- Freeradius-Users - lists.freeradius.org

Add $ to end of machine account uid
by Cody Jarrett 07 Jul '07

07 Jul '07

I need machines to be able to authenticate so that when a user who has never logged onto a computer can, by the machine have an active network connection and pulling the credentials from the samba-ldap domain. I have a realm setup to strip the domain/ part of the username which works fine, but I need to figure out how to add a $ at the end of anything that tries to connect as uid=host/computername. I'm sure I can figure out how to strip the host prefix, but can't quit figure out how to add the $ to the end. Thanks. -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

3 6

Configuration for EAP-SIM
by Garvin Haslett 06 Jul '07

06 Jul '07

Can anyone direct me to an example eap.conf entry to use EAP-SIM? I have looked but I don't see an example. Cheers, Garvin.

2 1

Adding an attribute to an incoming Access-Request
by Roy Walker 06 Jul '07

06 Jul '07

I have played with this a bit and can't seem to get it working... I need to add the "NAS-Port = 0" attribute to an incoming request if it is not set. This is currently breaking my sqlippool config and the upstream partner making the requests is not giving me a NAS-Port attribute. It looks like this should be done in the preprocess section, however the hints looks like it only works with a username and huntgroups doesn't really do what I need... Anyone got an idea? Thanks, Roy

2 2

Converting clients to clients.conf
by Lisa Casey 06 Jul '07

06 Jul '07

Hi, Is there any easy way to convert a freeradius clients file to a clients.conf file? I have several dozen entries in my clients file and if I have to convert this by hand it's going to be a lot of typing... Lisa Casey

2 1

RE: "Shared secret is incorrect" - but it is identical!
by Josh Howlett 06 Jul '07

