- Freeradius-Users - lists.freeradius.org

How to forward a request rejected by a proxy RADIUS server to another LDAP server?
by Clark J. Wang 05 Jun '07

05 Jun '07

I've configured a proxy RADIUS server in `proxy.conf' and an LDAP server in `radiusd.conf' and they work well. I want to forward those requests rejected by the proxy RADIUS server to the LDAP server and re-authenticate them again. Can I do that in FreeRADIUS? And how? Thanks.

3 2

Of course things break when I'm on vacation...
by Alan DeKok 03 Jun '07

03 Jun '07

It looks like my ISP died just as I was going on vacation. <sigh> My web site is down, but I've managed to move mail to another machine finally. I don't know how much mail is lost, and it may be a while before I can get all of the files off of the machine. We'll see how it goes. Alan DeKok.

1 0

problem in autehtication with EAP-MD5
by shantanu choudhary 02 Jun '07

02 Jun '07

hi all, i am trying to get autheticated by radius server using EAP-MD5 but i always get FAILURE and i m not able to figure out the problem, can anyone help me out!!!!! my client side shows out put like this:- EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=17): 01 00 00 0d 02 00 00 0d 01 74 65 73 74 75 73 65 72 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:03:7f:09:60:a0 RX EAPOL - hexdump(len=26): 01 00 00 16 01 01 00 16 04 10 e5 b2 63 cb 4e 4f e7 d1 b1 4f 30 95 6c 21 cd a9 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=1 method=4 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD EAP: Initialize selected EAP method: vendor 0 method 4 (MD5) CTRL-EVENT-EAP-METHOD EAP vendor 0 method 4 (MD5) selected CTRL_IFACE monitor send - hexdump(len=22): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 31 36 32 37 35 2d 31 00 EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): e5 b2 63 cb 4e 4f e7 d1 b1 4f 30 95 6c 21 cd a9 EAP-MD5: Generating Challenge Response EAP-MD5: Response - hexdump(len=16): 4a f8 0b fc 31 7e 27 47 ac 95 4c 77 56 30 bf c6 EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 01 00 16 04 10 4a f8 0b fc 31 7e 27 47 ac 95 4c 77 56 30 bf c6 EAPOL: SUPP_BE entering state RECEIVE RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=13): 4c 49 53 54 5f 4e 45 54 57 4f 52 4b 53 LIST_NETWORKS RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX EAPOL from 00:03:7f:09:60:a0 RX EAPOL - hexdump(len=8): 01 00 00 04 04 01 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING EAPOL: startWhen --> 0 RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING EAPOL: authWhile --> 0 EAPOL: SUPP_BE entering state TIMEOUT EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE RX EAPOL from 00:03:7f:09:60:a0 RX EAPOL - hexdump(len=9): 01 00 00 05 01 02 00 05 01 EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: deinitialize previously used EAP method (4, MD5) at INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=2 method=1 vendor=0 vendorMethod=0 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started CTRL_IFACE monitor send - hexdump(len=22): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 31 36 32 37 35 2d 31 00 EAP: EAP-Request Identity data - hexdump_ascii(len=0): EAP: using real identity - hexdump_ascii(len=8): 74 65 73 74 75 73 65 72 testuser EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=17): 01 00 00 0d 02 02 00 0d 01 74 65 73 74 75 73 65 72 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:03:7f:09:60:a0 RX EAPOL - hexdump(len=26): 01 00 00 16 01 03 00 16 04 10 62 2a 69 09 f7 63 b3 30 cf 0b bd 05 83 73 4f 4f EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=3 method=4 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD EAP: Initialize