- Freeradius-Users - lists.freeradius.org

Problem using EAP-TTLS
by luigi natalino 30 Aug '06

30 Aug '06

Hello,i've installed freeradius 1.1.2 and I've configured eap-ttls in eap.conf tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } I've not made other changes to this file. I've launched chillispot with --eapolenable option -> chilli --eapolenable I've installed and configured SecureW2 client on WinXP. The problem is that EAP-TTLS are not used as shown in this log: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=valug,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypass" ldap: basedn = "ou=homewifi,dc=valug,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139948 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1041, id=0, length=219 User-Name = "utente" CHAP-Challenge = 0xb8e461988db3fcb15283eae64c342d1b CHAP-Password = 0x0090a807a589b4864d7900bee913da1710 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "XX-XX-XX-XX-XX-XX" Called-Station-Id = "YY-YY-YY-YY-YY-YY" NAS-Identifier = "localhost" Acct-Session-Id = "44f1bf3c00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x81223a8de1013cb55976c322793533a2 WISPr-Logoff-URL = "http://192.168.182.5:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "utente", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 But "Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=valug,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypass" ldap: basedn = "ou=homewifi,dc=valug,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139948 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1041, id=0, length=219 User-Name = "utente" CHAP-Challenge = 0xb8e461988db3fcb15283eae64c342d1b CHAP-Password = 0x0090a807a589b4864d7900bee913da1710 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "XX-XX-XX-XX-XX-XX" Called-Station-Id = "YY-YY-YY-YY-YY-YY" NAS-Identifier = "localhost" Acct-Session-Id = "44f1bf3c00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x81223a8de1013cb55976c322793533a2 WISPr-Logoff-URL = "http://192.168.182.5:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "utente", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 The authentication seems not to take place through EAP-TTLS. Have I done any mistake in the Freeradius configuration or it depends on SecureW2? Since I use LDAP what Authentication Method i must set insecureW2 (i think PAP) ? What other information I must set? Excuse me for my bad english. Many Thanks, Luigi _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

2 1

Dialupadmin in dedicated server
by Guilherme Franco 30 Aug '06

30 Aug '06

Hello, I need to use Dialup Admin that is installed alone in a dedicated server. In the dialupadmin admin.config, it states thats it needs the /etc/local/radius in the same machine. What can I do? (considering that the freeradius in installed in another server) Thank you.

2 2

1.1.3 on Solaris 10 (sparc)
by Lin Richardson 30 Aug '06

30 Aug '06

I am quite pleased to report I have, with minimal discomfort, version 1.1.3running on Solaris 10. The source actually compiles perfectly once OS dependencies etc. are met. I will share a few tips here for any who may be attempting the same. My main goal was LDAP functionality. Other bells and whistles might require additional steps. Please forgive the Solaris info here, it is dangerously close to being off-topic... except that you need it to install freeradius. ------------------------------- Solaris System Headers Solaris 10 will likely require you to fix the system headers. http://sunfreeware.com/indexsparc10.html. Commands as root: *cd /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/install-tools/ vi mkheaders.conf* - Then put the line "SHELL=/bin/sh" on the first line of the mkheaders.conf file. - It should look something like the following: SHELL=/bin/sh SYSTEM_HEADER_DIR="/usr/include" OTHER_FIXINCLUDES_DIRS="" FIXPROTO_DEFINES="" STMP_FIXPROTO="stmp-fixproto" STMP_FIXINC="stmp-fixinc" Then you run the following command as root. It may take several minutes to rebuild the headers. *./mkheaders *------------------------------- Solaris Packages Solaris 10 has versions of openssl and openLDAP installed I believe with the system. They do not fulfill the compile requirements for freeradius functionality. you should go to http://sunfreeware.com/ and get the packages there, and also resolve any unmet dependencies. If you have other modules you are concerned with that are not building correctly, don't trust the OS packages. Look for equiv packages and try the build with them installed as well. download package gunzip packagename.gz sudo pkgadd -d packagename ------------------------------- Installing FreeRadius Installing actually went off without a hitch. ./configure, make, sudo make install No problems except I needed the packages so rlm_ldap would compile properly. ------------------------------- RunTime Environment In order for the ldap queries to work, the following needs to be set as an environmental variable, OR if you're handy with compiler flags you can take care of it during the compile with the `-RLIBDIR' linker flag. *export LD_LIBRARY_PATH="/usr/local/lib/;/usr/local/freeradius-1.1.3/lib"* The two locations in the above path are for access to the libgcc_s.so.1 libraries and the rlm_ldap libraries respectively.

