- Freeradius-Users - lists.freeradius.org

So long and thanks for the help
by Ethan Dicks 06 Jul '07

06 Jul '07

Hi, All, I've changed jobs this week, and am no longer working with freeRADIUS, but wanted to thank the folks here for the help I've received and for all the work that's gone into freeRADIUS. If I ever run into a need for an AAA server, I'll be back, but probably not before 2.0.0 is obsolete and questions about it elicit a response of "why would you use that old thing?!?" Thanks again! -ethan

1 0

Proxying without nostrip
by amarquez001＠ikasle.ehu.es 06 Jul '07

06 Jul '07

Hi everyone: I want to proxy requests with i2t realm to a i2t.server.com The problem is that if I use nostrip directive in the proxy.conf of the proxy server, all works fine. But I need to store logins in the i2t.server.com without the realm name, so I use this configuration from the proxy.conf in the proxy server: realm i2t { type = radius authhost = 192.168.2.2:1812 accthost = 192.168.2.2:1813 secret = testing123 strip } The result of the execution in the i2t.server.com is: root@alvaro-desktop:/etc/freeradius# freeradius -X Starting - reading configuration files ... . . . Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.1:1814, id=0, length=150 User-Name = "user1" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "00-0C-29-81-54-F3:" Calling-Station-Id = "00-0C-29-EC-7D-9D" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209000e01757365723140693274 Message-Authenticator = 0xae40c811e106af74fc216d522466a797 Proxy-State = 0x3335 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 9 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry user1 at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.2.1 port 1814 Proxy-State = 0x3335 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 468e1d50 Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 192.168.2.1:1814, id=0, length=159 Acct-Session-Id = "468D84AB-0000000D" Acct-Status-Type = Stop Acct-Authentic = RADIUS User-Name = "user1" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "00-0C-29-81-54-F3:" Calling-Station-Id = "00-0C-29-EC-7D-9D" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" Acct-Session-Time = 301 Event-Timestamp = "Jul 6 2007 12:48:16 CEST" Acct-Terminate-Cause = Idle-Timeout Proxy-State = 0x3336 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.2.1,NAS-IP-Address = 192.168.1.1,Acct-Session-Id = "468D84AB-0000000D",User-Name = "user1"' rlm_acct_unique: Acct-Unique-Session-ID = "e9f7ae8a84e4857d". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/freeradius/radacct/192.168.2.1/detail-20070706' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.1/detail-20070706 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'user1' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 0 to 192.168.2.1 port 1814 Proxy-State = 0x3336 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 468e1db0 Nothing to do. Sleeping until we see a request. Why rejects the request?? Any idea?? Thanks in advance. - Alvaro.

2 1

Cisco VRF + Radius
by Francesco Cristofori 06 Jul '07

06 Jul '07

Hi all, anybody has experience in setting up FR to support IP VRF for cisco equipments? Can you point me to some clear and simple configuration guide for doing that? TIA, Francesco.

3 2

Update reply packets from proxy servers
by Luis Galan 06 Jul '07

06 Jul '07

Hi! I have radius1 confiured as proxy radius to radius2. Users like "username@domain2" are proxied to radius2 which authtenticate these usernames. Question 1: Radius2 returns me the following reply packet if auth is succesfully: Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Reply-Message = "Auth successful" I need to strip Framed-IP-Address and Framed-IP-Netmask, then my radius1 should assign an ip address from a pool. How can I do that? Question 2: How can I send a different Nas-Ip-address to radius2. Now my NAS has an ip address ip1, and I want to change the ip address of the NAS when the request packet goes(is proxied) to radius2. Is it possible? Thanks. Luis

