- Freeradius-Users - lists.freeradius.org

problem connecting from windows xp to pptp server
by Danny Milshtein 28 May '07

28 May '07

Hi, I'm trying to connect to pptp server (with freeradius + mysql) with no success. when trying with radtest or NTradping from remote server it's work fine (the server return me Access-Acept) here is my radiusd dump : rad_recv: Access-Request packet from host 127.0.0.1:32787, id=39, length=69 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "danielmi" Calling-Station-Id = "192.168.8.244" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "danielmi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'danielmi' rlm_sql (sql): sql_set_user escaped user --> 'danielmi' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'danielmi' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'danielmi' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'danielmi' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'danielmi' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'danielmi' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Any idea why I keep getting failed message. thanks Danny :-) No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.0/819 - Release Date: 5/26/2007 10:47 AM No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.8.0/819 - Release Date: 5/26/2007 10:47 AM

3 5

Newbie-quiz: Can't get authentication to work.
by Giobbi Piero 28 May '07

28 May '07

Hello all. Just started out with Freeradius and got it installed and working (Debian Etch, FR 1.1.4). Im hooked up our firewall to authenticate to FR-server and the "link" works, so i guess the basics are ok. Now i have added a user in the system and in the Users-file: test-system Auth-Type := System, User-Password == "test-system" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.0.5.7, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Fall-Through = yes, Framed-Compression = Van-Jacobsen-TCP-IP When i connect to my FR-server i get this: rad_recv: Access-Request packet from host 10.0.5.1:56509, id=132, length=182 NAS-Identifier = "halon" NAS-IP-Address = 10.0.5.1 Message-Authenticator = 0x3f0dd3b6a7a3fd31e874e22721f5073d NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "10.0.8.184" User-Name = "test-system" MS-CHAP-Challenge = 0xbb1e68a886add6f65e6e9af66c709bfd MS-CHAP2-Response = 0x01000a3194599cecfe61460a4942c9671fe70000000000000000a5f8bab30f7bdf4664 07edd2d7be2e97969a1a918def8d2c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "test-system", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test-system at line 101 users: Matched entry DEFAULT at line 185 users: Matched entry DEFAULT at line 204 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "unix" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [test-system/<no User-Password attribute>] (from client halon port 0 cli 10.0.8.184) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 132 to 10.0.5.1 port 56509 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 132 with timestamp 465ab8d7 So, my firewall talks MS_CHAP, i haven't touched the radiusd.conf and its in there under authenticate {.. Now im stuck, i really don't know where else to look for, tried google but everything pointed to this wonderful list! I tried to change auth-type = Local but same problem. Maybe the problem lies here: rlm_realm: No '@' in User-Name = "test-system", looking up realm NULL rlm_realm: No such realm "NULL" But i can't tell. Any thoughts, solutions, pointers to right directions are greatly appreciated! Many thanks. p

2 1

Re: log file for free radius 1.1.6 eap-tls authentication
by anoop_c＠sifycorp.com 28 May '07

28 May '07

Hi all I have two quieres 1 I have changed the log_auth= yes Still i am not able to get logs.Pls find my configs prefix = /usr/local exec_prefix = ${prefix} sysconfdir = /etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = /usr/local/var/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = /usr/local/var/log/radius/radius.log log_stripped_names = no # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it\'s rejected # log_auth_goodpass - logs password if it\'s correct 2 While i am using Navis radius, ther will be one user file where you have to add all usernames.In free radius without adding the username also the authentication is working.I would like to have users file so that only the users specified in that will authenticate. Wat config change i should make for the same

2 1

Free Radius
by Bob Irwin 28 May '07

28 May '07

Hi, I'm a serious Newb with Radius, and I have a question regarding support for "Pool Hint". This is supported under "Radiator" (a radius server we use elsewhere on our network), and we need to replicate it in FreeRADIUS for a much smaller application. I'm wondering if FreeRADIUS supports it at all. We are running FreeRADIUS version 1.0.1 on Redhat. Google doesn't show me much at all, so I'm thinking if "Pool Hint" is supported, it might be under a different name. Any help/advice is appreciated. Thanks, Bob

