- Freeradius-Users - lists.freeradius.org

Uninstalling free radius
by Sujatha Pelluru 12 Sep '07

12 Sep '07

Hi, Can you please tell me how to uninstall free radius code. I have downloaded free radius 1.1.6. I have to uninstall now. Please tell me the procedure. Why delete messages? Unlimited storage is just a click away. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html

2 1

two different enable passwords.
by ashish verma 12 Sep '07

12 Sep '07

Hi all, I have radius-ldap setup for authenticating network devices. I have small doubt here. Is it possible to have different enable passwords for different huntgroups? For e.g. i have 2 huntgroups. one for cisco switches and one for cisco routers and I want to have different enable passwords for both. Currently i have only one entry for enable password and that is commom for all the cisco devices. On 9/10/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: Freeradius+Active directory - router login authentciation > (Rakesh Jha) > 2. Re: Freeradius doesn't detect EAP when authenticating against > MySQL (Andrew Rowson) > 3. RE : LOGs of eap-tls authentication (inelec communication) > 4. Re: Freeradius doesn't detect EAP when authenticating against > MySQL (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 10 Sep 2007 09:21:42 +0300 > From: "Rakesh Jha" <rakesh(a)burgan.com> > Subject: RE: Freeradius+Active directory - router login authentciation > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <A928C53C7FC96746A7C07338F009DCA00C4D37(a)BB-MAIL.main.burgan.bnk> > Content-Type: text/plain; charset="us-ascii" > > Alan, > > Please see the complete output of radiusd -X as following - > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > pap: auto_header = yes > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = yes > mschap: passwd = "(null)" > mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --domain=%{mschap:NT-D > omain:-burgan_dom} --username=%{mschap:User-Name:-None} > --challenge=%{mschap:Cha > llenge:-00} --nt-response=%{mschap:NT-Response:-00}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "(null)" > tls: random_file = "/dev/urandom" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > tls: cipher_list = "(null)" > tls: check_cert_issuer = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap_tls: Unable to open DH file - (null) > rlm_eap: Failed to initialize type tls > radiusd.conf[10]: eap: Module instantiation failed. > radiusd.conf[1962] Unknown module "eap". > radiusd.conf[1909] Failed to parse authenticate section. > > As you have written 'as are most "helpful" pages not on freeradius.org', > can you please suggest some links which guide correctly to configure > radius, openssl and active directory. > > Thanks a lot, > Rakesh Jha > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan > DeKok > Sent: Monday, September 10, 2007 8:35 AM > To: FreeRadius users mailing list > Subject: Re: Freeradius+Active directory - router login authentciation > > Rakesh Jha wrote: > ... > > After following FreeRADIUS Tutorial for AD integration I am not able > to > > start radius daemon as it complains - > > > > radiusd.conf[10]: eap: Module instantiation failed. > > radiusd.conf[1962] Unknown module "eap". > > radiusd.conf[1909] Failed to parse authenticate section. > > I'm at a bit of a loss for why so many people are so insistent on > removing all useful messages. > > Attention: > Any non-official business related views, opinions and other information > presented in this electronic mail > are solely those of the sender/author. > Burgan Bank does not endorse or accept responsibility for their opinions. > If you are not the addressed > indicated in this mail or responsible for delivering this message to the > intended, > you should delete this message and notify the sender immediately. > ------------------------------------------------------- > Burgan Bank S.A.K > www.burgan.com > > > > ------------------------------ > > Message: 2 > Date: Mon, 10 Sep 2007 08:47:09 +0100 > From: Andrew Rowson <freeradius(a)growse.com> > Subject: Re: Freeradius doesn't detect EAP when authenticating against > MySQL > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <b03eaa106466517b3d809c38044273f9(a)ticklemail.mrmen.home> > Content-Type: text/plain; charset="UTF-8" > > > > On Mon, 10 Sep 2007 07:31:04 +0200, Alan DeKok <aland(a)deployingradius.com> > wrote: > > Andrew Rowson wrote: > >> Looking over it, it seems that a problem comes up with the MSCHAP bit: > >> > >> rlm_mschap: No User-Password configured. Cannot create LM-Password. > >> rlm_mschap: No User-Password configured. Cannot create NT-Password. > >> rlm_mschap: Told to do MS-CHAPv2 for growse with NT-Password > >> rlm_mschap: FAILED: No NT/LM-Password. Cannot perform > authentication. > >> rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > >> modcall[authenticate]: module "mschap" returns reject for request 14 > >> > >> This appears to imply that there's no User-Password entry found > anywhere > >> for the user in the database. This would be correct, as the attribute > in > >> the radcheck table is set to Cleartext-Password. Anything other than > >> Cleartext-Password and freeradius doesn't attempt an auth-type of EAP, > >> but Local instead, going back to my original problem. > > > > What does the database contain? Cleartext-Password == password, > > or Cleartext-Password := password ? > > > > The database contains Cleartext-Password == password. I've tried it with > :=, but if I remember correctly that fails as well, with the Auth-type > being set to local again. I'll see if I can get a log of that failure as > well, if it'd be helpful? > > Andrew > > > > ------------------------------ > > Message: 3 > Date: Mon, 10 Sep 2007 10:23:19 +0200 (CEST) > From: inelec communication <inelec_communication(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <60722.76768.qm(a)web26011.mail.ukl.