert_issuer' to. I DO use them, and my eap.conf file looks like this: ----- s n i p ----- celia:~# egrep 'check_cert_issuer|check_cert_cn|cipher_list' /etc/freeradius/eap.conf check_cert_issuer = "<see below>" check_cert_cn = %{User-Name} cipher_list = "DEFAULT" ----- s n i p ----- The 'check_cert_issuer' value is a little personal (something I wouldn't want to post to the 'Net) but is the value found in the 'subject' line when running the command: openssl x509 -subject -noout -in <cacert> ----- s n i p ----- celia:~# openssl x509 -subject -noout -in /etc/ssl/CA/cacert.pem subject= <secret> ----- s n i p ----- > radiusd.conf[10]: eap: Module instantiation failed. > radiusd.conf[1962] Unknown module "eap". > radiusd.conf[1909] Failed to parse authenticate section. These will probably go away once you have fixed the tls parts above... > As you have written 'as are most "helpful" pages not on freeradius.org', > can you please suggest some links which guide correctly to configure > radius, openssl and active directory. I think Alan is a little 'judgmental' (wrong choice, but I can't quite get the exact translation of what I meant) if here. I would to if (since!) people don't think for them self and only follow external 'documentation' by the letter without trying to actually understand what it means... Following ANY documentation require UNDERSTANDING! Not HOW, but WHY ('... a certain option is used with a special value'). DISCLAIMER (before Alan slaps me :): I'm in no way better my self - I'm lousy in reading documentation. I only read a little here and a little there, but I (almost) always understand the parts that I DO read :) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

2 1

RE: Freeradius+Active directory - router login authentciation
by Rakesh Jha 12 Sep '07

12 Sep '07

Alan, Please see the complete output of radiusd -X as following - Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-D omain:-burgan_dom} --username=%{mschap:User-Name:-None} --challenge=%{mschap:Cha llenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "(null)" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap_tls: Unable to open DH file - (null) rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. As you have written 'as are most "helpful" pages not on freeradius.org', can you please suggest some links which guide correctly to configure radius, openssl and active directory. Thanks a lot, Rakesh Jha -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, September 10, 2007 8:35 AM To: FreeRadius users mailing list Subject: Re: Freeradius+Active directory - router login authentciation Rakesh Jha wrote: ... > After following FreeRADIUS Tutorial for AD integration I am not able to > start radius daemon as it complains - > > radiusd.conf[10]: eap: Module instantiation failed. > radiusd.conf[1962] Unknown module "eap". > radiusd.conf[1909] Failed to parse authenticate section. I'm at a bit of a loss for why so many people are so insistent on removing all useful messages. Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

5 5

Re: access reject packet
by lim chee hong 12 Sep '07

12 Sep '07

i create a testuser by adding following to /etc/freeradius/users: lim User-Password == "lim" DEFAULT Auth-Type := sql Fall-Through := 1 and also change the shared radius secret for localhost in /etc/freeradius/clients.conf client 127.0.0.1 { secret = testing123 nastype = other # localhost isn't usually a NAS... }but when i ran the radtest lim lim 127.0.0.1 0 testing123the access packet was rejected.any1 can show me the guide regarding this?thanks! ----- Original Message ---- From: lim chee hong <pierre3388(a)yahoo.co.uk> To: freeradius-users(a)lists.freeradius.org Sent: Monday, September 3, 2007 11:37:25 AM Subject: access reject packet [root@localhost raddb]# radtest lim lim localhost 1645 testing123 Sending Access-Request of id 194 to 127.0.0.1 port 1812 User-Name = "lim" User-Password = "lim" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=194, length=20 this is the result when i ran my radtest for my freeradius 1.1.6 in fedora core 2. unfortunely i get the access reject packet for the result.i had edited in my radius.config and client.config but i think i did wrongly since i get the access rejected.anybody know how to solve this problem?where should i correct in the config file. thanks in advance for ur help.i'm new in freeradius and hope tat can seek the help from u all.once again thank you to u all. Send instant messages to your online friends http://uk.messenger.yahoo.com Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

How do I Instruct Freeradius to connect to postgreSQL Database on a port other than 5432?
by justice obrey 12 Sep '07

