- Freeradius-Users - lists.freeradius.org

Dialup admin online user page & real online user different
by hyunok 06 Sep '07

06 Sep '07

Hello, I have a freeradius 1.1.7 server setup with ppp and pptp using a mysql DB for user authentication. dialup admin web Online Users page ==> 5 online real online pptp user ===> 7 online Why different?

2 1

Strange behaviour of rlm_chap (freeradius 1.1.7+mysql)
by Dan Searle 06 Sep '07

06 Sep '07

Hi, I've been running a free radius server for a while now, but today for no apparent reason I'm getting a lot of intermittent authentication failures using the rlm_chap module. Here's a trace of two login's the first works fine, the second a few moments later fails, the username and password supplied in both cases are correct and exactly the same. Can anyone shed any light on this? I've tried rebuilding the mysql database from scratch, and recompiling and installing the radius server, but to no avail... ---------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 81.178.20.107:1024, id=25, length=204 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:14:A4:87:DF:FF" Called-Station-Id = "rural-ap1" NAS-Port-Id = "wlan2" User-Name = "dan(a)adelix.com" NAS-Port = 2149580817 Acct-Session-Id = "80200011" Framed-IP-Address = 10.5.50.254 Mikrotik-Host-IP = 10.5.50.254 CHAP-Challenge = 0xxxxxx[removed] CHAP-Password = 0xxxxxx[removed] Service-Type = Login-User WISPr-Logoff-URL = "http://10.5.50.1/logout" NAS-Identifier = "rural-ap1" NAS-IP-Address = 10.0.0.249 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 3 users: Matched entry DEFAULT at line 54 radius_xlat: '/usr/local/bin/mtauth.pl dan(a)adelix.com' modcall[authorize]: module "files" returns ok for request 3 radius_xlat: 'dan(a)adelix.com' rlm_sql (sql): sql_set_user escaped user --> 'dan(a)adelix.com' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 3 rlm_chap: login attempt by "dan(a)adelix.com" with CHAP password rlm_chap: Using clear text password "xxxxxxx" for user dan(a)adelix.com authentication. rlm_chap: chap user dan(a)adelix.com authenticated succesfully modcall[authenticate]: module "chap" returns ok for request 3 modcall: leaving group CHAP (returns ok) for request 3 Exec-Program output: Session-Timeout=1173, Mikrotik-Xmit-Limit=1073222818, Mikrotik-Recv-Limit=1073515121, Exec-Program-Wait: value-pairs: Session-Timeout=1173, Mikrotik-Xmit-Limit=1073222818, Mikrotik-Recv-Limit=1073515121, Exec-Program: returned: 0 Sending Access-Accept of id 25 to 81.178.20.107 port 1024 Session-Timeout = 1173 Mikrotik-Xmit-Limit = 1073222818 Mikrotik-Recv-Limit = 1073515121 Finished request 3 ---------------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 81.178.20.107:1024, id=24, length=204 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:14:A4:87:DF:FF" Called-Station-Id = "rural-ap1" NAS-Port-Id = "wlan2" User-Name = "dan(a)adelix.com" NAS-Port = 2149580816 Acct-Session-Id = "80200010" Framed-IP-Address = 10.5.50.254 Mikrotik-Host-IP = 10.5.50.254 CHAP-Challenge = 0xxxxxx[removed] CHAP-Password = 0xxxxxx[removed] Service-Type = Login-User WISPr-Logoff-URL = "http://10.5.50.1/logout" NAS-Identifier = "rural-ap1" NAS-IP-Address = 10.0.0.249 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 5 users: Matched entry DEFAULT at line 54 radius_xlat: '/usr/local/bin/mtauth.pl dan(a)adelix.com' modcall[authorize]: module "files" returns ok for request 5 radius_xlat: 'dan(a)adelix.com' rlm_sql (sql): sql_set_user escaped user --> 'dan(a)adelix.com' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 5 rlm_chap: login attempt by "dan(a)adelix.com" with CHAP password rlm_chap: Using clear text password "xxxxxxx" for user dan(a)adelix.com authentication. rlm_chap: Password check failed modcall[authenticate]: module "chap" returns reject for request 5 modcall: leaving group CHAP (returns reject) for request 5 auth: Failed to validate the user. ---------------------------------------------------------------------------------------- -- Dan Searle Adelix Ltd dan.searle(a)adelix.com web: www.adelix.com tel: 0845 230 9590 / fax: 0845 230 9591 / support: 0845 230 9592 snail: The Old Post Office, Bristol Rd, Hambrook, Bristol BS16 1RY. UK. Adelix Ltd is a registered company in England & Wales No. 4232156 VAT registration number 779 4232 91 Adelix Ltd is BS EN ISO 9001:2000 Certified (No. GB 12763) Any views expressed in this email communication are those of the individual sender, except where the sender specifically states them to be the views of a member of Adelix Ltd. Adelix Ltd. does not represent, warrant or guarantee that the integrity of this communication has been maintained nor that the communication is free of errors or interference. ------------------------------------------------------------------------------------ Scanned for viruses, spam and offensive content by CensorNet MailSafe Professional Web & E-mail Filtering from www.censornet.com

