- Freeradius-Users - lists.freeradius.org

Problem with logging detail-log to syslog
by Mark van Herpen 23 May '07

23 May '07

Hello, I want to log all the freeradius (v 1.1.3) logs to syslog (syslog-ng). I 've already added this to my syslog-ng.conf : filter f_radiusd { match ("radiusd"); }; destination radiuslogs { file("var/log/radiusd.log"); }; log { source (src); filter(f_daemon); filter(f_radiusd); destination(radiuslogs);}; And I changed/added this in my radiusd.conf : logdir = syslog log_destination = syslog So far so good: when I restart syslog-ng and radiusd, radiusd is logging to /var/log/radiusd.log via syslog. But I also want to have the detail-logs, which are normaly in the raddact directory, working in syslog... Now I see this error in /var/log/radiusd.log : rlm_detail: Failed to create directory syslog/radacct: No such file or directory So the rlm_detail part doesn't understands the 'logdir = syslog' option in radiusd.conf I guess? How can I fix this? Thanks in advance Mark van Herpen

2 4

Problem connecting to a router via RADIUS Server authentication
by prajakta choudhari 23 May '07

23 May '07

Hi all: I have configured the radius server . I have a linksys router with wireless security as RADIUS enabled and laptop that connects to the linksys router. whenever i try connecting to the router i get the folloing message on the machine wiht the radius server. the clients.conf has the secret key as testing123 . In which other file do i have to put the same key. Cleaning up request 4 ID 0 with timestamp 46543306 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=129 Received packet from 192.168.6.15 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Cud someone throw light on this issue Thank you Prajakta Choudhari __________________________________________________________ Yahoo! India Answers: Share what you know. Learn something new http://in.answers.yahoo.com/

3 2

FreeRadius on openSuse Error
by Siqhamo Sifo 23 May '07

23 May '07

I am currently running freeradius on openSuse 10.2 and when I do a tail -f on my log file I c the ff error messsage : Error: Exec-Program: FAILED to execute /usr/local/bin/mtacnt: No such file or directory What i find strange is that it seems like mtacnt is not installed on my system which I find strange because when I took a look at my other radius box which is running fc5 the cmd mtacnt is available. Can any1 help REgards Sq

2 1

LDAP access configuration
by Manuel Sánchez Cuenca 23 May '07

23 May '07

Hello all, I have a scenario where a first radius server (R1) proxies the authentication request to another radius server (R2). Later, when the user is authenticated, R1 must access to a LDAP server to recover some network parameters, such as session-timeout or framed-ip-address, and enforce them in the Access Point (AP). Currently, R1 is configured to access to the LDAP server using the user name as filter (filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" in radiusd.conf). My question is, it is possible to configure this filter to use a radius attribute received in the response from R2? I mean, R2 returns in the response an attribute called attr1=val1, and then R1 must use this attribute to search in the LDAP server (¿filter="(uid=%{attr1})" or something similar?) Internet / User -------- AP ---------- R1 -------- R2 \ LDAP User AP R1 LDAP R2 (authn req.) ------------------------------>---------------------------------------> (authn response + attr1=val1) <---------------------------------------- (search uid=attr1) ------------------> (network params) <------------------ (params) <---------------- (Success) <------------<---------------- Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

1 0

Re: Freeradius-Users Digest, Vol 25, Issue 106
by anoop_c＠sifycorp.com 23 May '07

23 May '07

Hi all I am doing eap-tls with fr 1.1.6 I am not getting anything in the log file.I am able to authenticate and connect. Wat are the config to be done for getting log Regards Anoop

1 0

NAS ignoring Access-Accept
by Wolfgang Rosenauer 23 May '07

23 May '07

Hi, I'm not sure if I run into a Cisco or Freeradius issue here. I try to migrate from icradius to freeradius and everything worked in the new configuration when I tried with NTRadPing and so I'm switched the Cisco NAS to the new server. Unfortunately the NAS is ignoring the Access-Accept replies and always denies login attempts. That worked correctly with icradius and the NAS config changed only the ip address of the radius server. My first guess was an ip source issue but my server only has one ip address (and IPv6 ones but radiusd is only listening on 0.0.0.0) and freeradius is compiled with --with-udpfromto. Here are parts of my Cisco config: aaa authentication ppp default if-needed radius local aaa authorization network default radius local aaa accounting update newinfo aaa accounting exec default start-stop radius aaa accounting network default start-stop radius aaa accounting connection default start-stop radius radius-server configure-nas radius-server host a.b.c.d auth-port 1812 acct-port 1813 non-standard radius-server timeout 3 radius-server vsa send accounting I ran radiusd -X and saw that freeradius sent an Access-Accept reply to the NAS' ip address and source port. Any ideas? Thanks, Wolfgang

