- Freeradius-Users - lists.freeradius.org

Re: Freeradius hangs
by Karthik R 03 Nov '06

03 Nov '06

If you had said this at the start, and posted the debug log, you would have solved the problem a long time ago. This is even in the FAQ: http://wiki.freeradius.org/FAQ#The_NAS_seems_to_ignore_the_reply_of_the_rad… Alan DeKok. Alan, As you said, I tried with the option -i : radiusd --i <ip_address_radius server> -X But still i get the below error message at the radius server end, only one NIC is active now on the server. --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:4754 , id=119, length=151 Sending duplicate reply to client dlink:4754 - ID: 119 Re-sending Access-Accept of id 219 to 192.168.0.1 port 4754 On the client side MSVPN dialer interface, i see the error message: "Error 718: the connection was terminated becasue the remote computer didnt respond in timely manner". Thanks for your patience and co-operation.

2 1

Bug in rlm_sql reconnect code??
by Hans-Peter Fuchs 03 Nov '06

03 Nov '06

Hello List, the following I have tested with freeradius 1.1.2 and 1.1.3 I run a radius-server as test environment. The server is connected to a mysql-database. After long idles the mysql-server drops the radius client connections. After that the reconnect fails as you can see in the following output from radiusd -X. The first packet gets a accept response, the following 2 packets get reject responses because the database queries fail. rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql (AuthGuest): - sql_groupcmp finished: User belongs in group MAC rlm_sql (AuthGuest): Released sql socket id: 1 users: Matched entry DEFAULT at line 162 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [000f1fcc8e87] (from client noc4 port 0) Sending Access-Accept of id 10 to 134.95.129.28 port 1025 User-Name := "" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 454aea03 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 134.95.129.28:1025, id=192, length=56 User-Name = "000f1fcc8e87" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Session-Id = "000021c0" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (AuthGuest): Connected new DB handle, #0 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 0 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group ADMIN Invalid operator for item Sql-Group: reverting to '==' rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (AuthGuest): Connected new DB handle, #4 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 4 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group RZKR Invalid operator for item Sql-Group: reverting to '==' No huntgroup access: [000f1fcc8e87] (from client noc4 port 0) modcall[authorize]: module "preprocess" returns reject for request 1 modcall: leaving group authorize (returns reject) for request 1 Invalid user: [000f1fcc8e87/<no User-Password attribute>] (from client noc4 port 0) Delaying request 1 for 4 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 134.95.129.28:1025, id=192, length=56 Sending Access-Reject of id 192 to 134.95.129.28 port 1025 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 192 with timestamp 454b615d Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 134.95.129.28:1025, id=87, length=56 User-Name = "000f1fcc8e87" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Session-Id = "00002657" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (AuthGuest): Connected new DB handle, #3 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 3 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group ADMIN Invalid operator for item Sql-Group: reverting to '==' rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (AuthGuest): Connected new DB handle, #2 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 2 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group RZKR Invalid operator for item Sql-Group: reverting to '==' No huntgroup access: [000f1fcc8e87] (from client noc4 port 0) modcall[authorize]: module "preprocess" returns reject for request 2 modcall: leaving group authorize (returns reject) for request 2 Invalid user: [000f1fcc8e87/<no User-Password attribute>] (from client noc4 port 0) Delaying request 2 for 4 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 134.95.129.28:1025, id=87, length=56 Sending Access-Reject of id 87 to 134.95.129.28 port 1025 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 87 with timestamp 454b6165 Nothing to do. Sleeping until we see a request. Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

1 0

Limit access to internet by mac using freeradius
by Ali Jawad 03 Nov '06

03 Nov '06

Hi Ive got a micro ISP with 50 clients running on pppoe and freeradius for authenication, each client has a username and password. When a customer dials through his winbox to create pppoe connection the pppoe server on the server loads radius.so to do the authenication. What I want to do now is the following... I want to authenicate based on mac address and i do not want to use pppoe anymore..so everybody plugging in a network cable into my switch will have immediate internet access only if I have registered his mac address for him previously, otherwise everybody plugging his network cable into my swithces will have access to my internet connection. I mean I need something like the mac address filtering used in squid ...where only registered mac address are allowed through the proxy..any hints suggestions and/or tutorials are welcome. -- With Regards Ali Jawad

4 6

RadSec
by Manuel Sánchez Cuenca 03 Nov '06

03 Nov '06

Hello all, is RadSec implemented in FreeRadius? or it is planned to be done? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

