- Freeradius-Users - lists.freeradius.org

Need help, MS RAS as radius client
by Cui Jeffrey 13 Dec '06

13 Dec '06

Hello everyone, I started to use freeradius only a couple weeks ago. My job is to use rlm_jradius module to forward username/password to my own authentication application, it works fine with radclient. But when I was trying to use windows RAS (vpn server) as freeradius' client, from freeradius' output, I can see that there is no user-password. Any idea why this happens? I am using freeradius 1.1.2 on Redhat enterprise Linux version 4. Thank you Jeffrey rad_recv: Access-Request packet from host 192.168.2.151:1382, id=8, length=289 Acct-Session-Id = "108" NAS-IP-Address = 192.168.2.151 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 129 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.11.14.105" Tunnel-Client-Endpoint:0 = "10.11.14.105" Microsoft-Attr-35 = 0x4d5352415356352e3030 Microsoft-Attr-34 = 0x4d535241532d312d4a454646324b User-Name = "dvmh00000055(a)DVVPN.COM" MS-CHAP-Challenge = 0xe6e76c750472fb5879986d8b8e75df6e MS-CHAP2-Response = 0x0000f21eb6c0b591297af094964bb6e9417c0000000000000000f990636a5a5237f4c3456225c9c475b07004e32cb758fdf2 Message-Authenticator = 0x25fa1bd20b0a0f3fa273ae4fc66eb8d5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: Looking up realm "DVVPN.COM" for User-Name = "dvmh00000055(a)DVVPN.COM" rlm_realm: No such realm "DVVPN.COM" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 0 rlm_jradius: packing attribute Acct-Session-Id (type: 44; len: 3) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute NAS-Port (type: 5; len: 4) rlm_jradius: packing attribute MS-RAS-Vendor (type: 20381705; len: 4) rlm_jradius: packing attribute MS-RAS-Version (type: 20381714; len: 10) rlm_jradius: packing attribute NAS-Port-Type (type: 61; len: 4) rlm_jradius: packing attribute Tunnel-Type (type: 64; len: 4) rlm_jradius: packing attribute Tunnel-Medium-Type (type: 65; len: 4) rlm_jradius: packing attribute Calling-Station-Id (type: 31; len: 12) rlm_jradius: packing attribute Tunnel-Client-Endpoint (type: 66; len: 12) rlm_jradius: packing attribute Microsoft-Attr-35 (type: 20381731; len: 10) rlm_jradius: packing attribute Microsoft-Attr-34 (type: 20381730; len: 14) rlm_jradius: packing attribute User-Name (type: 1; len: 22) rlm_jradius: packing attribute MS-CHAP-Challenge (type: 20381707; len: 16) rlm_jradius: packing attribute MS-CHAP2-Response (type: 20381721; len: 50) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing attribute Client-IP-Address (type: 1052; len: 4) rlm_jradius: packing packet with code: 1 (attr length: 429) rlm_jradius: packing attribute Framed-IP-Address (type: 8; len: 4) rlm_jradius: packing attribute Framed-MTU (type: 12; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute Framed-Compression (type: 13; len: 4) rlm_jradius: packing packet with code: 0 (attr length: 80) rlm_jradius: packing attribute Auth-Type (type: 1000; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: sending 586 bytes to jradius server rlm_jradius: return code 8; receiving 2 packets rlm_jradius: reading packet: code=1 len=429 rlm_jradius: reading attribute: type=44; len=3 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=5; len=4 rlm_jradius: reading attribute: type=20381705; len=4 rlm_jradius: reading attribute: type=20381714; len=10 rlm_jradius: reading attribute: type=61; len=4 rlm_jradius: reading attribute: type=64; len=4 rlm_jradius: reading attribute: type=65; len=4 rlm_jradius: reading attribute: type=31; len=12 rlm_jradius: reading attribute: type=66; len=12 rlm_jradius: reading attribute: type=20381731; len=10 rlm_jradius: received attribute we do not recognize (type: 20381731) rlm_jradius: reading attribute: type=20381730; len=14 rlm_jradius: received attribute we do not recognize (type: 20381730) rlm_jradius: reading attribute: type=1; len=22 rlm_jradius: reading attribute: type=20381707; len=16 rlm_jradius: reading attribute: type=20381721; len=50 