- Freeradius-Users - lists.freeradius.org

NAS-IP-Address in mysql
by VeNoMouS 15 Feb '07

15 Feb '07

Hi guys After doing some tests, I just discovered that I cant have more then one NAS-IP-Address in radgroupcheck (it seems to ignore the others) does anyone know of a work around as i dont want to use the huntgroup file (makes it kinda anonying since im doing a web frontend for administration). Cheers

3 2

VLAN assigment and Alcatel Omniswitch 7800
by Oxiel Contreras 15 Feb '07

15 Feb '07

Helo gurus. I'm new to radius, but willing to learn :) Using OpenSuSE 10.1 and freeradius-1.1.0-19 and Windows2K as AD and Alcatel Omniswitch 7800 with 802.1x and Port Mobility features enabled. I've followed the steps from: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO The authentication of WindowsXP Supplicants with EAP/PEAP is working great, now i need to assign VLANs to this setup, i've searched the list and google and found this setting for /etc/raddb/users: jose Auth-Type == EAP Tunnel-Type += VLAN, Tunnel-Medium-Type += IEEE-802, Tunnel-Private-Group-Id += 3 But the port is never assigned to VLAN 3 for the user "jose". Is it possible to assign VLAN's with Alcatel ? Do i need any extra license ? Anybody have this running ? It seems to me, that the VLAN parameters are never returned to the switch in the Access-Accept parth of this the result from radiusd -X. oxiel:/etc/raddb # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --username=%{mschap:User-Name} --request-nt-key --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.20:1067, id=206, length=91 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 NAS-Port = 85 EAP-Message = 0x020200150153414755415041435c616d6730383731 Message-Authenticator = 0x4857fea61c5a9d66c114985dba27c8a2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 206 to 192.168.10.20 port 1067 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d6d6f0ddf48bb99c12194dfda4a1c27 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=207, length=168 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x9d6d6f0ddf48bb99c12194dfda4a1c27 NAS-Port = 85 EAP-Message = 0x0203005019800000004616030100410100003d030145c3b7635173ec271fb507e42e9738c3b4f164ffc4085f6bac9ecda83ac963b300001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xb2fbd984a0e1f39320472d32182a9a49 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06e3], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 207 to 192.168.10.20 port 1067 EAP-Message = 0x0104040a19c000000740160301004a02000046030145c3b9289f95159048307de2e5d8706c092897f0ec1ac572005c17e96e26ec7f20a28e7c07be63f2cc73041f94a317f13932b2fbd6a5fe5871ef5c48cc5f66e0e500040016030106e30b0006df0006dc0002e3308202df30820248a003020102020104300d06092a864886f70d01010505003081ac310b300906035504061302424f311330110603550408130a53616e7461204372757a311c301a0603550407131353616e7461204372757a202d204369756461643111300f060355040a130853616775617061633111300f060355040b130853697374656d6173311630140603550403130d6164 EAP-Message = 0x6d696e6973747261746f72312c302a06092a864886f70d010901161d6d656e64657a2e616e647265734073616775617061632e636f6d2e626f301e170d3036313233303030323231335a170d3037313233303030323231335a3081a4310b300906035504061302424f311330110603550408130a53616e7461204372757a311c301a0603550407131353616e7461204372757a202d204369756461643111300f060355040a130853616775617061633111300f060355040b130853697374656d6173310e300c060355040313056f7869656c312c302a06092a864886f70d010901161d6d656e64657a2e616e647265734073616775617061632e636f6d EAP-Message = 