- Freeradius-Users - lists.freeradius.org

freeradius sql /mssql
by Andrew D 23 Feb '07

23 Feb '07

Hi there, We've got FreeRADIUS Version 1.1.4, for host i386-portbld-freebsd5.5 using unixodbc/freetds connecting to a mssql DB. I've got a number of questions that I hope someone can answer. 1. If the user is found in the sql tables and has reply attributes etc, is it still possible to go through the 'users' file? if so how? I can't seem to get it to do it. 2. Is there an ability in any way to have a caching like feature or is DB failover and running 2 db servers with replication the only way to go? 3. Is there anyway to log the actual reason for rejection in 'Post-Auth-Type REJECT'? ie simultaneous use, invalid password etc? Cheers in Advance for any help. cya Andrew

3 5

RE: Freeradius Authentication to Actice Directory
by John Wan 23 Feb '07

23 Feb '07

Hi Sanni, Do you use Chillispots for the login screen or use other method. Thanks for your information. Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of sanni Sent: Friday, 23 February 2007 1:47 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius Authentication to Actice Directory I configured a freeradius server which should authenticate users on a Windows 2003 Active Directory server. Here are my configs: http://sanni.org/stuff/radius/clients.conf http://sanni.org/stuff/radius/eap.conf http://sanni.org/stuff/radius/radiusd.conf http://sanni.org/stuff/radius/users The Clients are Windows XP SP2 with WPA2 Patch. If i try to authenticate with a Dell Laptop and its integratet wlan card it works fine (log: http://sanni.org/stuff/radius/works.txt) But if i try to logon on with a PC, which has a USB wlan card (http://www.avm.de/de/Produkte/FRITZBox/FRITZ_WLAN_USB_Stick/index.html) i get "Exec-Program output: Logon failure (0xc000006d)". Settings are the same. And the USB stick works in the Laptop also. I seems that the freeradius works correct with laptops, but why doesn't it work with normal PCs. Here is the full debug, of a try with a normal PC: root@lmtsu001:/var/log/radius# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/eap.conf main: prefix = "" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /lib Module: Loaded PAP pap: encryption_scheme = "md5" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/lmtsu001.pem" tls: certificate_file = "/etc/raddb/certs/lmtsu001.pem" tls: CA_file = "/etc/raddb/certs/LiebherrRootCA.pem" tls: private_key_password = "secret" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.5.253.161:32768, id=20, length=192 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x02020013014c4d5457324b5c6c6d7465647630 Message-Authenticator = 0xdddd1f4219da4e9ab9795e715ae0852d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_eap: EAP packet type response id 2 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 20 to 10.5.253.161 port 32768 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa95f7b6453528d1cff0d066b3104a7f6 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=21, length=271 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x0203005019800000004616030100410100003d030145dd994586ca939faaaeaba54545 809612b1e8f0a0ca8e00c8630a29d87109c900001600040005000a000900640062000300 060013001200630100 State = 0xa95f7b6453528d1cff0d066b3104a7f6 Message-Authenticator = 0x19fbf8bedb7f072096c22e5a04418ac1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0474], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 21 to 10.5.253.161 port 32768 EAP-Message = 0x0104040a19c0000004d1160301004a02000046030145dd993e78c0527b162d5f7e38ec c295064684576f281936e17393ec79554b9420a92ab4e0e944eb0f2c7e1f42a712fcf909 9fae74a95aa19e9725c037390cfe8500040016030104740b00047000046d00046a308204 663082034ea003020102020a44445dec0001000008bb300d06092a864886f70d01010505 003054310b30090603550406130244453111300f060355040a13084c6965626865727231 11300f060355040b13085a4544562d4f5247311f301d060355040313164c696562686572 72456e746572707269736543413031301e170d3037303132353134353733395a170d3130 