3 2

CHAP on freeradius & mysql
by John Longland 03 Nov '06

03 Nov '06

Hi all My freeradius server has been running for some time now and due to the users file getting a bit long, I decide to go with the mysql-database. I have my PAP-clients running on the new mysql-radius setup but my CHAP clients are still failing. When I was running from the users-file, an entry would look like this: DEFAULT Auth-Type = MS-CHAP, Password == "void", Calling-Station-ID == '271111111' Framed-IP-Address = 1.2.3.4 but moving to mysql, I cannot have "" as usernames. So my radcheck table has john Auth-Type MS-CHAP john User-Password john john Calling-Station-ID 271111111' When I run radiusd in debug mode, it says modcall : module sql returns ok for request 1 rlm_chap login attempt by "john" with CHAP-password rlm_chap: Using clear text password john for user john authentication rlm_chap : Password check failed Is there any othe rdebugging aids that I can switch on to see whats cooking ?? Thanks ! John

2 1

RE: freeRADIUS on Solaris 10 - x86
by Ramm-Ericson, Johannes 03 Nov '06

03 Nov '06

-----Original Message----- > Date: Thu, 2 Nov 2006 15:24:13 +0100 (CET) > From: "Michael Messner" <michael.messner_edv(a)inode.at> > Subject: freeRADIUS on Solaris 10 - x86 > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <141.201.70.172.1162477453.wm(a)webmail.inode.at> > Content-Type: text/plain; charset=iso-8859-1 > > hey freeRADIUS users, > > next step ... testing freeRADIUS on a Solaris 10 box and I'm completely new to solaris! :-( I've started > with the configure again but there are so much things missing: > > snip... < > > thanks mIke ------------------------------ Hello Mike, Seeing as you are new to Solaris I'd say you can save yourself a lot of time and hard work by re-installing your x86 server with a standard Linux distribution. Even if you've never touched Linux before most distributions will have all the necessary prerequisites installed and if you choose to do so you won't even need to compile freeradius, you can install the vendor-supplied package for freeradius. Of course, YMMV, but I "grew up" with Solaris (and enjoyed it) but these days it's just simply a pain to install many free/open source packages on Solaris. Save yourself the trouble and go with Linux. Seeing as you are from Austria I suspect Suse will be your best option as you will probably find most local support around that distribution. Viele grüsse, Johannes