0x2e626f30819f300d06092a864886f70d010101050003818d0030818902818100d4bffbbfb022a7f958b349e687938d4957a97ad7bcafb5809650d765d01756a5c00de2e70f2e8f85b11be4b9e5bef2f3ae9f1d3b0621c220b8797d1ed166e7d9a8ebeafd94917c202578632e6995ec7d71af019b0672b0b2954a482b2b692d8ddac2f4b90920f694eca2108d5cdf2a56819b7066ca84d93ce7daf81d9622850f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181004377bcfc4439739f4796cfe2f00c81d6ec2b59daf43c6e6d84c379e650ee50979acce1fff0f9b8ff2b5f4ea4 EAP-Message = 0xb0ecde0f2330b714b271df9698fdcd756f12cd137889646279b9a6f4ee7093e2dafaaa875395a366bbf9f874bad9f3ebab34b626168e0d0f3c2618916e2da198e8bccbd5ba4ad4e1370b00108e78beabfff3a0410003f3308203ef30820358a0030201020209009c7ed6d4d9c27eca300d06092a864886f70d01010505003081ac310b300906035504061302424f311330110603550408130a53616e7461204372757a311c301a0603550407131353616e7461204372757a202d204369756461643111300f060355040a130853616775617061633111300f060355040b130853697374656d6173311630140603550403130d61646d696e697374726174 EAP-Message = 0x6f72312c302a06092a864886f70d010901161d6d656e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f79572080cc5e023f870a7ff061f9c0 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=208, length=94 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x3f79572080cc5e023f870a7ff061f9c0 NAS-Port = 85 EAP-Message = 0x020400061900 Message-Authenticator = 0x7b66c08480bde9c011c3ea836c8c7d4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 208 to 192.168.10.20 port 1067 EAP-Message = 0x01050346190064657a2e616e647265734073616775617061632e636f6d2e626f301e170d3036313233303030323130395a170d3038313232393030323130395a3081ac310b300906035504061302424f311330110603550408130a53616e7461204372757a311c301a0603550407131353616e7461204372757a202d204369756461643111300f060355040a130853616775617061633111300f060355040b130853697374656d6173311630140603550403130d61646d696e6973747261746f72312c302a06092a864886f70d010901161d6d656e64657a2e616e647265734073616775617061632e636f6d2e626f30819f300d06092a864886f70d01 EAP-Message = 0x0101050003818d0030818902818100a7ac18689f583d3798fa66644e9a0779f600d95e1e22398818f6ae4e7237c9876bb1dcff55570a031544606660d7b641cd09cdd8f6d0fae1ad005631f6139ee924aa795047fc9a5ec9960fafbea87111b8a78e84b940685d65fe8ab8643ba8b43c8268198966f013a744b159786e0d7e4b47ee15777ec7c2e74dad5f055787d30203010001a382011530820111301d0603551d0e041604148e06fc719eca87d27e9e33510370513812b461ce3081e10603551d230481d93081d680148e06fc719eca87d27e9e33510370513812b461cea181b2a481af3081ac310b300906035504061302424f3113301106035504 EAP-Message = 0x08130a53616e7461204372757a311c301a0603550407131353616e7461204372757a202d204369756461643111300f060355040a130853616775617061633111300f060355040b130853697374656d6173311630140603550403130d61646d696e6973747261746f72312c302a06092a864886f70d010901161d6d656e64657a2e616e647265734073616775617061632e636f6d2e626f8209009c7ed6d4d9c27eca300c0603551d13040530030101ff300d06092a864886f70d0101050500038181004ea0901bc63f1d9e4e65fe67fca6dc432b009e35d3939dedb0c6b4910f8920a1404562099fa54a30a4169807aae290c93f2188d8b808696875ba EAP-Message = 0xab8df4968fc8672f948da1000b3a59aa766c9fa48b42a5fc5534a209c0db7bd21c1732f0377e94fe2ec09f619eb1c939d2a4275f6b812050d32901b820ff1cc88e7c0b21e5e316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06b3a931efea56a67d3b12175eeadfc0 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=209, length=280 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x06b3a931efea56a67d3b12175eeadfc0 NAS-Port = 85 EAP-Message = 0x020500c01980000000b616030100861000008200800d59b5ba20edb2d54cd0d56be84aa6133a0b2628cd1ca03c0254343106a80a06ae14b39969a0feb9613d84a85a14917f95379ec54a8754d4808477557e179694065ac61dbe7841ae33223f2f8d1976886ca4f3b54e942c3fb697ba293a8fedf822348fd2c4c0a68505f1c6b67878d5c31cb5663fdd5e976675fce1ed3421e55c1403010001011603010020e023e4faf2cc10f4334474ed9751c5a959ffc9241ea03e2bf209c5f29cd8a2c3 