- Freeradius-Users - lists.freeradius.org

Assertion failed in conffile.c, line 109,Abort
by Arran Cudbard-Bell 26 Jun '07

26 Jun '07

Including separate configuration files in major stanza subsections results in. Assertion failed in conffile.c, line 109 Abort Post-Auth-Type REJECT { # * Uniform called station ID + SSID extraction # * Uniform calling station ID # * Correct NAS Port Type # * Rewrite loopback ips $INCLUDE ${confdir}/attrrewrite.conf # Log rejected attempts to help with debugging sql attr_filter.access_reject } Does the config parser not check in sub sections for files to be included ? Adding the relevant configuration lines contained in attrrewrite.conf does not result in the error. It's definitely the include statement. This happens in authorize, post-auth etc ... Sorry, last bug for today :) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

Re:users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

I used numbers (123456) and it seems to work.seems?? when i use user:akim passwd:willy everything is allwright (redirection authentication on radius and message response ok.) using browsing the net but when i try to use another user (carl passwd:aniam or all the several users i created ) i have an access-reject message with following result: modcall[authorize]: module "pap" returns noop for request 24 modcall: leaving group authorize (returns ok) for request 24 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 24 modcall[authenticate]: module "unix" returns notfound for request 24 modcall: leaving group authenticate (returns notfound) for request 24 auth: Failed to validate the user. Delaying request 24 for 1 seconds Finished request 24 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.3 port 2051 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 24 ID 0 with timestamp 467fea7b what might be the fault -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

RE: Freeradius-Users Digest, Vol 26, Issue 120
by Hugh Messenger 25 Jun '07

25 Jun '07

"Flavio Silvestrone" <drascii(a)gmail.com> said: > Subject: Re: "Clear text password not available" > The version of radius is "freeradius-1.0.1-3". All together now: "Upgrade to 1.1.6" I've kind of lost track of exactly what you are trying to do, but what the users file is seems to be set up to do is to authenticate 'massi' locally in the users file, and flavio against the UNIX passwd file. And UNIX is telling you it doesn't know anything about 'flavio'. I think. But definitely upgrade to 1.1.6, regardless!! -- hugh

3 2

RE: Simultaneous-Use problem.
by Josh Howlett 25 Jun '07

25 Jun '07

> On Monday 25 June 2007 11:42:08 Josh Howlett wrote: > > I have a feeling that the answer is blindingly obvious, but I can't > > figure it out... > > > > The 'users' file consists of: > > > > DEFAULT Auth-Type = Accept > > Simultaneous-Use := 1 > > Because Simultaneous-Use is in the wrong place. Make it a > check item and the session section should be processed. That fixed it. As I thought, blindingly obvious; a case of needing another pair of eyes... Thanks, josh.

1 0

Simultaneous-Use problem.
by Josh Howlett 25 Jun '07

25 Jun '07

I have a feeling that the answer is blindingly obvious, but I can't figure it out... The 'users' file consists of: DEFAULT Auth-Type = Accept Simultaneous-Use := 1 In radiusd.conf I also have: session { sql } authorize { radius-user-auth } 'radius-user-auth' is an rlm_exec instance that invokes a script used to authenticate users. It works fine, but the 'session' section never gets processed. Why? josh.

2 1

Re:users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

> > Carl aniams wrote: > ... > > please any suggestion > ... > > WARNING: Unprintable characters in the password. ? Double-check the > > shared secret on the server and the NAS! > > What part of that message is unclear? Be sure that i crossed check the shared secret on my server and on the nas (the AP) yet nothing i even changed them yet nothing Alan DeKok. > > > ------------------------------ > > > -- > -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ > > ANIAMBOSSOU Carl > NIAMS TECHNOLOGIES > tel: +229 90 04 08 58 +229 97 48 01 33 > COTONOU > REPUBLIC OF BENIN > WEST AFRICA

