- Freeradius-Users - lists.freeradius.org

Support for WiMAX VSA
by Nitin Naveen 25 Jul '07

25 Jul '07

Hello All, Hi I am Nitin Naveen working with HUGHES SYSTIQUE. We have been working to enhance freeradius to support WiMAX VSA (as per WiMAX NWG forum). WiMAX VSA are not the typical type-length-value rather they have type-length-controlinfo-value. We have enhanced the dictionary but we were not able to generate the attributes as per the WiMAX NWG format. For now we have developed our own rlm_hsc_wimax module. We like to contribute to freeradius so that the WiMAX VSA are supported as part of the standard distribution. To this end we can share our code. But before that we would like to follow the correct procedure for releasing the code. Your inputs and suggestion are awaited. Regards Nitin Naveen Principal Engineer HUGHES SYSTIQUE D-8, Infocity-11 Sector-33, Gugaon Haryana, India tel: +91-124-3045400 fax: +91-124-4039301 nitin.naveen(a)hsc.com www.hsc.com *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

4 4

mschap:User-Name and DOM\user versus user@DOM.EXAMPLE.COM
by Phil Mayers 25 Jul '07

25 Jul '07

All, A few facts first; Windows seems to "know" about both DOM\user and user(a)DOM.EXAMPLE.ORG formats for usernames; when generating an mschap response, it only ever user the "user" portion. ntlm_auth seems to take *exactly* what you put into the command line; that is, it does NO stripping of DOM\user or user(a)DOM.EXAMPLE.ORG rlm_mschap registers several expansions, including mschap:User-Name - this particular expansion performs the following transforms: host/name.dom.example.org -> name$ DOM\user -> user I'm wondering if it would be sensible to add the following transform to the above list: user(a)DOM.EXAMPLE.ORG -> user The rationale being thus: if you want to support both prefix and suffix forms of the realm *and* machine based auth, you have to use the slightly non-intuitive syntax: ntlm_auth --username=%{Stripped-User-Name:-%{mschap:User-Name}} and have : modules { realm suffix { format = suffix delimiter = "@" ignore_null = yes } realm ntdomain { format = prefix delimiter = "\" ignore_null = yes } } authorize { preprocess prefix suffix mschap } If the @suffix transform were in mschap, it would be possible to dispense with the realm modules entirely, and just use: ntlm_auth --username=%{mschap:User-Name} Comments?

1 0

RE: How to capture wireless EAP packets on Windows XP?
by Josh Howlett 25 Jul '07

25 Jul '07

I usually find it simplest to use tcpdump on the RADIUS server, although I've used Wireshark in the past on Windows supplicants. josh. > -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Clark J. Wang > Sent: 25 July 2007 03:48 > To: freeRadius Mailing List - users > Subject: How to capture wireless EAP packets on Windows XP? > > I'm testing FreeRADIUS's PEAP-EAP-MSCHAPv2 functionality with > a wireless USB adapter (D-Link AirPlus G DWL-G122) on Windows > XP (SP2). I tried to capture the EAP packets using Wireshark > 0.99.6a but I failed. > > Anyone can help? Thanks. > >

2 1

Freeradius 2.0 - vmps feature, inaccuracies on FreeNAC
by Sean.Boran＠swisscom.com 25 Jul '07

