- Freeradius-Users - lists.freeradius.org

DB handles and radius.log errors
by Ivan Kalik 13 Jun '07

13 Jun '07

PS. Example: http://puck.nether.net/pipermail/cisco-nas/2004-January/000474.html checkrad works with one Cisco router but not with another with same configuration and same IOS version. Ivan Kalik Kalik Informatika ISP

2 2

DB handles and radius.log errors
by Irina 13 Jun '07

13 Jun '07

First, thanks to Ivan for help with Simultaneous and to Dennis with indexing. I am new to radius, please bear with me. I will try to describe the problem as much as I can. I need to ask if anybody has experienced a problem with DB handles. Here is what we have experienced a couple of times. Both NASes Cisco talk to 1 radius (there is another radius, but it was set up on NASes as a secondary radius). Many connections drop at the same time on 1 or both NASes and try to reconnect. Radius did not get a proper disconnection, therefore sees many users connected with Stop = 0. All Simultaneous Logins are set to 1, so radius checks if users are connected on NAS. Below is what I find in radius.log. Mon Jun 11 14:48:28 2007 : Error: Discarding duplicate request from client aleph:1645 - ID: 95 due to unfinished request 28856 Mon Jun 11 14:48:33 2007 : Error: Discarding duplicate request from client aleph:1645 - ID: 95 due to unfinished request 28856 Mon Jun 11 14:48:33 2007 : Error: Check-TS: timeout waiting for checkrad Mon Jun 11 14:48:48 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Jun 11 14:48:48 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Also see logouts with no Login record Mon Jun 11 14:48:52 2007 : Error: rlm_radutmp: Logout for NAS aleph port 1401, but no Login record Mon Jun 11 14:48:52 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Jun 11 14:48:52 2007 : Error: rlm_radutmp: Logout for NAS aleph port 854, but no Login record I also see few of the following for different usernames Mon Jun 11 14:50:11 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'user(a)nas.net', nas '216.145.96.1'] Then Mon Jun 11 14:50:16 2007 : Error: rlm_sql_getvpdata: database query error Mon Jun 11 14:50:16 2007 : Error: rlm_sql (sql): SQL query error; rejecting user Also, radius.log has quite few lines (could be not related to only the problem I described above, because I see the following lines in radius.log constantly, with empty string instead of a username) Wed Jun 13 09:39:26 2007 : Error: rlm_radutmp: Logout for NAS heh port 1099, but no Login record Wed Jun 13 09:39:26 2007 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas '216.145.96.1'] I have increased num_sql_socks to 10. Is it a reasonable number? Or this does not help with this problem and I need to look more into finding and fixing it. And/or NASes problem? Any suggestion is welcome. Thank you for your help in advance. Irina ====================

2 1

Re: Freeradius-Users Digest, Vol 26, Issue 52 (Out of Office)
by BRETT WEEAST 13 Jun '07