selected EAP method: vendor 0 method 4 (MD5) CTRL-EVENT-EAP-METHOD EAP vendor 0 method 4 (MD5) selected CTRL_IFACE monitor send - hexdump(len=22): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 31 36 32 37 35 2d 31 00 EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): 62 2a 69 09 f7 63 b3 30 cf 0b bd 05 83 73 4f 4f EAP-MD5: Generating Challenge Response EAP-MD5: Response - hexdump(len=16): bd c1 d1 e3 be 9e 4c 46 7d d1 c0 a3 72 11 b0 ff EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 03 00 16 04 10 bd c1 d1 e3 be 9e 4c 46 7d d1 c0 a3 72 11 b0 ff EAPOL: SUPP_BE entering state RECEIVE RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=13): 4c 49 53 54 5f 4e 45 54 57 4f 52 4b 53 LIST_NETWORKS RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING EAPOL: startWhen --> 0 RX EAPOL from 00:03:7f:09:60:a0 RX EAPOL - hexdump(len=8): 01 00 00 04 04 03 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=6): 53 54 41 54 55 53 STATUS ioctl[SIOCGIFADDR]: Cannot assign requested address RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING RX ctrl_iface - hexdump_ascii(len=4): 50 49 4e 47 PING CTRL_IFACE monitor detached - hexdump(len=22): 2f 74 6d 70 2f 77 70 61 5f 63 74 72 6c 5f 31 36 32 37 35 2d 31 00 EAPOL: authWhile --> 0 EAPOL: SUPP_BE entering state TIMEOUT >> i dont know what is this cannot assign requested address,(i am not requesting for any address!!!) my supplicant file is like this:- ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel eapol_version=1 ap_scan=1 fast_reauth=1 network={ ssid="ATH182" scan_ssid=1 key_mgmt=WPA-EAP eap=MD5 identity="testuser" password="whatever" } >>and correspondingly server side shows message like this:- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.183:1079, id=0, length=177 Message-Authenticator = 0x48563b978d926b5c042592ec5eae4537 Service-Type = Framed-User User-Name = "testuser" Framed-MTU = 1488 Called-Station-Id = "00-03-7F-09-60-7E:ATH183" Calling-Station-Id = "00-03-7F-05-C0-9C" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000d017465737475736572 NAS-IP-Address = 192.168.2.183 NAS-Port = 2 NAS-Port-Id = "STA port # 2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry testuser at line 216 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.2.183 port 1079 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100160410457803a5fc7f8de5ad1e9065c4fec0b0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0eb6726b77f05929d54be6c45de1f52f Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 465abecc Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.2.183:1079, id=1, length=204 Message-Authenticator = 0xfbcd80decacba158727083a6ca513fac Service-Type = Framed-User User-Name = "testuser" Framed-MTU = 1488 State = 0x0eb6726b77f05929d54be6c45de1f52f Called-Station-Id = "00-03-7F-09-60-7E:ATH183" Calling-Station-Id = "00-03-7F-05-C0-9C" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100160410b6cac9199b585c8705d9230d18b93094 NAS-IP-Address = 192.168.2.183 NAS-Port = 2 NAS-Port-Id = "STA port # 2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry testuser at line 216 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Sending Access-Accept of id 1 to 192.168.2.183 port 1079 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testuser" Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 1 with timestamp 465abee0 Nothing to do. Sleeping until we see a request. >> can any one help me out it is really important and urgent. if u need i will also tell u my radius.conf, eap.conf and users file!! thank you regards shantanu --------------------------------- Download prohibited? No problem! CHAT from any browser, without download.