5 4

How to return the values from the exec program to free radius?
by Shankar Ganesh C 30 Aug '06

30 Aug '06

Hi All, Could some body help me to know how to return values from the exec program ? I can understand that I need to use the output-pairs or reply list .But do not really know how to use that any sample code or document would really help me. Thanks and regards Shankar ganesh

2 2

wpa auth.xp stuck on login
by Collen Blijenberg 30 Aug '06

30 Aug '06

Good day to you all, I'm kinda stuck with authenticating a windows xp sp2 laptop to a wlan - ap that uses wpa. i followed the 802.1X port based auth howto from tldp.org but no luck. the idea is to use ms-chapv2,eap,tls,peap in the log file i can see the user auth. come by, but no errors or problems showed up. the other day, a friend tried is with his mac i-book, and he did get in!? but now my xp machine doesn't.. dunno where it goes wrong.. starting radiusd -XX gives alot of output, but no error's shown either. here is a small dump.. --------- rad_recv: Access-Request packet from host 10.0.0.20:3072, id=0, length=125 User-Name = "collen" NAS-IP-Address = 10.0.0.20 Called-Station-Id = "0016b69e59c3" Calling-Station-Id = "00166f980e78" NAS-Identifier = "0016b69e59c3" NAS-Port = 46 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000b01636f6c6c656e Message-Authenticator = 0xe97abfadc688db9d412503fc8a0e283f Wed Aug 30 15:53:02 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authorize for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 0 Wed Aug 30 15:53:02 2006 : Debug: radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830' Wed Aug 30 15:53:02 2006 : Debug: rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP packet type response id 0 length 11 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Aug 30 15:53:02 2006 : Debug: users: Matched entry collen at line 217 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authorize (returns updated) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rad_check_password: Found Auth-Type EAP Wed Aug 30 15:53:02 2006 : Debug: auth: type "EAP" Wed Aug 30 15:53:02 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authenticate for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP Identity Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: processing type tls Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Initiate Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Start returned 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.0.0.20 port 3072 Reply-Message = "Go and See your system administrator" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x514be7fc208b2ee1df2cc191b5282f3a Wed Aug 30 15:53:02 2006 : Debug: Finished request 0 Wed Aug 30 15:53:02 2006 : Debug: Going to the next request Wed Aug 30 15:53:02 2006 : Debug: --- Walking the entire request list --- Wed Aug 30 15:53:02 2006 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.20:3072, id=0, length=212 User-Name = "collen" NAS-IP-Address = 10.0.0.20 Called-Station-Id = "0016b69e59c3" Calling-Station-Id = "00166f980e78" NAS-Identifier = "0016b69e59c3" NAS-Port = 46 Framed-MTU = 1400 State = 0x514be7fc208b2ee1df2cc191b5282f3a NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d030144f67859f94017b05e178d502a2f37b42e86f6cb6d6d13bd90a07398bdb3115900001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x0fb306b26777d99c2b78ac78fcbbcf85 Wed Aug 30 15:53:02 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authorize for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 1 Wed Aug 30 15:53:02 2006 : Debug: radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830' Wed Aug 30 15:53:02 2006 : Debug: rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP packet type response id 1 length 80 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Wed Aug 30 15:53:02 2006 : Debug: users: Matched entry collen at line 217 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "files" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authorize (returns updated) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rad_check_password: Found Auth-Type EAP Wed Aug 30 15:53:02 2006 : Debug: auth: type "EAP" Wed Aug 30 15:53:02 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authenticate for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: Request found, released from the list Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP/peap Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: processing type peap Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_peap: Authenticate Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: processing TLS Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Length Included Wed Aug 30 15:53:02 2006 : Debug: eaptls_verify returned 11 Wed Aug 30 15:53:02 2006 : Debug: (other): before/accept initialization Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: before/accept initialization Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 read client hello A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write server hello A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write certificate A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write server done A Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 flush data Wed Aug 30 15:53:02 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Aug 30 15:53:02 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Aug 30 15:53:02 2006 : Debug: In SSL Handshake Phase Wed Aug 30 15:53:02 2006 : Debug: In SSL Accept mode Wed Aug 30 15:53:02 2006 : Debug: eaptls_process returned 13 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 10.0.0.20 port 3072 Reply-Message = "Go and See your system administrator" EAP-Message = 0x0102040a19c0000006f1160301004a02000046030144f5983e2a3f2787f349e2c803691e2bd1dcecb00c4cdf71d8130966b67808e0203c016a91c6fb93cb2a5b767bd564efb362ae8b997c45585ec2c3ff446bda25e800040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x98cb9ce82b22aff87c8ddd218edbc40a Wed Aug 30 15:53:02 2006 : Debug: Finished request 1 Wed Aug 30 15:53:02 2006 : Debug: Going to the next request Wed Aug 30 15:53:02 2006 : Debug: rl_next: returning NULL --------------- Cheers Collen..