13 Jun '07

I will be out of the office from June 15 to June 25, 2007. If your request can not wait until my return on June 26, please email R035(a)gw.njsp.org or call 609-882-2000 x.6688. >>> freeradius-users 06/13/07 09:54 >>> Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Problem with WLAN-MAC authentication (Alan Dekok) 2. Re: Statistics tool? (Alan Dekok) 3. Re: Problem with WLAN-MAC authentication (tnt(a)kalik.co.yu) 4. Re: 2.0.0 documentation for radiusd.conf. (Arran Cudbard-Bell) 5. Re: 2.0.0 documentation for radiusd.conf. (Alan Dekok) 6. Re: Support for PEAP-Mschapv2 and PEAP-GTC simultaneously? (Colleen C. Morrissey) 7. freeradius-jradius-pam (lisa laam) 8. DB handles and radius.log errors (Irina) ---------------------------------------------------------------------- Message: 1 Date: Wed, 13 Jun 2007 14:35:33 +0200 From: Alan Dekok <aland(a)deployingradius.com> Subject: Re: Problem with WLAN-MAC authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <466FE495.9080402(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Klaus.Albers(a)wavin.de wrote: > Here is the output from the debug screen... The authorization process as > below loops when I switch on the encryption. Without any encryption it > works quite perfect. > > Or is it 'not' possible to use mac authentication and WEP/WPA with > preshared key at the same time? That's really up to your AP. ... > Sending Access-Accept of id 188 to 172.19.0.11 port 1261 FreeRADIUS is telling the AP that the MAC is OK. If the AP tries to authenticate again with the same MAC address, it's broken. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog ------------------------------ Message: 2 Date: Wed, 13 Jun 2007 14:36:39 +0200 From: Alan Dekok <aland(a)deployingradius.com> Subject: Re: Statistics tool? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <466FE4D7.2010304(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Graham Beneke wrote: > Does anyone know of any system that could be used to remotely monitor if > a radius server is up? radclient? Send the server a Status-Server request, and it should respond. See radiusd.conf for more. > Something along the lines of radtest and then you would add a nasclient > line for each testing location and dummy users entry that can be queried > by the test location. That's not needed. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog ------------------------------ Message: 3 Date: Wed, 13 Jun 2007 13:49:56 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Problem with WLAN-MAC authentication To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <H17XCPE4.1181738996.7142300.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 OK. So your client gets accepted. You will need to look at NAS logs to see where the connection breaks. Radius is working fine. Ivan Kalik Kalik Informatika ISP Dana 13/6/2007, "Klaus.Albers(a)wavin.de" <Klaus.Albers(a)wavin.de> pi?e: >Here is the output from the debug screen... The authorization process as >below loops when I switch on the encryption. Without any encryption it >works quite perfect. > >Or is it 'not' possible to use mac authentication and WEP/WPA with >preshared key at the same time? > >*NoIdeaWhatHappens* > >- - - - - - - - - > >Module: Instantiated detail (reply_log) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. >rad_recv: Access-Request packet from host 172.19.0.11:1261, id=188, >length=73 > User-Name = "00-19-d2-2a-61-50" > User-Password = 00-19-d2-2a-61-50" > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 >radius_xlat: >'../var/log/radius/radacct/172.19.0.11/auth-detail-20070613.log' >rlm_detail: >.../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.lo >g expands to >.../var/log/radius/radacct/172.19.0.11/auth-detail-20070613.log > modcall[authorize]: module "auth_log" returns ok for request 0 > rlm_realm: No '@' in User-Name = "00-19-d2-2a-61-50", looking up realm >NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > users: Matched entry 00-19-d2-2a-61-50 at line 3 > modcall[authorize]: module "files" returns ok for request 0 >rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 0 >modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type Accept > rad_check_password: Auth-Type = Accept, accepting the user >Login OK: [00-19-d2-2a-61-50/00-19-d2-2a-61-50] (from client wlanedv port >0) > Processing the post-auth section of radiusd.conf >modcall: entering group post-auth for request 0 >radius_xlat: >'../var/log/radius/radacct/172.19.0.11/reply-detail-20070613.log' >rlm_detail: >.../var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d.l >og expands to >.../var/log/radius/radacct/172.19.0.11/reply-detail-20070613.log > modcall[post-auth]: module "reply_log" returns ok for request 0 >modcall: leaving group post-auth (returns ok) for request 0 >Sending Access-Accept of id 188 to 172.19.0.11 port 1261 >Finished request 0 >Going to the next request >- - - - - - - - > > > >Wavin GmbH - Sitz der Gesellschaft: 49767 Twist - Registergericht: AG Osnabr?ck Abt. B 120003 - Gesch?ftsf?hrung: J?rgen Frei, Maarten Roef - Vors.d. Aufsichtsrates: Henk ten Hove ------------------------------ Message: 4 Date: Wed, 13 Jun 2007 13:51:36 +0100 From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> Subject: Re: 2.0.0 documentation for radiusd.conf. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <466FE858.6040709(a)sussex.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed > switch > Evaluate the given string, and choose the first matching "case" > statement inside of the current block. No statement other than > "case" can appear in a "switch" block. > > switch "string" { > ... > } > These work now ? :D > case > Define a static string to match a parent "switch" statement. A > "case" statement cannot appear outside of a "switch" block. > > case string { > ... > } > > update > Update a particular attribute list, based on the attributes > given in the current block. > > update <list> { > attribute = value > ... > } > > The <list> can be one of "request", "reply", "proxy-request", > "proxy-reply", or "control". The "control" list is the list of > attributes maintainted internally by the server that controls > how the server processes the request. Any attribute that does > not go in a packet on the network will generally be placed in > the "control" list. > Control instead of config ? Cool , very nice work :) ------------------------------ Message: 5 Date: Wed, 13 Jun 2007 14:59:00 +0200 From: Alan Dekok <aland(a)deployingradius.com> Subject: Re: 2.0.0 documentation for radiusd.conf. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <466FEA14.7030604(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Arran Cudbard-Bell wrote: >> switch > These work now ? :D Yes. I just added a "default" to the switch statements, too. See the updated "man unlang". > Control instead of config ? Yes. "config" is already used for configuration-file stuff. > Cool , very nice work :) Thanks. I think it's nearly time for a -pre2. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog ------------------------------ Message: 6 Date: Wed, 13 Jun 2007 09:34:07 -0400 From: "Colleen C. Morrissey" <morric(a)rpi.edu> Subject: Re: Support for PEAP-Mschapv2 and PEAP-GTC simultaneously? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <466FF24F.7090002(a)rpi.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Thanks! I had ldap returning Password-with-Header for GTC deployment and then added NT-Password for ms-chapv2. Commenting out the password-with-header for userpassword in ldap.attrmap seems to allow both to work. Which makes my life much easier :) Alan Dekok wrote: > Colleen C. Morrissey wrote: >> My question is can I somehow support both simultaneously with the same >> freeradius daemon (I know I can simply run a second daemon on different >> port supporting the other but that will require me to do lots of work on >> infrastructure/ssids to point to different servers)? Does anybody >> happen to have this working and be willing to post config? Or any other >> ideas? > > Yes. If you configure the server to know about the users clear-text > password or NT-hashed password, then PEAP/GTC should "just work". > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 7 Date: Wed, 13 Jun 2007 15:38:32 +0200 From: "lisa laam" <laam.lisa(a)gmail.com> Subject: freeradius-jradius-pam To: freeradius-users(a)lists.freeradius.org, freeradius-devel-request(a)lists.freeradius.org Message-ID: <b60805e90706130638q73397eacudc7841f01130c358(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, I have a trainee. -I have to write a module witch should be able to authenticate users with username and password concatenated to OTP (One Time Password) rather than only password. - this module should be able to authenticate first the user within Active Directory and then validate the OTP. -The module that validate the OTP is Servlet (JAVA module). and i should call this programme from my module to do OTP validation. - I propose to use Freeradius to integrate this module for remote access. -For web access I proposed writting a module (PAM module) for an Apache Server./ your comment? -The probleme is that i have only two months left to implement one of the two solution (Apache or Radius) so I should choose rapidly. Witch of the two is easiest to implement?? ( note this is that this is the first time I deal with Freeradius, PAM, Apache) my questions are : 2- if i used Freeradius, then what would be easy and rapid to implement a PAM module or using JRadius (I tried to install Jradius patch, but didn't succeed)? Did you recommend me JRadius (I thougt about JRadius because the OTP validation programme is written in JAVA) ? 3- about PAM modules, I understand that we could use this independently from Freeradius Server. Is this true. would it be easier and faster to implement a standalone PAM? please need your advice. help me to decide : - write a PAM for Freeradius or wwhat a module ? - use Jradius with Freeradius or - write PAM for Apache - standalone PAM ?? or - what ? thanks in advance Lisa.