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading packet: code=0 len=80 rlm_jradius: reading attribute: type=8; len=4 rlm_jradius: reading attribute: type=12; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=13; len=4 rlm_jradius: reading request: config_item: len=48 rlm_jradius: reading attribute: type=1000; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 modcall[authorize]: module "jradius" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for dvmh00000055(a)DVVPN.COM with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [dvmh00000055(a)DVVPN.COM/<no User-Password attribute>] (from client jeff2003 port 129 cli 10.11.14.105) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 0 rlm_jradius: packing attribute Acct-Session-Id (type: 44; len: 3) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute NAS-Port (type: 5; len: 4) rlm_jradius: packing attribute MS-RAS-Vendor (type: 20381705; len: 4) rlm_jradius: packing attribute MS-RAS-Version (type: 20381714; len: 10) rlm_jradius: packing attribute NAS-Port-Type (type: 61; len: 4) rlm_jradius: packing attribute Tunnel-Type (type: 64; len: 4) rlm_jradius: packing attribute Tunnel-Medium-Type (type: 65; len: 4) rlm_jradius: packing attribute Calling-Station-Id (type: 31; len: 12) rlm_jradius: packing attribute Tunnel-Client-Endpoint (type: 66; len: 12) rlm_jradius: packing attribute User-Name (type: 1; len: 22) rlm_jradius: packing attribute MS-CHAP-Challenge (type: 20381707; len: 16) rlm_jradius: packing attribute MS-CHAP2-Response (type: 20381721; len: 50) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing attribute Client-IP-Address (type: 1052; len: 4) rlm_jradius: packing packet with code: 1 (attr length: 381) rlm_jradius: packing attribute Framed-IP-Address (type: 8; len: 4) rlm_jradius: packing attribute Framed-MTU (type: 12; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute Framed-Compression (type: 13; len: 4) rlm_jradius: packing attribute MS-CHAP-Error (type: 20381698; len: 10) rlm_jradius: packing packet with code: 3 (attr length: 102) rlm_jradius: packing attribute Auth-Type (type: 1000; len: 4) rlm_jradius: packing attribute Service-Type (type: 6; len: 4) rlm_jradius: packing attribute Framed-Protocol (type: 7; len: 4) rlm_jradius: packing attribute Post-Auth-Type (type: 1014; len: 4) rlm_jradius: sending 576 bytes to jradius server rlm_jradius: return code 7; receiving 2 packets rlm_jradius: reading packet: code=1 len=381 rlm_jradius: reading attribute: type=44; len=3 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=5; len=4 rlm_jradius: reading attribute: type=20381705; len=4 rlm_jradius: reading attribute: type=20381714; len=10 rlm_jradius: reading attribute: type=61; len=4 rlm_jradius: reading attribute: type=64; len=4 rlm_jradius: reading attribute: type=65; len=4 rlm_jradius: reading attribute: type=31; len=12 rlm_jradius: reading attribute: type=66; len=12 rlm_jradius: reading attribute: type=1; len=22 rlm_jradius: reading attribute: type=20381707; len=16 rlm_jradius: reading attribute: type=20381721; len=50 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading packet: code=3 len=102 rlm_jradius: reading attribute: type=8; len=4 rlm_jradius: reading attribute: type=12; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=13; len=4 rlm_jradius: reading attribute: type=20381698; len=10 rlm_jradius: reading request: config_item: len=64 rlm_jradius: reading attribute: type=1000; len=4 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=7; len=4 rlm_jradius: reading attribute: type=1014; len=4 modcall[post-auth]: module "jradius" returns noop for request 0 modcall: leaving group REJECT (returns noop) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 8 to 192.168.2.151 port 1382 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 8 with timestamp 457dbde0 Nothing to do. Sleeping until we see a request. _________________________________________________________________ 与世界各地的朋友进行交流，免费下载 Live Messenger; http://get.live.com/messenger/overview