1 0

Reply VSA-s in Access-Reject
by Yervand Petrosyan 30 Aug '06

30 Aug '06

Thank you for answers, Really, it would be reasonably to have this option configurable. Yervand On Wed 30 Aug 2006 12:13, Nicolas Baradakis wrote: > Yervand Petrosyan wrote: > > In 1.1.3 version Access-Reject doesn't return in reply > > VSA attributes but it is works well in 1.0.1. > > Something was changed? > > Yes, because it was considered as a bug. > See http://bugs.freeradius.org/show_bug.cgi?id=207 > > I also note Vendor-Specific attributes aren't allow in Access-Reject > packets per RFC 2865. (section 5.44) > See http://www.ietf.org/rfc/rfc2865.txt This is not the first time we have been asked this, and as it appears that some NASes used this behaviour, maybe we should make this rfc compliance a configurable option.. I have added a section to the FAQ: http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#VSA_in_Access-Reje… -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

no more anonymous@my.realm
by A.L.M.Buxey＠lboro.ac.uk 30 Aug '06

30 Aug '06

hi, got a small question for those used to xlate etc. I have a development/test setup here which is happily authenticating via EAP/TTLS and PEAP. however, what I am seeing is that Windows users using PEAP are having their real name logged and recorded, whereas the Mac TTLS and Windows TTLS folk are being recorded as anonymous(a)my.realm - ie the outer layer is being recorded as their username (the inner layer username is happily being used for the authorization stage so all is okay....but the NAS and authentication/accounting SQL are filled with the anonymous(a)my.realm now, the Windows PEAP users also have anonymous(a)my.realm as their outer ID but I believe its the 'Windows is a bit leaky with inner credentials' issue that is allowing their real ID to be caught and logged. whats the recommended way of fixing this? what have other people done to fix this? enabling features such as use_tunneled_reply and log_stripped_name havent helped... I am thinking that xlate is the way to go oh, and currently the RADPOSTAUTH table is showing the real ID and the anonymous ID which isnt helping the NAS which receives the anonymous part last. do I simply drop or discard the anonymous part when it gets to this proxy box? alan

