- Freeradius-Users - lists.freeradius.org

Proxy problem in FreeRADIUS 1.1.3
by Chris A. Kalin 08 Sep '06

08 Sep '06

OK, I've got a bit of a weird issue here. I've beat my head against it and I'm turning to the list for help. I have local UNIX authentication, and I also proxy a few realms. The problem seems to arise when I have the same username both locally and going to a particular realm. We have bob(a)realm.com and bob. Bob (the local user) is disabled, he's in a certain group on my server that locks him out completely. On my backup RADIUS server, which is version 0.8-pre, I get the expected behavior - if bob tries to log in, he gets a "Your account has been disabled" message, but if bob(a)domain.com tries to log in, the proxy request goes to the remote server and it'll work. But on 1.1.3 I get weird results. Bob (local) gets the same "disabled" message, but so does bob(a)domain.com. But if I take bob out of the local passwd file, bob(a)domain.com proxies to where it's supposed to go and works fine. What's even weirder is in the above failure, I don't even get anything in radius.log about bob(a)domain.com failing auth - I have to hear about it from the customer himself. I'm assuming something major changed in the proxy code in the past, what, four years? But this is kind of a show stopper for me, so any help would be appreciated. I can post whatever config files anyone needs, but maybe I'm just missing something stupid here. Thanks in advance! Chris Kalin

3 12

Problems with SER, MySQL & FreeRADIUS
by Roberto Lopes 08 Sep '06

08 Sep '06

Hello! I'm having some problems when wanting the database of SER to be the one FreeRADIUS will be checking on, instead of the radius database. Like that I changed the file /etc/raddb/sql.conf At the end is the output of the problems. Hope somebody can help, Thanks in advance Roberto #----------------------------------------------------------------------------------------------------------------------------------------------# #SQL.conf sql { driver = "rlm_sql_mysql" server = "localhost" login = "root" password = "**********" # Database table configuration radius_db = "ser" # Allow for storing data after authentication postauth_table = "authenticate" authcheck_table = "subscriber" authreply_table = "subscriber2" ### postauth_table = "radpostauth" ### authcheck_table = "radcheck" ### authreply_table = "radreply" ### groupcheck_table = "radgroupcheck" ### groupreply_table = "radgroupreply" ### usergroup_table = "usergroup" # Table to keep radius client info ### nas_table = "nas" authorize_check_query = "SELECT phplib_id, username, password\ FROM ${authcheck_table} \ WHERE LOWER(username) = LOWER('%{SQL-User-Name}') \ ORDER BY phplib_id" authorize_reply_query = "SELECT phplib_id, username, password\ FROM ${authreply_table} \ WHERE LOWER(username) = LOWER('%{SQL-User-Name}') \ ORDER BY phplib_id" authorize_check_query = "SELECT phplib_id, username, password\ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY phplib_id" authorize_reply_query = "SELECT phplib_id, username, password\ FROM ${authreply_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY phplib_id" postauth_query = "INSERT into ${postauth_table} (phplib_id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" #SQL.conf #----------------------------------------------------------------------------------------------------------------------------------------------# I thought that i neede to create some more tables so here they are Subscriber2 will act like- authcheck_table Authenticate will actlike - postauth_table #----------------------------------------------------------------------------------------------------------------------------------------------# #Tables created in databaseSER CREATE TABLE authenticate ( phplib_id varchar(32) not null default '', user varchar(64) not null default '', pass varchar(25) not null default '', reply varchar(25) not null default '', date datetime NOT NULL default '0000-00-00 00:00:00', PRIMARY KEY phplib_id(phplib_id)); table subsciber had exactly the same structure of subscriber2 CREATE TABLE subscriber2 ( phplib_id varchar(32) NOT NULL default '', $USERCOL varchar(64) NOT NULL default '', domain varchar(128) NOT NULL default '', password varchar(25) NOT NULL default '', first_name varchar(25) NOT NULL default '', last_name varchar(45) NOT NULL default '', phone varchar(15) NOT NULL default '', email_address varchar(50) NOT NULL default '', datetime_created datetime NOT NULL default '0000-00-00 00:00:00', datetime_modified datetime NOT NULL default '0000-00-00 00:00:00', confirmation varchar(64) NOT NULL default '', flag char(1) NOT NULL default 'o', sendnotification varchar(50) NOT NULL default '', greeting varchar(50) NOT NULL default '', ha1 varchar(128) NOT NULL default '', ha1b varchar(128) NOT NULL default '', allow_find char(1) NOT NULL default '0', timezone varchar(128) default NULL, rpid varchar(128) default NULL, domn int(10) default NULL, uuid varchar(64) default NULL, UNIQUE KEY phplib_id (phplib_id), PRIMARY KEY ($USERCOL, domain), KEY user_2 ($USERCOL) ) ; #Tables created in databaseSER #----------------------------------------------------------------------------------------------------------------------------------------------# Output Problems reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf /etc/raddb/sql.conf[243]: Line is not in 'attribute = value' format Errors reading radiusd.conf