3031 EAP-Message = 0x32343134353733395a3081b4310b3009060355040613024445311b3019060355040813 12426164656e20577565727474656d626572673119301706035504071310426164205363 68757373656e726965643111300f060355040a13084c69656268657272310c300a060355 040b13034c4d543120301e060355040313176c6d7473753030312e6c6d742e6c69656268 6572722e69312a302806092a864886f70d010901161b6d69636861656c2e64657765696e 406c696562686572722e636f6d30819f300d06092a864886f70d010101050003818d0030 818902818100b369494643464bc0605937bc85aec08540102c9cf5ae605ec1855ff2ed63 5dbf EAP-Message = 0x3c64d3242c426067843f1d6555523c5d0e2697dab98a86852477ec576ec552e36da7cd f78812851ba984b352ea4b88c7b7c9d323fe4d10b8406cdc40b69110ace0ef94431baa7f ecb716dccdaa298ca31bcc05933b9357a5813a2afca1522c250203010001a382015b3082 0157300b0603551d0f0404030205a0301d0603551d0e0416041483d2835d90edabd05298 74fbae5d7a534e20c5a7303b06092b0601040182371507042e302c06242b060104018237 150885b9b113e8be6587d99111e0d81382c1ba07817081d1953f9daa2402016402010630 1f0603551d230418301680145d8e0e61cd050d159d72d205abd7775fb09cbac430460603 551d EAP-Message = 0x1f043f303d303ba039a0378635687474703a2f2f6470312e6c696562686572722e636f 6d2f4c69656268657272456e7465727072697365434130312831292e63726c305106082b 0601050507010104453043304106082b060105050730028635687474703a2f2f6470312e 6c696562686572722e636f6d2f4c69656268657272456e74657270726973654341303128 31292e63727430130603551d25040c300a06082b06010505070301301b06092b06010401 8237150a040e300c300a06082b06010505070301300d06092a864886f70d010105050003 8201010014e9db390f59b52bc62469fe2013c9ce9ade4435a91add0cbdb98142d2926838 3af4 EAP-Message = 0xf6307c4d76f61ad1a2b57f53c38f870bded3021a9f1d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4afc67a3e8014fee131055371aa38023 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=22, length=197 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x020400061900 State = 0x4afc67a3e8014fee131055371aa38023 Message-Authenticator = 0x299c938225edf0c465675cbec851f3d1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 modcall[authorize]: module "files" returns notfound for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 22 to 10.5.253.161 port 32768 EAP-Message = 0x010500d719004e8f1edcca934c54c42f6f512d7d25b9ef39fe2c6e15c74264b2734400 b8aa05d51c9607fd98008e50cb6c5daa5630305585d45185dd6bea73fb29de949e8a3614 52043724878b2d5112db973dcbd6b4fabbd77086c4320d49a4bbc671e09e032bf32127ad 0f76c6543883cc11336e07ad341ac8e5bce9a941e3cb8f85d80de4e34b53dc7774d176be 2616193cec8121c1c195f88ea1513e8589e8675fcb20809566ff30fa456a00a9f066a81b dc848c2140ec6e5589a7da0d1ec84ceb28a3e2ca8851cede63bbb716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x530b2dba728bbaa88434d2d0792a4a28 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=23, length=383 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x020500c01980000000b616030100861000008200803fff72d54b14ed9df96aeb3fe680 43f44992f3ebddf67c1b42a23376810cb99c04c51e873ec6305fa2ca19774ce4992c8679 2b7187d6acb390335e4e56ae11967f63353c641d15ee982e9795e859d787140055b6993c 41f5ea8da9b58149cd78f94d6cbbf43c2ef9163274e3723455b5cca3e050dae91f647f2d a364b0b2e322140301000101160301002070573150efbe715780423828c05b5fb3a1bf18 338ab44785fddcc5593af59157 State = 0x530b2dba728bbaa88434d2d0792a4a28 Message-Authenticator = 0xd94e80495369db6b588447a6e209e185 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_eap: EAP packet type response id 5 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 23 to 10.5.253.161 port 32768 EAP-Message = 0x0106003119001403010001011603010020371c7467b748a133b50fd00510553f3bb3b2 454509afc6b0c0f78d5d52dbd8b3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfa3d7a965dd0ad213b7e4b58554e38dc Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=24, length=197 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x020600061900 State = 0xfa3d7a965dd0ad213b7e4b58554e38dc Message-Authenticator = 0xcd43325aa4181859a93c812343af9008 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 