2 2

Re: Counter
by Sean 13 Dec '06

13 Dec '06

On Tue, 2006-12-12 at 22:35 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Sean wrote: > > Hi Alan, Thanks for all the help last night. I've made a lot of > > progress today. Max-Daily-Session is now being recognised as a valid > > attribute and users with the attribute are being authenticated. The > > problem I now have is that the users are being disconnected after > their > > allocated time has expired but they can log back in again straight > away > > instead of having to wait 24 hours. > > Is the NAS sending accounting packets? If not, the server has no > way > of knowing that the time was used up. Yes it is. It's a Linksys 54G running DD-WRT and Chillispot. The accounting works for Max-All-Session and Expiration. Also the user is disconnected after the correct time has elapsed under Max-Daily-Session. The problem is that he can log back on again straight away, instead of having to wait twenty four hours. > > Did you list "sql" in the "accounting" section? If not, the > accounting information won't be written to SQL. Yes sql is listed in accounting and the accounting information is being written into radacct. I think the problem might be in my sql code in sql.conf. I'll puzzle over it tonight although it works fine with the other attributes. Regards, Sean > > Alan DeKok.

2 1

Username to IP matching
by Daniel Davidson 12 Dec '06

12 Dec '06

I have a working freeradius system that is logging the hardware addresses of the users as they successfully connect through the system. I would like to also match the userid to the hardware address, and try as I might I cannot really figure/find out how to do that. Can someone show me the way or point me to something that does? thanks, Dan

1 0

problem with ldap search filter with '/'s (front slashes)
by Mark T. Valites 12 Dec '06

12 Dec '06

I'm trying to set up authentication to a SunOne Directory that requires not only a successful bind with by radius on behalf of the user attempting to authticate to it, but also a specified LDAP search filter to return a result as well. I can't seem to get the freeradius ldap module to return any result when the value of the attribute I'm comparing against contains a '/', as often found in the 'homeDirectory' and 'loginShell' LDAP attributes. >From the command line, the search and filter returns correctly: $ ldapsearch -v -H ldaps://ldapserver.domain.com \ -b ou=people,dc=domain,dc=com -x -D \ "uid=myuid,ou=people,dc=domain,dc=com" -W \ '(&(uid=myuid)(loginShell=/bin/tcsh))' The corresponding SunOne log: [12/Dec/2006:11:10:24 -0500] conn=4896 op=-1 msgId=-1 - fd=45 slot=45 LDAPS connection from www.xxx.yyy.zzz to xxx.yyy.zzz.www [12/Dec/2006:11:10:24 -0500] conn=4896 op=0 msgId=1 - BIND dn="uid=myuid,ou=people,dc=domain,dc=com" method=128 version=3 [12/Dec/2006:11:10:24 -0500] conn=4896 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=myuid,ou=people,dc=domain,dc=com" [12/Dec/2006:11:10:24 -0500] conn=4896 op=1 msgId=2 - SRCH base="ou=people,dc=domain,dc=com" scope=2 filter="(&(uid=myuid)(loginShell=/bin/tcsh))" attrs=ALL[12/Dec/2006:11:10:24 -0500] conn=4896 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0 [12/Dec/2006:11:10:24 -0500] conn=4896 op=2 msgId=3 - UNBIND [12/Dec/2006:11:10:24 -0500] conn=4896 op=2 msgId=-1 - closing - U1 [12/Dec/2006:11:10:25 -0500] conn=4896 op=-1 msgId=-1 - closed. A snippet from my radiusd.conf: server = "ldapserver.domain.com" basedn = "ou=people,dc=domain,dc=com" filter = "(&(uid=%u)(loginshell=/bin/tcsh))" The output from running radiusd in debug mode: rlm_ldap: - authorize rlm_ldap: performing user authorization for myuid radius_xlat: '(&(uid=myuid)(loginShell=/bin/tcsh))' radius_xlat: 'ou=people,dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldapserver.domain.com:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as / to ldapserver.domain.com:636 TLS certificate verification: Error, Unknown error rlm_ldap: waiting for bind result ... request 1 done rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=domain,dc=com, with filter (&(uid=myuid)(loginShell=/bin/tcsh)) request 2 done rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "myuid" with password "mypasswd" radius_xlat: '(&(uid=myuid)(loginShell=/bin/tcsh))' radius_xlat: 'ou=people,dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=com, with filter (&(uid=myuid)(loginShell=/bin/tcsh)) request 3 done rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. The corresponding SunOne log: [12/Dec/2006:11:12:33 -0500] conn=4897 op=-1 msgId=-1 - fd=45 slot=45 LDAPS connection from www.xxx.yyy.zzz to xxx.yyy.zzz.www [12/Dec/2006:11:12:33 -0500] conn=4897 op=0 msgId=1 - BIND dn="" method=128 version=3 [12/Dec/2006:11:12:33 -0500] conn=4897 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="" [12/Dec/2006:11:12:33 -0500] conn=4897 op=1 msgId=2 - SRCH base="ou=people,dc=domina,dc=com" scope=2 filter="(&(uid=myuid)(loginShell=/bin/tcsh))" attrs="radiusnasipaddress radiusexpiration acctflags ntpassword lmpassword radiuscallingstationid radiuscalledstationid radiussimultaneoususe radiusauthtype radiuscheckitem radiusreplymessage radiusloginlatport radiusportlimit radiusframedappletalkzone radiusframedappletalknetwork radiusframedappletalklink radiusloginlatgroup radiusloginlatnode radiusloginlatservice radiusterminationaction radiusidletimeout radiussessiontimeout radiusclass radiusframedipxnetwork radiuscallbackid radiuscallbacknumber radiuslogintcpport radiusloginservice radiusloginiphost radiusframedcompression radiusframedmtu radiusfilterid radiusframedrouting radiusframedroute radiusframedipnetmask radiusframedipaddress radiusframedprotocol radiusservicetype radiusreplyitem" [12/Dec/2006:11:12:33 -0500] conn=4897 op=1 msgId=2 - RESULT err=0 tag=101 nentries=0 etime=0 [12/Dec/2006:11:12:33 -0500] conn=4897 op=2 msgId=3 - SRCH base="ou=people,dc=domain,dc=com" scope=2 filter="(&(uid=myuid)(loginShell=/bin/tcsh))" attrs="uid" [12/Dec/2006:11:12:33 -0500] conn=4897 op=2 msgId=3 - RESULT err=0 tag=101 nentries=0 etime=0 The filter works correctly for attributes that don't contain a '/'. I don't see anything in RFC 2254 regarding '/'s needing escaping - am I missing something? -Mark -- Mark T. Valites Senior Systems Administrator University at Buffalo

