- Freeradius-Users - lists.freeradius.org

Sending Access-Challenge Fail
by Daniel Romero 06 Dec '06

06 Dec '06

I'm stucked... i don't know what to do... rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.100.185 port 1167 Framed-IP-Address := 192.168.100.210 Framed-IP-Netmask := 255.255.255.255 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0108be98f023e591df74f0eaf7670e9d Finished request 3 Going to the next request Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 457619d2 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 1 with timestamp 457619d3 Cleaning up request 2 ID 2 with timestamp 457619d3 Cleaning up request 3 ID 3 with timestamp 457619d3 Nothing to do. Sleeping until we see a request.

2 1

EAP
by Daniel Romero 06 Dec '06

06 Dec '06

Any ideas? ... Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "radiusUDP" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[399] Unknown module "eap". radiusd.conf[382] Failed to parse authenticate section.

4 3

EAP
by Daniel Romero 06 Dec '06

06 Dec '06

rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[399] Unknown module "eap". radiusd.conf[382] Failed to parse authenticate section. Cause: certificate's password and password on eap.conf where different. Solution: make them equals!!!

1 0

SQL reconnect
by Guido 05 Dec '06

05 Dec '06

Hi list, I'm using freeradius with Ms-SQL. Freeradius can open connections as many as are configured in mssql (num_sql_socks = 3). It is ok, but when SQL go down, or when connection with SQL go down freeradius can't connect to SQL until freeradius is restarted. So, I need a way to rstart freeradius when any problem with SQL happens. Regards, Guido

2 1

FreeRadius core dump on FreeBSD
by Lisa Besko 05 Dec '06

05 Dec '06

I'm getting a core dump with freeradius when I try to use Kerberos authentication on a FreeBSD box running 6.1-Stable with an AMD64 platform. I can run FreeRadius with Kerberos authentication on FreeBSD 6.1 Stable with the i386 platform with no problems. If you can point me in a direction to help fix the problem please do. Here's some more info.: FreeRADIUS Version 1.1.3, for host amd64-portbld-freebsd6.1 Kerberos5 Version 1.5 Sunfire 2100 Dual Core AMD Opteron(tm) Processor 180 Please let me know if I can provide any more info. Here's the debugging messages from starting radiusd -X (slightly sanitized to protect the innocent : Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Kerberos krb5: keytab = "(null)" krb5: service_principal = "(null)" rlm_krb5: krb5_init ok Module: Instantiated krb5 (krb5) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host xx.x.x.xx:50724, id=200, length=65 User-Name = "userid(a)realm.realm" User-Password = "thisisnothepasswordyouarelookingfor" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "realm.realm" for User-Name = "userid(a)realm.realm" rlm_realm: No such realm "realm.realm" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" Processing the authenticate section of radiusd.conf modcall: entering group Kerberos for request 0 Bus error (core dumped) Thanks for any pointers or help you can provide. I've been searching all over the web and beating my head against the wall for 3 days now. LB

1 1

client log
by Santiago Balaguer García 05 Dec '06

05 Dec '06

Hi people, I have installed freeradius 1.0.4 in my AAA servers. I work several years with this service and funcion very well. I am develeping a PHP platform for my people who install hotspots. Well, I want to log if a nas can not authenticate with my RADIUS server because of any reason. I wish only to log failed NAS request such as: -------------------------------------------------- rad_recv: Access-Request packet from host 192.168.1.247:1027, id=4, length=245Ignoring request from unknown client 192.168.1.247:1027--- Walking the entire request list --- -------------------------------------------------- Any suggestion?? Santiago _________________________________________________________________ Llama a tus amigos de PC a PC: ¡Es GRATIS! http://get.live.com/messenger/overview

3 2

Challenge-response with mod_auth_radius
by Arnaud Dostes 05 Dec '06

05 Dec '06

Hello, We would like to use freeradius with a 'home made' challenge response authentication scheme (we will build our own module) using mod_auth_radius. Ultimately we would like to prompt the user (after successfull authentication) with a challenge that he would have to enter in a securID like device and enter his response in the mod_auth_radius prompt. I've been toying with freeradius and mod_auth_radius for a few days now, and I still haven't succeeded in prompting the user with a challenge from the RADIUS server. Could anyone point me in the right direction ? Is it possible ? We're using mod_auth_radius as a basic client, but we could use any type of NAS. Best regards, Arnaud

2 2

Problems with Lucent ISDN Router.txt
by Andreas Krummrich 05 Dec '06

05 Dec '06

Hi, i have trouble, dialing out with a lucent max1800 isdn router, using freeradius under sles9. Here is an extract of the users file: <<< user-in Password == "xxx" Service-Type == Framed-User, Framed-Protocol = ASCEND-MPP, Framed-Address = yyy.yyy.yyy.yyy, Framed-Netmask = zzz.zzz.zzz.zzz, Framed-Route = None user-out Password == "xxxx", Service-Type == Dialout-Framed-User User-Name = "user", Ascend-Send-Auth = Send-Auth-CHAP, Ascend-Send-Secret = "xxxx", Ascend-Dial-Number = 0123456789, Ascend-Data-Svc = Nailed-64K, Framed-Protocol = ASCEND-MPP, Framed-Address = yyy.yyy.yyy.yyy., Framed-Netmask = zzz.zzz.zzz.zzz, Ascend-Expect-Callback = Expect-Callback-Yes, Ascend-Idle-Limit = 300 >>> With this config, dialing in is no problem and works fine. But dialing out with callback doesn't work. The call goes out and is terminated without any call back. I'm running freeradius in debug mode an getting the following output: <<< rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1025, id=145, length=67 User-Name = "user-out" User-Password = "xxx" NAS-IP-Address = yyy.yyy.yyy.yyy NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Processing the authorize section of radiusd.conf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/xxx.xxx.xxx.xxx/auth-detail-20061204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/xxx.xxx.xxx.xxx/auth-detail-20061204 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cxdmg-out", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry cxdmg-out at line 1291 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/var/log/radius/radacct/xxx.xxx.xxx.xxx/reply-detail-20061204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/xxx.xxx.xxx.xxx/reply-detail-20061204 modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 145 to xxx.xxx.xxx.xxx:1025 User-Name = "user" Ascend-Send-Auth = Send-Auth-CHAP Ascend-Send-Secret = "9" Ascend-Dial-Number = "0123456789" Ascend-Data-Svc = Nailed-64K Framed-Protocol = Ascend-MPP Framed-Address = yyy.yyy.yyy.yyy Framed-Netmask = zzz.zzz.zzz.zzz Ascend-Expect-Callback = Expect-Callback-Yes Ascend-Idle-Limit = 300 Finished request 0 Going to the next request >>> I dont't see any errors. The lucent retries several times and then gives up. As you can see, I allready includes the dictionary.ascend. Without any success. I also switched between OLD and VSA on the lucent and the freeradius. But without success. Are there any issues, between lucent and freeradius? Ore are there any errors in the config? Thanks in advance. Kind Regards, Andreas

2 1

Redundant Modules
by Wilmar Campos 05 Dec '06

05 Dec '06

Hello, I have a redundant configuration, in wich I try first a MySQL database, and if it fails i log the queries into a sql_log file. The problem is when the MySQL sever came up, the module does not try the MySQL module, it stays until I restart the service. Any Ideas? Thanks, -- Wilmar Campos

2 3

Proxy Problems
by Daniel Romero 05 Dec '06

05 Dec '06

Hi. I'm trying to run freeradius with eap/peap, but i'm get stucked in a kind of Proxy-State loop... The log is attached to this email. Any help would be very very helpful. D.R. Santiago, Chile.

2 4