24 to 10.5.253.161 port 32768 EAP-Message = 0x010700201900170301001591a2d21ce9953bc2b489072a8be60b8fb76e64d61c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x239b7587e5d69633313552d097ccd5ce Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=25, length=233 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x0207002a1900170301001fd67e5d53095da3e44b5bae83c9b5c86e8a74d67efc0aaffd 881709822ab76e State = 0x239b7587e5d69633313552d097ccd5ce Message-Authenticator = 0xf555dcfbbd229d838e3680f49290f0a4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 modcall[authorize]: module "files" returns notfound for request 5 rlm_eap: EAP packet type response id 7 length 42 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - LMTW2K\lmtedv0 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of LMTW2K\lmtedv0 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to LMTW2K\lmtedv0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 modcall[authorize]: module "files" returns notfound for request 5 rlm_eap: EAP packet type response id 7 length 19 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 25 to 10.5.253.161 port 32768 EAP-Message = 0x0108003f190017030100344db8a99be139eaac9dd7ebd5f85642c00726a56913fd781c 51c94645fadef1cf3aae988f035e7624bb08f338b4f2ee27085e83a4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd89568e532d25257fb891e6d0cc2a2dd Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=26, length=287 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x020800601900170301005536511a892ca59ce94a2a971136f8ff49a3ee3b0992110977 ef18cb3c7064117b3c0a316b26fe6d508e0551811c491cbdfa33b9717a471c7827861818 92662ee41a462d130ddc4f59f0c9bccf8c93daf3d3dc7de764 State = 0xd89568e532d25257fb891e6d0cc2a2dd Message-Authenticator = 0x154cd4e6319551e54988fd8aa494aa4d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 modcall[authorize]: module "files" returns notfound for request 6 rlm_eap: EAP packet type response id 8 length 96 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to LMTW2K\lmtedv0 PEAP: Adding old state with fc 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 modcall[authorize]: module "files" returns notfound for request 6 rlm_eap: EAP packet type response id 8 length 73 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for lmtedv0 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=lmtedv0' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: fc radius_xlat: '--challenge=0db1cf76e0c965cb' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=12a9fde094819f06320066f1e7dfe14a3592948c31aee8bd' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [LMTW2K\\lmtedv0] (from client localhost port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 26 to 10.5.253.161 port 32768 EAP-Message = 0x010900261900170301001b2939686bcf3fef828e50293342fcbfa3dabbb7981f84c2d2 0af334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x543585135e55b58d928a2a90b9f60379 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.5.253.161:32768, id=27, length=229 User-Name = "LMTW2K\\lmtedv0" Calling-Station-Id = "00-04-0E-FC-54-BA" Called-Station-Id = "00-19-A9-FD-9E-A0:DATA" NAS-Port = 29 NAS-IP-Address = 10.5.253.161 NAS-Identifier = "Cisco_71:72:27" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" EAP-Message = 0x020900261900170301001bdb86f77b75f354a83e03cdef1366f87ebbd85c6a045e8f83 5d742d State = 0x543585135e55b58d928a2a90b9f60379 Message-Authenticator = 0x18b6efd956617405afa59369cf816869 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "LMTW2K\lmtedv0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 modcall[authorize]: module "files" returns notfound for request 7 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [LMTW2K\\lmtedv0] (from client lmt-wc01 port 29 cli 00-04-0E-FC-54-BA) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... -- View this message in context: http://www.nabble.com/Freeradius-Authentication-to-Actice-Directory-tf32 73167.html#a9101194 Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

