- Freeradius-Users - lists.freeradius.org

freeRADIUS doc
by Carlo Prestopino 14 Sep '06

14 Sep '06

Hi all, I'm trying to access freeRaDIUS doc section (http://www.freeradius.org/radiusd/doc/) but I got a "Forbidden" access message. Is this section accessible to normal users? Best regards, Carlo

4 3

Re: IAS and Openser
by Artur Hayne 14 Sep '06

14 Sep '06

modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_realm: Looking up realm "voip.domain.br" for User-Name = "teste(a)voip.domain.br" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user teste to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 3 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for teste(a)voip.domain.br radius_xlat: '(uid=teste(a)voip.domain.br)' radius_xlat: 'ou=users,dc=voip,dc=domain,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,dc=voip,dc=domain,dc=br, with filter (uid=teste(a)voip.domain.br) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 3 modcall: leaving group authorize (returns notfound) for request 3 Sending Access-Request of id 3 to 10.2.1.XY port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Proxy-State = 0x323038 Re-sending Access-Request of id 0 to 10.2.1.XX port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Client-IP-Address = 10.2.1.XX Realm = "DEFAULT" Module-Failure-Message = "rlm_ldap: User not found" Realm = "DEFAULT" Proxy-State = 0x323035 Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.2.1.XX:33634, id=206, length=200 Ignoring duplicate packet from client OpenSER:33634 - ID: 206, due to outstanding proxied request 1. Its seems the proxy is working, but it dont communicate with the IAS. -- Module-Failure-Message = "rlm_ldap: User not found" -- I dont know what meanig, but the sound is not good. The command ldasearch return a rigth answer, I dont know what happended. The problem is in IAS? How can I test it? Any ideia? Merci. -------- freeradius-users-request(a)lists.freeradius.org escreveu:Hi, > How can I transform freeradius server in a proxy? > I configured the proxy.conf, but seems dont work > > And I uncommnet the line in radiusd.conf: > > proxy_requests = yes > $INCLUDE ${confdir}/proxy.conf > > I wanna do this: > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > > Its work? > > And in IAS should I configured anything? Configure the NULL realm with the same settings as DEFAULT. Other than that, the config sounds good to me. Did you change anything apart from that in the default config file? In particular, you need to have at least one instance of the "realm" module in authorize { }. The default config has "suffix" in there, that should be fine. You need to be sure then that your user names don't contain the @ character - otherwise they won't match the DEFAULT realm you set up in proxy.conf. If you are positive that an instance of realm is in authorize and NULL is configured, but it still doesn't work then please post the debug output (radiusd -X) of a packet that arrived and was supposed to be proxied, but wasn't. > Sorry for the portuguese e-mail. When I read it, I wondered what strange dialect of Spanish this is. :-) Portuguese and Spanish aren't that far apart after all, it seems. Greetings, Stefan Winter --------------------------------- Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora!

1 0

issue while setting up clients list from mysql
by Christian Hahn 14 Sep '06

14 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I've running a freeradius 2.0.0.pre0 from CVS (20060912) and have problems generating the clients list from the nas table of an mysql server. The mysql server is running on localhost I can connect using the same user/password combination configured in the radiusd sql section. On the mysql console I can ask the SELECT query for the nas tables defined in sql/mysql-dialup.conf with success. But if I fire up the radiusd it gives this error: - ----------8<----------- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=testing123 rlm_sql (sql): Adding client 127.0.0.1 (localhost) to clients list rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[11]: sql: Module instantiation failed. radiusd.conf[1966] Failed to find module "sql". radiusd.conf[1889] Failed to parse authorize section. Errors setting up modules I'm a little bit lost now, maybe I don't see the obvious. Any hints what can cause this error are appreciated. regards, Christian -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFCUPj6kMW7HW8620RAt9PAJ9pU1Ff4pmx5aIVuc7kfA7T7o2uWwCgnxDr FGRD6tYbV9JPq64hah4N48s= =6EQ9 -----END PGP SIGNATURE-----