Message-Authenticator = 0x11546e4b95a7e95f3dfdeb0f29124125 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 209 to 192.168.10.20 port 1067 EAP-Message = 0x0106003119001403010001011603010020f67af346039e8ee2405b3764ad5f918dfe61c4af3546e8ad1dd15bd21ca0d376 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x917ea9cbbe5c65d8ed6bff5fdcca7db7 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=210, length=94 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x917ea9cbbe5c65d8ed6bff5fdcca7db7 NAS-Port = 85 EAP-Message = 0x020600061900 Message-Authenticator = 0xa8af04dbd0c91ab153eacfb1b8b1f172 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 210 to 192.168.10.20 port 1067 EAP-Message = 0x01070020190017030100156bd5621bae4fb38c5dbe91e2c3b6c323cf23571705 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x98187c2d49a89527610d15cdff70fff3 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=211, length=132 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x98187c2d49a89527610d15cdff70fff3 NAS-Port = 85 EAP-Message = 0x0207002c19001703010021016436b91df2958d8e27a515af65591aa2c33e93d338a338ff2c309d65ff914296 Message-Authenticator = 0xaaadbac57d1774f3ce893f338f253858 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 44 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - MYDOMAIN\jose rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of MYDOMAIN\jose PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to MYDOMAIN\jose Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 211 to 192.168.10.20 port 1067 EAP-Message = 0x010800411900170301003630ab9d3435ef1d9c7dc7e6f242cd9270664e0e0fb207b960deb02b81bcd1b744a3888a0a56fe498640433309cac513a1bf3aa1674bde Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a92e7a96eacd44d4fd1ff63e908e9e2 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=212, length=186 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x7a92e7a96eacd44d4fd1ff63e908e9e2 NAS-Port = 85 EAP-Message = 0x0208006219001703010057df9dbbc7ef4684b090bdc706cd290f6f1fef65e3cdbb93aa0b1577dede1e9be3922c12e5af05e556bd3f9802d88d1c591ae180857fc263931b085e38adfdfe9d52508d6475a8b1b95de28fcd44329a3c916a40863eb07d Message-Authenticator = 0xcefaa60b5f32ef01b79a062ee8e8f3fe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 98 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to MYDOMAIN\jose PEAP: Adding old state with 3c ec Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 75 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for jose with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: a9 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --username=jose --request-nt-key --domain=MYDOMAIN --challenge=23482ae45d3e185d --nt-response=144c32fdf284bad9c7d9d789db878b80428eaa7ad9ae1a42' Exec-Program: /usr/bin/ntlm_auth --username=jose --request-nt-key --domain=MYDOMAIN --challenge=23482ae45d3e185d --nt-response=144c32fdf284bad9c7d9d789db878b80428eaa7ad9ae1a42 Exec-Program output: NT_KEY: 0A83D7C2B162B94C31CE636B6CA6ECCC Exec-Program-Wait: plaintext: NT_KEY: 0A83D7C2B162B94C31CE636B6CA6ECCC Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 6 modcall: leaving group MS-CHAP (returns ok) for request 6 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 212 to 192.168.10.20 port 1067 EAP-Message = 0x0109004a1900170301003fb564a89db69f923da3b09305d5b6869317541502643d9f145c8d9a34b6b85d9665ebfc45825ac25a188472d3c2f691811a34f54f2d7b08242e961c2592bc38 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3be7bff9e8a4a52effea7ebb58c23d24 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=213, length=117 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x3be7bff9e8a4a52effea7ebb58c23d24 