- Freeradius-Users - lists.freeradius.org

radwho is not working
by Angel L. Mateo 19 Feb '07

19 Feb '07

Hello, I have a problem with radwho and it is not working, it shows an empty list of users. I have two freeradius servers with the same configuration (running in an active/standby configuration). I have configure unix (radwtmp) and radutmp modules, I have configure accounting to use both unix and radutmp modules and session to use radutmp. I have also configure sql_log module so both servers logs accounting information to a share backend. So my configuration is: modules { ... # Unix /etc/passwd style authentication # unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } # Write a 'utmp' style file, of which users are currently # logged in, and where they've logged in from. # # This file is used mainly for Simultaneous-Use checking, # and also 'radwho', to see who's currently logged in. # radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } # # The rlm_sql_log module appends the SQL queries in a log # file which is read later by the radsqlrelay program. # # This module only performs the dynamic expansion of the # variables found in the SQL statements. No operation is # executed on the database server. (this could be done # later by an external program) That means the module is # useful only with non-"SELECT" statements. # # See rlm_sql_log(5) manpage. # sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}, '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date, ip) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S', '%{Client-IP-Address}' );" } } accounting { # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # Return an address to the IP Pool when we see a stop record. # amateo, 07/07/06: Activamos los pooles que hemos definido pool_vpn pool_vpn_alu pool_ono pool_ono_alu # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log } session { radutmp } The problem I have is that although radumtp and radwmtp are updated every time time radius authenticate an user, radwho shows an empty list, but radlast shows information. For example, at this moment: vulpes2:/etc/freeradius# radlast | more anonymou 765:ap Thu Jan 4 12:06 still logged in skarmeta 810:ap Thu Jan 4 12:05 still logged in anonymou 939:ap Thu Jan 4 12:05 - 12:06 (00:00) anonymou 1648:ap Thu Jan 4 12:05 still logged in anonymou 1211:ap Thu Jan 4 12:03 still logged in anonymou 1647:ap Thu Jan 4 12:02 - 12:05 (00:03) anonymou 764:ap Thu Jan 4 12:02 - 12:05 (00:03) skarmeta 837:ap Thu Jan 4 12:01 - 12:05 (00:03) anonymou 938:ap Thu Jan 4 12:00 - 12:02 (00:01) anonymou 1646:ap Thu Jan 4 11:59 - 12:02 (00:03) anonymou 763:ap Thu Jan 4 11:58 - 12:00 (00:01) skarmeta 809:ap Thu Jan 4 11:57 - 12:01 (00:03) anonymou 1645:ap Thu Jan 4 11:57 - 11:59 (00:02) anonymou 937:ap Thu Jan 4 11:56 - 11:58 (00:01) anonymou 613:ap Thu Jan 4 11:55 - 12:00 (00:04) anonymou 1644:ap Thu Jan 4 11:55 - 11:57 (00:02) anonymou 762:ap Thu Jan 4 11:54 - 11:56 (00:01) skarmeta 835:ap Thu Jan 4 11:53 - 11:57 (00:03) anonymou 1643:ap Thu Jan 4 11:53 - 11:55 (00:02) anonymou 1642:ap Thu Jan 4 11:51 - 11:53 (00:01) anonymou 936:ap Thu Jan 4 11:50 - 11:54 (00:03) anonymou 2668:ap Thu Jan 4 11:50 still logged in skarmeta 808:ap Thu Jan 4 11:49 - 11:53 (00:03) anonymou 1641:ap Thu Jan 4 11:49 - 11:51 (00:02) anonymou 761:ap Thu Jan 4 11:48 - 11:50 (00:01) ... as you can see, radlast shows that there are users logged in to teh system, but vulpes2:/etc/freeradius# radwho Login Name What TTY When From Location any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

5 11

RE: Installing Free radius 1.1.4 on Server Running Centos 4.4
by Josh Howlett 19 Feb '07