1 0

Installing FR 1.1.6
by Lisa Casey 06 Jul '07

06 Jul '07

Hi, I have a FreeBSD 5.3 machine that I want to install Freeradius on. The Freeradius that was in the ports on this machine was FR 1.0.1 and that was kind of old so I updated the ports collection and now the FR port that I have is Freeradius 1.1.6 When I typed make, I got this error: On FreeBSD before 6.2 ports system unfortunately can not set default X11BASE by itself so please help it a bit by setting X11BASE=${LOCALBASE} in make.conf. On the other hand, if you do wish to use non-default X11BASE, please set variable USE_NONDEFAULT_X11BASE. *** Error code 1 Stop. Well... there isn't a make.conf, but there is a Makefile, so I opened that and put in X11BASE=${LOCALBASE} With no indication of where in the Makefile this ought to go, I just chose a spot. I typed make again, this time I got a little farthur, but ended up with the same error: ===> Vulnerability check disabled, database not found ===> Found saved configuration for freeradius-1.1.6 => freeradius-1.1.6.tar.bz2 doesn't seem to exist in /usr/ports/distfiles/. => Attempting to fetch from ftp://ftp.freeradius.org/pub/radius/. freeradius-1.1.6.tar.bz2 100% of 2011 kB 150 kBps 00m00s ===> Extracting for freeradius-1.1.6 => MD5 Checksum OK for freeradius-1.1.6.tar.bz2. ===> freeradius-1.1.6 depends on file: /usr/local/bin/perl5.8.5 - found ===> freeradius-1.1.6 depends on file: /usr/local/sbin/pkg_info - not found ===> Verifying install for /usr/local/sbin/pkg_info in /usr/ports/ports-mgmt/pkg_install On FreeBSD before 6.2 ports system unfortunately can not set default X11BASE by itself so please help it a bit by setting X11BASE=${LOCALBASE} in make.conf. On the other hand, if you do wish to use non-default X11BASE, please set variable USE_NONDEFAULT_X11BASE. *** Error code 1 Stop. *** Error code 1 Stop in /usr/ports/net/freeradius. *** Error code 1 Stop in /usr/ports/net/freeradius. I've tried using a tab (X11BASE= ${LOCALBASE} instead of X11BASE=${LOCALBASE}) but that didn't work. I'ld sure appreciate some help getting past this error. Thanks, Lisa Casey

4 3

Re: RADIUS & PEAP
by Adrienne Rau 05 Jul '07

05 Jul '07

>Date: Tue, 03 Jul 2007 22:20:57 +0100 >From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> >Subject: Re: RADIUS & PEAP >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <468ABDB9.3080801(a)sussex.ac.uk> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed >If your using the Windows supplicant (which nearly everyone is, despite >it's nastyness), and want passwordless authentication using EAP, your >only other solution is to set up local PKI (public key infrastructure), >and start issuing client certificates, and use EAP-PEAP-TLS (Microsofts >version of EAP TLS). >What you're attempting to do is impossible because MS-CHAP is a mutual >authentication protocol. If the RADIUS server does not demonstrate >knowledge of the password to the supplicant, a well-behaved the >supplicant *should* refuse the connection.(I also wouldn't be surprised if the RADIUS server >barfs because it >can't get a valid user-password in order to construct the authentication >response but I can't comment authoritatively on this). >Finally, you can't authenticate MS-CHAP against /etc/passwd or /etc/shadow; MS-CHAP >requires access to the cleartext password or its NTLM hash. Thanks for the response. I was afraid that what I was attempting was impossible. I had been trying to use PEAP rather than TTLS because PEAP is supported natively by windows, but I've switched to TTLS, using the w2secure TTLS client for windows. I followed the instructions on the freeradius site for configuring system authentication with TTLS and EAP-MD5, but I am getting the error 'rlm_unix: Attribute "User-Password" is required for authentication'. When a run 'radtest' locally, I can authenticate properly. I have copied the output from radiusd -X below. Thank you for your help! -Adrienne radiusd -X [root@CentOSTest raddb]# radiusd -fX Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 160.39.105.254:32769, id=81, length=153 User-Name = "testuser" NAS-IP-Address = 160.39.105.254 NAS-Port = 4097 Called-Station-Id = "00-90-0B-0A-9D-1C:mins" Calling-Station-Id = "00-12-F0-7B-48-E7" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT Unknown radio" EAP-Message = 0x0201000d017465737475736572 Message-Authenticator = 0x66faae1fa2563d763c27ceb6b6ef98e9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 76 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "unix" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request >josh. -----Original Message----- >>> From: >>> freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. >>> org >>> [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre >>> >>> >> eradius.org] On Behalf Of Adrienne Rau >> >> >>> Sent: 03 July 2007 19:30 >>> To: freeradius-users(a)lists.freeradius.org >>> Subject: RADIUS & PEAP >>> >>> I am configuring a wireless network with EAP Authentication. >>> I can connect successfully with the following line in my users file. >>> >>> testuser User-Password == "testing" >>> >>> I would like to be able to authenticate with ANY password. I >>> tried using the "!=" operand, but that causes an MS-CHAP >>> incorrect response error. Is there any way to make EAP >>> authenticate with any password. If not, how can I have it >>> authenticate against the /etc/passwd and /etc/shadow files? >>> >>> Thank you for your help, >>> Adrienne Rau >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> >>> >>> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> Adrienne Rau