NAS-Port = 85 EAP-Message = 0x0209001d19001703010012f357dcf3cd2394e7337a3b0eaaa702c74609 Message-Authenticator = 0x022702d1f3f76c72f2b4d875449abc97 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to MYDOMAIN\jose PEAP: Adding old state with 6b 13 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: leaving group authenticate (returns ok) for request 7 PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 213 to 192.168.10.20 port 1067 EAP-Message = 0x010a00261900170301001b37f4320b69bebda8e841f4a55f6b41d84be0b529cb34d5a4357b38 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5597f1b859aff68c52dff25df3151a93 Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.10.20:1067, id=214, length=126 User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 State = 0x5597f1b859aff68c52dff25df3151a93 NAS-Port = 85 EAP-Message = 0x020a00261900170301001beac5a6d4d8702084479528a2ebd32267a4b66e9fbfef2b28315132 Message-Authenticator = 0x1f655acb0e50dfe0dd70edac651c8093 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 161 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 214 to 192.168.10.20 port 1067 MS-MPPE-Recv-Key = 0x0206f3af33e5e4224da7e663dfc79d8ff204c559d839a39343e1c91ad4198502 MS-MPPE-Send-Key = 0xae765f9bcca046bb7be43f55bbb5673120009c23275ed77f1526cef3639e3272 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "MYDOMAIN\\jose" Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 192.168.10.20:1067, id=215, length=82 Acct-Status-Type = Start User-Name = "MYDOMAIN\\jose" NAS-IP-Address = 192.168.10.20 Acct-Session-Id = "0015c5551a97" NAS-Port = 85 Xylan-Slot-Port = "3/17" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 9 modcall[preacct]: module "preprocess" returns noop for request 9 rlm_acct_unique: Hashing 'NAS-Port = 85,Client-IP-Address = 192.168.10.20,NAS-IP-Address = 192.168.10.20,Acct-Session-Id = "0015c5551a97",User-Name = "MYDOMAIN\\jose"' rlm_acct_unique: Acct-Unique-Session-ID = "eed7faa245223d13". modcall[preacct]: module "acct_unique" returns ok for request 9 rlm_realm: No '@' in User-Name = "MYDOMAIN\jose", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 9 modcall[preacct]: module "files" returns noop for request 9 modcall: leaving group preacct (returns ok) for request 9 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 9 radius_xlat: '/var/log/radius/radacct/192.168.10.20/detail-20070202' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.10.20/detail-20070202 modcall[accounting]: module "detail" returns ok for request 9 modcall[accounting]: module "unix" returns ok for request 9 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'MYDOMAIN\\jose' modcall[accounting]: module "radutmp" returns ok for request 9 modcall: leaving group accounting (returns ok) for request 9 Sending Accounting-Response of id 215 to 192.168.10.20 port 1067 Finished request 9 Going to the next request Cleaning up request 9 ID 215 with timestamp 45c3b928 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 206 with timestamp 45c3b928 Cleaning up request 1 ID 207 with timestamp 45c3b928 Cleaning up request 2 ID 208 with timestamp 45c3b928 Cleaning up request 3 ID 209 with timestamp 45c3b928 Cleaning up request 4 ID 210 with timestamp 45c3b928 Cleaning up request 5 ID 211 with timestamp 45c3b928 Cleaning up request 6 ID 212 with timestamp 45c3b928 Cleaning up request 7 ID 213 with timestamp 45c3b928 Cleaning up request 8 ID 214 with timestamp 45c3b928 Nothing to do. Sleeping until we see a request. Thanks and best regards to all of you. Oxiel Chiacchiera con i tuoi amici in tempo reale! http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com