19 Feb '07

$ yum install freeradius Josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of dataHosting Support > Sent: 19 February 2007 07:28 > To: freeradius-users(a)lists.freeradius.org > Subject: Installing Free radius 1.1.4 on Server Running Centos 4.4 > > > > Is there an easy step by step guide for beginners on > installing Free Radius 1.1.4. on Centos 4.4? > > > > Have setup new Centos Server and now wanting to install Free Radius. > > > > > > Regards, > > > > David Willis > > > > > >

1 0

Installing Free radius 1.1.4 on Server Running Centos 4.4
by dataHosting Support 19 Feb '07

19 Feb '07

Is there an easy step by step guide for beginners on installing Free Radius 1.1.4. on Centos 4.4? Have setup new Centos Server and now wanting to install Free Radius. Regards, David Willis

1 0

Attribute Max-Daily-Session + Session-Timeout
by Abel Monzón 19 Feb '07

19 Feb '07

Hello List. I have a problem. I had limited the Max-Daily-Session = 120, and the Session-Timeout = 60. The Session-Timeout work, but the Max-Daily-Session don't. because the Session-Timeout log out the user, but de Max-Daily-Session don't and let log in again. I have this in my radiusd.conf: sqlcounter contdiario { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily count-attribute = Max-Daily-Session query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } authorize { .... contdiario ..... } Any help? Thanks

1 0

sending logs to mysql?
by Arjuna Scagnetto 18 Feb '07

18 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is it possible to send all logs to the mysql directly from freeradius? thanks Arjuna Scagnetto -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFF2JKk7hNGJisFPxQRAjd1AJ4x0EjKuzIcLCDp/g1qSrUimUiorwCeMSaF 7Z8uGN4FD2HsjMwov6C/6s0= =Olor -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

1.1.4 stops responding to requests
by Phil Allred 18 Feb '07

18 Feb '07

Just a heads up: In our production environment here at Brooklyn Law School, 1.1.4 stops responding to radius requests after a few hours. We have used freeradius for some time (and love it) to authenticate wireless users to our ldap servers. We use it with two different wireless systems, trapeeze and colubris, which each do 802.1x authentication to freeradius servers using PEAP and mschapv2. We run it on three different servers. When vista came along, we had to upgrade from 1.1.4 to 1.0.5. We run Fedora Core 5 and Fedora Core 6 on these servers. Because there is no 1.1.4 rpm out yet for Core 5 or Core 6, we built freeradius from source. Since we are in a production environment, we were careful to use non-overlapping directory structures when we compiled and installed 1.1.4 so that if there was a problem, we could quickly go back to the rpm. 1.1.4 will run for a few hours and then either stop responding to requests or die. There is no seg fault warning in any log file. If I restart radius, it then begins answering again. Since it is a production environment in which 300-500 users are connected at any given time, we were unable to simply turn on debugging and look for problems. Once we realized the problem we had to quickly revert to 1.0.5 for now and make our relatively few Vista users for a little longer. I am going to try running it in debug mode over a weekend in a particular subset of the school's wireless network where not many users would be affected by a crash and see if I can collect any more information. I will do it on a system that never had any earlier version of freeradius installed on it, just to be safe. In the meantime, any advice would be appreciated. Thanks, Phil Allred

5 9

EAP-TLS - Authenticating only certain users
by Stephen Bowman 17 Feb '07

17 Feb '07

When using EAP-TLS as the only method in freeradius, is there a way to define a list of allowed users, perhaps by the CN on their client certificate? I want it so that not *everyone* who has a certificate signed by the CA list can authenticate, but rather a select few (of which I know the CN of their certificates). Thanks... Stephen