2 2

upgrade from .9 to latest
by Andrew Long 12 Dec '06

12 Dec '06

Would like to upgrade from .9 to latest build; what is recommended upgrade procedure? I have successfully built a new server (on another box) but can find no docs outlining upgrade procedure, especially such a large step. Is it possible to upgrade, or do I build a build another server on the same box? -- Regards, Andrew Long Network Support Specialist EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 Web: http://www.escapewire.com E-mail: along(a)escapewire.com

2 3

Re: Counter
by Sean 12 Dec '06

12 Dec '06

Hi Alan, Thanks for all the help last night. I've made a lot of progress today. Max-Daily-Session is now being recognised as a valid attribute and users with the attribute are being authenticated. The problem I now have is that the users are being disconnected after their allocated time has expired but they can log back in again straight away instead of having to wait 24 hours. I have this in the users file DEFAULT Max-Daily-Session := 300 This in radiusd.conf $INCLUDE ${confdir}/sql.conf sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } instantiate { exec expr noresetcounter daily } Could you please give me some pointers to where I'm going wrong. I've scoured the list archives and Google looking for answers. Regards, Sean

2 1

rlm_perl - Debian sarge
by Graeme Hinchliffe 12 Dec '06

12 Dec '06

Hi, I have written a module for use with freeRADIUS which seems to work fine and dandy on my desktop Fedora box. However when I drop this module and config on one of the production (and now test) Debian Sarge boxes running the same initial config with same version of freeRADIUS I get : /usr/sbin/freeradius: relocation error: /usr/lib/perl5/auto/DBI/ DBI.so: undefined symbol: Perl_Gthr_key_ptr and freeRADIUS obvioulsy refuses to start. I have googled this and it seems to be a fairly common error with perl, alas I cannot see anything to help resolve this, so I am asking here in the hope that someone else may have thwarted this pain. I have checked and perl supports multi and threaded .. libperl-dev did not sort it .. any other suggestions ? please ? :) (that don't involve installing Fedora on there.. tho that is getting more and more tempting) Graeme

1 0

Logging into MySQL doesnt work, how enable MAC address control on MySQL
by Andrej Simko 12 Dec '06