6 13

Re: Problems regarding MAC address authentication
by Shobhit Jindal 15 Feb '07

15 Feb '07

yeah upgrading is high on my list :) rlm_passwd says it provides authorization via files but i need it via LDAP. I didnt get much from your reply, here's what am doing presently plz suggest how should i proceed. ********************************************************************************************************* LDAP user: dn: uid=ashimece,cn=Ece08,cn=Students,dc=itweb uid: ashimece userPassword: jindal objectClass: account objectClass: simpleSecurityObject objectClass: top objectClass: radiusprofile cn: Ashim Dutta radiusCallingStationId: 00-90-4B-ED-AB-52 Logs of authentication : ********************************************************************************************************* when MAC ID is correct Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.9.1.2:1088, id=8, length=249 Message-Authenticator = 0x1aefde709d0282b89e74ef5d2df3e4ac Service-Type = Framed-User User-Name = "ashimece" Framed-MTU = 1488 State = 0xefc4f78cf9a0a3f62c93cd748bf36547 Called-Station-Id = "00-15-E9-C9-5F-C0: Dr.CVR24" Calling-Station-Id = "00-90-4B-ED-AB-52" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001bb0362047836069aff6d4a653b9d47e05dcaa105bfa0926b49c0ab2 NAS-IP-Address = 10.9.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "chap" returns noop for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "ashimece", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 18 rlm_ldap: - authorize rlm_ldap: performing user authorization for ashimece radius_xlat: '(uid=ashimece)' radius_xlat: 'dc=itweb' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=itweb, with filter (uid=ashimece) rlm_ldap: checking if remote access for ashimece is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-90-4B-ED-AB-52 & op=21 rlm_ldap: Adding userPassword as User-Password, value jindal & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user ashimece authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 18 modcall: group authorize returns updated for request 18 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 18 modcall: group authenticate returns ok for request 18 Sending Access-Accept of id 8 to 10.9.1.2:1088 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0xfdd87b133b79449727654aa3a681ee48d891ee6ff1685344159acbc3ff02d820 MS-MPPE-Send-Key = 0xdcbb432b81d40d6e1d189527a911932a7b161f8b68ba2ee06e862c455967699e EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ashimece" Finished request 18 Going to the next request Waking up in 6 seconds... ********************************************************************************************************* when MAC ID is *NOT* correct but is authenticated successfully Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.9.1.2:1088, id=17, length=249 Message-Authenticator = 0xaab5be28b7a3198b4432458ae62e1905 Service-Type = Framed-User User-Name = "ashimece" Framed-MTU = 1488 State = 0xdfdb9e22d8d2452e0a4c3daf52e757f6 Called-Station-Id = "00-15-E9-C9-5F-C0:Dr.CVR24" Calling-Station-Id = " 00-90-4B-ED-AB-52" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x021100261900170301001ba1bc4bf393dc67e00b5d456b4eda44e73fdef7b14ba0558ecbe493 NAS-IP-Address = 10.9.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 27 modcall[authorize]: module "preprocess" returns ok for request 27 modcall[authorize]: module "chap" returns noop for request 27 modcall[authorize]: module "mschap" returns noop for request 27 rlm_realm: No '@' in User-Name = "ashimece", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 27 rlm_eap: EAP packet type response id 17 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 27 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 27 rlm_ldap: - authorize rlm_ldap: performing user authorization for ashimece radius_xlat: '(uid=ashimece)' radius_xlat: 'dc=itweb' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=itweb, with filter (uid=ashimece) rlm_ldap: checking if remote access for ashimece is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-90-4B-ED-AB-00 & op=21 rlm_ldap: Adding userPassword as User-Password, value jindal & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user ashimece authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 27 modcall: group authorize returns updated for request 27 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 27 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 27 modcall: group authenticate returns ok for request 27 Sending Access-Accept of id 17 to 10.9.1.2:1088 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x777bb3e1d089ab4d06e5d17cc4e75e1ce71c8a31f7ac06cf193ac2aca893eca9 MS-MPPE-Send-Key = 0x485bd639e4f35fb4fe39fe954d6a1959f3d25f149b53d22c180716bac82abac9 EAP-Message = 0x03110004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ashimece" Finished request 27 Going to the next request Waking up in 5 seconds... ********************************************************************************************************* when MAC ID is correct BUT ldap *filter* is changed from uid to radiusCallingStationId but is *NOT* authenticated Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.9.1.2:1089, id=7, length=249 Message-Authenticator = 0xef805c6611b81ccd4e57f0a01b5a56b2 Service-Type = Framed-User User-Name = "ashimece" Framed-MTU = 1488 State = 0xaf77bba9c6823b2507d129594c59a524 Called-Station-Id = "00-15-E9-C9-5F-C0: Dr.CVR24" Calling-Station-Id = "00-90-4B-ED-AB-52" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001bd7bb65c7f80981315f61ec2779f602c81f4ec09c0c92babb82aacb NAS-IP-Address = 10.9.1.2 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: No '@' in User-Name = "ashimece", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 15 rlm_ldap: - authorize rlm_ldap: performing user authorization for ashimece radius_xlat: '(radiusCallingStationId=00-90-4B-ED-AB-52)' radius_xlat: 'dc=itweb' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=itweb, with filter (radiusCallingStationId=00-90-4B-ED-AB-52) rlm_ldap: checking if remote access for ashimece is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-90-4B-ED-AB-52 & op=21 rlm_ldap: Adding userPassword as User-Password, value jindal & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user ashimece authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 15 modcall: group authorize returns updated for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 15 modcall: group authenticate returns invalid for request 15 auth: Failed to validate the user. Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 6 seconds... -- Registerd Linux User #426561 - Shobhit Jindal B.Tech. Part-III, Department Of Electronics Engineering, ITBHU INDIA