2 3

Re: Freeradius-Users Digest, Vol 22, Issue 66
by silvia bogos 17 Feb '07

17 Feb '07

Hi i dont get any answer till now, though i join ur list that i hope a help from someone. please i need to decide what to use RED HAT OR SLACKWARE. On 2/15/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: db.counter not found! (Alan DeKok) > 2. Re: VLAN assigment and Alcatel Omniswitch 7800 (Oxiel Contreras) > 3. [SOLVED] - Re: VLAN assigment and Alcatel Omniswitch 7800 > (Oxiel Contreras) > 4. Re: Simple security (Gaddis, Jeremy L.) > 5. NAS-IP-Address in mysql (VeNoMouS) > 6. Re: NAS-IP-Address in mysql (Dan Mahoney, System Admin) > 7. strip unwanted characters from reply message (Cory Robson) > 8. Re: a problem about radius and ldap [SOLVED] (Ramazan Ulker) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 15 Feb 2007 03:02:40 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: db.counter not found! > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <45D3BF40.30201(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Enrique Llanos V. wrote: > > And of course in my raddb (freeradius) path: > > > > bash-2.05b# locate db.counter > > /usr/local/etc/raddb/db.counter > > "locate" uses a database that is updated daily. So if the file > disappears, locate doesn't notice. > > Use "ls" instead. > > > Yet when i start freeradius i obtain this error: > ... > > Wed Feb 14 17:02:40 2007 : Error: rlm_counter: Failed to open file > > /usr/local/etc/raddb/db.counter: No such file or directory > ... > > Any ideas in how to correct this error? > > Ensure that the /usr/local/etc/raddb directory exists, and readable by > radiusd. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 2 > Date: Wed, 14 Feb 2007 22:08:57 -0400 > From: Oxiel Contreras <oxielc(a)yahoo.it> > Subject: Re: VLAN assigment and Alcatel Omniswitch 7800 > To: freeradius-users(a)lists.freeradius.org > Message-ID: <200702142208.57769.oxielc(a)yahoo.it> > Content-Type: text/plain; charset="iso-8859-1" > > Hello Marcel. > > > I'm afraid you added it in the wrong place, dictionary.alcatel does not > > contain the VSAs for Omniswitches (Alcatel-Lucent has multiple > > dictionaries for different products, dictionary.alcatel appears to be > > for a BRAS, not for an enterprise switch). > > The dictionary you're looking for is dictionary.xylan; the easiest way > > is to use Xylan-Auth-Group for sending your VLAN (The name isn't really > > that important, what is important is that the number for the attribute > > is correct (1 in this case) and that it is defined with the proper > > vendor number (800 for Omniswitches)). > > Right, indeed used Xylan-Auth-Group and worked perfectly, i'm so happy a > tear > fell down :) > > Many thanks. > > Oxiel > > Chiacchiera con i tuoi amici in tempo reale! > http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Wed, 14 Feb 2007 22:30:17 -0400 > From: Oxiel Contreras <oxielc(a)yahoo.it> > Subject: [SOLVED] - Re: VLAN assigment and Alcatel Omniswitch 7800 > To: freeradius-users(a)lists.freeradius.org > Message-ID: <200702142230.18122.oxielc(a)yahoo.it> > Content-Type: text/plain; charset="iso-8859-15" > > Hello Santa. > > This worked great!!! > > I was doing 802.1x only, no AVLAN. > > For any soul out there trying to implement 802.1x with FreeRadius on > OpenSuSE10.1 and Omniswitch 7800 and Active Directory as taught on: > > http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO > > Take note of the following points: > > 1) If you use PEAP, install the patch from MS to Radius as noted on the > FAQ, > you need someone with Gold Support from M$ to get it or email me off the > list :) > > http://wiki.freeradius.org/FreeRADIUS_Wiki:FAQ#PEAP_Doesn.27t_Work > > 2) If PEAP is your election, install the CA and generate the certificates > on > the Radius server. > > 3) Modify the permissions of execution for the winbind daemon in order to > acomplish the ntlm_auth process, FIXME, now using root permissions. > > 4) Use Xylan-Auth-Group as VSA in /etc/raddb/users as the attribute for > assigning VLAN, or generate the new dictionary.alcatel as Santa Yeh > described > below, and then use Alcatel-Auth-Group as the attribute for VLAN > > 5) Use the setup for omniswitch as described below by Santa Yeh > > 