12 Dec '06

Hello everybody I have a problem in setting up my freeradius to log all querries into database. The radacct is still empty. I read some messages from this mailing group and I found that the NAS server is not sending anything about Start time or Stop time. My naslist looks like: # NAS Name Short Name Type #---------------- ---------- ---- localhost local other and in clients.conf I have nastype = other So maybe I donnot know how to setup NAS on my server or maybe I donnot understand what does the NAS means. I am sure that we do not have any cisco or something like that so I want to authenticate only on the machine where freeradius is running. And second question. Does anybody know how to setup MAC address control from MySQL database. My idea is that when user wants to login it will need his username, password and MAC address to authenticate succesfully. Thank you for any ideas! AnDY

3 4

Problem with unprintable characters in the password
by Rafał Kamiński 12 Dec '06

12 Dec '06

Hello, I don't touch my Radius server since 2 weeks, and know when I try do some radtest, it show me Acces-Reject and in log: Mon Dec 11 14:51:47 2006 : Debug: Processing the authorize section of radiusd.conf Mon Dec 11 14:51:47 2006 : Debug: modcall: entering group authorize for request 2 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: - authorize Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: performing user authorization for rka Mon Dec 11 14:51:47 2006 : Debug: radius_xlat: '(uid=rka)' Mon Dec 11 14:51:47 2006 : Debug: radius_xlat: 'ou=users,dc=firm' Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: performing search in ou=users,dc=firm, with filter (uid=rka) Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: looking for check items in directory... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: looking for reply items in directory... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Setting Auth-Type = ldap Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: user rka authorized to use remote access Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall[authorize]: module "ldap" returns ok for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall: leaving group authorize (returns ok) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rad_check_password: Found Auth- Type ldap Mon Dec 11 14:51:47 2006 : Debug: auth: type "LDAP" Mon Dec 11 14:51:47 2006 : Debug: Processing the authenticate section of radiusd.conf Mon Dec 11 14:51:47 2006 : Debug: modcall: entering group LDAP for request 2 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authenticate]: calling ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: - authenticate Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: login attempt by "rka" with password "?Pđ ,??č?ń/9?Â??" Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: user DN: uid=rka,ou=Users,dc=firm Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: (re)connect to ldap:636, authentication 1 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS mode to 1 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ca.pem Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS Cert File to / etc/freeradius/cert/radius.crt Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS Key File to / etc/freeradius/cert/radius.key Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: bind as uid=rka,ou=Users,dc=firm/?Pđ ,??č?ń/9?Â?? to ldap:636 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Bind failed with invalid credentials Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Mon Dec 11 14:51:47 2006 : Debug: modsingle[authenticate]: returned from ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall[authenticate]: module "ldap" returns reject for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall: leaving group LDAP (returns reject) for request 2 Mon Dec 11 14:51:47 2006 : Debug: auth: Failed to validate the user. Mon Dec 11 14:51:47 2006 : Debug: WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Mon Dec 11 14:51:47 2006 : Debug: Delaying request 2 for 1 seconds Mon Dec 11 14:51:47 2006 : Debug: Finished request 2 Mon Dec 11 14:51:47 2006 : Debug: Going to the next request Mon Dec 11 14:51:47 2006 : Debug: --- Walking the entire request list --- Mon Dec 11 14:51:47 2006 : Debug: Waking up in 1 seconds... Mon Dec 11 14:51:48 2006 : Debug: --- Walking the entire request list --- Mon Dec 11 14:51:48 2006 : Debug: Waking up in 1 seconds... Mon Dec 11 14:51:49 2006 : Debug: --- Walking the entire request list --- Last when i run that servers all was oki :( And know :( not :( Why ? I'm sure that my secret is good. Can you help me? BR Kamyk

2 1

Temporary Accounts
by Thibault Le Meur 12 Dec '06

12 Dec '06

Hi, I'm using FR 1.1.3. I'd like to use the 'files' or 'mysql' backends to store temporary radius accounts used for guest accesses. I'd like to be able to enforce: * a Day-Of-Week and Time-Of-Day policy ===> using the Login-Time attribute seems appropriate * an 'account available Not-Before / Not-After' policy ===> What is the recommended setup for this last part of the policy ? - Using the 'Expiration' attribute for the 'Not-After' part is ok, but what about the Not-Before part ? - Do I have to use the Current-Login attribute to check the Not-Before part ? If yes what is the format of this attribute ? Any pointer to a faq or a sample setup file would be appreciated ;-) Regards, Thibault

2 8