3 26

2.0.0-pre1 - cannot build on FreeBSD
by David Wood 02 Jun '07

02 Jun '07

Dear all, I've put in quite a bit of work today towards porting 2.0.0-pre1 to FreeBSD, with the intention of submitting a FreeRADIUS 2 port as soon as possible. Unfortunately, there's a problem which I don't have the autoconf skills to patch quickly. When checking (and later attempting to use) net/if.h, you need to #include sys/socket.h on FreeBSD to get the definition of struct sockaddr. If someone can give me a patch, I'll carry on with the work. What actually happens is that configure complains: configure: WARNING: net/if.h: present but cannot be compiled configure: WARNING: net/if.h: check for missing prerequisite headers? configure: WARNING: net/if.h: see the Autoconf documentation configure: WARNING: net/if.h: section "Present But Cannot Be Compiled" configure: WARNING: net/if.h: proceeding with the preprocessor's result configure: WARNING: net/if.h: in the future, the compiler will take precedence with the underlying entry in config.log of: configure:22662: checking net/if.h usability configure:22679: cc -c -O -pipe -march=pentium3 -I/usr/local/include -L/usr/local/lib -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conft est.c >&5 In file included from conftest.c:83: /usr/include/net/if.h:265: error: field `ifru_addr' has incomplete type /usr/include/net/if.h:266: error: field `ifru_dstaddr' has incomplete type /usr/include/net/if.h:267: error: field `ifru_broadaddr' has incomplete type /usr/include/net/if.h:299: error: field `ifra_addr' has incomplete type /usr/include/net/if.h:300: error: field `ifra_broadaddr' has incomplete type /usr/include/net/if.h:301: error: field `ifra_mask' has incomplete type /usr/include/net/if.h:368: error: field `addr' has incomplete type /usr/include/net/if.h:369: error: field `dstaddr' has incomplete type (the incomplete type is no definition of struct sockaddr). If you let things continue, the build eventually fails thus: /usr/local/bin/libtool --mode=compile cc -O -pipe -march=pentium3 -I/usr/local/include -L/usr/local/lib -D_REENTRANT -D_POSIX_PTHRE AD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/var/ports/usr/ports_updated/net/freeradius2/work/freeradius-server-2.0 .0-p re1/src -c misc.c cc -O -pipe -march=pentium3 -I/usr/local/include -L/usr/local/lib -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDE BUG -D_LIBRADIUS -I/var/ports/usr/ports_updated/net/freeradius2/work/freeradius-server-2.0 .0-pre1/src -c misc.c -fPIC -DPIC -o .lib s/misc.o misc.c: In function `ip_hton': misc.c:424: error: `AF_INET' undeclared (first use in this function) misc.c:424: error: (Each undeclared identifier is reported only once misc.c:424: error: for each function it appears in.) misc.c: In function `ip_ntoh': misc.c:455: error: storage size of 'ss' isn't known misc.c:469: error: `AF_INET' undeclared (first use in this function) misc.c:455: warning: unused variable `ss' misc.c: In function `lrad_ipaddr_cmp': misc.c:585: error: `AF_INET' undeclared (first use in this function) gmake[4]: *** [misc.lo] Error 1 (sys/socket.h contains the #define for AF_INET - so if it's not the same problem, it's a very similar one). If anyone wants more information (logs, typescript), I'll happily provide them. I also can't get the PGP signature on the 2.0.0-pre1 tarball to verify - in the fairly old version of PGP 7 on my Windows XP box (which is the only place I have my keyrings), I get a bad signature error. The signature on 1.1.6 works just fine. Looking forward to 2.0 - and trusting this is useful, David -- David Wood david(a)wood2.org.uk

3 8

RE: Disabling EAP-TLS while keeping EAP-PEAP
by tnt＠kalik.co.yu 02 Jun '07

02 Jun '07

If someone can gain that level of access and decides JUST to issue a wild certificate - write him a "Thank You" letter. What if he cretes a batch of new users? Or resets ALL your users passwords to "Leroy wuz 'ere"? Your worries are misplaced. Ivan Kalik Kalik Informatika ISP

1 0

error make rlm_tls
by Pilar Sanchez 01 Jun '07

01 Jun '07

Hello I'm trying to install FR 1.1.6 (from .tar file) on Solaris 8, with openssl 0.9.8e (also installed from .tar file), and when I do the "make", the types rlm_eap_peap and rlm_eap_tls fail. When I do the "compile" they find the OpenSSL libs The error is: In file included from eap_peap.h:25, from rlm_eap_peap.c:24: ../../libeap/eap_tls.h:138: error: parse error before "SSL" I know this is an "old" problem but, I thougth that was related with a bug in 1.1.1 version Does someone give me some indications on how to solve this problem? Thanks in advance ******************************************* Pilar Sánchez Fernández Comunicaciones CEDEX C/ Alfonso XII nº 3 y 5 Tel: 91 335 72 81 Mail: pilar.sanchez(a)cedex.es http://www.cedex.es ********************************************

5 8

Use of hints to preselect EAP type
by Don Peoples 31 May '07

31 May '07

If the RADIUS User-Name were prefixed with a string to indicate its preferred EAP type for authentication, could the hints file be used to force first that EAP authentication be used, and then that the indicated EAP type be used? This would be desirable to minimize response time. If so, how would this be configured? Thanks.