6) Thank all these great people who develop and support this great > software. > > Thanks Alan, A.L.M., Jeremy, Marcel and Santa. > > Best regards > > Oxiel > > El Mi?rcoles, 14 de Febrero de 2007 11:19, Santa Yeh escribi?: > > > Hello Oxiel, > > > > Are you doing AVLAN or 802.1x? > > > > 1. I created a new file - dictionary.alcatel > > > > # > > # dictionary.alcatel > > # > > # Alcatel VSAs > > # > > > > VENDOR Alcatel 800 > > > > # > > # Standard attribute > > # > > ATTRIBUTE Alcatel-Auth-Group 1 integer Alcatel > > ATTRIBUTE Alcatel-Slot-Port 2 string Alcatel > > ATTRIBUTE Alcatel-Time-of-Day 3 string Alcatel > > ATTRIBUTE Alcatel-Client-IP-Addr 4 ipaddr Alcatel > > ATTRIBUTE Alcatel-Group-Desc 5 string Alcatel > > ATTRIBUTE Alcatel-Port-Desc 6 string Alcatel > > > > VALUE Acct-Authentic AUTH-AVCLIENT 4 > > VALUE Acct-Authentic AUTH-TELNET 5 > > VALUE Acct-Authentic AUTH-HTTP 6 > > > > 2. For users file > > > > user1 Auth-Type := Local, Password = "user1" > > Alcatel-Auth-Group = 3 > > > > 3. For AVLAN > > > > vlan 3 authentication enable > > vlan port mobile 1/1 bpdu ignore enable > > vlan port 1/1 authenticate enable > > ip interface vlan3 address 192.168.11.254 mask 255.255.255.0 vlan 3 > > aaa radius-server rad1 host 192.168.10.211 key radkey > > aaa authentication vlan single-mode rad1 > > aaa accounting vlan rad1 > > aaa avlan default dhcp 192.168.11.254 > > aaa avlan dns alcatel > > avlan 3 auth-ip 192.168.11.253 > > > > 4. For 802.1x (Sorry, just from my memory) > > > > vlan 3 802.1x enable > > vlan port mobile 1/1 bpdu ignore enable > > vlan port 1/1 802.1x enable > > ip interface vlan3 address 192.168.11.254 mask 255.255.255.0 vlan 3 > > aaa radius-server rad1 host 192.168.10.211 key radkey > > aaa authentication 802.1x rad1 > > aaa accounting 802/1x rad1 > Chiacchiera con i tuoi amici in tempo reale! > http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com > > > > ------------------------------ > > Message: 4 > Date: Thu, 15 Feb 2007 00:07:42 -0500 (EST) > From: "Gaddis, Jeremy L." <jeremy(a)linuxwiz.net> > Subject: Re: Simple security > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <Pine.LNX.4.64.0702150007130.26174(a)w00t.linuxwiz.net> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Wed, 14 Feb 2007, Scott Hughes wrote: > > I have friend that want some light security on the small network they > have (15-25 PCs). > > > > What is the best way to secure his network so that someone can't just > plug in his laptop and be on the network? He would prefer to make this > seamless to his users. > > 802.1X > > -- > Jeremy L. Gaddis, MCP, GCWN jeremy(a)linuxwiz.net > LinuxWiz Consulting http://linuxwiz.net > > > > > ------------------------------ > > Message: 5 > Date: Thu, 15 Feb 2007 18:09:04 +1300 > From: "VeNoMouS" <venom(a)gen-x.co.nz> > Subject: NAS-IP-Address in mysql > To: freeradius-users(a)lists.freeradius.org > Message-ID: <jdhnn4.lzlxf2(a)www.gen-x.co.nz> > Content-Type: text/plain; charset="iso-8859-1" > > Hi guys After doing some tests, I just discovered that I cant have more > then > one NAS-IP-Address in radgroupcheck (it seems to ignore the others) does > anyone know of a work around as i dont want to use the huntgroup file > (makes > it kinda anonying since im doing a web frontend for administration). > > > Cheers > > > > > ------------------------------ > > Message: 6 > Date: Thu, 15 Feb 2007 01:09:41 -0500 (EST) > From: "Dan Mahoney, System Admin" <danm(a)prime.gushi.org> > Subject: Re: NAS-IP-Address in mysql > To: venom(a)gen-x.co.nz, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20070215010842.M65264(a)prime.gushi.org> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Thu, 15 Feb 2007, VeNoMouS wrote: > > > Hi guys After doing some tests, I just discovered that I cant have more > then > > one NAS-IP-Address in radgroupcheck (it seems to ignore the others) does > > anyone know of a work around as i dont want to use the huntgroup file > (makes > > it kinda anonying since im doing a web frontend for administration). > > this is getting to be a really common question :) > > Yes, you need to embed the nas-ip-address as part of your query (in the > WHERE clause (same way as you match the username) so only the matching > items are returned. > > -Dan > > > > > > > Cheers > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > -- > > "I can feel it, comin' back again...Like a rolling thunder chasin' the > wind..." > > -Dan Mahoney, JS, JB & SL, May 10th, 1997, Approx 1AM > > --------Dan Mahoney-------- > Techie, Sysadmin, WebGeek > Gushi on efnet/undernet IRC > ICQ: 13735144 AIM: LarpGM > Site: http://www.gushi.org > --------------------------- > > > > ------------------------------ > > Message: 7 > Date: Thu, 15 Feb 2007 15:40:00 +0900 > From: "Cory Robson" <cory(a)cmi.net.au> > Subject: strip unwanted characters from reply message > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20070215063635.3AAD5104464(a)poseidon.gateway.net.au> > Content-Type: text/plain; charset="us-ascii" > > I have failed logins being dumped into a table in myslq and am getting a > lot > of unwanted characters. > > IE: Password Has Expired=5Cr=5Cn > > Is there a way I can tell it to only supply the textual content > > > Thanks > > > Cory > > > > ------------------------------ > > Message: 8 > Date: Thu, 15 Feb 2007 08:45:30 +0200 > From: "Ramazan Ulker" <ulkerra(a)gmail.com> > Subject: Re: a problem about radius and ldap [SOLVED] > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <79b4f8410702142245j263beef5vd8f15e1794b8c187(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi > Sorry for too many mails. Problem solved by setting identity and password > in > radius.conf with proper user in ldap. I managed to get User-Password from > ldap at the end as shown below. > > rlm_ldap: Added password ramazan in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: Adding userpassword as User-Password, value ramazan & op=21 > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, > value 2 & op=11 > rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & > op=11 > rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 > rlm_ldap: Adding radiusClass as Class, value employee & op=11 > rlm_ldap: user ramazan authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 1 > modcall: leaving group authorize (returns updated) for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/md5 > rlm_eap: processing type md5 > rlm_eap: Freeing handler > modcall[authenticate]: module "eap" returns ok for request 1 > modcall: leaving group authenticate (returns ok) for request 1 > Login OK: [ramazan/<no User-Password attribute>] (from client ldapsrv port > 50001 cli 00-12-79-AE-D2-4D) > On 1/29/07, Ramazan Ulker <ulkerra(a)gmail.com> wrote: > > > > > > > > Hi > > > > I'm working on 802.1x implementation(cisco 2950, freeradius, ldap), i > face > a problem. First of all, defining users and passwords in users file in > raddb > works well with md5 authentication. Then i tried to use ldap, then with > radtest i get accept-accept packet. But while authenticating from xp > client > with md5-challenge, I got > > > > Auth:rlm_ldap:Attribute "User-Password" is required for authentication > > > > error. In one of the e-mail you said don't authenticate from ldap, but > with radtest function i get success!!! The passwords are kept clear text. > I'm looking forward to getting your help. I also send radius debug log. > > > > Best Regards > > > > Ramazan > > > > > > > > > > > > Starting - reading configuration files ... > > > > reread_config: reading radiusd.conf > > > > Config: including file: /etc/raddb/proxy.conf > > > > Config: including file: /etc/raddb/clients.conf > > > > Config: including file: /etc/raddb/snmp.conf > > > > Config: including file: /etc/raddb/sql.conf > > > > main: prefix = "/usr" > > > > main: localstatedir = "/var" > > > > main: logdir = "/var/log/radius" > > > > main: libdir = "/usr/lib/freeradius" > > > > main: radacctdir = "/var/log/radius/radacct" > > > > main: hostname_lookups = no > > > > main: max_request_time = 30 > > > > main: cleanup_delay = 5 > > > > main: max_requests = 1024 > > > > main: delete_blocked_requests = 0 > > > > main: port = 0 > > > > main: allow_core_dumps = no > > > > main: log_stripped_names = yes > > > > main: log_file = "/var/log/radius/radius.log" > > > > main: log_auth = yes > > > > main: log_auth_badpass = yes > > > > main: log_auth_goodpass = yes > > > > main: pidfile = "/var/run/radiusd/radiusd.pid" > > > > main: user = "radiusd" > > > > main: group = "radiusd" > > > > main: usercollide = no > > > > main: lower_user = "no" > > > > main: lower_pass = "no" > > > > main: nospace_user = "no" > > > > main: nospace_pass = "no" > > > > main: checkrad = "/usr/sbin/checkrad" > > > > main: proxy_requests = yes > > > > proxy: retry_delay = 5 > > > > proxy: retry_count = 3 > > > > proxy: synchronous = no > > > > proxy: default_fallback = yes > > > > proxy: dead_time = 120 > > > > proxy: post_proxy_authorize = yes > > > > proxy: wake_all_if_all_dead = no > > > > security: max_attributes = 200 > > > > security: reject_delay = 1 > > > > security: status_server = no > > > > main: debug_level = 0 > > > > read_config_files: reading dictionary > > > > read_config_files: reading naslist > > > > read_config_files: reading clients > > > > read_config_files: reading realms > > > > radiusd: entering modules setup > > > > Module: Library search path is /usr/lib/freeradius > > > > Module: Loaded expr > > > > Module: Instantiated expr (expr) > > > > Module: Loaded PAP > > > > pap: encryption_scheme = "crypt" > > > > Module: Instantiated pap (pap) > > > > Module: Loaded CHAP > > > > Module: Instantiated chap (chap) > > > > Module: Loaded MS-CHAP > > > > mschap: use_mppe = yes > > > > mschap: require_encryption = no > > > > mschap: require_strong = no > > > > mschap: passwd = "(null)" > > > > mschap: authtype = "MS-CHAP" > > > > Module: Instantiated mschap (mschap) > > > > Module: Loaded System > > > > unix: cache = no > > > > unix: passwd = "(null)" > > > > unix: shadow = "(null)" > > > > unix: group = "(null)" > > > > unix: radwtmp = "/var/log/radius/radwtmp" > > > > unix: usegroup = no > > > > unix: cache_reload = 600 > > > > Module: Instantiated unix (unix) > > > > Module: Loaded LDAP > > > > ldap: server = "192.168.100.18" > > > > ldap: port = 389 > > > > ldap: net_timeout = 1 > > > > ldap: timeout = 4 > > > > ldap: timelimit = 3 > > > > ldap: identity = "" > > > > ldap: start_tls = no > > > > ldap: password = "" > > > > ldap: basedn = "dc=dot1x.com" > > > > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > > > > ldap: default_profile = "(null)" > > > > ldap: profile_attribute = "(null)" > > > > ldap: password_header = "(null)" > > > > ldap: password_attribute = "userPassword" > > > > ldap: access_attr = "radiusgroupname" > > > > ldap: groupname_attribute = "cn" > > > > ldap: groupmembership_filter = > > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > > > ldap: groupmembership_attribute = "radiusGroupName" > > > > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > > > > ldap: ldap_debug = 0 > > > > ldap: ldap_connections_number = 5 > > > > ldap: compare_check_items = no > > > > ldap: access_attr_used_for_allow = yes > > > > conns: (nil) > > > > rlm_ldap: reading ldap<->radius mappings from file > /etc/raddb/ldap.attrmap > > > > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > > > > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > > > > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > > > > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > > > > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > > > > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS > Calling-Station-Id > > > > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > > > > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > > > > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > > > > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > > > > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > > > > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > > > > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > > > > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > > > > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > > > > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > > > > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > > > > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > > > > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS > Framed-Compression > > > > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > > > > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > > > > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > > > > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > > > > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > > > > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS > Framed-IPX-Network > > > > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > > > > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > > > > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > > > > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS > Termination-Action > > > > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > > > > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > > > > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > > > > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > > > > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > > > > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > > > > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > > > > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > > > > rlm_ldap: LDAP userPassword mapped to RADIUS User-Password > > > > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > > > > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS > Tunnel-Medium-Type > > > > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS > Tunnel-Private-Group-Id > > > > conns: 0x8101f58 > > > > Module: Instantiated ldap (ldap) > > > > Module: Loaded eap > > > > eap: default_eap_type = "md5" > > > > eap: timer_expire = 60 > > > > rlm_eap: Loaded and initialized the type md5 > > > > rlm_eap: Loaded and initialized the type leap > > > > Module: Instantiated eap (eap) > > > > Module: Loaded preprocess > > > > preprocess: huntgroups = "/etc/raddb/huntgroups" > > > > preprocess: hints = "/etc/raddb/hints" > > > > preprocess: with_ascend_hack = no > > > > preprocess: ascend_channels_per_line = 23 > > > > preprocess: with_ntdomain_hack = no > > > > preprocess: with_specialix_jetstream_hack = no > > > > preprocess: with_cisco_vsa_hack = no > > > > Module: Instantiated preprocess (preprocess) > > > > Module: Loaded realm > > > > realm: format = "suffix" > > > > realm: delimiter = "@" > > > > Module: Instantiated realm (suffix) > > > > Module: Loaded files > > > > files: usersfile = "/etc/raddb/users" > > > > files: acctusersfile = "/etc/raddb/acct_users" > > > > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > > > > files: compat = "no" > > > > Module: Instantiated files (files) > > > > Module: Loaded Acct-Unique-Session-Id > > > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port-Id" > > > > Module: Instantiated acct_unique (acct_unique) > > > > Module: Loaded detail > > > > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > > > detail: detailperm = 384 > > > > detail: dirperm = 493 > > > > detail: locking = no > > > > Module: Instantiated detail (detail) > > > > Module: Loaded radutmp > > > > radutmp: filename = "/var/log/radius/radutmp" > > > > radutmp: username = "%{User-Name}" > > > > radutmp: case_sensitive = yes > > > > radutmp: check_with_nas = yes > > > > radutmp: perm = 384 > > > > radutmp: callerid = yes > > > > Module: Instantiated radutmp (radutmp) > > > > Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on > 1814/udp. > > > > Ready to process requests. > > > > rad_recv: Access-Request packet from host 192.168.100.17:1812, id=11, > length=129 > > > > NAS-IP-Address = 192.168.100.17 > > > > NAS-Port = 50001 > > > > NAS-Port-Type = Ethernet > > > > User-Name = "ramazan" > > > > Called-Station-Id = "00-0F-8F-77-DB-81" > > > > Calling-Station-Id = "00-12-79-AE-D2-4D" > > > > Service-Type = Framed-User > > > > Framed-MTU = 1500 > > > > EAP-Message = 0x0200000c0172616d617a616e > > > > Message-Authenticator = 0x68c41631d4feb2234d900b37a9845348 > > > > modcall: entering group authorize for request 0 > > > > modcall[authorize]: module "preprocess" returns ok for request 0 > > > > modcall[authorize]: module "chap" returns noop for request 0 > > > > rlm_eap: EAP packet type notification id 0 length 12 > > > > rlm_eap: EAP Start not found > > > > modcall[authorize]: module "eap" returns updated for request 0 > > > > rlm_realm: No '@' in User-Name = "ramazan", looking up realm NULL > > > > rlm_realm: No such realm "NULL" > > > > modcall[authorize]: module "suffix" returns noop for request 0 > > > > users: Matched DEFAULT at 152 > > > > rlm_ldap: Entering