1 0

freeradius-jradius-pam
by lisa laam 13 Jun '07

13 Jun '07

Hi, I have a trainee. -I have to write a module witch should be able to authenticate users with username and password concatenated to OTP (One Time Password) rather than only password. - this module should be able to authenticate first the user within Active Directory and then validate the OTP. -The module that validate the OTP is Servlet (JAVA module). and i should call this programme from my module to do OTP validation. - I propose to use Freeradius to integrate this module for remote access. -For web access I proposed writting a module (PAM module) for an Apache Server./ your comment? -The probleme is that i have only two months left to implement one of the two solution (Apache or Radius) so I should choose rapidly. Witch of the two is easiest to implement?? ( note this is that this is the first time I deal with Freeradius, PAM, Apache) my questions are : 2- if i used Freeradius, then what would be easy and rapid to implement a PAM module or using JRadius (I tried to install Jradius patch, but didn't succeed)? Did you recommend me JRadius (I thougt about JRadius because the OTP validation programme is written in JAVA) ? 3- about PAM modules, I understand that we could use this independently from Freeradius Server. Is this true. would it be easier and faster to implement a standalone PAM? please need your advice. help me to decide : - write a PAM for Freeradius or wwhat a module ? - use Jradius with Freeradius or - write PAM for Apache - standalone PAM ?? or - what ? thanks in advance Lisa.

1 0

Re: Problem with WLAN-MAC authentication
by Klaus.Albers＠wavin.de 13 Jun '07

13 Jun '07

Here is the output from the debug screen... The authorization process as below loops when I switch on the encryption. Without any encryption it works quite perfect. Or is it 'not' possible to use mac authentication and WEP/WPA with preshared key at the same time? *NoIdeaWhatHappens* - - - - - - - - - Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.19.0.11:1261, id=188, length=73 User-Name = "00-19-d2-2a-61-50" User-Password = 00-19-d2-2a-61-50" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '../var/log/radius/radacct/172.19.0.11/auth-detail-20070613.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.lo g expands to ../var/log/radius/radacct/172.19.0.11/auth-detail-20070613.log modcall[authorize]: module "auth_log" returns ok for request 0 rlm_realm: No '@' in User-Name = "00-19-d2-2a-61-50", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry 00-19-d2-2a-61-50 at line 3 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [00-19-d2-2a-61-50/00-19-d2-2a-61-50] (from client wlanedv port 0) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '../var/log/radius/radacct/172.19.0.11/reply-detail-20070613.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d.l og expands to ../var/log/radius/radacct/172.19.0.11/reply-detail-20070613.log modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 188 to 172.19.0.11 port 1261 Finished request 0 Going to the next request - - - - - - - - Wavin GmbH - Sitz der Gesellschaft: 49767 Twist - Registergericht: AG Osnabr�ck Abt. B 120003 - Gesch�ftsf�hrung: J�rgen Frei, Maarten Roef - Vors.d. Aufsichtsrates: Henk ten Hove