1 0

Different authentication for different clients
by Maikon Graeff 31 May '07

31 May '07

Hi, is there a solution to configure different authentication for different clients? For example: All authentication coming from NAS xxxx use this configuration for LDAP: base_filter = "abc" >From NAS yyyy use: base_filter = "cbd" Regards, -- ( ) .:. Maikon R Graeff / \ .:. GoogleTalk maikong at gmail dot com

1 0

Possible LDAP issue
by John Ellin 31 May '07

31 May '07

Installed and configured FreeRADIUS and fired it up: (lines prefixed v are server messages, lines prefixed ^ are client messages) [root@hagrid ~]# radiusd -x v Starting - reading configuration files ... v Module: Loaded exec v rlm_exec: Wait=yes but no output defined. Did you mean output=none? v Module: Instantiated exec (exec) v Module: Loaded expr v Module: Instantiated expr (expr) v Module: Loaded PAP v Module: Instantiated pap (pap) v Module: Loaded CHAP v Module: Instantiated chap (chap) v Module: Loaded MS-CHAP v Module: Instantiated mschap (mschap) v Module: Loaded System v Module: Instantiated unix (unix) v Module: Loaded LDAP v rlm_ldap: Registering ldap_groupcmp for Ldap-Group v rlm_ldap: Registering ldap_xlat with xlat_name ldap v rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap v [...] v conns: 0x8125160 v Module: Instantiated ldap (ldap) v Module: Loaded eap v rlm_eap: Loaded and initialized type md5 v rlm_eap: Loaded and initialized type leap v rlm_eap: Loaded and initialized type gtc v rlm_eap: Loaded and initialized type mschapv2 v Module: Instantiated eap (eap) v Module: Loaded preprocess v Module: Instantiated preprocess (preprocess) v Module: Loaded realm v Module: Instantiated realm (suffix) v Module: Loaded files v Module: Instantiated files (files) v Module: Loaded Acct-Unique-Session-Id v Module: Instantiated acct_unique (acct_unique) v Module: Loaded detail v Module: Instantiated detail (detail) v Module: Loaded radutmp v Module: Instantiated radutmp (radutmp) v Module: Instantiated detail (reply_log) v Initializing the thread pool... v Listening on authentication 192.168.0.16:1812 v Listening on authentication 127.0.0.1:1812 v Listening on accounting 192.168.0.16:1813 v Listening on accounting 127.0.0.1:1813 v Listening on proxy *:1814 v Ready to process requests. This user is defined in the raddb/users file: [root@hagrid ~]# radtest testuser secret 192.168.0.16 10 hashpass ^ Sending Access-Request of id 158 to 192.168.0.16:1812 ^ User-Name = "testuser" ^ User-Password = "secret" ^ NAS-IP-Address = hagrid.4ccompany.com ^ NAS-Port = 10 v rad_recv: Access-Request packet from host 192.168.0.16:35308, id=158, length=60 v User-Name = "testuser" v User-Password = "secret" v NAS-IP-Address = 255.255.255.255 v NAS-Port = 10 v rlm_ldap: - authorize v rlm_ldap: performing user authorization for testuser v rlm_ldap: ldap_get_conn: Checking Id: 0 v rlm_ldap: ldap_get_conn: Got Id: 0 v rlm_ldap: (re)connect to hagrid.4ccompany.com:389, authentication 0 v rlm_ldap: bind as / to hagrid.4ccompany.com:389 v rlm_ldap: waiting for bind result ... v rlm_ldap: Bind was successful v rlm_ldap: object not found or got ambiguous search result v rlm_ldap: search failed v rlm_ldap: ldap_release_conn: Release Id: 0 v Sending Access-Accept of id 158 to 192.168.0.16:35308 ^ rad_recv: Access-Accept packet from host 192.168.0.16:1812, id=158, length=20 This user is in LDAP (user id & passwords changed for obvious reasons): [root@hagrid ~]# radtest hansolo imnottelling 192.168.0.16 10 hashpass ^ Sending Access-Request of id 172 to 192.168.0.16:1812 ^ User-Name = "hansolo" ^ User-Password = "imnottelling" ^ NAS-IP-Address = hagrid.4ccompany.com ^ NAS-Port = 10 v rad_recv: Access-Request packet from host 192.168.0.16:35308, id=172, length=56 v User-Name = "hansolo" v User-Password = "imnottelling" v NAS-IP-Address = 255.255.255.255 v NAS-Port = 10 v rlm_ldap: - authorize v rlm_ldap: performing user authorization for hansolo v rlm_ldap: ldap_get_conn: Checking Id: 0 v rlm_ldap: ldap_get_conn: Got Id: 0 v rlm_ldap: checking if remote access for hansolo is allowed by dialupAccess v rlm_ldap: looking for check items in directory... v rlm_ldap: looking for reply items in directory... v rlm_ldap: user hansolo authorized to use remote access v rlm_ldap: ldap_release_conn: Release Id: 0 for(i=0;i<9;++i) { ^ Re-sending Access-Request of id 172 to 192.168.0.16:1812 ^ User-Name = "hansolo" ^ User-Password = "some hash of imnottelling" ^ NAS-IP-Address = hagrid.4ccompany.com ^ NAS-Port = 10 v rad_recv: Access-Request packet from host 192.168.0.16:35308, id=172, length=56 v Discarding duplicate request from client macnab:35308 - ID: 172 due to unfinished request 1 } ^ radclient: no response from server for ID 172 v WARNING: Unresponsive child (id 3072723888) for request 1 As you can see, everything works fine for a radius specific user, but it grinds to a halt for a user declared in LDAP. Any pointers would be greatly appreciated. -- Best regards, jona. Where a calculator on the ENIAC is equipped with 18,000 vacuum tubes and weighs 30 tons, computers in the future may have only 1,000 vacuum tubes and weigh only 1 1/2 tons. --- Popular Mechanics, March 1949