ldap_groupcmp() > > > > radius_xlat: 'dc=dot1x.com' > > > > radius_xlat: '(uid=ramazan)' > > > > ldap_get_conn: Got Id: 0 > > > > rlm_ldap: attempting LDAP reconnection > > > > rlm_ldap: (re)connect to 192.168.100.18:389, authentication 0 > > > > rlm_ldap: bind as / to 192.168.100.18:389 > > > > rlm_ldap: waiting for bind result ... > > > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > > > ldap_release_conn: Release Id: 0 > > > > radius_xlat: > '(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= > dot1x.com > ))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= > dot1x.com)))' > > > > ldap_get_conn: Got Id: 0 > > > > rlm_ldap: performing search in dc=dot1x.com, with filter > > (&(cn=VPN)(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= > dot1x.com > ))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= > dot1x.com)))) > > > > rlm_ldap: object not found or got ambiguous search result > > > > ldap_release_conn: Release Id: 0 > > > > ldap_get_conn: Got Id: 0 > > > > rlm_ldap: performing search in uid=ramazan,cn=users,cn=idc,dc=dot1x.com, > with filter (objectclass=*) > > > > rlm_ldap::ldap_groupcmp: User found in group VPN > > > > ldap_release_conn: Release Id: 0 > > > > users: Matched DEFAULT at 171 > > > > modcall[authorize]: module "files" returns ok for request 0 > > > > modcall[authorize]: module "mschap" returns noop for request 0 > > > > rlm_ldap: - authorize > > > > rlm_ldap: performing user authorization for ramazan > > > > radius_xlat: '(uid=ramazan)' > > > > radius_xlat: 'dc=dot1x.com' > > > > ldap_get_conn: Got Id: 0 > > > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > > > rlm_ldap: checking if remote access for ramazan is allowed by > radiusgroupname > > > > rlm_ldap: looking for check items in directory... > > > > rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 > > > > rlm_ldap: looking for reply items in directory... > > > > rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, > value 2 & op=11 > > > > rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & > op=11 > > > > rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 > > > > rlm_ldap: Adding radiusClass as Class, value group-net & op=11 > > > > rlm_ldap: user ramazan authorized to use remote access > > > > ldap_release_conn: Release Id: 0 > > > > modcall[authorize]: module "ldap" returns ok for request 0 > > > > modcall: group authorize returns updated for request 0 > > > > rad_check_password: Found Auth-Type ldap > > > > auth: type "LDAP" > > > > modcall: entering group Auth-Type for request 0 > > > > rlm_ldap: - authenticate > > > > rlm_ldap: Attribute "User-Password" is required for authentication. > > > > modcall[authenticate]: module "ldap" returns invalid for request 0 > > > > modcall: group Auth-Type returns invalid for request 0 > > > > auth: Failed to validate the user. > > > > Login incorrect: [ramazan/<no User-Password attribute>] (from client > radius port 50001 cli 00-12-79-AE-D2-4D) > > > > Delaying request 0 for 1 seconds > > > > Finished request 0 > > > > Going to the next request > > > > --- Walking the entire request list --- > > > > Waking up in 1 seconds... > > > > --- Walking the entire request list --- > > > > Waking up in 1 seconds... > > > > --- Walking the entire request list --- > > > > Sending Access-Reject of id 11 to 192.168.100.17:1812 > > > > Waking up in 4 seconds... > > >

6 7

clients.conf vs rlm_sql table nas
by VeNoMouS 17 Feb '07

17 Feb '07

Hi guys I was just wondering why we have a nas table in mysql when it doesn't act like clients.conf ive tried putting nas details into the nas config with out any nas's in clients.conf but radius does not start so, what is the nas table actually for then?

2 3

hi
by adnan khan 17 Feb '07

17 Feb '07

hi sir , i hope you are all fine , sir i don't found dictionary.tunnel file , what can i do , because i have to add the users on the different vlan , with out this file (dictionary.tunnel) can i add the users on different vlan looking forward to hear from you regards adnan ____________________________________________________________________________________ Don't get soaked. Take a quick peak at the forecast with the Yahoo! Search weather shortcut. http://tools.search.yahoo.com/shortcuts/#loc_weather

2 1