3 5

Re[4]: Strange behaviour of rlm_chap (freeradius 1.1.7+mysql)
by Dan Searle 06 Sep '07

06 Sep '07

Hi, No, again I can assure you that the same password is sent in both cases, and it matches the password on the server (stored in clear text). Thursday, September 6, 2007, 11:04:12 AM, you wrote: > Password on the server is most likely the same. Password sent most likely > isn't. > Ivan Kalik > Kalik Informatika ISP > Dana 6/9/2007, "Dan Searle" <dan(a)adelix.com> piše: >>Hi, >> >>I can assure you the password is exactly the same in both cases. I'll >>try and setup a test user later on and post the results. But the >>passwords in the two traces I posted below were the same. >> >>Dan... >> >>Thursday, September 6, 2007, 10:47:34 AM, you wrote: >> >>> And how can anyone help? You have deleted the most relevant parts of the >>> debug (CHAP attributes and the password, which, according to the server, >>> are not the same in both cases). If you don't want to use data from a >>> real user, create a test one and post that. >> >>> Ivan Kalik >>> Kalik Informatika ISP >> >> >>> Dana 6/9/2007, "Dan Searle" <dan(a)adelix.com> piše: >> >>>>Hi, >>>> >>>>Hello? Is there anybody out there? Can someone who knows how CHAP >>>>works please explain to me how this could be happening? >>>> >>>>Does a CHAP challenge time-out after a certain amount of time? Does >>>>the rlm_chap module hold a copy of old CHAP challenge's and prevent >>>>the same one being re-used to stop replay attacks? If so how do I >>>>switch this off? >>>> >>>>Anyone? Anything? >>>> >>>>Dan... >>>> >>>>Thursday, August 30, 2007, 3:08:16 PM, you wrote: >>>> >>>>> Hi, >>>> >>>>> I've been running a free radius server for a while now, but today for >>>>> no apparent reason I'm getting a lot of intermittent authentication >>>>> failures using the rlm_chap module. >>>> >>>>> Here's a trace of two login's the first works fine, the second a few >>>>> moments later fails, the username and password supplied in both cases >>>>> are correct and exactly the same. Can anyone shed any light on this? >>>>> I've tried rebuilding the mysql database from scratch, and recompiling >>>>> and installing the radius server, but to no avail... >>>> >>>>> ---------------------------------------------------------------------------------------- >>>> >>>> >>>>> rad_recv: Access-Request packet from host 81.178.20.107:1024, id=25, length=204 >>>>> NAS-Port-Type = Wireless-802.11 >>>>> Calling-Station-Id = "00:14:A4:87:DF:FF" >>>>> Called-Station-Id = "rural-ap1" >>>>> NAS-Port-Id = "wlan2" >>>>> User-Name = "dan(a)adelix.com" >>>>> NAS-Port = 2149580817 >>>>> Acct-Session-Id = "80200011" >>>>> Framed-IP-Address = 10.5.50.254 >>>>> Mikrotik-Host-IP = 10.5.50.254 >>>>> CHAP-Challenge = 0xxxxxx[removed] >>>>> CHAP-Password = 0xxxxxx[removed] >>>>> Service-Type = Login-User >>>>> WISPr-Logoff-URL = "http://10.5.50.1/logout" >>>>> NAS-Identifier = "rural-ap1" >>>>> NAS-IP-Address = 10.0.0.249 >>>>> Processing the authorize section of radiusd.conf >>>>> modcall: entering group authorize for request 3 >>>>> modcall[authorize]: module "preprocess" returns ok for request 3 >>>>> rlm_chap: Setting 'Auth-Type := CHAP' >>>>> modcall[authorize]: module "chap" returns ok for request 3 >>>>> users: Matched entry DEFAULT at line 54 >>>>> radius_xlat: '/usr/local/bin/mtauth.pl dan(a)adelix.com' >>>>> modcall[authorize]: module "files" returns ok for request 3 >>>>> radius_xlat: 'dan(a)adelix.com' >>>>> rlm_sql (sql): sql_set_user escaped user --> 'dan(a)adelix.com' >>>>> radius_xlat: 'SELECT id, UserName, Attribute, Value, op >>>>> FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id' >>>>> rlm_sql (sql): Reserving sql socket id: 0 >>>>> rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op >>>>> FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id >>>>> radius_xlat: 'SELECT >>>>> radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op >>>>> FROM radgroupcheck,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' >>>>> rlm_sql_mysql: query: SELECT >>>>> radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op >>>>> FROM radgroupcheck,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id >>>>> radius_xlat: 'SELECT id, UserName, Attribute, Value, op >>>>> FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id' >>>>> rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op >>>>> FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id >>>>> radius_xlat: 'SELECT >>>>> radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op >>>>> FROM radgroupreply,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' >>>>> rlm_sql_mysql: query: SELECT >>>>> radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op >>>>> FROM radgroupreply,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id >>>>> rlm_sql (sql): Released sql socket id: 0 >>>>> modcall[authorize]: module "sql" returns ok for request 3 >>>>> modcall: leaving group authorize (returns ok) for request 3 >>>>> rad_check_password: Found Auth-Type CHAP >>>>> auth: type "CHAP" >>>>> Processing the authenticate section of radiusd.conf >>>>> modcall: entering group CHAP for request 3 >>>>> rlm_chap: login attempt by "dan(a)adelix.com" with CHAP password >>>>> rlm_chap: Using clear text password "xxxxxxx" for user dan(a)adelix.com authentication. >>>>> rlm_chap: chap user dan(a)adelix.com authenticated succesfully >>>>> modcall[authenticate]: module "chap" returns ok for request 3 >>>>> modcall: leaving group CHAP (returns ok) for request 3 >>>>> Exec-Program output: Session-Timeout=1173, >>>>> Mikrotik-Xmit-Limit=1073222818, Mikrotik-Recv-Limit=1073515121, >>>>> Exec-Program-Wait: value-pairs: Session-Timeout=1173, >>>>> Mikrotik-Xmit-Limit=1073222818, Mikrotik-Recv-Limit=1073515121, >>>>> Exec-Program: returned: 0 >>>>> Sending Access-Accept of id 25 to 81.178.20.107 port 1024 >>>>> Session-Timeout = 1173 >>>>> Mikrotik-Xmit-Limit = 1073222818 >>>>> Mikrotik-Recv-Limit = 1073515121 >>>>> Finished request 3 >>>> >>>>> ---------------------------------------------------------------------------------------- >>>> >>>>> rad_recv: Access-Request packet from host 81.178.20.107:1024, id=24, length=204 >>>>> NAS-Port-Type = Wireless-802.11 >>>>> Calling-Station-Id = "00:14:A4:87:DF:FF" >>>>> Called-Station-Id = "rural-ap1" >>>>> NAS-Port-Id = "wlan2" >>>>> User-Name = "dan(a)adelix.com" >>>>> NAS-Port = 2149580816 >>>>> Acct-Session-Id = "80200010" >>>>> Framed-IP-Address = 10.5.50.254 >>>>> Mikrotik-Host-IP = 10.5.50.254 >>>>> CHAP-Challenge = 0xxxxxx[removed] >>>>> CHAP-Password = 0xxxxxx[removed] >>>>> Service-Type = Login-User >>>>> WISPr-Logoff-URL = "http://10.5.50.1/logout" >>>>> NAS-Identifier = "rural-ap1" >>>>> NAS-IP-Address = 10.0.0.249 >>>>> Processing the authorize section of radiusd.conf >>>>> modcall: entering group authorize for request 5 >>>>> modcall[authorize]: module "preprocess" returns ok for request 5 >>>>> rlm_chap: Setting 'Auth-Type := CHAP' >>>>> modcall[authorize]: module "chap" returns ok for request 5 >>>>> users: Matched entry DEFAULT at line 54 >>>>> radius_xlat: '/usr/local/bin/mtauth.pl dan(a)adelix.com' >>>>> modcall[authorize]: module "files" returns ok for request 5 >>>>> radius_xlat: 