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > hello, > running radius in debug mode doesn't give any log file ,i meen it > doesn't give logs in radiusd.log ; if you give me your result when you > have rubn radiusd -X -A perhaps i can help > > regards > > > anoop_c(a)sifycorp.com a ?crit : > > Hi 1 I am using eap-tls authentication.My setup is working well with > certificates. I am unable to get logs of user login ok or denied in > the radius.log file [root@anoop sbin]# radiusd -X -A Starting - > reading configuration files ... reread_config: reading radiusd.conf Config: > including file: /etc/raddb/proxy.conf Config: including file: > /etc/raddb/clients.conf Config: including file: > /etc/raddb/snmp.conf Config: including file: > /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: > prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: > logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" > main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: > hostname_lookups = no main: snmp = no main: max_request_time = 30 > main: cleanup_delay = 5 main: max_requests = 1024 main: > delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no > main: log_stripped_names > = yes main: log_file = \"/usr/local/var/log/radius/radius.log\" main: > log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = > yes main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: > user = \"(null)\" main: group = \"(null)\" main: usercollide = no > main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = > \"no\" main: nospace_pass = \"no\" main: checkrad = > \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: > retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: > default_fallback = yes proxy: dead_time = 120 proxy: > post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: > max_attributes = 200 security: reject_delay = 1 security: status_server > = no main: debug_level = 0 read_config_files: reading > dictionary read_config_files: reading naslist Using deprecated naslist > file. Support for this will go away soon. read_config_files: reading > clients > read_config_files: reading realms radiusd: entering modules > setup Module: Library search path is /usr/local/lib Module: Loaded exec > exec: wait = yes exec: program = \"(null)\" exec: input_pairs = > \"request\" exec: output_pairs = \"(null)\" exec: packet_type = > \"(null)\" rlm_exec: Wait=yes but no output defined. Did you mean > output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: > Instantiated expr (expr) Module: Loaded System unix: cache = no unix: > passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" > unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = > no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: > Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: > ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = > no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and > initialized type leap gtc: challenge = \"Password: \" > gtc: auth_type = \"PAP\" rlm_eap: Loaded and initialized type gtc tls: > rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = > 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = > \"(null)\" tls: pem_file_type = yes tls: private_key_file = > \"/etc/1x/07xwifi.pem\" tls: certificate_file = \"/etc/1x/07xwifi.pem\" > tls: CA_file = \"/etc/1x/root.pem\" tls: private_key_password = > \"password\" tls: dh_file = \"/etc/1x/DH\" tls: random_file = > \"/etc/1x/random\" tls: fragment_size = 1024 tls: include_length = yes > tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = > \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the > certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH > parameters. DH cipher suites may not work! WARNING: Fix this by running > the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized > type tls mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap > (eap) Module: Loaded preprocess preprocess: huntgroups = > \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" > preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = > 23 preprocess: with_ntdomain_hack = no preprocess: > with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess > (preprocess) Module: Loaded realm realm: format = \"suffix\" realm: > delimiter = \"@\" realm: ignore_default = no realm: ignore_null = > no Module: Instantiated realm (suffix) Module: Loaded files files: > usersfile = \"/etc/raddb/users\" files: acctusersfile = > \"/etc/raddb/acct_users\" files: preproxy_usersfile = > \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated > files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = > \"User-Name, > Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port\" Module: > Instantiated acct_unique (acct_unique) Module: Loaded detail detail: > detailfile = > \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d\" > detail: detailperm = 384 detail: dirperm = 493 detail: locking = > no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: > filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = > \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = > yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated > radutmp (radutmp) Listening on authentication *:1812 Listening on > accounting *:1813 Ready to process requests. 2 I am using certificate > based authentication so do i need to edit anything in the users > file/ Thanks and regards Anoop > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > --------------------------------- > Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! > Mail >

