- Freeradius-Users - lists.freeradius.org

Multiple shared secrets?
by Mark J Elkins 12 Jun '07

12 Jun '07

Can one have multiple shared secrets for the same client(NAS) ? ie - in clients.conf - something like... client 192.168.10.20{ secret = secret1 secret = secret2 shortname = mynas nastype = other } ... so that if the first secret does not work - the second secret is tried? (or how else could I solve the problem) I'm merging two Radius Servers - and authenticating packets from my Incumberant Telcom Provider - who is using proxies (a handful) from (hundreds of) multiple NAS's... from different services (Dialup - is one system, aDSL is another system). I currently have two different shared secrets - and these seem to be bleeding together... I'm looking for a stop-gap until I can get the right people to do the right thing. -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

3 2

Server dies
by Hugh Messenger 12 Jun '07

12 Jun '07

Having been running freeradius in debug mode (with no problems at all) for a month or so while testing and provisioning, it's time to put it in production. Unfortunately, when I run it as a service, it dies after a few hours. No clues, no errors, no nothing . it just silently dies off. Load is not a factor - we're migrating our wireless networks to PPPOE, and right now just have a handful of test users. So freeradius isn't handling more than a handful of requests per hour. I'm running RHEL4, fully up2date. Freeradius 1.1.6, using sqlippool and sql accounting. MySql 5.1 is on another machine. If it makes any difference, the init.d integration seems to be working fine, it correctly starts on boot, and I can control it with 'service'. Are there any logs or stats I could post to help give a clue? I'm basically looking at a blank wall, I have no idea how to even start trying to track this one down. As usual, TIA for any suggestions. -- hugh

2 1

FreeRADIUS 1.1.6 & max_servers
by Dow, Corey 11 Jun '07

11 Jun '07

Hi there, I'm using freeRADIUS 1.1.6 and am authenticating users via NTLM to AD. From time to time, radiusd stops authenticating connections and I see in radius.log that the maximum number of threads has been reached: Fri Jun 8 13:55:54 2007 : Info: The maximum number of threads (32) are active, cannot spawn new thread to handle request Fri Jun 8 13:55:59 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 229 due to unfinished request 214 Fri Jun 8 13:56:04 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 229 due to unfinished request 214 Fri Jun 8 13:56:04 2007 : Error: WARNING: Unresponsive child (id 2786053008) for request 213 Fri Jun 8 13:56:09 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 229 due to unfinished request 214 Fri Jun 8 13:56:16 2007 : Info: The maximum number of threads (32) are active, cannot spawn new thread to handle request Fri Jun 8 13:56:21 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 230 due to unfinished request 215 Fri Jun 8 13:56:26 2007 : Error: Discarding duplicate request from client nm5406-10:1025 - ID: 230 due to unfinished request 215 Most of what I have been able to gather seems to indicate that this is because of a 'slow' server. I seem to be hitting this even with a very quiet test environment, and only a handful of supplicants. I can't reproduce this at will, and would appreciate any suggestions to correct. Thanks in advance, Corey Corey Dow Solution Test Center Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747 Tel : 1-916-785-8003

1 0

Help with Multiple AD/LDAP
by Ryan Kramer 11 Jun '07

11 Jun '07

Hello, I'm working on a new config to allow multiple AD servers to be hit, and am running into a problem. Just a quick background, I have one server that has multiple root level OU's with users under it. It may not be the recommended design, but for our needs it is suitable. I've set up freeradius with three unique ldap entries, all connecting to the same AD server but under different OU's. Anyway, in users.conf I've got this: DEFAULT Ldap-Group == "WIFIUSER" Filter-ID = "WIFIUSER", Fall-Through=1 radiusd.conf authorize { ... LDAP1 LDAP2 LDAP3 } which will return group=WIFIUSER in the accept-accept if the user is in the WIFIUSER AD group. The problem is it only works if the user exists in the last LDAP entry that is listed. it will still return an accept-accept, but no group, if they aren't in the last OU. (In the example above, a user in the LDAP1 OU would not get the WIFUSER group accept-accept, even though they are in it. Moving LDAP1 to the bottom would make it work. Any suggestions? Ryan Kramer