2 1

Re: pool-key issue in rlm_sqlippool
by Hugh Messenger 05 Jul '07

05 Jul '07

Peter Nixon <listuser(a)peternixon.net> said: > On Wed 04 Jul 2007, Hugh Messenger wrote: > > I have a problem with the pool-key in rlm_sqlippool. > > You can run two copies of the module. As long as you don't have the same > pool > name in both, just assign your pool name based on hunt group and > everything > will work as you expect :-) Ah hah. I think I get it now! So basically I can replicate the "Multiple sqlippool instance example" setup from the wiki, where the only difference between the two instance configs is the pool-key. I was going at it the wrong way. Thinking in terms of "if it's a dialup do sqlippool_dialup, elsif it's a wireless do sqlippool_wireless". Instead of "try sqlippool_dialup, if it fails try sqlippool_wireless", just relying on the Pool-Name to take care of things. Thankyou for being so patient! > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 1

Help: "rlm_eap: processing type tls" Done, but "Segmentation fault"
by gaopeng 05 Jul '07

05 Jul '07

Dear all,I am a beginner about FreeRadius, and was learnning implement the WPA EAP-TLS by FreeRadius. I refer to the document named "WPA Authentication for Windows XP Clients with RADIUS HOWTO". I meet the problem: the trace stoped with error "Segmentation fault" after "rlm_eap: processing type tls". The log is attached, I wonder if you know what's wrong with it. I will really appreciate your helping me! Thanks a lot in advance!Gao Pengroot@RADIUS:~# freeradius -XStarting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: /etc/freeradius/proxy.confConfig: including file: /etc/freeradius/clients.confConfig: including file: /etc/freeradius/snmp.confConfig: including file: /etc/freeradius/eap.confConfig: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" m! ain: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1600 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0read_config_files: reading dictionaryread_config_files: readin! g naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clientsread_config_files: reading realmsradiusd: entering modules setupModule: Library search path is /usr/lib/freeradiusModule: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)"rlm_exec: Wait=yes but no output defined. Did you mean output=none?Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt"Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)"Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = norlm_eap: Loade! d and initialized type md5rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP"rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/wireless-auth/pem/RADIUS.pem" tls: certificate_file = "/etc/wireless-auth/pem/RADIUS.pem" tls: CA_file = "/etc/wireless-auth/pem/root.pem" tls: private_key_password = "password" tls: dh_file = "/etc/wireless-auth/dh" tls: random_file = "/etc/wireless-auth/random" tls: fragment_size = 1600 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)"rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yesrlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = n! orlm_eap: Loaded and initialized type mschapv2Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = noModule: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = noModule: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no"Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"Module: Instantiated acct_unique (acct_unique) Module: Lo! aded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = noModule: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yesModule: Instantiated radutmp (radutmp) Listening on authentication *:1812Listening on accounting *:1813Ready to process requests.rad_recv: Access-Request packet from host 192.168.1.1:1024, id=0, length=175 User-Name = "host/cn1ndr2c.cn001.siemens.net" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001a704e2a1b" Calling-Station-Id = "000cf15c5443" NAS-Identifier = "001a704e2a1b" NAS-Port = 11 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200002401686f73742f636e316e647232632e636e3030! 312e7369656d656e732e6e6574 Message-Authenticator = 0x4cfed09a13 0593c598c4930aca9b01da Processing the authorize section of radiusd.confmodcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/cn1ndr2c.cn001.siemens.net", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry host/cn1ndr2c.cn001.siemens.net at line 218 modcall[authorize]: module "files" returns ok for request 0modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAPauth: type "EAP" Processing the authenticate section of radiusd.confm! odcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tlsSegmentation fault _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