1 0

İnstalling error
by Erol Toksöz 22 Feb '07

22 Feb '07

Hi, I am trying to install Freeradius server on my SUN Solaris 2.8 unix server. After installed gcc.2.95. During ./configure it gives error below .... .... checking for gmake... no checking for make... /usr/ccs/bin/make configure: error: GNU Make is not installed. Please download and install it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing. I visited this site and found make.3.81 but it needs gcc3.46 or higher version. But freeradius installer doesn't like gcc3.46. So I couldn't install freeradius. Anyone knows solution? Erol Toksöz Araştırmacı TÜBİTAK MAM Bilişim Teknolojileri Enstitüsü Tel: +90(262)677 2625 Fax:+90(262)646 3187 <mailto:erol.toksoz@bte.mam.gov.tr> www.mam.gov.tr

2 1

Freeradius is logging the passwords
by Angel L. Mateo 22 Feb '07

22 Feb '07

Hello, I have running freeradius authenticating against an openldap directory. In my configuration I have this: log_auth = yes log_auth_badpass = yes log_auth_goodpass = no But I can see passwords of everybody in my auth-details files (correct and incorrect password). Is there any way to log just wrong password? Or not to log any password at all? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

3 4

Need info abt freeradiusclient
by Senthil Nathan 22 Feb '07

22 Feb '07

Hi, I need few info about freeradiusclient. 1. I installed it and when starting the application, 'freeradiusclient', it was asking for the config files location. Please let me know how to start the 'freeradiusclient'. 2. On starting it, how to send the accounting messages from the client. fyi, I have already installed the freeradius server 1.1.4 and could start it. Please give me more insight on these issues. Thanks Senthil Nathan R

1 0

İnstalling error
by Erol Toksöz 22 Feb '07

22 Feb '07

Hi, I am trying to install Freeradius server on my SUN Solaris 2.8 unix server. After installed gcc.2.95. During ./configure it gives error below .... .... checking for gmake... no checking for make... /usr/ccs/bin/make configure: error: GNU Make is not installed. Please download and install it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing. I visited this site and found make.3.81 but it needs gcc3.46 or higher version. But Erol Toksöz Araştırmacı TÜBİTAK MAM Bilişim Teknolojileri Enstitüsü Tel: +90(262)677 2625 Fax:+90(262)646 3187 <mailto:erol.toksoz@bte.mam.gov.tr> www.mam.gov.tr

1 0

RE: VPN and Group Policy
by Deramus, Chris 21 Feb '07

21 Feb '07

Assuming you have your reply table set up properly the following should work: id UserName Attribute Value op 1 test.user Class TestGroup == I've used this set up for 3 years with both Cisco 3000's and for the past year with ASA 5000's and it works like a charm. -----Original Message----- From: freeradius-users-bounces+chris.deramus=hq.doe.gov(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.deramus=hq.doe.gov@lists.freeradi us.org] On Behalf Of Berndt Sevcik Sent: Wednesday, February 21, 2007 8:03 AM To: FreeRadius users mailing list Subject: VPN and Group Policy We are using a Cisco ASA Firewall for VPN access (lika a VPN3000). The RADIUS server should authenticate our users and assign them a group policy. Somewhere I read that I have to send the CLASS attribute in the RADIUS reply to assign the grou policy to a user. When I look at the debug output from the firewall I can see that the attribut is sent to the firewall. Also the access accept packet is received by the firewall. Radius: Code = 2 (0x02) Radius: Identifier = 17 (0x11) Radius: Length = 88 (0x0058) Radius: Vector: 2B9061A9AA15E08DA2F1FACCFFD012F7 Radius: Type = 25 (0x19) Class Radius: Length = 16 (0x10) Radius: Value (String) = 4f 55 3d 49 54 2d 53 65 72 76 69 63 65 3b | OU=IT-Service; ,,,,, rad_procpkt: ACCEPT RADIUS_ACCESS_ACCEPT: normal termination RADIUS_DELETE remove_req 0xf6d9874 session 0x208 id 17 free_rip 0xf6d9874 radius: send queue empty Is there an other attribut so send back? Something special to know about freeRADIUS config? Has someone a working config ore some tipps for me? Thanks in advance. Berndt ----------------------------------------- TGM - Die Schule der Technik IT-Service A-1200 Wien, Wexstr. 19-23 Tel. +43(1)33126/316 Fax: +43(1)33126/154 E-Mail: berndt.sevcik(a)tgm.ac.at ----------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Problems With EAP
by Arjuna Scagnetto 21 Feb '07