1 1

Re: Freeradius-Users Digest, Vol 26, Issue 34
by Apangshu Saha 11 Jun '07

11 Jun '07

Hi martin, i have enabled all the following things in eap.conf....but still the supplicant shows attempting to authenticate.....i am using winXp as supplicant.....what will be the configuration setting in winxp....it asks log in name..password..and domain name...what is that domain name.....i am giving the user name and password as same as i have written in "users" file in RADIUS server....but what should i put in domain name....you plz help me how should i set the supplicant...... with thanks... apangshu eap { > default_eap_type = peap > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > > md5 { > } > > tls { > ... > } > > ttls { > ... > } > peap { > ... > } > >>> mschapv2 { > >>> } > } > On 6/11/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. help in setting up PEAP in freeRADIUS with winXp (Apangshu Saha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Jun 2007 20:38:36 +0530 > From: "Apangshu Saha" <apangshu(a)gmail.com> > Subject: help in setting up PEAP in freeRADIUS with winXp > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <c52421460706110808x6fe85e32w7e88da881b7938a5(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Martin, > Thanks for your reply.Everything you mentioned is configured in eap.conf > file.Still i am facing the problem. > Plz let me know how to proceed to fix it. > > With thanks... > Apangshu > > On 6/11/07, freeradius-users-request(a)lists.freeradius.org < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Re: help in setting up PEAP in freeRADIUS with winXp > > supplicant (Martin Gadbois) > > 2. Re: Freeradius as a secondary (Jeff) > > 3. Re: Big "VSA + Proxy" problem (Guilherme Franco) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Mon, 11 Jun 2007 09:28:27 -0400 > > From: Martin Gadbois <martin.gadbois(a)colubris.com> > > Subject: Re: help in setting up PEAP in freeRADIUS with winXp > > supplicant > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <466D4DFB.1020704(a)colubris.com> > > Content-Type: text/plain; charset=UTF-8 > > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Apangshu Saha wrote: > > > > > rad_check_password: Found Auth-Type EAP > > > auth: type "EAP" > > > Processing the authenticate section of radiusd.conf > > > modcall: entering group authenticate for request 5 > > > rlm_eap: EAP Identity > > > rlm_eap: No such EAP type mschapv2 > > > rlm_eap: Failed in EAP select > > > modcall[authenticate]: module "eap" returns invalid for request 5 > > > modcall: leaving group authenticate (returns invalid) for request 5 > > > auth: Failed to validate the user. > > > PEAP: Tunneled authentication was rejected. > > > rlm_eap_peap: FAILURE > > > > Do you have mschap enabled in your eap.conf? > > > > eap { > > default_eap_type = peap > > timer_expire = 60 > > ignore_unknown_eap_types = no > > cisco_accounting_username_bug = no > > > > md5 { > > } > > > > tls { > > ... > > } > > > > ttls { > > ... > > } > > peap { > > ... > > } > > >>> mschapv2 { > > >>> } > > } > > > > > > - -- > > ============== +---------------------------------------------+ > > Martin Gadbois | "Please answer by yes or no. | > > Sr. SW Designer | Uncooperative user waste precious CPU time" | > > Colubris Networks Inc. | -- The Andromeda Strain, M. Crichton, 1969 | > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.5 (GNU/Linux) > > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > > > iD8DBQFGbU379Y3/iTTCEDkRAhz+AJkBQD2iH/pJHGSFwVdBnNcFAMdILACgomOf > > vZhC4ftJ7IjYZXP+1oTcjQI= > > =YvGQ > > -----END PGP SIGNATURE----- > > > > > > ------------------------------ > > > > Message: 2 > > Date: Mon, 11 Jun 2007 10:28:37 -0400 > > From: Jeff <jeffa(a)jahelpdesk.com> > > Subject: Re: Freeradius as a secondary > > To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <20070611142837.c0c38dfd(a)ns1.jahelpdesk.com> > > Content-Type: text/plain; charset="us-ascii" > > > > Ok new issue thats eluding me > > I uninstalled version 1. then installed version 2 > > > > anyway. i resetup the configs and made sure my services file is 1645 > > radius and 1646 for acct as before > > anyway > > when i do a auth with ntradping all connects aok > > when i do anykind of an accouting request, stop start update i get error > > 10054 > > which i read may mean check the port which it apperas i am set aok > unless > > i am missing something > > > > NEXT > > Nothing is going into the radacct dir for detail file either or is it > > being created > > > > Also when i do a /etc/init.d/freeradius start or restart everything is > aok > > when i do a /etc/init.d/freeradius reload I see in the radius log that > its > > saying there is errors in the radius config > > > > Anyway anyone have any ideas? > > _____ > > > > From: Peter Nixon [mailto:listuser@peternixon.net] > > To: FreeRadius users mailing list [mailto: > > freeradius-users(a)lists.freeradius.org] > > Sent: Sun, 10 Jun 2007 19:43:58 -0400 > > Subject: Re: Freeradius as a secondary > > > > On Sun 10 Jun 2007, Jeff wrote: > > > I am using the version installed through software update on opensuse > > > > You may wish to use my updated packages at: > > http://software.opensuse.org/download/network:/aaa/ > > > > Just add is as a software repository in YaST. (ie. > > http://software.opensuse.org/download/network:/aaa/openSUSE_10.2/) > > > > Cheers > > > > -- > > > > Peter Nixon > > http://www.peternixon.net/ > > PGP Key: http://www.peternixon.net/public.asc > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > >

1 0

help in setting up PEAP in freeRADIUS with winXp
by Apangshu Saha 11 Jun '07

11 Jun '07

Hi Martin, Thanks for your reply.Everything you mentioned is configured in eap.conf file.Still i am facing the problem. Plz let me know how to proceed to fix it. With thanks... Apangshu On 6/11/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: help in setting up PEAP in freeRADIUS with winXp > supplicant (Martin Gadbois) > 2. Re: Freeradius as a secondary (Jeff) > 3. Re: Big "VSA + Proxy" problem (Guilherme Franco) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Jun 2007 09:28:27 -0400 > From: Martin Gadbois <martin.gadbois(a)colubris.com> > Subject: Re: help in setting up PEAP in freeRADIUS with winXp > supplicant > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <466D4DFB.1020704(a)colubris.com> > Content-Type: text/plain; charset=UTF-8 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Apangshu Saha wrote: > > > rad_check_password: Found Auth-Type EAP > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 5 > > rlm_eap: EAP Identity > > rlm_eap: No such EAP type mschapv2 > > rlm_eap: Failed in EAP select > > modcall[authenticate]: module "eap" returns invalid for request 5 > > modcall: leaving group authenticate (returns invalid) for request 5 > > auth: Failed to validate the user. > > PEAP: Tunneled authentication was rejected. > > rlm_eap_peap: FAILURE > > Do you have mschap enabled in your eap.conf? > > eap { > default_eap_type = peap > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > > md5 { > } > > tls { > ... > } > > ttls { > ... > } > peap { > ... > } > >>> mschapv2 { > >>> } > } > > > - -- > ============== +---------------------------------------------+ > Martin Gadbois | "Please answer by yes or no. | > Sr. SW Designer | Uncooperative user waste precious CPU time" | > Colubris Networks Inc. | -- The Andromeda Strain, M. Crichton, 1969 | > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.5 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFGbU379Y3/iTTCEDkRAhz+AJkBQD2iH/pJHGSFwVdBnNcFAMdILACgomOf > vZhC4ftJ7IjYZXP+1oTcjQI= > =YvGQ > -----END PGP SIGNATURE----- > > > ------------------------------ > > Message: 2 > Date: Mon, 11 Jun 2007 10:28:37 -0400 > From: Jeff <jeffa(a)jahelpdesk.com> > Subject: Re: Freeradius as a secondary > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20070611142837.c0c38dfd(a)ns1.jahelpdesk.com> > Content-Type: text/plain; charset="us-ascii" > > Ok new issue thats eluding me > I uninstalled version 1. then installed version 2 > > anyway. i resetup the configs and made sure my services file is 1645 > radius and 1646 for acct as before > anyway > when i do a auth with ntradping all connects aok > when i do anykind of an accouting request, stop start update i get error > 10054 > which i read may mean check the port which it apperas i am set aok unless > i am missing something > > NEXT > Nothing is going into the radacct dir for detail file either or is it > being created > > Also when i do a /etc/init.d/freeradius start or restart everything is aok > when i do a /etc/init.d/freeradius reload I see in the radius log that its > saying there is errors in the radius config > > Anyway anyone have any ideas? > _____ > > From: Peter Nixon [mailto:listuser@peternixon.net] > To: FreeRadius users mailing list [mailto: > freeradius-users(a)lists.freeradius.org] > Sent: Sun, 10 Jun 2007 19:43:58 -0400 > Subject: Re: Freeradius as a secondary > > On Sun 10 Jun 2007, Jeff wrote: > > I am using the version installed through software update on opensuse > > You may wish to use my updated packages at: > http://software.opensuse.org/download/network:/aaa/ > > Just add is as a software repository in YaST. (ie. > http://software.opensuse.org/download/network:/aaa/openSUSE_10.2/) > > Cheers > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > >

2 1

Freeradius as a secondary
by Jeff 11 Jun '07

11 Jun '07

I am using Freeradius as a Secondary Radius. The issue is sometimes not always but 98% of the time A user when they connect to the secondary (freeradius) and connect accounting packet start and then when they disconnect no accounting packet stop gets to the secondary Reason its going to the primary radius (VOPRAdius) Thus the problem being the secondary thinks they are still connected. The nas's are not onn site these are from level3 networks Does anyone know what to do for this? Since freeradius is not being used as a primary too I am at a stump on this one.