25 Jul '07

Hi, Thanks for taking the time to respond, I understand better, see the answers inline below.. ... > http://lists.cistron.nl/pipermail/freeradius-users/2006- > August/056121.html > > FreeNAC is announced: "The 'plan' is for the project to move forward > to eventually become THE OpenSource Enterprise tool for dynamic VLAN > assignment and LAN/WLAN authentication." > > Uh... right. FreeRADIUS hasn't been doing that already for nearly a > decade? FreeRADIUS is *crushing* Cisco and Microsoft in the AAA space. > It's doing LAN & WLAN authentication daily for hundreds of millions of > users. There is *nothing* in the WLAN authentication space (open > source > or otherwise) that competes with FreeRADIUS. I *regularly* here about > sites with 10+ million users switching to FreeRADIUS. I was thinking in a very different way. The idea was not to create any tensions or competition with other OpenSource products. My focus was to offer "LAN Access Control", what many people call "NAC". To me there was no solution for that, from systems management point of view. So I created the DB and GUI around OpenVMPS, added switch/router scanning, integration with other network tools and a GUI. We did not try to replace OpenVMPS, or FreeRadius, but make them easier to use in one specific environment: LAN control. When I said "become THE OpenSource Enterprise tool for dynamic VLAN..", it was a call to ask people to help and work, not a declaration against other tools like Freeradius. I like the idea of setting a goal. > And FreeNAC is going to become "THE" project for LAN & WLAN > authentication... by "tying in" FreeRADIUS as a subsidiary project? > > Honestly, what reaction did you expect? It wasn't a provocation, really. I did not think FreeRadius sees itself as a NAC server. > It's one thing to say "we've written a web gui that administers VMPS > and RADIUS". It's another thing *entirely* to say that a project > funded > by a large company is going to "tie in" FreeRADIUS, and become "THE" > market leader in the space. Hang on, I meant to use FreeRadius for the 802.1x, my focus was to add whatever additional DB modules, interfaces, or GUIs were necessary. A pity we didn't discuss this along time ago.. ... > FreeNAC, like some other projects, appears largely to be a way to > generate consulting revenue. That isn't a bad thing, as people have to > make money. But don't pretend that it's an "open" project because your > boss tells you to (1) work on it, and to (2) accept patches from other > people. Actually no, it was first and foremost a GPL project with the aim of publishing the work done so far. I really consider it to be an open project, it was, and still is my first priority to create an OpenSurce GPL project that could live with or without its initial sponsor, Swisscom Innovations. No boss told me to work on it, its been my idea from day 1. The idea of the consulting is to try and get some funding to ensure the long term survival. I did not think of GPL and funding as mutually exclusive, but you do? .... > > - "Good luck getting patches added if they conflict with the > corporate > > agenda" > > The community are free to change FreeNAC themselves, and submit > > patches, > > ... which may or may not be accepted. > > Is there anyone *other* than a Swisscom employee who has CVS commit > access to FreeNAC? You can have SVN access if you want. Any developer can have it if he takes the time. All I ask is that, like in most projects there is a phase where people get to know each other, communicate, and ensure patches do not create major stability problems. > For similar examples, see ISC, and the third-party patches to Bind > and > dhcpd. There are patches floating around for features used by many > sites. Those patches are tested, widely used, in wide demand, and > aren't included in the main distribution. The reasons they're not > included aren't nefarious... just reality. Is the ISC GPL? > In contrast, FreeRADIUS adds features that people need. If a patch > works, and enough people say they're using it, the patch goes in. > (Modulu some editorial re-writes). This is the way it's worked for > almost a decade, and this is the way it will *always* work. Good. Perhaps you could explain your CVS commit policy, or what we should do differently? ... > > if we don't do it fast enough. That is what OpenSource is about. > > The core team is not closed to Swisscom Innovation people either. > I'll > > welcome > > anyone with the motivation, skills and time. > > This is, I repeat, a GPL - OpenSource project. > > ... started by a company, with the core team being solely company > employees. > > There are many open source, GPL projects that work that way. But > they > make it clear they're corporate projects with community input. They > don't pretend they're community projects. The ones that try to co-opt > community projects encounter hostility from that community. My intention *is* to create a community with a consulting spinoff, not the other way around. ... > *I* got annoyed. But that's because it was clear that FreeNAC was > using *my* work to claim that *they* were the leader in the WLAN > authentication space. That I understand now. As regards WLAN, I only mentioned that as an aim, because its turns out that if you doing LAN access control on wired LAN, its useful if it can do wireless too. > > But, at the end, I'd really like to close this misunderstanding and > move > > further. There's no point in arguing or flaming each other as we're > both > > working on closely related opensource project. > > I would like to move forward in a productive manner. As such, I've > added VMPS functionality to FreeRADIUS. Since it is has more features, > is more functional, and is more configurable then the OpenVMPS server > in > FreeNAC, I expect you to switch to using a real VMPS server in the next > release. The OpenVMPS tool/interface is "real" and has worked well for us. I will download FreeRadius and look at your implementation. ... > > In fact, FreeRADIUS was always in our mind, we announced FreeNAC on > the > > "freeradius-user" mailing list in 2006 and we also integrated it. > This > > is natural because the core value of FreeNAC is in at the "policy > > level", and not in the support of underlying protocols like VMPS or > > 802.1x. > > The announcement was... interesting. The claim to be "THE" project > for LAN & WLAN authentication was grandiose from a project and people > with *zero* track record. It was an aim, not a claim. > > > We've also closely followed the development in the NAC area and > > contacted other opensource projects (SecureW2, NAC@FHH) for that > > purpose. > > > > We would enjoy a collaboration that would lead to create _the_ > > opensource NAC framework. > > Really. The original announcement didn't mention the word > "collaboration". If it had, it would have been more positive. > Instead, > it looked a lot like the intent was to put a web front end on > FreeRADIUS, and label the result as "FreeNAC". Maybe with a fine-print > disclaimer of "by the way, it's a corporate project that builds on a > decade of community work on FreeRADIUS". > > Yes, the original announcement *really* got under my skin. Rather > than fight you, I spent a few hours writing code that filled a market > demand: a supported and actively maintained VMPS server. Well it's a pity I didn't know that, that really was not the aim, but I guess the damage is done now. > FreeNAC can do what it wants. When v2.0 is released, FreeRADIUS will > be the most widely used VMPS server on the planet. And the best way to > get a web GUI for VMPS + RADIUS shipped to 100k sites will be to > include > it's code in FreeRADIUS. > > Alan DeKok. VMPS is only one part of the problem. Do you want to add a Database, Client Security tools/interfaces, policy engine, interfaces to AntiVirus servers, scanners, Patch servers, and so to FreeRadius? I thought Freeradius concentrates on the authentication protocols, not the network integration aspects? Regards, Sean