2 4

Re: a problem about radius and ldap [SOLVED]
by Ramazan Ulker 15 Feb '07

15 Feb '07

Hi Sorry for too many mails. Problem solved by setting identity and password in radius.conf with proper user in ldap. I managed to get User-Password from ldap at the end as shown below. rlm_ldap: Added password ramazan in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userpassword as User-Password, value ramazan & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusClass as Class, value employee & op=11 rlm_ldap: user ramazan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Login OK: [ramazan/<no User-Password attribute>] (from client ldapsrv port 50001 cli 00-12-79-AE-D2-4D) On 1/29/07, Ramazan Ulker <ulkerra(a)gmail.com> wrote: > > > > Hi > > I'm working on 802.1x implementation(cisco 2950, freeradius, ldap), i face a problem. First of all, defining users and passwords in users file in raddb works well with md5 authentication. Then i tried to use ldap, then with radtest i get accept-accept packet. But while authenticating from xp client with md5-challenge, I got > > Auth:rlm_ldap:Attribute "User-Password" is required for authentication > > error. In one of the e-mail you said don't authenticate from ldap, but with radtest function i get success!!! The passwords are kept clear text. I'm looking forward to getting your help. I also send radius debug log. > > Best Regards > > Ramazan > > > > > > Starting - reading configuration files ... > > reread_config: reading radiusd.conf > > Config: including file: /etc/raddb/proxy.conf > > Config: including file: /etc/raddb/clients.conf > > Config: including file: /etc/raddb/snmp.conf > > Config: including file: /etc/raddb/sql.conf > > main: prefix = "/usr" > > main: localstatedir = "/var" > > main: logdir = "/var/log/radius" > > main: libdir = "/usr/lib/freeradius" > > main: radacctdir = "/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = yes > > main: log_file = "/var/log/radius/radius.log" > > main: log_auth = yes > > main: log_auth_badpass = yes > > main: log_auth_goodpass = yes > > main: pidfile = "/var/run/radiusd/radiusd.pid" > > main: user = "radiusd" > > main: group = "radiusd" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/sbin/checkrad" > > main: proxy_requests = yes > > proxy: retry_delay = 5 > > proxy: retry_count = 3 > > proxy: synchronous = no > > proxy: default_fallback = yes > > proxy: dead_time = 120 > > proxy: post_proxy_authorize = yes > > proxy: wake_all_if_all_dead = no > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > > read_config_files: reading dictionary > > read_config_files: reading naslist > > read_config_files: reading clients > > read_config_files: reading realms > > radiusd: entering modules setup > > Module: Library search path is /usr/lib/freeradius > > Module: Loaded expr > > Module: Instantiated expr (expr) > > Module: Loaded PAP > > pap: encryption_scheme = "crypt" > > Module: Instantiated pap (pap) > > Module: Loaded CHAP > > Module: Instantiated chap (chap) > > Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: passwd = "(null)" > > mschap: authtype = "MS-CHAP" > > Module: Instantiated mschap (mschap) > > Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > > Module: Instantiated unix (unix) > > Module: Loaded LDAP > > ldap: server = "192.168.100.18" > > ldap: port = 389 > > ldap: net_timeout = 1 > > ldap: timeout = 4 > > ldap: timelimit = 3 > > ldap: identity = "" > > ldap: start_tls = no > > ldap: password = "" > > ldap: basedn = "dc=dot1x.com" > > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > > ldap: default_profile = "(null)" > > ldap: profile_attribute = "(null)" > > ldap: password_header = "(null)" > > ldap: password_attribute = "userPassword" > > ldap: access_attr = "radiusgroupname" > > ldap: groupname_attribute = "cn" > > ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > ldap: groupmembership_attribute = "radiusGroupName" > > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > > ldap: ldap_debug = 0 > > ldap: ldap_connections_number = 5 > > ldap: compare_check_items = no > > ldap: access_attr_used_for_allow = yes > > conns: (nil) > > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link > > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network > > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone > > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > > rlm_ldap: LDAP userPassword mapped to RADIUS User-Password > > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type > > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id > > conns: 0x8101f58 > > Module: Instantiated ldap (ldap) > > Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > rlm_eap: Loaded and initialized the type md5 > > rlm_eap: Loaded and initialized the type leap > > Module: Instantiated eap (eap) > > Module: Loaded preprocess > > preprocess: huntgroups = "/etc/raddb/huntgroups" > > preprocess: hints = "/etc/raddb/hints" > > preprocess: with_ascend_hack = no > > preprocess: ascend_channels_per_line = 23 > > preprocess: with_ntdomain_hack = no > > preprocess: with_specialix_jetstream_hack = no > > preprocess: with_cisco_vsa_hack = no > > Module: Instantiated preprocess (preprocess) > > Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > Module: Instantiated realm (suffix) > > Module: Loaded files > > files: usersfile = "/etc/raddb/users" > > files: acctusersfile = "/etc/raddb/acct_users" > > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > > files: compat = "no" > > Module: Instantiated files (files) > > Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" > > Module: Instantiated acct_unique (acct_unique) > > Module: Loaded detail > > detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > > Module: Instantiated detail (detail) > > Module: Loaded radutmp > > radutmp: filename = "/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > > Module: Instantiated radutmp (radutmp) > > Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp. > > Ready to process requests. > > rad_recv: Access-Request packet from host 192.168.100.17:1812, id=11, length=129 > > NAS-IP-Address = 192.168.100.17 > > NAS-Port = 50001 > > NAS-Port-Type = Ethernet > > User-Name = "ramazan" > > Called-Station-Id = "00-0F-8F-77-DB-81" > > Calling-Station-Id = "00-12-79-AE-D2-4D" > > Service-Type = Framed-User > > Framed-MTU = 1500 > > EAP-Message = 0x0200000c0172616d617a616e > > Message-Authenticator = 0x68c41631d4feb2234d900b37a9845348 > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > rlm_eap: EAP packet type notification id 0 length 12 > > rlm_eap: EAP Start not found > > modcall[authorize]: module "eap" returns updated for request 0 > > rlm_realm: No '@' in User-Name = "ramazan", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > users: Matched DEFAULT at 152 > > rlm_ldap: Entering ldap_groupcmp() > > radius_xlat: 'dc=dot1x.com' > > radius_xlat: '(uid=ramazan)' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: attempting LDAP reconnection > > rlm_ldap: (re)connect to 192.168.100.18:389, authentication 0 > > rlm_ldap: bind as / to 192.168.100.18:389 > > rlm_ldap: waiting for bind result ... > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > ldap_release_conn: Release Id: 0 > > radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in dc=dot1x.com, with filter (&(cn=VPN)(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))) > > rlm_ldap: object not found or got ambiguous search result > > ldap_release_conn: Release Id: 0 > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in uid=ramazan,cn=users,cn=idc,dc=dot1x.com, with filter (objectclass=*) > > rlm_ldap::ldap_groupcmp: User found in group VPN > > ldap_release_conn: Release Id: 0 > > users: Matched DEFAULT at 171 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_ldap: - authorize > > rlm_ldap: performing user authorization for ramazan > > radius_xlat: '(uid=ramazan)' > > radius_xlat: 'dc=dot1x.com' > > ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) > > rlm_ldap: checking if remote access for ramazan is allowed by radiusgroupname > > rlm_ldap: looking for check items in directory... > > rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 > > rlm_ldap: looking for reply items in directory... > > rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 > > rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 > > rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 > > rlm_ldap: Adding radiusClass as Class, value group-net & op=11 > > rlm_ldap: user ramazan authorized to use remote access > > ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns ok for request 0 > > modcall: group authorize returns updated for request 0 > > rad_check_password: Found Auth-Type ldap > > auth: type "LDAP" > > modcall: entering group Auth-Type for request 0 > > rlm_ldap: - authenticate > > rlm_ldap: Attribute "User-Password" is required for authentication. > > modcall[authenticate]: module "ldap" returns invalid for request 0 > > modcall: group Auth-Type returns invalid for request 0 > > auth: Failed to validate the user. > > Login incorrect: [ramazan/<no User-Password attribute>] (from client radius port 50001 cli 00-12-79-AE-D2-4D) > > Delaying request 0 for 1 seconds > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Sending Access-Reject of id 11 to 192.168.100.17:1812 > > Waking up in 4 seconds... >