1 0

NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47
by ego seek 14 Sep '06

14 Sep '06

Date: Wed, 13 Sep 2006 16:35:49 +0100 From: Rob Shepherd <rob(a)techniumcast.com> Subject: Re: NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <45082555.6030105(a)techniumcast.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Thank you, but, after done that radiusd display this to me: radius_xlat: 'davide' rlm_sql (sql): sql_set_user escaped user --> 'davide' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'davide' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql: Failed to create the pair: Unknown attribute "NT_Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 What I have to do now? (username=davide, password=verde, my radcheck table row is: ------------|------------------------------|--------|--------------------------------------------------------------| |davide | NT_Password | := | 781b0395cf9f8c1e5873eee5d28c38eb | ------------|------------------------------|---------|--------------------------------------------------------------| where i have to configure radius? BEst regards. ego seek wrote: > I'm working with mschapv2, > I use a PHP web site to register a user, can i insert into the db a > NT-hased password? Yes, radcheck should contain UserName | Attribute | op | Value | ----------|---------------|------|------------------------------------| colin | NT_Password | := | abcdef1234567890abcdef1234567890 | I use Pear Crypt... <?php $cr = new Crypt_CHAP_MSv1(); $cr->password = $password; $NThash = bin2hex($cr->ntPasswordHash()); ?> Rob

2 1

(Desperate) help setting up freeradius for use with eap-tls and win clients
by Federico Carbonetti 14 Sep '06

14 Sep '06

Hello everybody! I am completely new to freeradius and its world, as well as to linux environment.. I post this e-mail because I have few days left to configure freeradius for an exam about WLAN security and I am desperate... :( Yesterday I installed freeradius 1.1.3 on my linux kubuntu box (where I have kernel 2.6.15 installed) by following this step by step guide in 3 parts: http://www.linuxjournal.com/article/8151 Everything worked fine, maybe I just wasn't sure about the permissions changing described in part III of the guide.. But when I finally started the server by typing rc.radiusd start It just wrote radiusd as response and then the shell prompts for new commands, while I think it should say something like "waiting to process..." Can anybody please help me to fix this? Otherwise, if you could please suggest me another HOWTO more updated and more reliable of the one I mentioned above, I could also start again on another laptop where i have kubuntu installed as well.. Thanks a lot everybody for your attention/the help you will wish to give me!:) federico

3 4

NT-PASSWORD--WORKING
by ego seek 14 Sep '06

14 Sep '06

FOUND ERROR.... if I insert NT-PASSWORD, instead of NT_PASSWORD, it work fine. thank you so much egoseek Date: Wed, 13 Sep 2006 16:35:49 +0100 From: Rob Shepherd <rob(a)techniumcast.com> Subject: Re: NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <45082555.6030105(a)techniumcast.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed ego seek wrote: > I'm working with mschapv2, > I use a PHP web site to register a user, can i insert into the db a > NT-hased password? Yes, radcheck should contain UserName | Attribute | op | Value | ----------|---------------|------|------------------------------------| colin | NT_Password | := | abcdef1234567890abcdef1234567890 | I use Pear Crypt... <?php $cr = new Crypt_CHAP_MSv1(); $cr->password = $password; $NThash = bin2hex($cr->ntPasswordHash()); ?> Rob

1 0

Maximum timed out Session
by Elie Hani 14 Sep '06

14 Sep '06

Hi; Is there a way to disconnect a user after a certain time automatically using freeradius? I've tried the entry:"Max-All-Session" in the database, but it didn't work. Thanks Elie Hani

3 2

RADIUS proxy-----trace user site surfed------
by ego seek 14 Sep '06

14 Sep '06

Does anybody know how can I setup RADIUS and a proxy server to generate a log for the users? I need to trace where in the Internet the user went. Do yoy have any other suggestion for this pourpose? thank you. Best regards egoseek

3 2

Re: IAS and Openser
by Artur Hayne 14 Sep '06

14 Sep '06

Hello, How can I transform freeradius server in a proxy? I configured the proxy.conf, but seems dont work proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm DEFAULT { type = radius authhost = mydomain.br accthost = mydomain.br secret = mysecret nostrip } And I uncommnet the line in radiusd.conf: proxy_requests = yes $INCLUDE ${confdir}/proxy.conf I wanna do this: |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| Its work? And in IAS should I configured anything? Sorry for the portuguese e-mail. freeradius-users-request(a)lists.freeradius.org escreveu: Hello! This list is in English. > Como faço para transformar o Freeradius num cliente do IAS? Existe algum > tutorial, ou artigo? Se for sem passar pelo servidor freeradius eu já > configurei o radiusclient para ir direto ao IAS, mas não deu certo, nada > acontece, e o pior de tudo que não tenho nem como debugar o problema e o > arquivo de log do IAS é muito fraco. > > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > > Da pra fazer isso? Como faço isso? > > Alguma idéia? If I got you right, all you want to do is use FreeRADIUS as a proxy to communicate to an IAS which does the authentication. This is easy, all you need to do is proxy all incoming requests to the IAS. See proxy.conf, read it, try it, and if doesn't work for you ask here again. But in English please, it's been quite a time since I had Spanish in school. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Re: PAP questions.
by Keith Woodworth 14 Sep '06