2 1

terminating EAP tunnels, proxy and realms
by Andreas Liebe 25 Jun '07

25 Jun '07

Hi all, we're using FreeRadius 1.1.6 to give access to our WLAN with EAP-TTLS. Worked great so far. No we want to participate in inter University roaming (eduroam) and thus have to proxy some requests a parent server. Everything works great except regarding the outer identity. If it's just "anonymous" everything is ok, but if it's "anonymous@<somerealm>" and <somerealm> is configured in proxy.conf the EAP-Request ist proxied instead of terminated. This is correct by configuration but not wanted. Is there a way to terminate the EAP regardless of the outer identity? Here's an example: User-Name = "anonymous(a)tu-darmstadt.de" Calling-Station-Id = "00-18-DE-B5-3A-E2" ... EAP-Message = 0x0201001e01616e6f6e796d6f75734074752d6461726d73746164742e 6465 Message-Authenticator = 0x7a211176339c3e2ee9f7a0fe56864b2a ... rlm_realm: Looking up realm "tu-darmstadt.de" for User-Name = "anonymous(a)tu-darmstadt.de" rlm_realm: Found realm "tu-darmstadt.de" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm tu-darmstadt.de rlm_realm: Adding Realm = "tu-darmstadt.de" rlm_realm: Preparing to proxy authentication request to realm "tu-darmstadt. de" modcall[authorize]: module "suffix" returns updated for request 6 rlm_eap: Request is supposed to be proxied to Realm tu-darmstadt.de. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 6 ... How can I bypass proxy authentication for EAP-Messages? This is the setup in users: ... # matches request without any realm (local) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm !* "NULL", Proxy-To-Realm := MyRealm User-Name = `%{User-Name}`,Fall-Through = Yes # matches requests going explicitly to tu-darmstadt.de (local) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm == "tu-darmstadt.de", Proxy-To-Realm := MyRealm User-Name = `%{User-Name}`,Fall-Through = Yes # matches requests going parent radius DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm == DEFAULT, Proxy-To-Realm := Parent User-Name = `%{User-Name}`,Fall-Through = Yes ... Thanks a lot, -Andreas -- Andreas Liebe/Darmstadt University of Technology/+49 6151 16-3150/3050(FAX)

5 13

re： Problem on freeradius+openldap+tls
by Hangjun He 25 Jun '07

25 Jun '07

freeradius version 1.1.6 openldap version 2.3.23 opensll verson 0.9.7g Hangjun He <elmerhe(a)yahoo.com.cn> 写道： hi, freeradis with openldap is OK when use cleartext communication. Now I want to use tls. openssl s_client -connect 127.0.0.1:636 -showcerts -state -CAfile /usr/local/etc/openldap/ssl/cacert.pem show the cacert /cert/key is correct. But when I use freeradis with tls, errors pup up: freeradius error: rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(uid=hwang)' radius_xlat: 'ou=People,dc=aerohive,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/openldap/ssl/cacert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 openldap error: TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=902, written=902 ...... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 2a .* TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1052 connection_read(11): TLS accept failure error=-1 id=5, closing connection_closing: readying conn=5 sd=11 for close connection_close: conn=5 sd=11 daemon: removing 11 When I use freeradius in the same host with openldap, There are other errors: connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:SSLv3 read client certificate A TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data connection_read(10): unable to get TLS client DN, error=49 id=11 connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify partly configuration in slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem TLSCertificateFile /usr/local/etc/openldap/ssl/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/serverkey.pem TLSVerifyClient try Can anyone tell me why it is? Anything wrong with my configure file. Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！ --------------------------------- 抢注雅虎免费邮箱-3.5G容量，20M附件！

2 2

users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

hi i am using freeradius 1.1.6 with mysql 4 on a fedora core 4 with a DD-WRT v23 with enabled chilli. i have the users created through the dialupadmin page. users are successfully created but while trying to log through chilli i have the following when i do radiusd -X please any suggestion welcome Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:2051, id=0, length=197 User-Name = "akim" User-Password = "\332%\300D\310\373h\345]\237\036\216\242\373\362\001" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-90-4B-A4-D0-E8" Called-Station-Id = "00-18-F8-68-09-F5" NAS-Identifier = "hotspot" Acct-Session-Id = "467fca8f00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x23a39f4c2fabd6436787a53362759cf8 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "akim", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'akim' rlm_sql (sql): sql_set_user escaped user --> 'akim' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'akim' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'akim' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'akim' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'akim' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [akim]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.3 port 2051 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 467fb396 Nothing to do. Sleeping until we see a request. -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

3 2

reference guide...
by suganthi V 25 Jun '07

25 Jun '07

Hi all, I am new to freeradius. I want to understand the over all code flow and design of freeradius. Can anyone suggest any reference guide for understanding the design of freeradius please??????? I went thro some manuals of freeradius. But they r theoritical, explaining about radius configurations and packet formats. But i want to understand the design of that... Please help me if u know some guide..... Thanks a lot..... --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 3