'dan(a)adelix.com' >>>>> rlm_sql (sql): sql_set_user escaped user --> 'dan(a)adelix.com' >>>>> radius_xlat: 'SELECT id, UserName, Attribute, Value, op >>>>> FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id' >>>>> rlm_sql (sql): Reserving sql socket id: 3 >>>>> rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op >>>>> FROM radcheck WHERE Username = 'dan(a)adelix.com' ORDER BY id >>>>> radius_xlat: 'SELECT >>>>> radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op >>>>> FROM radgroupcheck,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' >>>>> rlm_sql_mysql: query: SELECT >>>>> radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op >>>>> FROM radgroupcheck,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id >>>>> radius_xlat: 'SELECT id, UserName, Attribute, Value, op >>>>> FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id' >>>>> rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op >>>>> FROM radreply WHERE Username = 'dan(a)adelix.com' ORDER BY id >>>>> radius_xlat: 'SELECT >>>>> radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op >>>>> FROM radgroupreply,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' >>>>> rlm_sql_mysql: query: SELECT >>>>> radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op >>>>> FROM radgroupreply,usergroup WHERE usergroup.Username = >>>>> 'dan(a)adelix.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id >>>>> rlm_sql (sql): Released sql socket id: 3 >>>>> modcall[authorize]: module "sql" returns ok for request 5 >>>>> modcall: leaving group authorize (returns ok) for request 5 >>>>> rad_check_password: Found Auth-Type CHAP >>>>> auth: type "CHAP" >>>>> Processing the authenticate section of radiusd.conf >>>>> modcall: entering group CHAP for request 5 >>>>> rlm_chap: login attempt by "dan(a)adelix.com" with CHAP password >>>>> rlm_chap: Using clear text password "xxxxxxx" for user dan(a)adelix.com authentication. >>>>> rlm_chap: Password check failed >>>>> modcall[authenticate]: module "chap" returns reject for request 5 >>>>> modcall: leaving group CHAP (returns reject) for request 5 >>>>> auth: Failed to validate the user. >>>> >>>> >>>>> ---------------------------------------------------------------------------------------- >>>> >>>> >>>>> -- >>>> >>>>> Dan Searle >>>>> Adelix Ltd >>>>> dan.searle(a)adelix.com web: www.adelix.com >>>>> tel: 0845 230 9590 / fax: 0845 230 9591 / support: 0845 230 9592 >>>>> snail: The Old Post Office, Bristol Rd, Hambrook, Bristol BS16 1RY. UK. >>>> >>>>> Adelix Ltd is a registered company in England & Wales No. 4232156 >>>>> VAT registration number 779 4232 91 >>>>> Adelix Ltd is BS EN ISO 9001:2000 Certified (No. GB 12763) >>>> >>>>> Any views expressed in this email communication are those >>>>> of the individual sender, except where the sender specifically states >>>>> them to be the views of a member of Adelix Ltd. Adelix Ltd. does not >>>>> represent, warrant or guarantee that the integrity of this communication >>>>> has been maintained nor that the communication is free of errors or >>>>> interference. >>>> >>>> >>>>> ------------------------------------------------------------------------------------ >>>>> Scanned for viruses, spam and offensive content by CensorNet MailSafe >>>> >>>>> Professional Web & E-mail Filtering from www.censornet.com >>>>> - >>>>> List info/subscribe/unsubscribe? See >>>>> http://www.freeradius.org/list/users.html >>>> >>>>> ------------------------------------------------------------------------------------ >>>>> Scanned for viruses, spam and offensive content by CensorNet MailSafe >>>> >>>>> Professional Web & E-mail Filtering from www.censornet.com >>>> >>>> >>>>-- >>>> >>>>Dan Searle >>>>Adelix Ltd >>>>dan.searle(a)adelix.com web: www.adelix.com >>>>tel: 0845 230 9590 / fax: 0845 230 9591 / support: 0845 230 9592 >>>>snail: The Old Post Office, Bristol Rd, Hambrook, Bristol BS16 1RY. UK. >>>> >>>>Adelix Ltd is a registered company in England & Wales No. 4232156 >>>>VAT registration number 779 4232 91 >>>>Adelix Ltd is BS EN ISO 9001:2000 Certified (No. GB 12763) >>>> >>>>Any views expressed in this email communication are those >>>>of the individual sender, except where the sender specifically states >>>>them to be the views of a member of Adelix Ltd. Adelix Ltd. does not >>>>represent, warrant or guarantee that the integrity of this communication >>>>has been maintained nor that the communication is free of errors or >>>>interference. >>>> >>>> >>>>------------------------------------------------------------------------------------ >>>>Scanned for viruses, spam and offensive content by CensorNet MailSafe >>>> >>>>Professional Web & E-mail Filtering from www.censornet.com >>>>- >>>>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>>> >>>> >> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> ------------------------------------------------------------------------------------ >>> Scanned for viruses, spam and offensive content by CensorNet MailSafe >> >>> Professional Web & E-mail Filtering from www.censornet.com >> >>-- >> >>Dan Searle >>Adelix Ltd >>dan.searle(a)adelix.com web: www.adelix.com >>tel: 0845 230 9590 / fax: 0845 230 9591 / support: 0845 230 9592 >>snail: The Old Post Office, Bristol Rd, Hambrook, Bristol BS16 1RY. UK. >> >>Adelix Ltd is a registered company in England & Wales No. 4232156 >>VAT registration number 779 4232 91 >>Adelix Ltd is BS EN ISO 9001:2000 Certified (No. GB 12763) >> >>Any views expressed in this email communication are those >>of the individual sender, except where the sender specifically states >>them to be the views of a member of Adelix Ltd. Adelix Ltd. does not >>represent, warrant or guarantee that the integrity of this communication >>has been maintained nor that the communication is free of errors or >>interference. >> >> >>------------------------------------------------------------------------------------ >>Scanned for viruses, spam and offensive content by CensorNet MailSafe >> >>Professional Web & E-mail Filtering from www.censornet.com >> >> > ------------------------------------------------------------------------------------ > Scanned for viruses, spam and offensive content by CensorNet MailSafe > Professional Web & E-mail Filtering from www.censornet.com -- Dan Searle Adelix Ltd dan.searle(a)adelix.com web: www.adelix.com tel: 0845 230 9590 / fax: 0845 230 9591 / support: 0845 230 9592 snail: The Old Post Office, Bristol Rd, Hambrook, Bristol BS16 1RY. UK. Adelix Ltd is a registered company in England & Wales No. 4232156 VAT registration number 779 4232 91 Adelix Ltd is BS EN ISO 9001:2000 Certified (No. GB 12763) Any views expressed in this email communication are those of the individual sender, except where the sender specifically states them to be the views of a member of Adelix Ltd. Adelix Ltd. does not represent, warrant or guarantee that the integrity of this communication has been maintained nor that the communication is free of errors or interference. ------------------------------------------------------------------------------------ Scanned for viruses, spam and offensive content by CensorNet MailSafe Professional Web & E-mail Filtering from www.censornet.com