9 33

How to capture wireless EAP packets on Windows XP?
by Clark J. Wang 25 Jul '07

25 Jul '07

I'm testing FreeRADIUS's PEAP-EAP-MSCHAPv2 functionality with a wireless USB adapter (D-Link AirPlus G DWL-G122) on Windows XP (SP2). I tried to capture the EAP packets using Wireshark 0.99.6a but I failed. Anyone can help? Thanks.

1 0

RE: rlm_sql bug in 64-bit architecture ?
by Chris Bell 24 Jul '07

24 Jul '07

I would love to know what the: Invalid operator for item Expiration: reverting to '==' I get them like so: Invalid operator for item User-name: reverting to '==' All three of my server logs are filled with them and I've been unable to find the reason why. All the username's listed in the huntgroup can successfully authenticate. -----Original Message----- From: freeradius-users-bounces+cbell=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+cbell=thig.com@lists.freeradius.org]On Behalf Of Richard Cotrina Sent: Tuesday, July 24, 2007 2:57 PM To: FreeRadius users mailing list Subject: rlm_sql bug in 64-bit architecture ? Hi everyone : I've been searching for the possible causes of a problem, that appears when sqlcounter is enabled, and just in 64-bits plattforms (FreeBSD/Sparc64). The radius_xlat function performed by rlm_sql seems to not reading well some attributes like "Expiration" and always complains about "Invalid Operator", not matter what operator is put [1]. Note the big difference between the responses obtained in the 64-bit and 32-bit arch, using radtest and running radiusd in debug mode: rlm_sql can't read neither the value nor the operator for Expiration attribute, despite the fact that in both cases, the database used is the same. (rlm_sql debug options enabled in rlm_sql.c). freeradius 1.1.6 / FreeBSD Sparc64 ========================== radius_xlat: 'prueba(a)test.com' rlm_sql (sql): [snip] radius_xlat: [snip] rlm_sql: check items User-Password := "prueba" Auth-Type := Local Simultaneous-Use := 1 Max-Daily-Session := 3600 Expiration <INVALID-TOKEN> "Dec 31 1969 19:00:00 PET" <--- Notice this (where this value come from ?) rlm_sql: reply items Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1500 Service-Type = Framed-User Idle-Timeout = 300 Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' rlm_sql (sql): No matching entry in the database for request from user [prueba(a)test.com] modcall[authorize]: module "sql" returns notfound for request 9 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 9 [snip] --> Got an Access-Reject response freeradius 1.1.6 / FreeBSD i386 ======================= radius_xlat: 'prueba(a)test.com' rlm_sql (sql): [snip] radius_xlat: [snip] rlm_sql: check items User-Password := "prueba" Auth-Type := Local Simultaneous-Use := 1 Max-Daily-Session := 3600 Expiration := "Sep 24 2007 11:30:00 PET" <--- get the correct 'op' and 'value' rlm_sql: reply items Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1500 Service-Type = Framed-User Idle-Timeout = 300 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code [snip] --> Got an Access-Accept response What could be going wrong with rlm_sql ? Is there any bug in freeradius code related to 64-bit architectures ? I'd appreciate any suggestion to solve this. Richard Cotrina [1]. http://archives.free.net.ph/message/20070517.165523.c7432a23.en.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