1 0

Cannot compile and run on Mac OS X 10.4.7
by Michael Check 30 Aug '06

30 Aug '06

Hi all, We've tried to compile fr v1.1.2 on os x.4.7 with no luck. We've followed the instructions at doc/MACOSX (using --disable_shared - the mod for the makefile for rlm_sql is already done in this version) but get the following errors during make (this is the tail of the make): /usr/bin/ld: multiple definitions of symbol _CRYPTO_lock /usr/lib/libcrypto.dylib(cryptlib.o) definition of _CRYPTO_lock /usr/local/mysql/lib/libmysqlclient_r.a(libtaocrypt_la-misc.o) definition of _CRYPTO_lock in section (__TEXT,__text) collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 And cannot proceed further. --- If you try and compile _without_ --disable_shared, the we get through make with this at the end: /usr/local/src/freeradius-1.1.2/libtool --mode=link gcc -o radwho radwho.lo util.lo log.lo conffile.lo -lresolv -lpthread ../lib/libradius.la gcc -o .libs/radwho radwho.o util.o log.o conffile.o -lresolv -lpthread -L../lib/.libs -lradius creating radwho Making all in raddb... make[2]: Nothing to be done for `all'. Making all in scripts... make[2]: Nothing to be done for `all'. Making all in doc... Making all in examples... /usr/bin/make -C examples all make[4]: Nothing to be done for `all'. Making all in rfc... /usr/bin/make -C rfc all make[4]: Nothing to be done for `all'. The make install has these ominous warning while linking all the libraries for each rlm: ---------------------------------------------------------------------- Making install in rlm_realm... if [ "xrlm_realm" != "x" ]; then \ /usr/local/src/freeradius-1.1.2/libtool --mode=install /usr/local/src/freeradius-1.1.2/install-sh -c -c \ rlm_realm.la /usr/local/lib/rlm_realm.la || exit $?; \ rm -f /usr/local/lib/rlm_realm-1.1.2.la; \ ln -s rlm_realm.la /usr/local/lib/rlm_realm-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_realm.la' (cd /usr/local/src/freeradius-1.1.2/src/modules/rlm_realm; /bin/sh /usr/local/src/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_realm.la -rpath /usr/local/lib rlm_realm.lo rlm_realm.c /usr/local/src/freeradius-1.1.2/src/lib/libradius.la -lresolv -lpthread) gcc -dynamiclib -flat_namespace -undefined suppress -o .libs/rlm_realm-1.1.2.so rlm_realm.lo /usr/local/lib/libradius.dylib -lresolv -lpthread -lc -install_name /usr/local/lib/rlm_realm-1.1.2.so /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm-1.1.2.soT /usr/local/lib/rlm_realm-1.1.2.so (cd /usr/local/lib && rm -f rlm_realm.so && ln -s rlm_realm-1.1.2.so rlm_realm.so) /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm.lai /usr/local/lib/rlm_realm.la /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm.a /usr/local/lib/rlm_realm.a ranlib /usr/local/lib/rlm_realm.a chmod 644 /usr/local/lib/rlm_realm.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable during execution See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- AND FOR PERL: Making install in rlm_perl... /usr/local/src/freeradius-1.1.2/install-sh -c -m 755 example.pl /usr/local/etc/raddb if [ "xrlm_perl" != "x" ]; then \ /usr/local/src/freeradius-1.1.2/libtool --mode=install /usr/local/src/freeradius-1.1.2/install-sh -c -c \ rlm_perl.la /usr/local/lib/rlm_perl.la || exit $?; \ rm -f /usr/local/lib/rlm_perl-1.1.2.la; \ ln -s rlm_perl.la /usr/local/lib/rlm_perl-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_perl.la' (cd /usr/local/src/freeradius-1.1.2/src/modules/rlm_perl; /bin/sh /usr/local/src/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_perl.la -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /usr/local/src/freeradius-1.1.2/src/lib/libradius.la -L/usr/local/lib /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread) *** Warning: This library needs some functionality provided by /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. gcc -dynamiclib -flat_namespace -undefined suppress -o .libs/rlm_perl-1.1.2.so rlm_perl.lo /usr/local/lib/libradius.dylib -L/usr/local/lib -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread -lc -install_name /usr/local/lib/rlm_perl-1.1.2.so /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl-1.1.2.soT /usr/local/lib/rlm_perl-1.1.2.so (cd /usr/local/lib && rm -f rlm_perl.so && ln -s rlm_perl-1.1.2.so rlm_perl.so) /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl.lai /usr/local/lib/rlm_perl.la /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl.a /usr/local/lib/rlm_perl.a ranlib /usr/local/lib/rlm_perl.a chmod 644 /usr/local/lib/rlm_perl.a AND RUNNING sudo radiusd -X, the following error results: read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1565] Failed to link to module 'rlm_exec': dlopen(/usr/local/lib/rlm_exec-1.1.2.so, 9): Symbol not found: _debug_flag Referenced from: /usr/local/lib/rlm_exec-1.1.2.so Expected in: flat namespace AND QUITS IMMEDIATELY --- We tried googling around and we're happy to hear that freeradius will be a part of 10.5, but we'd like to get it running now... There really is no other docs we've found on getting it compiled (after difficulty like the above) and installed. Certainly nothing recent anyway. Is it true that it _should_ just work? :) Thanks in advance for any assistance, Michael Check