2 1

rlm_sql error in pre2
by Norbert Wegener 12 Sep '07

12 Sep '07

In some cases I do not have the need to query for groupmembership. When I undefine group_membership_query, I get the following error: rlm_sql (voipsipsql): Error retrieving group list^M rlm_sql (voipsipsql): Error processing groups; rejecting user Maybe an information about the non availability of groupmembership would be more helpful than an error ? Norbert Wegener

2 2

sometimes double records in radacct
by Nelson Serafica 12 Sep '07

12 Sep '07

I notice in my radacct that there are double records. See sample below: +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | RadAcctId | AcctSessionId | AcctUniqueId | UserName | AcctStartTime | AcctStopTime | ConnectInfo_start | AcctStartDelay | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | 531828 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:32 | 2007-09-12 11:20:14 | | 0 | | 531826 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:33 | 2007-09-12 11:19:14 | 33333 LAPM/V42BIS | 0 | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ I noticed that the difference (AcctStartTime,AcctStartDelay,ConnectInfo_start) are indicated in the accounting_start_query_alt parameters. If you will noticed, there are identical AcctSessionId which was supposed to be none and the difference between them is the one that is updated by accounting_start_query_alt. It must not be identical. The problem is there are identical AcctSessionId. Would it be possible that the culprit is in the accounting_start_query_alt parameters? Is the accounting_start_query failing that's why accounting_start_query_alt take over? accounting_start_query is not broken and one line only. Is there a way to increase time before accounting_start_query_alt takes over? ____________________________________________________ Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com

1 0

Fw: Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type
by Rohaizam Abu Bakar 12 Sep '07

12 Sep '07

Resent... --haizam ----- Original Message ----- From: "Rohaizam Abu Bakar" <haizam(a)myjaring.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, September 11, 2007 5:09 PM Subject: Same config 1.1.2 but not work on 1.1.7 - not set Auth-Type > > I've tried as recommended not to set Auth-Type but trying below will works > in 1.1.2 but not on my recently upgraded to 1.1.7 > > Configs:- > > ############################ > a) radiusd.conf > > authorize { > Autz-Type LDAP { > ldap1 > } > > Autz-Type ADSL { > ldapadsl1 > } > > } > authenticate { > > Auth-Type ldap1 { > ldap1 > Auth-Type ldapadsl1 { > ldapadsl1 > } > } > > b) users > > DEFAULT Huntgroup-Name == "adsl", ldapadsl1-Ldap-Group == > "ADSL", Autz-Type := ADSL > DEFAULT Autz-Type := LDAP > ################################## > > > > Results:- > > > In 1.1.2 - (Auth-Type ldap1 => working!!) > > ############################################ > > modcall: leaving group authorize (returns ok) for request 18 > Found Autz-Type LDAP > Processing the authorize section of radiusd.conf > modcall: entering group LDAP for request 18 > modcall: entering group redundant for request 18 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for test > radius_xlat: '(uid=test)' > radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with > filter (uid=test) > rlm_ldap: checking if remote access for test is allowed by dialupAccess > rlm_ldap: Added password {CRYPT}XXXXXXXX in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value > Van-Jacobson-TCP-IP & op=11 > rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 > rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & > op=11 > rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & > op=11 > rlm_ldap: Setting Auth-Type = ldap1 > rlm_ldap: user test authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap1" returns ok for request 18 > modcall: leaving group redundant (returns ok) for request 18 > modcall: leaving group LDAP (returns ok) for request 18 > rad_check_password: Found Auth-Type ldap1 > auth: type "ldap1" > > ###################################### > > > > In 1.1.7 (Auth-Type = Local => not working!!) > > ########################################## > modcall: leaving group authorize (returns ok) for request 1 > Found Autz-Type LDAP > Processing the authorize section of radiusd.conf > modcall: entering group LDAP for request 1 > modcall: entering group redundant for request 1 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for test > radius_xlat: '(uid=test)' > radius_xlat: 'ou=RADIUS,ou=People,dc=xxx,dc=xx' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in ou=RADIUS,ou=People,dc=xxx,dc=xx, with > filter (uid=test) > rlm_ldap: checking if remote access for test is allowed by dialupAccess > rlm_ldap: Added password {CRYPT}XXXXXXXXXXXXX in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding radiusFramedCompression as Framed-Compression = > Van-Jacobson-TCP-IP > rlm_ldap: Adding radiusFramedMTU as Framed-MTU = 1500 > rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol = PPP > rlm_ldap: Adding radiusServiceType as Service-Type = Framed-User > rlm_ldap: user test authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap1" returns ok for request 1 > modcall: leaving group redundant (returns ok) for request 1 > modcall: leaving group LDAP (returns ok) for request 1 > auth: type Local > auth: user supplied User-Password does NOT match local User-Password > > ###################################3 > >