3 2

encrypted password
by Felipe Ceglia - PY1NB 13 Jun '07

13 Jun '07

Hi again, I need to migrate my users from plain old unix passwd file to sql. How do I have the user information in the radcheck table? Encrypted-Password == 9D8wtP7DGqgCg ? My passwd file looks like: anavc:9D8wtP7DGqgCg:1002:300:#Ana:/home/dummy:/usr/bin/passwd This password seems not to be MD5. Any guesses? Thank you again, Felipe

5 8

Problem with WLAN-MAC authentication
by Klaus.Albers＠wavin.de 13 Jun '07

13 Jun '07

Hello, I am quite new to the Freeradius topic and I have got a problem: First of all I started with this tutorial: http://www.wi-fitechnology.com/Papers+req-showcontent-id-1-page-2.html But I did not get it running. Then I changed the configuration to this: 00-19-d2-2a-61-50 Auth-Type := Accept In the debug log I can see, that it should work. Without encryption it works, but as soon as I configure any kind of static encryption (WEP, WPA) on the ap, I won´t get any connection. Where could I search for a failure? Regards Klaus My Equipment: - Access Point: HP J8131A Wireless Access Point 420 - Radius: Freeradius 1.1.5 Windows build running on Virtual PC with Windows XP Prof. - Wlan Clients: Lenovo T60 with Windows XP Prof. Wavin GmbH - Sitz der Gesellschaft: 49767 Twist - Registergericht: AG Osnabrück Abt. B 120003 - Geschäftsführung: Jürgen Frei, Maarten Roef - Vors.d. Aufsichtsrates: Henk ten Hove

4 5

Big "VSA + Proxy" problem
by Guilherme Franco 13 Jun '07

13 Jun '07

Hello, Running Freeradius 1.1.4 on RHEL with an Oracle backend. I'm at a Carrier and every "@bar.com" request is configured to be proxied but I have a problem where a VSA (in radreply table) is not even sent to bar.com. In my database: select * from radcheck; ID USERNAME ATTRIBUTE OP VALUE --- ------------------ --------------------- ---- ----------- 1 foo(a)bar.com User-Password := temp123 select * from radreply; ID USERNAME ATTRIBUTE OP VALUE --- ------------------ ---------------------------- ---- ----------- 1 foo(a)bar.com ERX-Service-Bundle := test1 ID USERNAME ATTRIBUTE OP VALUE --- ------------------ ---------------------------- ---- ------------------------ 2 foo(a)bar.com Framed-IP-Address := 192.168.254.199 Disabling the proxying for this realm works correctly (freeradius auths the user locally and sends the VSA to the router). With proxy configured, the user gets authenticated by bar.com but the VSA is not sent to bar.com (no traces of it in pre_proxy logs nor in radiusd -X debugs). I've already added ERX-Service-Bundle =* ANY in both attrs and attrs.pre-proxy and enabled the filters in radiusd.conf, but still no luck. Question: if that issue gets fixed and the VSA goes to bar.com, is there any way to bar.com return that same VSA untouched (considering that bar.com doesn't knows a thing about that VSA, i.e: it doesn't has any VSA info on it's database)? In fact, I don't need to send that VSA to bar.com, I just need to send it directly to my router(just like in the unproxied realm) but the proxy feature doesn't allow that. Please consider that I can't simply add "ERX-Service-Bundle := test1" in attrs (like I do with DNS VSAs) because the value of that VSA is chained with the user in radreply and each user has it's own different value (test2, test5, etc.). I'm very worried. Can anyone please shed some light on this? Thank you very much!

2 5

To check Simultaneous against 2 NASes
by Irina 13 Jun '07

13 Jun '07

Hello, 2 identical servers (CentOS release 5 (Final) running FreeRADIUS Version 1.1.3 with MySQL (Ver 14.12 Distrib 5.0.22) MySQL on both - master and slave to each other 2 NASes authenticate and do accounting to either FreeRadius server. checkrad is used to handle Simultaneous Logins How can I set up to check Simultaneous Logins against of both NASes? For example, a user goes through NAS1, freeradius server checks only that NAS1 if the user is connected. How can I make it to check against of both NASes? Thank you for your help in advance. Irina

3 5

same error: radiusd
by Mahalakshmi Vijayakumar 13 Jun '07

13 Jun '07

Hi, i even downloaded the freeradius-1.1.6 and installed it.... again when i give the cmd radiusd -X, i get the same error Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1788] Failed to parse authorize section. thanks.................

3 2