1 0

Need help setting up FreeRadius using PEAP/MSChapV2
by Graham, Robert 03 Nov '06

03 Nov '06

A year ago I tried to set up 802.1x on our network using PEAP/MSChapV2 without any luck, but wanted to try again so here I am. I followed the document titled, "FreeRADIUS Active Directory Integration HOWTO" on the FreeRadius Wiki site and I am still not able to authenicate against AD. I hope someone out there can provide some assistance and HELP me out. I have included the debug out below. Any help would GREATLY be appreciated... [root@mem-co-radius3 raddb]# /usr/local/sbin/radiusd -XA Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.243:1645, id=166, length=112 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" EAP-Message = 0x02010010014d454d5c7267726168616d Message-Authenticator = 0x129b48f31fd82471f30cc7fb9f2b16c0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 166 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5c2ae6e98091f71681bce0ece77b661 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=167, length=95 User-Name = "0015583295bb" User-Password = "0015583295bb" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "0015583295bb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=168, length=236 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0xe5c2ae6e98091f71681bce0ece77b661 EAP-Message = 0x0202007a198000000070160301006b010000670301454aa65119092ed15cac0bf2dd1cfa4ae4ba44f4f6fb75edb0d148540e065a03000018002f00350005000ac009c00ac013c01400320038001300040100002600000010000e00000b6d656d5c7267726168616d000a00080006001700180019000b00020100 Message-Authenticator = 0xd1271dca6c660ae3adf19b38556b5d25 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 122 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 006b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0681], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 168 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103040a19c0000006de160301004a020000460301454aa6514b766eafc2fdf25fd35176661a0d197b10cea78e4064392cb2769bef20e4728653cfbf97ede5bad97ef290087837f33cc737c0304c51f65488dfa815f6002f0016030106810b00067d00067a0002de308202da30820243a003020102020102300d06092a864886f70d0101040500308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b130249543123302106 EAP-Message = 0x092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d301e170d3036313130323233313034305a170d3037313130323233313034305a3081b8310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b13024954312330210603550403131a6d656d2d636f2d726164697573332e6d656d2d696e732e636f6d3123302106092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d3081 EAP-Message = 0x9f300d06092a864886f70d010101050003818d0030818902818100bf04a465438fd6b2b9680b7db35b104621e27cd1cd32f050467ee2b804d113d999e2b8c69b0e6e6f735b6638b6dbf774d1fc7b7cb8256a3038211e650e4e2e029d83f6f649dec345dadb86ba2529f736475a67c106b5d74773abdb8ac1074745e181a4b5fce41fd1f9855cb5356ab1a613dd63903ebd4141877cc6f4176111c90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181000e18c5fc89fd6bf6829bedd85e5fe53d0424fd79edc87c136e199895f10742c78d3f6a3d39128917d7bc6d3b66e4953016 EAP-Message = 0x0e5216a179547e2d1679c45745a5d2b6833dcd6ab5cae91dd82caa3a5d81cabde7904fb35d62d5c381704cfef893d16f5afd2ab8ecf9ec619033bd833e3a04d659a757355aa76422d22746562d637000039630820392308202fba003020102020100300d06092a864886f70d0101040500308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b130249543123302106092a864886f70d01090116147365637572697479406d EAP-Message = 0x656d2d696e732e636f6d301e170d3036313130323233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4722dd921ba28f05b6a3ce4dd0c63ff5 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=169, length=120 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0x4722dd921ba28f05b6a3ce4dd0c63ff5 EAP-Message = 0x020300061900 Message-Authenticator = 0x2fe4ba89411ecaaf30d4b0fcc21e009c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 169 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010402e41900303933375a170d3038313130313233303933375a308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d757475616c20496e737572616e6365310b3009060355040b130249543123302106092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100a8dd3475b1809a8cb2c6c94466179b05472486a197db9c387a0c9963f23fda351942db60e5f537c3b76abb8cbd6c2060 EAP-Message = 0xf0de117453969dec0c34d1e98dd26c2aa373780a37f793d1b912d74676b7bf9a33b99ba2299250bfa23c18bec11204512cdc9e438ee4ccb646f643ce57a7075cd0b6950be4b5893dfa0357f3e6f44f7b0203010001a381f33081f0301d0603551d0e04160414692e5a16ee8618311365cdae5af4f78c2f31a4a73081c00603551d230481b83081b58014692e5a16ee8618311365cdae5af4f78c2f31a4a7a18199a48196308193310b30090603550406130255533111300f060355040813084d6973736f7572693111300f06035504071308436f6c756d626961312c302a060355040a13234d6973736f75726920456d706c6f79657273204d75747561 EAP-Message = 0x6c20496e737572616e6365310b3009060355040b130249543123302106092a864886f70d01090116147365637572697479406d656d2d696e732e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810079c9916ca05fde402cf2e85befa2ae87244447523a09a922320183d8694faa74dd7d5addf7164ef96350a24df5da75050a54ea796738036a65be17fcd71521fe61b0f3e69e635f93c24887d88be2fc45c7c4a5dbb9cfb745852c476c7a439ceaf3e1348232bece52c82f453a8ace4319cdc35f41593c22f04acf76515acf898f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ce86c1c3a38aed8bcb14c9da3a5743f Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=170, length=322 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0x8ce86c1c3a38aed8bcb14c9da3a5743f EAP-Message = 0x020400d01980000000c61603010086100000820080b77d0443340fa7e3b42f8318960f944f15a0a73271046b0d214a6c34fb25a701ae2c03fd2c21dd496240b1c8238f72a3a527151715148068e72feb05b580156d320cce3657cd8e5ff327981c1ba0021ce8bb23c94243d18d03c083fef43c2928a2d903ee759cc6b97c8be550b65e5c0cadf681e16f40688363093327061599671403010001011603010030cb59268377c2f35bbb5ed04112bb5d080c903154fe75ba0e9353913f943962405da3b30e5931e143ddb32a0715ce32a3 Message-Authenticator = 0x32568f629d463150d30fcdcb1f4a9221 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 170 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01050041190014030100010116030100304af5b337b3cda8be50cdfb95d5d40e0d5edf65aaf35d6103df543a82b1df2c90676adf32b1277e7837bce039fd169873 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3fa55aa771536d2480fa32bd3214f790 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.1.243:1645, id=171, length=120 User-Name = "MEM\\rgraham" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 172.16.1.243 NAS-Port = 13 Calling-Station-Id = "00-15-58-32-95-BB" State = 0x3fa55aa771536d2480fa32bd3214f790 EAP-Message = 0x020500061900 Message-Authenticator = 0x5681e2ac70ffdfed2a265d2beeb405de Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "MEM\rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 171 to 172.16.1.243 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0106005019001703010020d08cd78b8085bb7e97b9adbe129e47fa17a094ff284ec4df5b954f625a749c1e1703010020e4aaebed0bf703160bb667600586ff0fdc1a75d6264db7a51ffe165cca8e943d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83dac1e77347d020ee17ac371330f05e Finished request 5 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 166 with timestamp 454aa651 Sending Access-Reject of id 167 to 172.16.1.243 port 1645 Cleaning up request 1 ID 167 with timestamp 454aa651 Cleaning up request 2 ID 168 with timestamp 454aa651 Cleaning up request 3 ID 169 with timestamp 454aa651 Cleaning up request 4 ID 170 with timestamp 454aa651 Cleaning up request 5 ID 171 with timestamp 454aa651 Nothing to do. Sleeping until we see a request.