4 3

TLS cant connect ldap+freeradius+novell
by Martin G 24 Jul '07

24 Jul '07

Hello! Im new to both this mailinglist and to novell/linux/ldap/freeradius but iv tried my best to install a radius/ldap linuxserver to pass on radius-requests from a Aruba-controller to our novell-server. IPs: Novell 10.10.0.11 Aruba 10.10.0.28 Linux (freeradius+ldap) 10.10.0.132 Iv tried to change tls_mode, port and tls_start on and off a couple of times without any good result and when i go use ldapsearch -vvv -h 10.10.0.11 -x -Z -b ou=adm,ou=malmo,o=wifi "cn=lotta" i recieve "TLS: hostname does not match CN in peer certificate". So i have some thoughts about the certificate, but iv exported the selfsigned novell-certificate from the novellserver and verifyed it. But im not sure how to use a "client-certificate" on the linux. When i use "freeradius -XXX -A" on the linuxserver and i trie to do a radius-request, the aruba gets a timeout and the linuxserver tells me the following logg: Tue Jul 10 11:32:28 2007 : Info: Starting - reading configuration files ... Tue Jul 10 11:32:28 2007 : Debug: reread_config: reading radiusd.conf Tue Jul 10 11:32:28 2007 : Debug: Config: including file: /etc/freeradius/proxy.conf Tue Jul 10 11:32:28 2007 : Debug: Config: including file: /etc/freeradius/clients.conf Tue Jul 10 11:32:28 2007 : Debug: Config: including file: /etc/freeradius/snmp.conf Tue Jul 10 11:32:28 2007 : Debug: Config: including file: /etc/freeradius/eap.conf Tue Jul 10 11:32:28 2007 : Debug: Config: including file: /etc/freeradius/sql.conf Tue Jul 10 11:32:28 2007 : Debug: main: prefix = "/usr" Tue Jul 10 11:32:28 2007 : Debug: main: localstatedir = "/var" Tue Jul 10 11:32:28 2007 : Debug: main: logdir = "/var/log/freeradius" Tue Jul 10 11:32:28 2007 : Debug: main: libdir = "/usr/lib/freeradius" Tue Jul 10 11:32:28 2007 : Debug: main: radacctdir = "/var/log/freeradius/radacct" Tue Jul 10 11:32:28 2007 : Debug: main: hostname_lookups = no Tue Jul 10 11:32:28 2007 : Debug: main: max_request_time = 30 Tue Jul 10 11:32:28 2007 : Debug: main: cleanup_delay = 5 Tue Jul 10 11:32:28 2007 : Debug: main: max_requests = 1024 Tue Jul 10 11:32:28 2007 : Debug: main: delete_blocked_requests = 0 Tue Jul 10 11:32:28 2007 : Debug: main: port = 0 Tue Jul 10 11:32:28 2007 : Debug: main: allow_core_dumps = no Tue Jul 10 11:32:28 2007 : Debug: main: log_stripped_names = yes Tue Jul 10 11:32:28 2007 : Debug: main: log_file = "/var/log/freeradius/radius.log" Tue Jul 10 11:32:28 2007 : Debug: main: log_auth = yes Tue Jul 10 11:32:28 2007 : Debug: main: log_auth_badpass = yes Tue Jul 10 11:32:28 2007 : Debug: main: log_auth_goodpass = yes Tue Jul 10 11:32:28 2007 : Debug: main: pidfile = "/var/run/freeradius/freeradius.pid" Tue Jul 10 11:32:28 2007 : Debug: main: user = "freerad" Tue Jul 10 11:32:28 2007 : Debug: main: group = "freerad" Tue Jul 10 11:32:28 2007 : Debug: main: usercollide = no Tue Jul 10 11:32:28 2007 : Debug: main: lower_user = "no" Tue Jul 10 11:32:28 2007 : Debug: main: lower_pass = "no" Tue Jul 10 11:32:28 2007 : Debug: main: nospace_user = "no" Tue Jul 10 11:32:28 2007 : Debug: main: nospace_pass = "no" Tue Jul 10 11:32:28 2007 : Debug: main: checkrad = "/usr/sbin/checkrad" Tue Jul 10 11:32:28 2007 : Debug: main: proxy_requests = yes Tue Jul 10 11:32:28 2007 : Debug: proxy: retry_delay = 5 Tue Jul 10 11:32:28 2007 : Debug: proxy: retry_count = 3 Tue Jul 10 11:32:28 2007 : Debug: proxy: synchronous = no Tue Jul 10 11:32:28 2007 : Debug: proxy: default_fallback = yes Tue Jul 10 11:32:28 2007 : Debug: proxy: dead_time = 120 Tue Jul 10 11:32:28 2007 : Debug: proxy: post_proxy_authorize = no Tue Jul 10 11:32:28 2007 : Debug: proxy: wake_all_if_all_dead = no Tue Jul 10 11:32:28 2007 : Debug: security: max_attributes = 200 Tue Jul 10 11:32:28 2007 : Debug: security: reject_delay = 1 Tue Jul 10 11:32:28 2007 : Debug: security: status_server = no Tue Jul 10 11:32:28 2007 : Debug: main: debug_level = 0 Tue Jul 10 11:32:28 2007 : Debug: read_config_files: reading dictionary Tue Jul 10 11:32:28 2007 : Debug: read_config_files: reading naslist Tue Jul 10 11:32:28 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Jul 10 11:32:28 2007 : Debug: read_config_files: reading clients Tue Jul 10 11:32:28 2007 : Debug: read_config_files: reading realms Tue Jul 10 11:32:28 2007 : Debug: radiusd: entering modules setup Tue Jul 10 11:32:28 2007 : Debug: Module: Library search path is /usr/lib/freeradius Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded exec Tue Jul 10 11:32:28 2007 : Debug: exec: wait = yes Tue Jul 10 11:32:28 2007 : Debug: exec: program = "(null)" Tue Jul 10 11:32:28 2007 : Debug: exec: input_pairs = "request" Tue Jul 10 11:32:28 2007 : Debug: exec: output_pairs = "(null)" Tue Jul 10 11:32:28 2007 : Debug: exec: packet_type = "(null)" Tue Jul 10 11:32:28 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated exec (exec) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded expr Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated expr (expr) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded PAP Tue Jul 10 11:32:28 2007 : Debug: pap: encryption_scheme = "crypt" Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated pap (pap) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded CHAP Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated chap (chap) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded MS-CHAP Tue Jul 10 11:32:28 2007 : Debug: mschap: use_mppe = yes Tue Jul 10 11:32:28 2007 : Debug: mschap: require_encryption = no Tue Jul 10 11:32:28 2007 : Debug: mschap: require_strong = no Tue Jul 10 11:32:28 2007 : Debug: mschap: with_ntdomain_hack = no Tue Jul 10 11:32:28 2007 : Debug: mschap: passwd = "(null)" Tue Jul 10 11:32:28 2007 : Debug: mschap: ntlm_auth = "(null)" Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated mschap (mschap) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded System Tue Jul 10 11:32:28 2007 : Debug: unix: cache = no Tue Jul 10 11:32:28 2007 : Debug: unix: passwd = "(null)" Tue Jul 10 11:32:28 2007 : Debug: unix: shadow = "/etc/shadow" Tue Jul 10 11:32:28 2007 : Debug: unix: group = "(null)" Tue Jul 10 11:32:28 2007 : Debug: unix: radwtmp = "/var/log/freeradius/radwtmp" Tue Jul 10 11:32:28 2007 : Debug: unix: usegroup = no Tue Jul 10 11:32:28 2007 : Debug: unix: cache_reload = 600 Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated unix (unix) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded LDAP Tue Jul 10 11:32:28 2007 : Debug: ldap: server = "10.10.0.11" Tue Jul 10 11:32:28 2007 : Debug: ldap: port = 636 Tue Jul 10 11:32:28 2007 : Debug: ldap: net_timeout = 1 Tue Jul 10 11:32:28 2007 : Debug: ldap: timeout = 4 Tue Jul 10 11:32:28 2007 : Debug: ldap: timelimit = 3 Tue Jul 10 11:32:28 2007 : Debug: ldap: identity = "cn=admin,o=wifi" Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_mode = no Tue Jul 10 11:32:28 2007 : Debug: ldap: start_tls = yes Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_cacertfile = "/etc/freeradius/certs/WIFITREE_CA.b64" Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_certfile = "/etc/freeradius/certs/WIFITREE_CA.b64" Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_cacertdir = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_keyfile = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_randfile = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: tls_require_cert = "allow" Tue Jul 10 11:32:28 2007 : Debug: ldap: password = "******" Tue Jul 10 11:32:28 2007 : Debug: ldap: basedn = "ou=adm,ou=malmo,o=wifi" Tue Jul 10 11:32:28 2007 : Debug: ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" Tue Jul 10 11:32:28 2007 : Debug: ldap: base_filter = "(objectclass=radiusprofile)" Tue Jul 10 11:32:28 2007 : Debug: ldap: default_profile = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: profile_attribute = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: password_header = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: password_attribute = "nspmPassword" Tue Jul 10 11:32:28 2007 : Debug: ldap: access_attr = "dialupAccess" Tue Jul 10 11:32:28 2007 : Debug: ldap: groupname_attribute = "cn" Tue Jul 10 11:32:28 2007 : Debug: ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" Tue Jul 10 11:32:28 2007 : Debug: ldap: groupmembership_attribute = "(null)" Tue Jul 10 11:32:28 2007 : Debug: ldap: dictionary_mapping = "/etc/freeradius/ldap.attrmap" Tue Jul 10 11:32:28 2007 : Debug: ldap: ldap_debug = 0 Tue Jul 10 11:32:28 2007 : Debug: ldap: ldap_connections_number = 5 Tue Jul 10 11:32:28 2007 : Debug: ldap: compare_check_items = no Tue Jul 10 11:32:28 2007 : Debug: ldap: access_attr_used_for_allow = yes Tue Jul 10 11:32:28 2007 : Debug: ldap: do_xlat = yes Tue Jul 10 11:32:28 2007 : Debug: ldap: edir_account_policy_check = yes Tue Jul 10 11:32:28 2007 : Debug: ldap: set_auth_type = yes Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: Registering ldap_groupcmp for Ldap-Group Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: Registering ldap_xlat with xlat_name ldap Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusClass mapped to RADIUS Class Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port Tue Jul 10 11:32:28 2007 : Debug: rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message Tue Jul 10 11:32:28 2007 : Debug: conns: 0x8145988 Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated ldap (ldap) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded eap Tue Jul 10 11:32:28 2007 : Debug: eap: default_eap_type = "md5" Tue Jul 10 11:32:28 2007 : Debug: eap: timer_expire = 60 Tue Jul 10 11:32:28 2007 : Debug: eap: ignore_unknown_eap_types = no Tue Jul 10 11:32:28 2007 : Debug: eap: cisco_accounting_username_bug = no Tue Jul 10 11:32:28 2007 : Debug: rlm_eap: Loaded and initialized type