2 6

How to add a prefix to User-Name before proxying to another RADIUS server?
by Clark J. Wang 23 May '07

23 May '07

I have two RADIUS servers rad_1 and rad_2. For some users rad_1 needs to forward the requests to rad_2 and I want to add some prefix like `QA/' to User-Name before forwarding to rad_2. Does FreeRADIUS support that? And how to configure? Thanks.

3 2

Gigaword support
by eugene＠snowball.co.za 22 May '07

22 May '07

I would like to have updated mysql querries for FreeRadius that supports gigawords. Please assist.

2 1

Radius compatibility questions
by Ouahiba MACHANI 22 May '07

22 May '07

Hi, Can anyone give me details about FreeRadius compatibility? My questions are : 1- Dose radius operate easily with Cisco equipments (including firewalls, VPN, … ) and other hardware VPN servers? 2- The same question for software VPN, such as Microsoft Routing and Remote Access Server (RRAS)? 3- the same question for access points? 3- What version or variants of the following standards and methods dose radius support : X802.1X, EAP-X? - Is there available plug-in that allow to interface with ActiveDirectory ? LDAP directories ? Databases (Oracle, MySQL, etc) ? Where can I find the features of the actual version of radius? I want to develop a plug-in for FreeRadius. This plug-in should be able to handle authentication requests send from a VPN server (either hardware, Cisco or a Software (MS RRAS) implementation) or an AccessPoint. The second requirements, is that this plug-in should be able to interface with the different users Data store including ActiveDirectory, LDAP directories and Databases, to accomplish user authentication. How should I proceed to do this? Should I develop multiples modules? Is their any existing code that I can use to develop such a plug-in? Any additional indication are welcome. Thanks in advance.

3 2

Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
by xuebin gong 22 May '07

22 May '07

Hi, All, I am user and want to integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication. Our operating system is Fedora 5 Linux. (1)Install freeRadius-1.1.6 After following the instruction of installation in http://wwww.freeradius.org, install freeRadius-1.1.6 on Fedora Linux 5, run radius server in debug mode radiusd -X ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. FreeRadius was installed succeefully. (2)Configure freeRadius-1.1.6 (2.1) Configure radiusd.conf (2.1.1) LDAP module ldap{ server = "10.0.0.118" identity = "cn=Manager,dc=mtcable,dc=net" password = mtncnl1970 basedn = "dc=mtcable,dc=net" filter = "uid=%{Stripped-User-Name:-%{User-Name}}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } (2.1.2) authorize module uncomment ldap line authorize{ ...... ldap ...... } (2.1.3) authenticate module uncomment block ldap block: authenticate{ ...... Auth-Type LDAP { ldap } ...... } (2.2) edit /usr/local/etc/raddb/users Uncomment the following lines: DEFAULT Auth-Type = LDAP Fall-Through = 1 (3)Install openLDAP (4)Configure openLDAP (5)Add one LDAP entry for testing dn: uid=jjeep, ou=radius, rccd=AAA3140018f, dc=mtcable,dc=net userPassword:: aabbccdd cn: jeep uid: jjeep radiusAuthType: local radiusSimultaneousUse: 1 homeDirectory: // objectClass: top objectClass: posixAccount objectClass: radiusprofile uidNumber: 7012 gidNumber: 100 After add this entry to LDAP, we reset the password to "888888" (5)Test After run test command line radtest jjeep "888888" localhost 1 testing123 The following is information from running Radiusd -X: ...... rad_recv: Access-Request packet from host 127.0.0.1:32771, id=192, length=57 User-Name = "jjeep" User-Password = "888888" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jjeep", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jjeep radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.0.0.118:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 970 to 10.0.0.118:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for req uest 0 rlm_pap: WARNING! No "known good" password found for the use r. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "jjeep" with password "888888" radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [jjeep] (from cl ient localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request The following is logfile: ...... May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" method=128 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 RESULT tag=97 err=0 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH attr=uid May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text= It looks like LDAP search successfully and found 3 entries, but redius server could not find any objects. What is wrong with my integration? Thanks In Advanced Robin ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091

3 2