06 Jul '07

Hi Ken, What happens if, using radtest, you specify the username *without* the realm from the remote machine? josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of ken > Sent: 03 July 2007 22:02 > To: FreeRadius users mailing list > Subject: "Shared secret is incorrect" - but it is identical! > > I'm trying to get FreeRadius working on a Fedora Core 6 > server with a view to eventually using it to authenticate > against Windows Active Directory via ntlm_auth for the Janet > Roaming Service. The first attempts at configuring it failed > rather drastically so I went back to the beginning and I'm > doing things one step at at time, making one-line changes to > configs then using radtest and/or radclient to ensure it > still works. I can now authenticate a users defined in users > file, or in the Unix passwd file, from radtest on local > machine. (i.e. the same one the server is running on). Next > step is to check that I can use FreeRadius over the network > by trying radclient on another machine. > > It doesn't work from the networked machine. I see the > "invalid signature (err=2)! (Shared secret is incorrect.)" message. > > Debug log says to "double check the shared secret on the > server". I have more than double checked it. I'm using the > same shared secret on both machines. I "know" the shared > secret is correct because it works from the local machine. > But obviously it isn't! Because the encrypted password can't > be read on the server. What can I do to make sure the shared > secret truly is correct? > > The definitions for both hosts are identical in the > clients.conf file. At one point I manually edited them to > swap the names of servers while leaving the secrets the same, > just in case there was some hidden unprintable character - > but the new local one still worked, proving that the two > entries in the clients.conf file are in fact identical. > > The shared secrets used in the radtest command are identical. > I'm cutting and pasting the *same* radtest command in, not > retyping it. > > To test for sure I put radclient commands in scripts on the > remote machine, where they failed. Then I ftped them from > the machine they failed on to the other one - where they > worked! So it *has* to be the same! And if I alter it in any > way there then radtest fails so its not getting a free > passage just because its local. > > I have a horrid fear I've missed something totally obvious > about how radclient works and that I'm doing something really > really stupid stupid - but I can't see what. And I've been > stuck here for over a week now. Any clues? > > From the local machine I get: > > =================== > [ken@monstera ~]$ /usr/local/bin/radtest -d /etc/raddb > username(a)bbk.ac.uk password server.IP.addr 122 sharedsecret > Sending Access-Request of id 121 to server.IP.addr port 1812 > User-Name = "username(a)bbk.ac.uk" > User-Password = "password" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 122 > rad_recv: Access-Accept packet from host server.IP.addr:1812, > id=121, length=20 =================== > > But when I try from the remote machine I get: > > =================== > /usr/local/bin/radtest -d /etc/raddb username(a)bbk.ac.uk > password server.IP.addr 122 sharedsecret Sending > Access-Request of id 184 to server.IP.addr port 1812 > User-Name = "username(a)bbk.ac.uk" > User-Password = "password" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 122 > rad_recv: Access-Reject packet from host server.IP.addr:1812, > id=184, length=20 > rad_verify: Received Access-Reject packet from client > server.IP.addr port 1812 with invalid signature (err=2)! > (Shared secret is incorrect.) > [ken@ficus ~]$ /usr/local/bin/radtest -d /etc/raddb > username(a)bbk.ac.uk password server.IP.addr 122 sharedsecret > Sending Access-Request of id 246 to server.IP.addr port 1812 > User-Name = "username(a)bbk.ac.uk" > User-Password = "password" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 122 > rad_recv: Access-Reject packet from host server.IP.addr:1812, > id=246, length=20 > rad_verify: Received Access-Reject packet from client > server.IP.addr port 1812 with invalid signature (err=2)! > (Shared secret is incorrect.) > [ken@ficus ~]$ /usr/local/bin/radtest -d /etc/raddb > username(a)bbk.ac.uk password server.IP.addr 122 sharedsecret > Sending Access-Request of id 7 to server.IP.addr port 1812 > User-Name = "username(a)bbk.ac.uk" > User-Password = "password" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 122 > rad_recv: Access-Reject packet from host server.IP.addr:1812, > id=7, length=20 > rad_verify: Received Access-Reject packet from client > server.IP.addr port 1812 with invalid signature (err=2)! > (Shared secret is incorrect.) > ================== > > > I strongly suspect that I am doing something stupid on the > client side, because the same request works from the local > server. But just in case its relevant, on the server in debug > mode the failed transaction looks like this: > > > ================== > rad_recv: Access-Request packet from host > client.IP.addr:32772, id=61, length=68 > User-Name = "username(a)bbk.ac.uk" > User-Password = > "V\303\245\321\364Fb\334\373\275\242\203\\o6\264" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 122 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 9 > modcall[authorize]: module "preprocess" returns ok for request 9 > radius_xlat: > '/var/log/radius/radacct/client.IP.addr/auth-detail-20070703' > rlm_detail: > /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > expands to > /var/log/radius/radacct/client.IP.addr/auth-detail-20070703 > modcall[authorize]: module "auth_log" returns ok for request 9 > modcall[authorize]: module "chap" returns noop for request 9 > modcall[authorize]: module "mschap" returns noop for request 9 > rlm_realm: Looking up realm "bbk.ac.uk" for User-Name = > "username(a)bbk.ac.uk" > rlm_realm: Found realm "bbk.ac.uk" > rlm_realm: Adding Stripped-User-Name = "username" > rlm_realm: Proxying request from user username to realm bbk.ac.uk > rlm_realm: Adding Realm = "bbk.ac.uk" > rlm_realm: Authentication realm is LOCAL. > modcall[authorize]: module "suffix" returns noop for request 9 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 9 > users: Matched entry DEFAULT at line 20 > modcall[authorize]: module "files" returns ok for request 9 > rlm_pap: WARNING! No "known good" password found for the user. > Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for request 9 > modcall: leaving group authorize (returns