1 0

Useful sqlippool script
by Roy Walker 05 Jul '07

05 Jul '07

For those working with sqlippool, I made a quick script which will make it easy for you to create the ip blocks in the radippool table. Might be nice for new users if this was included in the scripts directory. #!/bin/sh # This script will output the necessary INSERT commands # for the sqlippool module in freeradius # Enter the pool name attribute POOL_NAME=your_pool_name # Set the first 2 octets of the IP network NETWORK=1.1 # Set the starting point of the third octet START_RANGE=1 # Set the ending point of the third octet END_RANGE=254 # Set the starting point of the fourth octet MIN_IP=1 # Set the ending point of the fourth octet MAX_IP=254 ######################################################################## # ######################################################################## # # Make sure that END_RANGE is higher than START_RANGE if [ $START_RANGE -gt $END_RANGE ] ; then echo "ERROR: Then ending range must be higher than the starting range." exit 1 fi SUBNET=$START_RANGE IP=$MIN_IP count=0 while [ true ]; do if [ $IP -gt $MAX_IP ] ; then if [ $SUBNET -eq $END_RANGE ] ; then exit 0; else SUBNET=$(( $SUBNET + 1 )) IP=$MIN_IP fi fi echo "INSERT INTO radippool (pool_name, FramedIPAddress) VALUES ('$POOL_NAME', '$NETWORK.$SUBNET.$IP');" IP=$(( $IP + 1 )) done; exit 0

2 2

Acct-Terminate-Cause = NAS-Error
by Flavio Silvestrone 05 Jul '07

05 Jul '07

Hello list, i have a problem with freeradius and an Access Point configured as NAS. I'm using freeradius version 1.1.6. I suppose that the problem is about this message: Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Error Here the complite log: Thu Jul 5 10:57:26 2007 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 401 NAS-Port-Type = Ethernet User-Name = "massi" Calling-Station-Id = "00:15:D6:24:32:52" Called-Station-Id = "internet-test-2.4GH" NAS-Port-Id = "wlan1" Acct-Session-Id = "81f0005c" Framed-IP-Address = 10.1.1.7 Framed-IP-Netmask = 255.255.255.0 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Identifier = "FlyBoost" NAS-IP-Address = 192.168.10.36 Acct-Delay-Time = 0 Client-IP-Address = 192.168.10.36 Acct-Unique-Session-Id = "e4880271975e52f1" Timestamp = 1183625846 Thu Jul 5 10:57:26 2007 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 401 NAS-Port-Type = Ethernet User-Name = "massi" Calling-Station-Id = "00:15:D6:24:32:52" Called-Station-Id = "internet-test-2.4GH" NAS-Port-Id = "wlan1" Acct-Session-Id = "81f0005c" Framed-IP-Address = 10.1.1.7 Framed-IP-Netmask = 255.255.255.0 Acct-Authentic = RADIUS Acct-Session-Time = 0 Acct-Input-Octets = 56 Acct-Input-Gigawords = 0 Acct-Input-Packets = 5 Acct-Output-Octets = 50 Acct-Output-Gigawords = 0 Acct-Output-Packets = 5 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Error NAS-Identifier = "FlyBoost" NAS-IP-Address = 192.168.10.36 Acct-Delay-Time = 0 Client-IP-Address = 192.168.10.36 Acct-Unique-Session-Id = "e4880271975e52f1" Timestamp = 1183625846 Any idea ? Thank's Flavio

3 4