1 0

How do I Instruct Freeradius to connect to postgreSQL Database on a port other than 5432?
by justice obrey 11 Sep '07

11 Sep '07

I finally managed to figure it out. In the postgresql.conf file, I put in: port = '5490' and that worked. --------------------------------- Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search.

1 0

Nas Prompt User
by Sofia Silva 11 Sep '07

11 Sep '07

I have an user configured as Nas Prompt User, when i make a login in the graphic interface i get this: login: testuser Password: RADIUS: Authentication OK Starting. RADIUS_SERVICE_TYPE = NAS-Prompt-User RADIUS_USER_NAME = testuser after that, the process finishes and returns me the original prompt. When i try to do a radius login on a tty i get the same message and then it asks me to login again. So i'm pretty sure i'm not logging in. I think i should specificate the home directory and the shell of the user, but idon't know where to do it. could you please help me?? Thanks a lot, Sofia _________________________________________________________________ ¿Cuánto vale tu auto? Tips para mantener tu carro. ¡De todo en MSN Latino Autos! http://latino.msn.com/autos/

1 0

Multiple Huntgroups for one User?
by Alexander Papenburg 11 Sep '07

11 Sep '07

Hi Freeradius-List, is it possible to give/deny access to multiple huntgroups for a single user/group? E.g.: User/group is denied to access hosts 10.0.0.1, 10.0.0.2 and 10.0.0.3 but is allowed to access all the other hosts in 10.0.0.0/24. Something like hostpools would be nice (e.g.: user/group1 can access pool1, pool2 and pool3. user2 can access pools 1+2 but is denied to access pool3). Thanks in advance, Alexander

1 0

RE : LOGs of eap-tls authentication (inelec communication)
by anoop_c＠sifycorp.com 11 Sep '07