2 2

IP Address lease time
by John Williams 08 Sep '06

08 Sep '06

I want to set a lease time on IP address assignment. Does Freeradius do this or the device the connection is terminated on? We have an L2TP tunnel terminating dialup customers on a Cisco 7403. Is there an attribute to assign users from Freeradius or a Cisco config line that does this? Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.12.2/441 - Release Date: 07/09/2006

4 3

Different ldap authentications
by Angel L. Mateo 08 Sep '06

08 Sep '06

Hello, We are using freeradius as our radius server and we use it for authentication and authorization in different applications. Our users backend is a ldap directory, so in radiusd.conf we've got: server = "ldap.domain.com" identity = "cn=radiususer,dc=domain,dc=com" password = radiuspw basedn = "ou=People,dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Now, we need to configure our radius server so it could use another different ldap configuration for some of its clients. I know I could discriminate clients, but I haven't found how to make it use another different ldap configuration, if it is possible. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 1

Optimize LDAP searches
by Jorgen Rosink 08 Sep '06

08 Sep '06

We have multiple remote sites each with it's own NAS, each NAS search for users in multiple LDAP contexts. Each NAS (read: site) has one or more "primary" contexts, which I like to search first before looking in all others (roaming users). At this time search order is based on the order of LDAP module entries in the authorize {} section. Is there a way to configure the search order of multiple LDAP contexts based on NAS IP address ? I understand there is no way to do a single recursive query on a LDAP base like o=myorg, is there some reason, or should I submit a feature request ??? ;-)))

2 1

RE: How to restrict pppoe users on nas-port-id
by eugene＠snowball.co.za 07 Sep '06

07 Sep '06

Thank you Gef that pointed me in the right direction. What I still had to figure out was that the "check-item" variable is an extra row in the radcheck table and that the operator has to be "==". Kind regards, Eugene -----Original Message----- From: freeradius-users-bounces+eugene=snowball.co.za(a)lists.freeradius.org [mailto:freeradius-users-bounces+eugene=snowball.co.za@lists.freeradius. org] On Behalf Of Geoffrey Cauchi Sent: 06 September 2006 09:25 To: 'FreeRadius users mailing list' Subject: RE: How to restrict pppoe users on nas-port-id Use the check-item variable to restrict port id's Gef -----Original Message----- From: freeradius-users-bounces+agcauchi=winssystems.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+agcauchi=winssystems.com@lists.freeradi us.o rg] On Behalf Of eugene(a)snowball.co.za Sent: 05 September 2006 21:04 To: freeradius-users(a)lists.freeradius.org Subject: How to restrict pppoe users on nas-port-id I'm using FreeRADIUS Version 1.0.4 with Dialup_admin and mysql and I would like to know if anyone can direct me in the right place to find out how to restrict pppoe users from logging in from multiple NAS port IDs. I would like to restrict them to logging on to only a specific set of port IDs that comes from a database. Any help will be appreciated. -Eugenevdm - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