ok) for request 9 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 9 > modcall[authenticate]: module "unix" returns notfound for request 9 > modcall: leaving group authenticate (returns notfound) for request 9 > auth: Failed to validate the user. > WARNING: Unprintable characters in the password. ? > Double-check the shared secret on the server and the NAS! > Delaying request 9 for 1 seconds > Finished request 9 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 61 to client.IP.addr port 32772 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 9 ID 61 with timestamp 468aaada Nothing > to do. Sleeping until we see a request. > ================== > > > And a successful one looks like this - the obvious difference > is that the password is in clear (though I have obfuscated it > here) - as would be expected if there was no shared secret. > > ================== > rad_recv: Access-Request packet from host > server.IP.addr:32770, id=170, length=46 > User-Name = "username" > User-Password = "password" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 10 > modcall[authorize]: module "preprocess" returns ok for request 10 > radius_xlat: > '/var/log/radius/radacct/server.IP.addr/auth-detail-20070703' > rlm_detail: > /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > expands to > /var/log/radius/radacct/server.IP.addr/auth-detail-20070703 > modcall[authorize]: module "auth_log" returns ok for request 10 > modcall[authorize]: module "chap" returns noop for request 10 > modcall[authorize]: module "mschap" returns noop for request 10 > rlm_realm: No '@' in User-Name = "username", looking up > realm NULL > rlm_realm: Found realm "NULL" > rlm_realm: Adding Stripped-User-Name = "username" > rlm_realm: Proxying request from user username to realm NULL > rlm_realm: Adding Realm = "NULL" > rlm_realm: Authentication realm is LOCAL. > modcall[authorize]: module "suffix" returns noop for request 10 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 10 > users: Matched entry username at line 2 > modcall[authorize]: module "files" returns ok for request 10 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 10 > modcall: leaving group authorize (returns ok) for request 10 > rad_check_password: Found Auth-Type Local > auth: type Local > auth: user supplied User-Password matches local User-Password > Processing the post-auth section of radiusd.conf > modcall: entering group post-auth for request 10 > radius_xlat: > '/var/log/radius/radacct/server.IP.addr/reply-detail-20070703' > rlm_detail: > /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d > expands to > /var/log/radius/radacct/server.IP.addr/reply-detail-20070703 > modcall[post-auth]: module "reply_log" returns ok for request 10 > modcall: leaving group post-auth (returns ok) for request 10 > Sending Access-Accept of id 170 to server.IP.addr port 32770 > Finished request 10 Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 10 ID 170 with timestamp 468aab69 Nothing > to do. Sleeping until we see a ================== > > > Debug of startup looks like this (same in both cases obviously). > I made new conf files to contain any local changes I might > make & to yhelp me find my way aroudn radiusd.conf more > easily - but they are just the sections of conf I might want > to change pulled out and INCLUDEd back in so no substantial change: > > ================== > /usr/local/sbin/radiusd -X -d /etc/raddb Starting - reading > configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/raddb/bbk_fr_listen.conf > Config: including file: /etc/raddb/bbk_fr_security.conf > Config: including file: /etc/raddb/proxy.conf > Config: including file: /etc/raddb/clients.conf > Config: including file: /etc/raddb/snmp.conf > Config: including file: /etc/raddb/eap.conf > Config: including file: /etc/raddb/bbk_fr_mschap.conf > Config: including file: /etc/raddb/bbk_fr_ldap.conf > Config: including file: /etc/raddb/bbk_fr_passwd.conf > Config: including file: /etc/raddb/bbk_fr_realms.conf > Config: including file: /etc/raddb/bbk_fr_details.conf > Config: including file: /etc/raddb/sql.conf > Config: including file: /etc/raddb/bbk_fr_radutmp.conf > Config: including file: /etc/raddb/bbk_fr_counters.conf > Config: including file: /etc/raddb/bbk_fr_exec.conf > Config: including file: /etc/raddb/bbk_fr_ippool.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = yes > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > pap: auto_header = yes > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = yes > mschap: require_strong = yes > mschap: with_ntdomain_hack = yes > mschap: passwd = "(null)" > mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "peap" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/raddb/certs/radius2.bbk.ac.uk.key" > tls: certificate_file = "/etc/raddb/certs/radius2.bbk.ac.uk.pem" > tls: CA_file = "/etc/raddb/certs/ct_root.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/etc/raddb/certs/dh" > tls: random_file = "/dev/urandom" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > tls: cipher_list = "(null)" > tls: check_cert_issuer = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/etc/raddb/huntgroups" > preprocess: hints = "/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded detail > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (auth_log) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/etc/raddb/users" > files: acctusersfile = "/etc/raddb/acct_users" > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (pre_proxy_log) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detai l-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (post_proxy_log) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (reply_log) > Listening on authentication *:1812 > Listening on accounting *:1813 > Listening on proxy *:1814 > Ready to process requests. > > ================== > > > FreeRADIUS Version 1.1.5, for host i686-pc-linux-gnu, built > on Mar 9 2007 at 15:07:40 > > > The configurations are minimal: > > > relevant entries in clients file: > > ================== > client nnn.nnn.nnn.nnn { > secret = sharedsecret > shortname = monstera > nastype = other > } > client nnn.nnn.nnn.nnn { > secret = sharedsecret > shortname = ficus > nastype = other > } > ================== > > relevant entry in users file > > ================== > username Auth-Type := Local, User-Password == "password" > ================== > > > As I said, authentication works for the host on which Freeradius > is running, but not on the other. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