11 Sep '07

> Message: 3 > Date: Mon, 10 Sep 2007 10:23:19 +0200 (CEST) > From: inelec communication <inelec_communication(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication > To: FreeRadius users mailing list Hi Please find my result.The authentication is working well.The problem is logs are not in radius.log file. [root@anoop fr1.1.7]# cat successlog Message-Authenticator = 0x96080298cf8084c0a353d72c9e82a3aa Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ab131c9d151752c61f18ffb09aa2c55 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1033, id=1, length=299 Message-Authenticator = 0xe6d7ba1e4458e637c60740bc57383f9e Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x8ab131c9d151752c61f18ffb09aa2c55 Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020100600d800000005616030100510100004d030146e4c9b422a11c 6b0c2a9c5e74b8a0de5e3eb0e1d8a15f49cb7cbf83ad04116a105892c006371829ccf94f1dcdc6d8 3e3d001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04be], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a0dc000000563160301004a02000046030146e4c9b59eb2f0 eb1e4eff23a4604203f5da0d54bd36842f27464dc2af678d07203e33b80dee1b655fafab80ece953 ac778f9d578cced14cc8f23c7e0e2c4335b800040016030104be0b0004ba0004b700022b30820227 30820190a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131333037353834305a170d3038303131333037353834305a 305f310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693122302006092a864886f70d01090116136a65796b756d61725f734073696679 2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c6f366d39a74d8 b66b561628be123f18f9b0a71f09b98d21b990e9a987d9acf3ceabd01df377e13da987a23f244496 dfc0609e99ee03a9f44e51033cbb84c814d9d3225aacc7c67786fcd193d57c3f5ac16d7d1b835701 52edca9ba9ff99ca4feffcb244551292fad52026afda1f876205e84a26b81cebd89fa03fd97e5f7f db0203010001a317301530130603551d25040c300a06082b06 EAP-Message = 0x010505070301300d06092a864886f70d010104050003818100a4cbb4 e6e8190d840edc9e61637a38ffa423b2a67e8d308c3005b8ec18318e94ddddbac0ccb1a15780c285 de01622608f4caded74bab6f0c9d44dfdeb648e46bdd4de3606e4c7f86e5f86472722db409baffdb 78eb6c7ad267a623e1155af13de26e83f3ce29b4f82baf551b756d2f49e5691cc1d80f6fb253b11e 7a15bf296000028630820282308201eba003020102020100300d06092a864886f70d010104050030 3b310b300906035504061302494e310b300906035504081302544e310d300b060355040a13045369 66793110300e0603550403130730377877696669301e170d30 EAP-Message = 0x37303131333037353830305a170d3038303131333037353830305a30 3b310b300906035504061302494e310b300906035504081302544e310d300b060355040a13045369 66793110300e060355040313073037787769666930819f300d06092a864886f70d01010105000381 8d0030818902818100ec232cf24bd548a586d614994a3f3b9ee699eb64a3bf9a0c90d7bc8afb3984 2c767c3613757b8d38a78ceaa6a499be55dcf997abb9963b3ef406b39f766054d8e37d35859e6bd5 ce686c01eb63a25684afb79cd6796193355bd3ae67eae642701a34d1bc93426ade87434dadfbc8a8 b0cae8137d97d2a267973f2213ebeefcfd0203010001a38195 EAP-Message = 0x308192301d0603551d0e04160414095ab44cec0cb80f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf4654b6a22307d938c91831ef0396b8e Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1033, id=2, length=209 Message-Authenticator = 0x5dc14e6f1f5361ad60a06d2bffa9e4a9 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0xf4654b6a22307d938c91831ef0396b8e Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103016d0d80000005638c150861ea8bc609ed3cfbc030630603551d 23045c305a8014095ab44cec0cb80f8c150861ea8bc609ed3cfbc0a13fa43d303b310b3009060355 04061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603 550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d01 010405000381810019a69104ce7b395ddbb7a05ae632f71c590ba34e71b9a57cbe952eabed153fda cb07eb1c8d6db397f1f47a687103025a91b0431e73beac6e788de0af02e7d49e35808652dc4b2db6 0ccbcef9245239c47c785fb5c78c79ed7dd22d60ab6c19727e EAP-Message = 0xaa68ec38e3fc5b6e7716741e1f56eba981970face974b560ba07450e cdf817160301004c0d000044020102003f003d303b310b300906035504061302494e310b30090603 5504081302544e310d300b060355040a1304536966793110300e0603550403130730377877696669 0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x378a0c3727565af6c193024a8be476bc Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1033, id=3, length=1100 Message-Authenticator = 0x2261a2046965f5b6c67629831b5ef1f5 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x378a0c3727565af6c193024a8be476bc Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0203037b0d800000037116030103410b00023100022e00022b308202 2730820190a003020102020106300d06092a864886f70d0101040500303b310b3009060355040613 02494e310b300906035504081302544e310d300b060355040a1304536966793110300e0603550403 