14 Sep '06

On Tue, 22 Aug 2006, Alan DeKok wrote: |->Keith Woodworth <kwoody(a)citytel.net> wrote: |->> One of the things I did try was add PAP to the authorize section, but |->> radius failed to start when I did that. |-> |-> And the error message was...? Had to put this project a side for the last 2 weeks...Hate when I have to do that. Also this post has lots of debug output. Anyway here is the error: radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1569] Failed to parse authorize section. Here is where I put pap, with all the comments stripped: authorize { preprocess # auth_log # attr_filter ### KEITH pap chap mschap # digest # IPASS # ntdomain #eap files sql # etc_smbpasswd # ldap # daily # checkval } |->> Deployingradius.com did say there were very few circumstances to set |->> Auth-Type, but not which ones. Guess I found one? |-> |-> Possibly. Much of this is fixed in CVS head, which is currently |->planned to be 2.0 before Christmas. The PAP module does more there, |->and there are MANY fewer cases where you have to set Auth-Type. At the rate I'm going, it will be Christmas before I'm ready to go. |->> How stable is the current server version? Anyone using it in production? |-> |-> Yes. A number of people. There are 3 issues that need addressing |->before it's ready for an official 2.0, however. Would it be advisable to upgrade at this point or wait till its official? |->> Sounds like I might have to be using the CVS version to do what I want |->> properly of only having the user in one table and do PAP authentication |->> with the crypt password stored in sql. |-> |-> 1.1.2 can do it, it just takes a little more configuration. |->Basically, for every user who has a Crypt-Password attribute, you have |->to set "Auth-Type = Local". Not ":=", but "=". After having to put this aside for a few weeks I have finally done some testing. One. If the user has a crypt password in radcheck: 4 | tester | Crypt-Password | := | f3RCpSYQzT292 is listed in Usergroup: 14 | tester | default And default is in radgroupcheck: +----+-----------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-------+ | 1 | default | Auth-Type | = | Local | This is the debug output: rad_recv: Access-Request packet from host 204.244.99.67:1645, id=92, length=76 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Ok, so next change radgroupcheck so Auth-Type is PAP: +----+-----------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-------+ | 1 | default | Auth-Type | := | PAP | and do another dialup try: rad_recv: Access-Request packet from host 204.244.99.67:1645, id=93, length=76 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt by "tester" with password test rlm_pap: Using password "f3RCpSYQzT292" for user tester authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Sending Access-Accept of id 93 to 204.244.99.67 port 1645 Service-Type := Framed-User Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Framed-Routing := None Framed-IP-Netmask := 255.255.255.255 Finished request 0 I get authenticated, I get an IP and away I go. Now here is the main issue: I remove the user tester from the UserGroup table but leave Auth-Type := PAP rad_recv: Access-Request packet from host 204.244.99.67:1645, id=97, length=76 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Crypt Sending Access-Accept of id 97 to 204.244.99.67 port 1645 Finished request 0 And while Radius seems to send an Access-Accept, the dialup user gets an error 691 password invalid. So last change set Auth-Type = Local in radgroupcheck as per the suggestion above: 1 | default | Auth-Type | = | Local Debug output: rad_recv: Access-Request packet from host 204.244.99.67:1645, id=100, length=76 NAS-IP-Address = 204.244.98.67 NAS-Port = 23 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: type Crypt Sending Access-Accept of id 100 to 204.244.99.67 port 1645 Finished request 1 Going to the next request Again I get Access-Accept, but a 691 password error on the client side. So as I see it with this: I have to have the user listed in UserGroup AND RadCheck with a Crypt-Password attribute and RadGroupCheck with Auth-Type := PAP for the user to authenticate and be able to get online. If the username is in UserGroup AND RadCheck with the Auth-Type = Local I see this: modcall[authorize]: module "sql" returns ok for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. So I guess I missed something completely or its not possible to have a username ONLY listed in Radcheck with Crypt-Password and authenticate that user? Does the username really need to be be in both the UserGroup table and Radcheck table for a crypt-password method to work? Sorry for the long post. Thanks, Keith

4 7