3 11

help in setting up PEAP in freeRADIUS with winXp supplicant
by Apangshu Saha 11 Jun '07

11 Jun '07

Dear All, I am a newbee in freeRADIUS and unable to setting up PEAP in freeRADIUS with winXp supplicant.On the client side it always show attempting to authenticate.I am getting the following lines at the last of the log file of freeRADIUS.Help me to sort out the problem please. **************************log file************************* modcall[authorize]: module "files" returns ok for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x0105002019001703010015c37ca76db66f6a97fcfcf85e65a7e03d3e70fcf43d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5142c99b4f3e278d5f71af41f06e1e96 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=180 User-Name = "administrator" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0x5142c99b4f3e278d5f71af41f06e1e96 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500291900170301001e103d6d5ce7a04c446824e451f6b169ff53a8f48d18f614092295e6e1cdb6 Message-Authenticator = 0x45a325b094cfed83fdb2aad638a9fb12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry administrator at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - administrator rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of administrator PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to administrator Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry administrator at line 215 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: No such EAP type mschapv2 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x010600261900170301001b91727baee5568c72883984a71242056b8f336171f797c3646a85de Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1654be07c4122f438449a5f35981dd27 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.14:2049, id=0, length=177 User-Name = "administrator" NAS-IP-Address = 192.168.6.14 Called-Station-Id = "0012172a3da3" Calling-Station-Id = "00131008616c" NAS-Identifier = "0012172a3da3" NAS-Port = 5 Framed-MTU = 1400 State = 0x1654be07c4122f438449a5f35981dd27 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001bdbac43bc04a3b2686dc05fc44cdb0a3922e36e0156ea45c11c188e Message-Authenticator = 0x0150585836af2d8127b88cf51a3efbfd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 users: Matched entry administrator at line 215 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: leaving group authenticate (returns invalid) for request 6 auth: Failed to validate the user. Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.6.14 port 2049 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 6 ID 0 with timestamp 466d3f35 Nothing to do. Sleeping until we see a request. ***********************log file************************************* please help. with regards... apangshu

2 1

freeradius eap-ttls pap ldap
by emmcosta 11 Jun '07

11 Jun '07

Hi everyone, I have a problem with my configuration, authorize is ok but authentication fail.I use freeradius 1.1.6 e openldap 2.2.13 and use windows xp for client with securew2. My access-point is Cisco aironet 1100. My radiusd.conf: .......... ldap { server = "localhost" identity = "cn=root,dc=teste,dc=pt" password = secret basedn = "dc=teste,dc=pt" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 set_auth_type = no } .............. authorize { preprocess ldap pap } authenticate{ Auth-Type PAP { pap } Auth-Type LDAP { ldap } eap } My eap.conf: eap{ default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = yes md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { default_eap_type = gtc use_tunneled_reply = yes } } The log: ............ rlm_ldap: - authorize rlm_ldap: performing user authorization for user_test radius_xlat: '(uid=user_test)' radius_xlat: 'dc=teste,dc=pt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=teste,dc=pt, with filter (uid=user_test) Waking up in 1 seconds... Threads: total/active/spare threads = 5/1/4 rlm_ldap: checking if remote access for user_test is allowed by uid rlm_ldap: Added password {CRYPT}HkDWb49nxN4Zo in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value {CRYPT}HkDWb49nxN4Zo & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user gilberto authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 rlm_pap: No clear-text password in the request. Not performing PAP. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [user_test/<no User-Password attribute>] (from client 192.168.1.69 port 371 cli 0040.96a2.24f3) Delaying request 2 for 1 seconds Finished request 2 Going to the next request Thread 3 waiting to be assigned a request --- Walking the entire request list --- Waking up in 1 seconds... Threads: total/active/spare threads = 5/0/5 --- Walking the entire request list --- Sending Access-Reject of id 121 to 192.168.1.69 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 121 with timestamp 4669d1cd Nothing to do. Sleeping until we see a request. Anyone can help-me. Best regards -- /emmc

4 5

POD and HP Products.
by Arran Cudbard-Bell 11 Jun '07

11 Jun '07

Hi, Trying to find out whether any HP products support PoD (Packet of Disconnect). I've got a HP2626 ProCurve switch and one of the new HP 530 WAPs (released last august). Tried using radclient with the example in the wiki, but I don't get any response back from the switch or the WAP. According to the RFC (rfc3576) even if the packet of disconnect does not have the correct attributes , the NAS should send back a PoD NAK with the appropriate error code. The lack of Disconnect NAK suggests that HP devices don't support PoD, but I just wanted to check to see if anybody has had any experience with this. Seems strange that their enterprise products don't support something as basic as this, specially when the RFC was published in 2003. *sigh* Whats even more stupid is that you can disconnect users using the ssh interface on the switches using, # conf *# aaa port-access authenticator <port range> reauthenticate* .

2 2