7 16

Checking Service-Type with checkval and mysql
by Guilhem MORE-CAUSSE 30 Aug '06

30 Aug '06

Hello I am currently trying to have my FreeRadius server check the "Service-Type" values, and reject Login attempts from a user that should be used for service-type Outbound only. My client equipment always send the "Service-Type" attribute in its requests. This attribute is defined into the check databases, but debug mode says: >>Debug: rlm_checkval: Could not find attribute named Service-Type in check pairs I really do not see what is wrong and why value checking is not done properly. It should find the attribute in the database, and reject the request. Can you help me out ? Below is my radcheck table, relevant parts of my radiusd.config and the debug output. mysql> select * from radcheck; +----+----------+--------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+--------------+----+----------+ | 3 | admin | Password | == | cisco | | 5 | admin | Service-Type | == | Outbound | +----+----------+--------------+----+----------+ checkval { item-name = Service-Type check-name = Service-Type data-type = string notfound-reject = yes } //... authorize { preprocess chap suffix eap #files sql checkval } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } eap } rad_recv: Access-Request packet from host 10.10.107.68:1645, id=6, length=86 NAS-IP-Address = 10.10.107.68 NAS-Port = 500 NAS-Port-Type = Virtual User-Name = "admin" Calling-Station-Id = "XXX.XXX.XXX.XXX" User-Password = "cisco" Service-Type = Login-User Wed Aug 30 11:30:13 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 11:30:13 2006 : Debug: modcall: entering group authorize for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_realm: No '@' in User-Name = "admin", looking up realm NULL Wed Aug 30 11:30:13 2006 : Debug: rlm_realm: No such realm "NULL" Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 1 Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'admin' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'admin' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'admin' ORDER BY id' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'admin' ORDER BY id' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): Released sql socket id: 3 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling checkval (rlm_checkval) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_checkval: Item Name: Service-Type, Value: Login-User Wed Aug 30 11:30:13 2006 : Debug: rlm_checkval: Could not find attribute named Service-Type in check pairs Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from checkval (rlm_checkval) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "checkval" returns notfound for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall: group authorize returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: auth: type Local Wed Aug 30 11:30:13 2006 : Debug: auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 6 to 10.10.107.68:1645 Cisco-AVPair += "ipsec:tunnel-password=admin123" Cisco-AVPair == "ipsec:addr-pool=admin" Cisco-AVPair == "ipsec:inacl=admin" Service-Type == Outbound-User Cisco-AVPair += "shell:priv-lvl=0" Cisco-AVPair += "ipsec:key-exchange=ike" Cisco-AVPair += "ipsec:key-exchange=preshared-key" Tunnel-Type:0 == ESP Wed Aug 30 11:30:13 2006 : Debug: Finished request 1 Wed Aug 30 11:30:13 2006 : Debug: Going to the next request Thanks for your help ! G.

1 0

Reply VSA-s in Access-Reject
by Yervand Petrosyan 30 Aug '06

30 Aug '06

Hello, In 1.1.3 version Access-Reject doesn't return in reply VSA attributes but it is works well in 1.0.1. Something was changed? Thanks in advance, Yervand __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3