12 Sep '07

All, The PostgreSQL database that I want my freeradius-1.1.7 to connect to is running on a port different from the default 5432 and beacause of this, Freeradius is not not able to connect to the database. How do I change my fFreeradius configuration to instruct it to to the postgresql database on a port say 5490? It is the rlm_sql_postgresql driver that fails in doing this connection. Thanks for any suggestions. Below is the debug: root@dev-radius:~# /opt/freeradius/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/postgresql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/opt/freeradius/etc/raddb/huntgroups" preprocess: hints = "/opt/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_postgresql" sql: server = "localhost" sql: port = "" sql: login = "postgres" sql: password = "" sql: radius_db = "radiusdb" sql: nas_table = "nas" sql: sqltrace = yes sql: sqltracefile = "/opt/freeradius/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 25 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = '%{SQL-User-Name}' ??ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = '%{SQL-User-Name}' ??ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), AcctSessionTime = (EXTRACT(EPOCH FROM('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = (EXTRACT(EPOCH FROM('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ??ServiceType, FramedProtocol, FramedIPAddress, XAscendSessionSvrKey) ??values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval - '%{Acct-Session-Time:-0}'::interval), ??'%{Acct-Session-Time}', '%{Acct-Authentic}', ??(('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), ??(('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', ??'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', ??NULLIF('%{Framed-IP-Address}', '')::inet, '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = "INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) ??values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', ??'%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', ??NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct ??SET AcctStartTime = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), AcctStartDelay = 0, ??ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' ??AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" sql: accounting_stop_query = "UPDATE radacct ??SET AcctStopTime = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), ??AcctSessionTime = NULLIF('%{Acct-Session-Time}', '')::bigint, ??AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), ??AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), ??AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, ??FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' ??WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' ??AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" sql: accounting_stop_query_alt = "INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, ??AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ??AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) ??values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', ??'%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval - '%{Acct-Session-Time:-0}'::interval), ??('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), NULLIF('%{Acct-Session-Time}', '')::bigint, ??'%{Acct-Authentic}', '%{Connect-Info}', ??(('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), ??(('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', ??'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', ??NULLIF('%{Framed-IP-Address}', '')::inet, 0)" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "" sql: postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to postgres@localhost:/radiusdb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server postgres@localhost:radiusdb rlm_sql_postgresql: Postgresql error 'could not connect to server: Connection refused ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): starting 5 rlm_sql (sql): starting 6 rlm_sql (sql): starting 7 rlm_sql (sql): starting 8 rlm_sql (sql): starting 9 rlm_sql (sql): starting 10 rlm_sql (sql): starting 11 rlm_sql (sql): starting 12 rlm_sql (sql): starting 13 rlm_sql (sql): starting 14 rlm_sql (sql): starting 15 rlm_sql (sql): starting 16 rlm_sql (sql): starting 17 rlm_sql (sql): starting 18 rlm_sql (sql): starting 19 rlm_sql (sql): starting 20 rlm_sql (sql): starting 21 rlm_sql (sql): starting 22 rlm_sql (sql): starting 23 rlm_sql (sql): starting 24 rlm_sql (sql): Failed to connect to any SQL server. rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Ignoring unconnected handle 24.. rlm_sql (sql): Ignoring unconnected handle 23.. rlm_sql (sql): Ignoring unconnected handle 22.. rlm_sql (sql): Ignoring unconnected handle 21.. rlm_sql (sql): Ignoring unconnected handle 20.. rlm_sql (sql): Ignoring unconnected handle 19.. rlm_sql (sql): Ignoring unconnected handle 18.. rlm_sql (sql): Ignoring unconnected handle 17.. rlm_sql (sql): Ignoring unconnected handle 16.. rlm_sql (sql): Ignoring unconnected handle 15.. rlm_sql (sql): Ignoring unconnected handle 14.. rlm_sql (sql): Ignoring unconnected handle 13.. rlm_sql (sql): Ignoring unconnected handle 12.. rlm_sql (sql): Ignoring unconnected handle 11.. rlm_sql (sql): Ignoring unconnected handle 10.. rlm_sql (sql): Ignoring unconnected handle 9.. rlm_sql (sql): Ignoring unconnected handle 8.. rlm_sql (sql): Ignoring unconnected handle 7.. rlm_sql (sql): Ignoring unconnected handle 6.. rlm_sql (sql): Ignoring unconnected handle 5.. rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 25, tried to connect 0 rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 24 rlm_sql (sql): Closing sqlsocket 23 rlm_sql (sql): Closing sqlsocket 22 rlm_sql (sql): Closing sqlsocket 21 rlm_sql (sql): Closing sqlsocket 20 rlm_sql (sql): Closing sqlsocket 19 rlm_sql (sql): Closing sqlsocket 18 rlm_sql (sql): Closing sqlsocket 17 rlm_sql (sql): Closing sqlsocket 16 rlm_sql (sql): Closing sqlsocket 15 rlm_sql (sql): Closing sqlsocket 14 rlm_sql (sql): Closing sqlsocket 13 rlm_sql (sql): Closing sqlsocket 12 rlm_sql (sql): Closing sqlsocket 11 rlm_sql (sql): Closing sqlsocket 10 rlm_sql (sql): Closing sqlsocket 9 rlm_sql (sql): Closing sqlsocket 8 rlm_sql (sql): Closing sqlsocket 7 rlm_sql (sql): Closing sqlsocket 6 rlm_sql (sql): Closing sqlsocket 5 rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 --------------------------------- Boardwalk for $500? In 2007? Ha! Play Monopoly Here and Now (it's updated for today's economy) at Yahoo! Games.

3 2