4 5

RE: Freeradius-Users Digest, Vol 27, Issue 24
by Hugh Messenger 06 Jul '07

06 Jul '07

Peter Nixon <listuser(a)peternixon.net> said: > And different pool names in each instance.... Yup, although obviously the Pool-Name is set up independently of the sqlippool instances. I have some unlang at the start of 'authorize' section that sets the Pool-Name based on a mix of NAS IP and Calling-Station-Id. I also have some NAS's in the main 'dialup' Huntgroup that do their own pool assignments (so I don't set a Pool-Name). So I've wrapped the group stuff inside a test ... Post-Auth-Type alaweb { if ("%{control:Pool-Name}") { group { ... } } } (I tried wrapping it round the whole of the Post-Auth-Type block, but FR doesn't like that) Anyway, that part now works famously, thank you. My one remaining question is, what should the 'accounting' section look like? As far as I can tell, the accounting queries always return OK (except if there was some kind of database problem) regardless of whether a table row was affected or not. Which is to be expected I suppose, as 'notfound' isn't normally relevant in an accounting query. But I obviously need to apply the right instance, so I get the right pool-key for the allocate/clear queries. So I guess I'll have to wrap some unlang around it like ... if ("%{control:Pool-Name}") { if ("%{control:Huntgroup-Name" == "dialup") { sqlippool_dialup } elsif ("%{control:Huntgroup-Name" == "wireless") { sqlippool_wireless } } Just out of interest, what would the recommended 'accounting' config look like for the Wiki example? > > Thankyou for being so patient! > > You are welcome. Everyone is/was helped by someone when they start out :-) I'm definitely at that "a little knowledge is a dangerous thing" stage with FR. :) I do fully intend to try and pay forward some of the help I've been getting by building a "Wireless and Dialup with MySQL Cookbook" for the wiki, once I've gotten this all sorted out! > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 1

SIGHUP working?
by Roy Walker 06 Jul '07

06 Jul '07

Is SIGHUP working in CVS?

3 3

So long and thanks for the help
by Ethan Dicks 06 Jul '07

06 Jul '07

Hi, All, I've changed jobs this week, and am no longer working with freeRADIUS, but wanted to thank the folks here for the help I've received and for all the work that's gone into freeRADIUS. If I ever run into a need for an AAA server, I'll be back, but probably not before 2.0.0 is obsolete and questions about it elicit a response of "why would you use that old thing?!?" Thanks again! -ethan

1 0

Proxying without nostrip
by amarquez001＠ikasle.ehu.es 06 Jul '07

06 Jul '07

Hi everyone: I want to proxy requests with i2t realm to a i2t.server.com The problem is that if I use nostrip directive in the proxy.conf of the proxy server, all works fine. But I need to store logins in the i2t.server.com without the realm name, so I use this configuration from the proxy.conf in the proxy server: realm i2t { type = radius authhost = 192.168.2.2:1812 accthost = 192.168.2.2:1813 secret = testing123 strip } The result of the execution in the i2t.server.com is: root@alvaro-desktop:/etc/freeradius# freeradius -X Starting - reading configuration files ... . . . Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.1:1814, id=0, length=150 User-Name = "user1" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "00-0C-29-81-54-F3:" Calling-Station-Id = "00-0C-29-EC-7D-9D" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209000e01757365723140693274 Message-Authenticator = 0xae40c811e106af74fc216d522466a797 Proxy-State = 0x3335 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 9 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry user1 at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.2.1 port 1814 Proxy-State = 0x3335 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 468e1d50 Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 192.168.2.1:1814, id=0, length=159 Acct-Session-Id = "468D84AB-0000000D" Acct-Status-Type = Stop Acct-Authentic = RADIUS User-Name = "user1" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "00-0C-29-81-54-F3:" Calling-Station-Id = "00-0C-29-EC-7D-9D" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" Acct-Session-Time = 301 Event-Timestamp = "Jul 6 2007 12:48:16 CEST" Acct-Terminate-Cause = Idle-Timeout Proxy-State = 0x3336 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.2.1,NAS-IP-Address = 192.168.1.1,Acct-Session-Id = "468D84AB-0000000D",User-Name = "user1"' rlm_acct_unique: Acct-Unique-Session-ID = "e9f7ae8a84e4857d". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/freeradius/radacct/192.168.2.1/detail-20070706' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.1/detail-20070706 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'user1' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 0 to 192.168.2.1 port 1814 Proxy-State = 0x3336 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 468e1db0 Nothing to do. Sleeping until we see a request. Why rejects the request?? Any idea?? Thanks in advance. - Alvaro.

2 1

Cisco VRF + Radius
by Francesco Cristofori 06 Jul '07

06 Jul '07

Hi all, anybody has experience in setting up FR to support IP VRF for cisco equipments? Can you point me to some clear and simple configuration guide for doing that? TIA, Francesco.

3 2