1 0

RE: Network Printers with freeradius? Anyway?
by Josh Howlett 06 Sep '07

06 Sep '07

Do your printers support 802.1x? josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Sérgio Kojima > Sent: 05 September 2007 18:58 > To: freeradius-users(a)lists.freeradius.org > Subject: Network Printers with freeradius? Anyway? > > Hello all. > > Finaly my FreeRADIUS 2.0.0-pre2 is running with Samba PDC + > OpenLdap and foundry/dot1x switchs. Very well... > Now, the next level is the printers. How to configure my > network printers with freeradius? > No solicitation does not arrive when i run "radiusd -X". > Printers are using DHCP. > > See you! > > > ============================================================= > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

5 5

how to configure MNID in the access accept response packet?
by j v 06 Sep '07

06 Sep '07

Hey guys , Throw some light on how to configure MNID to be send in the access accept response packet to the client for wireless networks authentication if AT hardware identifier is sent to the server as vendor specific information. --------------------------------- Why delete messages? Unlimited storage is just a click away.

1 0

Will connection attempts from NAS' not in nas table be logged?
by Patric 06 Sep '07

06 Sep '07

Hi Guys, Just a quick question, as the per the subject line : If my freeradius server receives a connection attempt from a NAS not listed in the NAS table (as specified in sql.conf : nas_table = "nas"), will that attempt appear in the radius.log, or would such information only appear in debug mode? Many thanks! Patric -- Q: I want to be a sysadmin. What should I do? A: Seek professional help. ---------------------------------------------------------------------- Find out how you can get spam free email. http://www.bluebottle.com/tag/3

1 1

Network Printers with freeradius? Anyway?
by Sérgio Kojima 05 Sep '07

05 Sep '07

Hello all. Finaly my FreeRADIUS 2.0.0-pre2 is running with Samba PDC + OpenLdap and foundry/dot1x switchs. Very well... Now, the next level is the printers. How to configure my network printers with freeradius? No solicitation does not arrive when i run "radiusd -X". Printers are using DHCP. See you! =============================================================

1 0

Radius records to multiple postgresql databases
by Jigar Dani 05 Sep '07

05 Sep '07

Hello, I am very new to freeradius/SQL/Database concept. I have been able to successfully install and run a radius server and point it to a database. However, I need to point it to multiple postgresql databases. I would be very grateful if someone would help me with the same. Thanks & Regards, Jigar

1 0

Problems using freeradius with ldap
by Sergio Belkin 05 Sep '07

05 Sep '07

I have problem when in Fedora 4 (sadly in my job I cannot change this) using radtest against LDAP Packages version: openldap-servers-2.2.29-1.FC4 openldap-clients-2.2.29-1.FC4 openldap-2.2.29-1.FC4 freeradius-1.0.4-1.FC4.1 This is part of /etc/raddb/radiusd.conf: ldap { server = "localhost" basedn = "ou=people,dc=mydomain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword (member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames) (uniquemember=%{Ldap-UserDn})))" timeout = 4 timelimit = 3 net_timeout = 1 } authorize { chap mschap suffix eap files ldap checkval } And this a portion of /etc/raddb/users: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Auth-Type = LDAP Fall-Through = 1 I've appended the schemas in /etc/openldap/slapd.conf: /usr/share/doc/freeradius-1.0.4/RADIUS-LDAPv3.schema /usr/share/doc/freeradius-1.0.4/RADIUS-LDAP.schema Well, when I issue radtest in debug mode I get: radtest testuser sample localhost 0 testing123 Sending Access-Request of id 88 to 127.0.0.1:1812 User-Name = "testuser" User-Password = "sample" NAS-IP-Address = host.mydomain.com NAS-Port = 0 rad_recv: Access-Request packet from host 127.0.0.1:42077, id=88, length=58 User-Name = "testuser" User-Password = "sample" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser radius_xlat: '(uid=testuser)' radius_xlat: 'ou=people,dc=mydomain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=mydomain,dc=com, with filter (uid=testuser) rlm_ldap: Added password sample in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 88 to 127.0.0.1:42077 Waking up in 4 seconds... rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=88, length=20 17:20:33 [root@spike] /etc/raddb $ --- Walking the entire request list --- Cleaning up request 2 ID 88 with timestamp 46dc6c8f Nothing to do. Sleeping until we see a request. Please could you lend me a hand to resolv this issue? Thanks in advance! -- Sergio Belkin Comunicación e Internet

4 7

Freeradius+Active directory - router login authentciation
by Rakesh Jha 05 Sep '07

05 Sep '07

For Cisco router login /enable authentication I want to use active directory authentication. I have installed Red Hat Linux 4 (2.6.9-5.EL #1) with Samba. I have also installed OpenSSL 0.9.8e 23 Feb 2007 and FreeRadius 1.1.7. I see RHL OS installation also put openssl (some old version of 2003) in /usr/bin directory. After following FreeRADIUS Tutorial for AD integration I am not able to start radius daemon as it complains - radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. Please advise what am I missing? While compiling openssl and freeradius I am using default option. Somewhere I read - "you want to use TLS or TTLS or PEAP, but have compiled the server without TLS support. Install openssl and the corresponding development libraries (often called openssl-devel) and recompile the server." Also one link advises to configure freeradius as following - ./configure --with-rlm-eap-tls-include-dir=/usr/kerberos/include/ Here problem is that I donot see /usr/kerberos/include path. Please suggest the right option for compiling openssl, freeradius and advisory. Thanks & regards, Rakesh Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0