21 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think the Auth-Type value is the problem, try to use an entry like "username" User-Password = "pass" without explicit the Auth-Type value. but if it works i do not realy understand why it works :) i'm a freeradius newbie too. arjuna -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFF3FZC7hNGJisFPxQRAuFqAJ9ebvcnj4Pe5c3dSnKRoKCkdp8JBwCdFJbU gLiRcofUX9yEk+k6AiCyrvc= =9QAG -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Problems With EAP
by Anuj Tripathi 21 Feb '07

21 Feb '07

Hi All I am a newbie to freeradius. I am trying to use freeradius as an authentication server along with a WRT54G Linksys (Cisco) access point. On the client side i have a windows machine where i have enabled PEAP authentication, through which it asks me for user name and password. The problem i am facing is that the Radius server is not getting password, and hence not authenticating. Following is a snippet of the log i got : rad_recv: Access-Request packet from host 10.129.20.111:2863, id=0, length=169 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) Message-Authenticator = 0xd75320cd909f5132bb834f1196e6f5b3 Service-Type = Framed-User User-Name = "steve" Framed-MTU = 1488 Called-Station-Id = "00-18-F8-64-80-D9:ANUJ" Calling-Station-Id = "00-17-9A-D1-9F-B7" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a017374657665 NAS-IP-Address = 10.129.20.111 NAS-Port = 7 NAS-Port-Id = "STA port # 7" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry steve at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local *auth: No User-Password or CHAP-Password attribute in the request* *auth: Failed to validate the user.* *Login incorrect: [steve/<no User-Password attribute>] (from client localhost port 7 cli 00-17-9A-D1-9F-B7)* Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.129.20.111:2863, id=0, length=169 Sending Access-Reject of id 0 to 10.129.20.111 port 2863 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 45dc2565 Nothing to do. Sleeping until we see a request. My Client file reads : steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP Am I missing out on something ? Kindly help me with this as soon as possible. Its a little urgent. regards, Anuj Tripathi

2 3

VPN and Group Policy
by Berndt Sevcik 21 Feb '07

21 Feb '07

We are using a Cisco ASA Firewall for VPN access (lika a VPN3000). The RADIUS server should authenticate our users and assign them a group policy. Somewhere I read that I have to send the CLASS attribute in the RADIUS reply to assign the grou policy to a user. When I look at the debug output from the firewall I can see that the attribut is sent to the firewall. Also the access accept packet is received by the firewall. Radius: Code = 2 (0x02) Radius: Identifier = 17 (0x11) Radius: Length = 88 (0x0058) Radius: Vector: 2B9061A9AA15E08DA2F1FACCFFD012F7 Radius: Type = 25 (0x19) Class Radius: Length = 16 (0x10) Radius: Value (String) = 4f 55 3d 49 54 2d 53 65 72 76 69 63 65 3b | OU=IT-Service; ,,,,, rad_procpkt: ACCEPT RADIUS_ACCESS_ACCEPT: normal termination RADIUS_DELETE remove_req 0xf6d9874 session 0x208 id 17 free_rip 0xf6d9874 radius: send queue empty Is there an other attribut so send back? Something special to know about freeRADIUS config? Has someone a working config ore some tipps for me? Thanks in advance. Berndt ----------------------------------------- TGM - Die Schule der Technik IT-Service A-1200 Wien, Wexstr. 19-23 Tel. +43(1)33126/316 Fax: +43(1)33126/154 E-Mail: berndt.sevcik(a)tgm.ac.at -----------------------------------------

1 0