1 0

strip unwanted characters from reply message
by Cory Robson 15 Feb '07

15 Feb '07

I have failed logins being dumped into a table in myslq and am getting a lot of unwanted characters. IE: Password Has Expired=5Cr=5Cn Is there a way I can tell it to only supply the textual content Thanks Cory

1 0

Multiple SSL CA Files
by Michael Courtney 15 Feb '07

15 Feb '07

Freeradius List, I have Freeradius 1.1.3 running on a Fedora Core 6 box, and it works great in the current setup. My question has to do with a configuration change that I'm having trouble implementing. Right now, I have an in-house CA Cert that was generated for our servers that sit behind a firewall. The Radius server connects to our LDAP box via a hole in the firewall over an SSL connection that was generated with our internal CA Cert. I would like to have two SSL certs on the Radius box: one, for the internal connections to our servers, and two, an SSL cert that one can verify as a trusted Root Authority for the TTLS connections. This is causing an issue right now on the server. I have the following LDAP fields in radiusd.conf: tls_cacertfile = /etc/lfncerts/cacert.pem tls_certfile = /etc/lfncerts/ldap2_public_cert.pem tls_keyfile = /etc/lfncerts/ldap2_private_key.pem I have the following fields in the eap.conf: private_key_file = /etc/lfnnewcerts/radius.lawrencefreenet.org.key certificate_file = /etc/lfnnewcerts/radius.lawrencefreenet.org.crt CA_file = /etc/lfnnewcerts/rapidssl_01.cer Here's the output in the logs: Feb 14 12:47:26 radius kernel: audit(1171478846.538:8): avc: denied { read } for pid=10837 comm="radiusd" name="radius.lawrencefreenet.org.crt" dev=dm-0 ino=1310741 scontext=root:system_r:radiusd_t:s0 tcontext=root:object_r:user_home_t:s0 tclass=file As you can see, the CA_files are different, since they are signed by different certificate authorities. I have tried this configuration and 777'ed each of the files to no avail. Is the configuration I'm trying to implement possible? Any help that you can offer would be greatly appreciated! Thanks for your time! -Mike

2 1

Freeradius dies if it cant resolve clients...
by "Jóhann B. Guðmundsson" 15 Feb '07

15 Feb '07

I had the unfortunate experience for my radius daemon to die when it couldn't resolve one client in clients.conf Is there any particular reason for radius not to spew out error message to the logs and declare the client "dead" or "unresolvable " and continue to function or is this just bad programming.... Best regards Johann B. -- Jóhann B. Guðmundsson. RHCE,CCSA Unix Kerfistjóri. Kerfistjórn. Reiknistofnun Háskóla Íslands. Tæknigarði, Dunhaga 5. Rafpóstur: johannbg(a)hi.is 107 Reykjavík. Sími: 525-4267 Ísland. Bréfasími: 552-8801 Johann B. Gudmundsson. RHCE,CCSA Unix System Engineer. IT Management. Reiknistofnun University of Iceland. Taeknigardi, Dunhaga 5. Email: johannbg(a)hi.is IS-107 Reykjavik. Phone: +354-525-4267 Iceland. Fax: +354-552-8801

4 5

pap/peap confusion
by Matt Ashfield 14 Feb '07

14 Feb '07

I'm pouring through the alphabet soup of all of this and have a few questions that keep popping up. During a pap conversation, the radius server ends up with the username/password passed to it from the client. It then encrypts the password to match the encryption of the stored password in ldap (or other directory) and tries a bind. Correct? During a PEAP conversation, the radius server also would end-up with a username/password received from the client (either via clear-text or via the mschap conversation). Why can it not then encrypt the password just like PAP did? Does it do the comparison to LDAP stored passwords via MSCHAP as well? Thanks for any info. Matt mda(a)unb.ca

4 3

Group reply parameter
by tzieleniewski 14 Feb '07

14 Feb '07

Hi!! I'd like to ask You If it is possible to set up radius in such way that whenever there will be an Access Request send from the NAS for a user which in a member of the particular group in database the reply will be attached with the reply parameter of thed value equal to the User-Name parameter. So generally there will be for instance the Cleartext-password attribute in the radchek table for that user and a reply parameter in the radgroupreply table, will it work? Is it possible to specify the parameter as it is done in the users file %{User-Name} will it be translated to the correct value? Thanks in advance Cheers -tomasz

1 0

FreeRadius + OpenLDAP + VLAN assignation
by Romain Mercier 14 Feb '07

14 Feb '07

Hi, I want to assign users to a certain VLAN depending on an attribute stocked in LDAP. At the time, I use files module to do that and it works in a first test but don't take care about the attribute. How can I use the attribute I create? In the ldap.attrmap file I add this line: checkItem Ldap-Group auaStatut In the users file I add these lines: DEFAULT Ldap-Group == "xxxx" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 1, Fall-Through = 0 Does anybody have an idea? Romain Mercier

2 2