md5 Tue Jul 10 11:32:28 2007 : Debug: rlm_eap: Loaded and initialized type leap Tue Jul 10 11:32:28 2007 : Debug: gtc: challenge = "Password: " Tue Jul 10 11:32:28 2007 : Debug: gtc: auth_type = "PAP" Tue Jul 10 11:32:28 2007 : Debug: rlm_eap: Loaded and initialized type gtc Tue Jul 10 11:32:28 2007 : Debug: mschapv2: with_ntdomain_hack = no Tue Jul 10 11:32:28 2007 : Debug: rlm_eap: Loaded and initialized type mschapv2 Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated eap (eap) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded preprocess Tue Jul 10 11:32:28 2007 : Debug: preprocess: huntgroups = "/etc/freeradius/huntgroups" Tue Jul 10 11:32:28 2007 : Debug: preprocess: hints = "/etc/freeradius/hints" Tue Jul 10 11:32:28 2007 : Debug: preprocess: with_ascend_hack = no Tue Jul 10 11:32:28 2007 : Debug: preprocess: ascend_channels_per_line = 23 Tue Jul 10 11:32:28 2007 : Debug: preprocess: with_ntdomain_hack = no Tue Jul 10 11:32:28 2007 : Debug: preprocess: with_specialix_jetstream_hack = no Tue Jul 10 11:32:28 2007 : Debug: preprocess: with_cisco_vsa_hack = no Tue Jul 10 11:32:28 2007 : Debug: preprocess: with_alvarion_vsa_hack = no Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated preprocess (preprocess) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded realm Tue Jul 10 11:32:28 2007 : Debug: realm: format = "suffix" Tue Jul 10 11:32:28 2007 : Debug: realm: delimiter = "@" Tue Jul 10 11:32:28 2007 : Debug: realm: ignore_default = no Tue Jul 10 11:32:28 2007 : Debug: realm: ignore_null = no Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated realm (suffix) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded files Tue Jul 10 11:32:28 2007 : Debug: files: usersfile = "/etc/freeradius/users" Tue Jul 10 11:32:28 2007 : Debug: files: acctusersfile = "/etc/freeradius/acct_users" Tue Jul 10 11:32:28 2007 : Debug: files: preproxy_usersfile = "/etc/freeradius/preproxy_users" Tue Jul 10 11:32:28 2007 : Debug: files: compat = "no" Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated files (files) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded Acct-Unique-Session-Id Tue Jul 10 11:32:28 2007 : Debug: acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated acct_unique (acct_unique) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded detail Tue Jul 10 11:32:28 2007 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Tue Jul 10 11:32:28 2007 : Debug: detail: detailperm = 384 Tue Jul 10 11:32:28 2007 : Debug: detail: dirperm = 493 Tue Jul 10 11:32:28 2007 : Debug: detail: locking = no Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated detail (detail) Tue Jul 10 11:32:28 2007 : Debug: Module: Loaded radutmp Tue Jul 10 11:32:28 2007 : Debug: radutmp: filename = "/var/log/freeradius/radutmp" Tue Jul 10 11:32:28 2007 : Debug: radutmp: username = "%{User-Name}" Tue Jul 10 11:32:28 2007 : Debug: radutmp: case_sensitive = yes Tue Jul 10 11:32:28 2007 : Debug: radutmp: check_with_nas = yes Tue Jul 10 11:32:28 2007 : Debug: radutmp: perm = 384 Tue Jul 10 11:32:28 2007 : Debug: radutmp: callerid = yes Tue Jul 10 11:32:28 2007 : Debug: Module: Instantiated radutmp (radutmp) Tue Jul 10 11:32:28 2007 : Debug: Listening on authentication *:1812 Tue Jul 10 11:32:28 2007 : Debug: Listening on accounting *:1813 Tue Jul 10 11:32:28 2007 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.10.0.28:32795, id=42, length=112 NAS-IP-Address = 10.10.0.29 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "lotta" User-Password = "********" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86600DB2" Aruba-Essid-Name = "" Aruba-Location-Id = "0.0.0" Tue Jul 10 11:32:29 2007 : Debug: Processing the authorize section of radiusd.conf Tue Jul 10 11:32:29 2007 : Debug: modcall: entering group authorize for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Tue Jul 10 11:32:29 2007 : Debug: rlm_realm: No '@' in User-Name = "lotta", looking up realm NULL Tue Jul 10 11:32:29 2007 : Debug: rlm_realm: No such realm "NULL" Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Tue Jul 10 11:32:29 2007 : Debug: users: Matched entry DEFAULT at line 152 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Tue Jul 10 11:32:29 2007 : Debug: modcall[authorize]: module "files" returns ok for request 0 Tue Jul 10 11:32:29 2007 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: - authorize Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: performing user authorization for lotta Tue Jul 10 11:32:29 2007 : Debug: radius_xlat: '(cn=lotta)' Tue Jul 10 11:32:29 2007 : Debug: radius_xlat: 'ou=adm,ou=malmo,o=wifi' Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: attempting LDAP reconnection Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: (re)connect to 10.10.0.11:636, authentication 0 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: setting TLS mode to 1 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: setting TLS CACert File to /etc/freeradius/certs/WIFITREE_CA.b64 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: setting TLS CACert Directory to /etc/freeradius/certs/ Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: setting TLS Cert File to /etc/freeradius/certs/WIFITREE_CA.b64 Tue Jul 10 11:32:29 2007 : Debug: rlm_ldap: starting TLS Tue Jul 10 11:32:30 2007 : Debug: rlm_ldap: ldap_start_tls_s() Tue Jul 10 11:32:30 2007 : Error: rlm_ldap: could not start TLS Can't contact LDAP server Tue Jul 10 11:32:30 2007 : Error: rlm_ldap: (re)connection attempt failed Tue Jul 10 11:32:30 2007 : Debug: rlm_ldap: search failed Tue Jul 10 11:32:30 2007 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Jul 10 11:32:30 2007 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Tue Jul 10 11:32:30 2007 : Debug: modcall[authorize]: module "ldap" returns fail for request 0 Tue Jul 10 11:32:30 2007 : Debug: modcall: leaving group authorize (returns fail) for request 0 Tue Jul 10 11:32:30 2007 : Debug: Finished request 0 Tue Jul 10 11:32:30 2007 : Debug: Going to the next request Tue Jul 10 11:32:30 2007 : Debug: --- Walking the entire request list --- Tue Jul 10 11:32:30 2007 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.0.28:32795, id=42, length=112 Tue Jul 10 11:32:31 2007 : Debug: Discarding duplicate request from client localhost:32795 - ID: 42 Tue Jul 10 11:32:31 2007 : Debug: --- Walking the entire request list --- Tue Jul 10 11:32:31 2007 : Debug: Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.10.0.28:32795, id=42, length=112 Tue Jul 10 11:32:33 2007 : Debug: Discarding duplicate request from client localhost:32795 - ID: 42 Tue Jul 10 11:32:33 2007 : Debug: --- Walking the entire request list --- Tue Jul 10 11:32:33 2007 : Debug: Waking up in 2 seconds... Tue Jul 10 11:32:35 2007 : Debug: --- Walking the entire request list --- Tue Jul 10 11:32:35 2007 : Debug: Cleaning up request 0 ID 42 with timestamp 4693522d Tue Jul 10 11:32:35 2007 : Debug: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.10.0.28:32795, id=42, length=112 NAS-IP-Address = 10.10.0.29 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "lotta" User-Password = "******" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86600DB2" Aruba-Essid-Name = "" Aruba-Location-Id = "0.0.0" Tue Jul 10 11:32:35 2007 : Debug: Processing the authorize section of radiusd.conf Tue Jul 10 11:32:35 2007 : Debug: modcall: entering group authorize for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Tue Jul 10 11:32:35 2007 : Debug: rlm_realm: No '@' in User-Name = "lotta", looking up realm NULL Tue Jul 10 11:32:35 2007 : Debug: rlm_realm: No such realm "NULL" Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "eap" returns noop for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Tue Jul 10 11:32:35 2007 : Debug: users: Matched entry DEFAULT at line 152 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "files" returns ok for request 1 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: - authorize Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: performing user authorization for lotta Tue Jul 10 11:32:35 2007 : Debug: radius_xlat: '(cn=lotta)' Tue Jul 10 11:32:35 2007 : Debug: radius_xlat: 'ou=adm,ou=malmo,o=wifi' Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: attempting LDAP reconnection Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: (re)connect to 10.10.0.11:636, authentication 0 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: setting TLS mode to 1 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: setting TLS CACert File to /etc/freeradius/certs/WIFITREE_CA.b64 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: setting TLS CACert Directory to /etc/freeradius/certs/ Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: setting TLS Cert File to /etc/freeradius/certs/WIFITREE_CA.b64 Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: starting TLS Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: ldap_start_tls_s() Tue Jul 10 11:32:35 2007 : Error: rlm_ldap: could not start TLS Can't contact LDAP server Tue Jul 10 11:32:35 2007 : Error: rlm_ldap: (re)connection attempt failed Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: search failed Tue Jul 10 11:32:35 2007 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Jul 10 11:32:35 2007 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall[authorize]: module "ldap" returns fail for request 1 Tue Jul 10 11:32:35 2007 : Debug: modcall: leaving group authorize (returns fail) for request 1 Tue Jul 10 11:32:35 2007 : Debug: Finished request 1 Tue Jul 10 11:32:35 2007 : Debug: Going to the next request Tue Jul 10 11:32:35 2007 : Debug: --- Walking the entire request list --- Tue Jul 10 11:32:35 2007 : Debug: Waking up in 6 seconds... Hope someone got any help. /Mr G _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 4