130730377877696669301e170d3037303131373033303230385a170d303830313137303330323038 5a305f310b300906035504061302494e310b300906035504081302544e310d300b060355040a1304 536966793110300e06035504031307616e6f6f7030373122302006092a864886f70d01090116136a 65796b756d61725f7340736966792e636f6d30819f300d0609 EAP-Message = 0x2a864886f70d010101050003818d0030818902818100c530f10ae7bd 0f0fbd6bbafbcd48532c054b9afd474b7cd7ce6aa0291d664476bb1d9d143cfb4c713f5b47b5e636 3f6ceed4c3bc51ef1a35c84a100bb17b262f38923947a12f1e288ffe57fccfa92e6d12da42d9016a 8da5c07c7705c2156da206d76fd569ca589fdca309fd1703fec4b5fa77ee1257b5b9514e39b4d79d 601f0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886 f70d01010405000381810089c51110b91d0135f1a99f29ea922ff1a7738195963017d2d9dd32c81d 2782210b1329644559fc746cb77ce6f707f50efe3aa155b3d9 EAP-Message = 0x36f15183865793097ff4207baac2d26153f81f177377493db3d2a52d b063b7668b57bc0e575401a6da093e5abd9a0f147810eaf1ee2967bc2252afe0bf8b7b678914895c c3190f22eb7a1000008200803ea26a8f1b684b4c6f76f7ca07e3b3d0dd71dd459cd90f96868faf38 253fc9970fbc3e19efb321e353e982314b42e8bb66aa5b1ee540a4810d8a48a1615b8af8657a9b38 cc1caf7da1966813de8f59f372c63c4cbac4dd3ad7877bcc8fba80ca799f52efcdee1b541461ef7e 65948840305e0dbcc845d069765955affbf8b41e0f0000820080588771eb658b2403ce711f921da6 27e0b633993385a5dc7d249503ecc0c84f7bdefc5bf34c20a9 EAP-Message = 0x4b18930f40b19d87ea7d1819aa00d2e42ea7fed5f4ad7d327a0a6eee 2b2c5915e86f5c4399e75af08982a3462b8b65478ef1c88592679fd3de147e0b1153e54c4e97c8e5 3119db0b0c62b47ec818386db914820c02f63071781403010001011603010020761ad2fae86d1219 94064ff99a0de5bc0eb15df5bafe1a75fcfa20f285db803a NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0235], Certificate chain-depth=1, error=0 --> User-Name = anoop07 --> BUF-Name = 07xwifi --> subject = /C=IN/ST=TN/O=Sify/CN=07xwifi --> issuer = /C=IN/ST=TN/O=Sify/CN=07xwifi --> verify return:1 chain-depth=0, error=0 --> User-Name = anoop07 --> BUF-Name = anoop07 --> subject = /C=IN/ST=TN/O=Sify/CN=anoop07/emailAddress=jeykumar_s(a)sify.com --> issuer = /C=IN/ST=TN/O=Sify/CN=07xwifi --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], CertificateVerify TLS_accept: SSLv3 read certificate verify A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010400350d800000002b1403010001011603010020324ac90185d18d e8ead736d798e140ed642aeb31ff52849b3aa5b6f021c5aec0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5ffef94eee0c0123922689d2e6c2fe8e Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 46e4c9b5 Cleaning up request 1 ID 1 with timestamp 46e4c9b5 Cleaning up request 2 ID 2 with timestamp 46e4c9b5 Cleaning up request 3 ID 3 with timestamp 46e4c9b5 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.0.50:1033, id=4, length=209 Message-Authenticator = 0x221fc85bf9fb820395d9c8484a3fdabc Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x5ffef94eee0c0123922689d2e6c2fe8e Called-Station-Id = \"00-0F-3D-AF-DD-C1:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020400060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module \"preprocess\" returns ok for request 4 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 4 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module \"files\" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module \"eap\" returns ok for request 4 modcall: leaving group authenticate (returns ok) for request 4 Sending Access-Accept of id 4 to 192.168.0.50 port 1033 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x428d07c24a61cd12f49c7b51f54e36b19dce6fa5e42d393221d 043784abdc995 MS-MPPE-Send-Key = 0x55f256119e8b41171ac594ea1a871d302fff183d06365a3505b 6a6786eee1fc5 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = \"anoop07\" Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 4 with timestamp 46e4c9bc Nothing to do. Sleeping until we see a request. [root@anoop fr1.1.7]# > <freeradius-users(a)lists.freeradius.org> > Message-ID: <60722.76768.qm(a)web26011.mail.ukl.yahoo.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > hello, > running radius in debug mode doesn\'t give any log file ,i meen it > doesn\'t give logs in radiusd.log ; if you give me your result when you > have rubn radiusd -X -A perhaps i can help > > regards > >

3 2

can't start radius
by ann kok 10 Sep '07

10 Sep '07

Hi all When starting the radius, the error is showing "the file size is exceeding" check /var/log/freeradius/radwtmp is 2G 1/ how can I avoid it but we still keep the log file? 2/ ls the limitation in linux or in freeradius program? if it is in linux, can I increase the file size limit? I am using debian thank you ____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/

2 2