1 0

RE: problem connecting from windows xp to pptp server
by Danny Milshtein 31 May '07

31 May '07

After a lot of help from Thibault I was able to connect from xp client. the causes for the problem was : 1. missing raddattr plug-in to option.pptpd raddattr.so # after radius.so 2. un update dictionary (Microsoft & merit) both in /etc/raddb & /etc/radiusclient attached my dictionaries Microsoft & merit (both client & server) 3. include dictionary syntax – should be : $INCLUDE /etc/raddb/dictionary.microsoft $INCLUDE /etc/raddb/dictionary.merit 4. need to config the following options in option.pptpd refuse-pap refuse-chap refuse-mschap require-mppe +mschap +mschap-v2 Thanks Danny _____ From: Danny Milshtein [mailto:danny@videocells.com] Sent: Monday, May 28, 2007 8:59 AM To: 'FreeRadius users mailing list' Subject: RE: problem connecting from windows xp to pptp server Hi, All the check options are checked. Maybe the PPTPD strip the CHAP-Password in some way ? Danny Milshtein -----Original Message----- From: freeradius-users-bounces+danny=videocells.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+danny=videocells.com@lists.freeradius.org] On Behalf Of tnt(a)kalik.co.yu Sent: Sunday, May 27, 2007 9:05 PM To: FreeRadius users mailing list Subject: Re: problem connecting from windows xp to pptp server Yes. There is no password in your request: rad_recv: Access-Request packet from host 127.0.0.1:32787, id=39, length=69 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "danielmi" Calling-Station-Id = "192.168.8.244" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Check your connection properties and see if "Check for name, password etc." is ticked (Options tab). Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.0/819 - Release Date: 5/26/2007 10:47 AM No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.0/819 - Release Date: 5/26/2007 10:47 AM No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.4/825 - Release Date: 5/30/2007 3:03 PM

2 1