rlm_sql bug in 64-bit architecture ?
by Richard Cotrina 24 Jul '07

24 Jul '07

Hi everyone : I've been searching for the possible causes of a problem, that appears when sqlcounter is enabled, and just in 64-bits plattforms (FreeBSD/Sparc64). The radius_xlat function performed by rlm_sql seems to not reading well some attributes like "Expiration" and always complains about "Invalid Operator", not matter what operator is put [1]. Note the big difference between the responses obtained in the 64-bit and 32-bit arch, using radtest and running radiusd in debug mode: rlm_sql can't read neither the value nor the operator for Expiration attribute, despite the fact that in both cases, the database used is the same. (rlm_sql debug options enabled in rlm_sql.c). freeradius 1.1.6 / FreeBSD Sparc64 ========================== radius_xlat: 'prueba(a)test.com' rlm_sql (sql): [snip] radius_xlat: [snip] rlm_sql: check items User-Password := "prueba" Auth-Type := Local Simultaneous-Use := 1 Max-Daily-Session := 3600 Expiration <INVALID-TOKEN> "Dec 31 1969 19:00:00 PET" <--- Notice this (where this value come from ?) rlm_sql: reply items Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1500 Service-Type = Framed-User Idle-Timeout = 300 Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' rlm_sql (sql): No matching entry in the database for request from user [prueba(a)test.com] modcall[authorize]: module "sql" returns notfound for request 9 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 9 [snip] --> Got an Access-Reject response freeradius 1.1.6 / FreeBSD i386 ======================= radius_xlat: 'prueba(a)test.com' rlm_sql (sql): [snip] radius_xlat: [snip] rlm_sql: check items User-Password := "prueba" Auth-Type := Local Simultaneous-Use := 1 Max-Daily-Session := 3600 Expiration := "Sep 24 2007 11:30:00 PET" <--- get the correct 'op' and 'value' rlm_sql: reply items Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1500 Service-Type = Framed-User Idle-Timeout = 300 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code [snip] --> Got an Access-Accept response What could be going wrong with rlm_sql ? Is there any bug in freeradius code related to 64-bit architectures ? I'd appreciate any suggestion to solve this. Richard Cotrina [1]. http://archives.free.net.ph/message/20070517.165523.c7432a23.en.html

1 0

2.0.0-pre2 Time?
by Roy Walker 23 Jul '07

23 Jul '07

Don't know if there is an official list of things needed to be done before pre2? It's been a few months, maybe time for a pre2? Roy

2 1

Different Authentication for several devices (several Nas-Ip-Address)
by nicolaskarp＠free.fr 23 Jul '07

23 Jul '07

Hello, Thank you for your help but I don't understand how you can make it. Here my configuration that I try: #Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 } # Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 } preproxy { files overwrite_nasip dev_equipment } Here what I want : 1. If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi 2. the proxy forwards the access-request to the radius server 3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi Thank you for your assistance Nicolas.

5 9