2 1

Proxy home server failover
by Tomas Hoger 27 May '07

27 May '07

Hi! I have a question regarding proxy failover in FreeRadius 1.x. Proxy code chooses first active home server for realm and send packet to that one. If no reply is received after configured number of retries, request is rejected, other servers are *not* tried. Does version 2.0 have the same behavior? According to comments in sample proxy.conf it seems new version will also try only one server and reject request if no reply is received. I have made a quick modification of request_list.c, so that request_reject is not called when try_count drops to 0. After that, when NAS retries, different home server is selected. Can not calling request_reject have any negative impact (memory leak, internal structures inconsistency, ...)? Wouldn't it make sense to make configuration parameter, which will instruct radiusd whether it should reject or silently drop request, for which it has not received reply from home server? For realms with single home server, it won't make much difference, as request will be rejected on next NAS retry (all home servers are marked dead), but for realms with multiple home servers, reject will not be sent just because one of the home servers is not responding. Ideas? th.

2 2

Accounting-Response with invalid signature
by Rio Yang 27 May '07

27 May '07

Hi All, I got the following message from my radius.log. Wed May 23 16:39:11 2007 : Error: Received Accounting-Response packet from 172.16.1.1:1813 with invalid signature (err=2)! (Shared secret is incorrect.) Wed May 23 16:39:11 2007 : Error: Reply from home server 172.16.1.1:1813 - ID: 180 arrived too late for request 2515449. Try increasing 'retry_delay' or 'max_request_time' It caused some problem on accounting record . The secret between NAS and RADIUS are the same. But the log tell me the secret is incorrect at Accounting-Response. Do anybody know what's the main cause and how to fix it ? PS. NAS and Radius are in the same subnet without any firewall. Rio@TW

5 9

dialupadmin not displaying menu
by Carl aniams 27 May '07

27 May '07

hi, I am installing a wireless hotspot with freeradius.the installation went fine, but when trying to display the dialupadmin html page http://localhost /dialupadmin <http://localhost/dialupadmin> the pae displays fine but the menu on the left is not displayed as it should be. instead i observed that it is the content of a php3 script in the conf file that are written need a help please -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

How to re-forward a request rejected by one proxy server to another proxy server?
by Clark J. Wang 26 May '07

26 May '07

I configuired two proxy servers `radius1' and `radius2' for realm `foo.com' in file `proxy.conf'. And I want those requests rejected by `radius1' to be re-forwarded to `radius2'. How can I do that? Thanks.

2 1

how to add feature authentification...
by Trio Yulistianto 26 May '07

26 May '07

dear all i'm using freeradius-1.1.6 and mysql database... for now running well.. but i need something add to authentification process.. i have one table "Payment_Table" (username,payment) all username in radcheck already copied to username field,payment field filled by '0' or '1' this is what i need : while user trying to connect, freeradius will check payment_table, if payment field is '0' user cannot log in,except field contain with '1' any suggestion? thanks trio

2 1

FreeRadius crash
by Doug Hardie 26 May '07

26 May '07

I am encountering an infrequent problem where FreeRadius crashes about once a week on a fairly busy server. I have a primary and secondary authentication server and just a primary accounting server. Both the primary and secondary crash at the same time (well the secondary is about 30 seconds behind the primary). Thus I know that it is an authentication request causing the problem. However, using the authentication requests that occurred just prior to the crash I am unable to replicate the problem. I have core dumps and have tried to find useful information on the cause but have not found anything. The trace always shows: (gdb) where #0 0x280a94ab in pthread_testcancel () from /usr/lib/libpthread.so.2 #1 0x280a1e3c in pthread_mutexattr_init () from /usr/lib/ libpthread.so.2 #2 0x2808b450 in ?? () FreeRadius 1.1.2 on FreeBSD 6.1 using libpthread. I have tried using libthr but that crashed instantly on receipt of any request so I suspect that was not intended to work. I am beginning to suspect that the problem may lie in libpthread. Is there anything that can be retrieved from the core files that might help? There are always several threads active at the time of the crash.

5 15