2 1

LDAP + AD username length
by duckeo 03 Nov '06

03 Nov '06

Is it possible to trim down the length of the username used to query AD with ldap? For names longer than 20 characters I am getting "rlm_ldap: object not found or got ambiguous search result" returned. Thanks

1 0

Dialup authentication says it works, but doesn't.
by Ernie Dunbar 02 Nov '06

02 Nov '06

We have a Cisco AS5300 for our dialup pool. It is able to log into our new FreeRadius server and make authentication requests, but users are not able to authenticate. It's very strange, because FreeRadius produces logs like this: Thu Nov 2 11:06:24 2006 : Auth: Login OK: [XXXXXX/XXXXXX] (from client dialup port 8) But the client gets "Error 691: Your username or password are incorrect". I can tell that it's authenticating properly, because when a user gets their password wrong, I see this instead: Thu Nov 2 11:02:20 2006 : Auth: Login incorrect: [user1/somepass] (from client dialup port 13) Thu Nov 2 11:02:20 2006 : Auth: Login incorrect: [user1/somepass] (from client dialup port 13) We're using FreeRadius' mysql support for authentication, and I'm absolutely positive that part is working fine. It even creates accounting data in the database. Something else that might be interesting is what happens when I try to set up a user in /etc/freeradius/users. The relevent stanza in the users file is this: foobar Auth-Type := Local, User-Password == "asdf1234" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Fall-Through = No The logs FreeRadius produces say this: Thu Nov 2 12:09:09 2006 : Auth: Login incorrect (No password configured for the user): [foobar/asdf1234] (from client dialup port 85) Thu Nov 2 12:09:09 2006 : Auth: Login incorrect: [foobar/asdf1234] (from client dialup port 85) Thu Nov 2 12:09:09 2006 : Auth: Login incorrect (No password configured for the user): [foobar/asdf1234] (from client dialup port 85) Thu Nov 2 12:09:09 2006 : Auth: Login incorrect: [foobar/asdf1234] (from client dialup port 85)

1 0

Re: Freeradius hangs
by Karthik R 02 Nov '06

02 Nov '06

Alan, yes, the RADIUS server returned Access-accept for the session requested from NAS. But it again receives the access-request from NAS and sending duplicate reply. Does it mean NAS unable to process the response received from Freeradius. Below is the reponse snap where i see access-accept and access-request happened several time at same instant. On the NAS end, its pretty plain configuration (configured radius ip and secret passwd) and no logging is available. The NAS documentation doesnt talk about radius error codes. Sending Access-Accept of id 219 to 192.168.0.1 port 4754 MS-CHAP2-Success = 0x9f533d41443033433538413845303733454132373045303043444441364531383431433344383938383938 MS-MPPE-Recv-Key = 0xdc882e2dfa10109679e37fe4bafba95d MS-MPPE-Send-Key = 0xf3e3e6a91f2d6e4b64b8b2e5add4bdad MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:4754 , id=219, length=151 Sending duplicate reply to client dlink:4754 - ID: 219 Re-sending Access-Accept of id 219 to 192.168.0.1 port 4754 Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:4754, id=219, length=151 Sending duplicate reply to client dlink:4754 - ID: 219 Re-sending Access-Accept of id 219 to 192.168.0.1 port 4754 Waking up in 6 seconds... so when i have this log message at radius srv end, at the client dialer interface i get this error message as "access was denied because username\password invalid on the domain". But am sure the logon credentials are correct. Also freeradius service hangs sometime during authentication process while processing request which came from NAS box. sorry about vague reply. Kartthik

2 1