WPA with Chillispot in proxy mode, problem
by Giuseppina Venezia 07 Sep '06

07 Sep '06

Hi all, I'm trying to use FreeRADIUS with WPA and Chillispot in proxy mode. When I try to login, chillispot give me this error: radius.c: 1602: Received unknown radius packet 11! chilli.c: 3751: radius_proxy_ind() failed! This is the log of freeradius: ------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=mydomain,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "aPassword" ldap: basedn = "ou=myDepartment,dc=mydomain,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP radiusMaxBandwidthDown mapped to RADIUS WISPr-Bandwidth-Max-Down rlm_ldap: LDAP radiusMaxBandwidthUp mapped to RADIUS WISPr-Bandwidth-Max-Up rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139a00 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = yes rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/usr/local/etc/raddb/db.ippool" ippool: ip-index = "/usr/local/etc/raddb/db.ipindex" ippool: range-start = 192.168.182.129 IP address [192.168.182.129] ippool: range-stop = 192.168.182.254 IP address [192.168.182.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1024, id=0, length=125 User-Name = "prof1" EAP-Message = 0x0202000a0170726f6631 Message-Authenticator = 0xdb9251a308d92279fddaedc7cd5553b2 Calling-Station-Id = "00-17-F2-44-11-C2" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "localhost" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "prof1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=myDepartment,dc=mydomain,dc=it' radius_xlat: '(uid=prof1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=it/aPassword to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=myDepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=myDepartment,dc=mydomain,dc=it, with filter (&(cn=professor)(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Maurizio Costanzo,ou=faculty,ou=dspsa,ou=myDepartment,dc=mydomain,dc=it, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group professor rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for prof1 radius_xlat: '(uid=prof1)' radius_xlat: 'ou=myDepartment,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=myDepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: checking if remote access for prof1 is allowed by userPassword rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusGroupName as Ldap-Group, value professor & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-05-5D-25-12-5B & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-02-C7-8F-A0-16 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-0B-6B-4A-22-E8 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-17-F2-44-11-C2 & op=21 rlm_ldap: Adding userPassword as User-Password, value a & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value 98 & op=11 rlm_ldap: user prof1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-05-5D-25-12-5B rlm_checkval: Value Name: Calling-Station-Id, Value: 00-02-C7-8F-A0-16 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-0B-6B-4A-22-E8 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 modcall[authorize]: module "checkval" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 127.0.0.1 port 1024 Service-Type == Framed-User Filter-Id = "98" EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06c632db2f3bbd1c133568054f07c4a0 Finished request 0 ------------------ This is my eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } I've configured Access Point with WPA-Enterprise support. Let me know if you need some other informations. Thanks in advance Best Regards,Giusy

2 5

Question about Multiple-valued attributes
by Ali Majdzadeh 07 Sep '06

07 Sep '06

Hi Is it possible to catch Multiple-valued attributes through a C program? I can fetch, for example, User-Name attribute by calling USER_NAME = getenv (USER_NAME); but how should I fetch something like Cisco-AVPair? Best Regards Ali

2 2

XT Radius to Free Radius
by relists 07 Sep '06

07 Sep '06

Hi I am currently trying to migrate XT Radius to Freeradius and running into a few problems when trying to run an External Script. The external script in XT Radius checks the username and password against a postgres database and if username and password match it returns the details for that user e.g. IP address, Framed-Address etc etc. We are using the default xradiusd.conf file with the port number changed to 1645. We have changed the users file to the following: DEFAULT Auth-Type := External Exec-Program = "/etc/raddb/checkpassword.pl %u %{User-Password}" If we run the scipt manually it works as expected with IP address etc etc returned. These details are stored in our postgres database. We are using the Ntradping tool as suggested by the radius book. When we startup radius using radiusd -X we get the following errors. Does anyone have any ideas what we are doing wrong? Thanks in advance. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1:1926, id=4, length=68 User-Name = "user(a)adslgateway.co.uk" User-Password = "test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "adslgateway.co.uk" for User-Name = "user(a)adslgateway.co.uk" rlm_realm: No such realm "adslgateway.co.uk" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 4 radius_xlat: '/etc/raddb/checkpassword.pl user(a)adslgateway.co.uk test' modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 4 to 192.168.1.1:1926 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 4 with timestamp 44fe9d6f Nothing to do. Sleeping until we see a request.

4 7

exec-program-wait to send back AV pairs to freeradius
by Shankar Ganesh C 07 Sep '06

07 Sep '06

Hi All, I am trying to set values for more than one attributes in the exec-program-wait for accounting start packets. Below is the code i am trying in the exec-program-wait putenv("Calling-Station-ID=10") putenv("Called-Station-ID=50") Putenv("Acct-Session-ID="20") return 0; I have set the exec-wait=yes in the radiusd.conf I am not sure whether freeradius picks all this values and sets in the valuepairs of the radius_exec_program () I am trying to set the accounting response packets with this value pairs in the rad_accounting using pairmove but still my accounting response packets does not contain this attributes value pairs. Can some body help me to solve this problem ? Thanks and regards Shankar ganesh

2 1