- Freeradius-Users - lists.freeradius.org

cisco vpn & radius
by Pierre LEONARD 10 May '06

10 May '06

hi i would like to configure my cisco 2620 router as VPN concentrator with a 12.3 IOS and i use a radius server (freeradius) to authenticate the users of the VPN but when the radius get the ip config to the router then the router don't relay these informations to the VPN client and it assigns an ip in its pool. i don't know how must i config the router in order that it uses the radius ip config to configure the VPN client... if i delete the pool from the router then i cannot connect on the VPN router and i didn't find any configuration to specify the router to use the ip config from the radius... i hope i'm clear !!

1 1

enabling syslog service in freeradius-1.1.1
by sumi thra 10 May '06

10 May '06

Hi All, How to send the freeradius server logs to remote syslog server?? Is it a compile time option? or we need to specify in config script to build with syslog option. or starting the server with radiusd -l syslog is enough ? How do i go ahead? Please reply me if you have any idea. Thanks, Sumi

1 1

ippool
by Pierre LEONARD 09 May '06

09 May '06

hi everybody, i try to use the main_pool module but i meet some problems with it. I'm using radius server in order to authenticate vpn users connected on a cisco router i would like to assign fixed ip for each vpn users but when i use main_pool module in post-auth section, freeradius don't want to start with this error : Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded files Module: Instantiated files (files) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded IPPOOL rlm_ippool: Failed to open file /etc/freeradius/db.ippool: Permission denied radiusd.conf[561]: main_pool: Module instantiation failed. radiusd.conf[611] Unknown module "main_pool". radiusd.conf[609] Failed to parse post-auth section. what is the utility of db.ippool and db.ipindex ? and what is the right syntaxe for this both files ?

4 5

Bugzilla problem?
by Jason Testart 09 May '06

09 May '06

Last night, I tried to create myself an account on the freeradius Bugzilla (bugs.freeradius.org) and I have yet to receive any mail. I tried a total of 3 times with three different e-mail addresses. Anyone else having problems?

2 1

FreeRADIUS 1.1.1 Segmentation fault on Fedora 4
by Nikolas Thoman 09 May '06

09 May '06

I am running FreeRADIUS 1.1.1 on a Fedora Core 4 server (kernel 2.6.11-1.1369_FC4smp) to authenticate using EAP-SIM. After ~400 successful auths at 20 requests/second the radiusd service encounters a segmentation fault. The output of the gdb dump is as follows: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208572224 (LWP 9805)] 0x0072ec33 in _int_malloc () from /lib/libc.so.6 (gdb) bt #0 0x0072ec33 in _int_malloc () from /lib/libc.so.6 #1 0x00730792 in malloc () from /lib/libc.so.6 #2 0x005007e4 in eap_compose (handler=0x8fb8220) at eap.c:395 #3 0x004ffa94 in eap_authenticate (instance=0x8f8e4b8, request=0x8fbe648) at rlm_eap.c:341 #4 0x08053009 in modcall () #5 0x0805351d in modcall () #6 0x0805312d in modcall () #7 0x080525ba in find_module_instance () #8 0x0804c532 in rad_check_password () #9 0x0804cb03 in rad_authenticate () #10 0x08054c0a in rad_respond () #11 0x08056287 in main () (gdb) I have another FreeRADIUS 1.0.3 server running on a Red Hat 9 server (kernel 2.4.20-8) that has had no problems running this kind of traffic. Any help in diagnosing the reason why I'm encountering a fault in malloc would be much appreciated. Thanks, Nik

4 17

Limit connection
by charlonet 09 May '06

09 May '06

Hi, I have small problem concern with my radius server(freeradius). I cannot how make to limit the connection of the various accounts ? exple: user1: 2 simultaneous connections user2: 1 connection simultaneous Cordially ---------------------------------------------------------------------- Le Pingouin Noir -- Charlonet -- Fixe : 20 32 68 91 / 20 32 07 57 GSM : +225 08 00 74 80 ICQ : 323076595 skype : charlonet yahoomessenger : charlonet MSN : charlonet_gates(a)hotmail.com Adresse Postale : 06 BP 1217 Abidjan 06 Côte d'Ivoire Vous avez reçu gratuitement donnez gratuitement (Mt 10,8) ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 1

users connected blocked
by Nicola Iotti 09 May '06

09 May '06

Hi all....sorry for HTML content but it's not my PC...... We are using freeradius 1.0.5 just as proxy to do a realm based messages redirection... we have the problem that sometimes the radius client doesn't send stop message and users remain connected.It is a big problem because if one user blocked tries to connect again, the main server rejects connection because in its database the user is already connected. Is it possible to use Acct-Interim-Attribute to solve this problem.. I mean: is it possible to do that when freeradius doesn't receive anymore Interim-Update messages for one connection, it sends to main server a stop message for that connection ? Or is there another way to force connection ends message to main server after a fixed time or when freeradius doesn't receive anymore Interim-Update message even if freeradius doesn't receive stop message from client?(remember that all the database are on the main server only..) Thank you Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

2 1

Help in Freeradius and openser
by raviprakash sunkara 09 May '06

09 May '06

Hi to all, I tried to insert the users for testing the server, but small error arrived. That is . a) radiusd.conf[1840] unknown Auth-Type "digest" in authenticate section. b) radclient: Failed to send packet for ID 162: Unknown attribute "NAS-IP-Address" c) radtest test test 192.168.2.55 1812 radiustest Sending Access-Request of id 215 to 192.168.2.55 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 Re-sending Access-Request of id 215 to 192.168.2.55 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 Please help me in a,b and c issues. what are these issues. Please help me -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

2 1

problems with machine authetication
by wekz 09 May '06

09 May '06

Hello everybody, last week I was working out a freeradius 1.1.1 + ldap with domain authentication. I got it running with the help of Phil Mayers with this configuration: authorize { preprocess ntdomain # other modules } realm MYDOMAIN { type = radius authhost = LOCAL accthost = LOCAL strip } But it didn't work till I enable ntdomain_hack in the mschap module: with_ntdomain_hack = yes The truth is I don't understand it at all. Here's my thinking: When someone is trying to authenticate and he belongs to a domain, in the request packet windows sends a string like: MYDOMAIN\\username In the authorization part, using the realm ntdomain, the server can strip the User-Name and use only username so it can find it in ldap. But when it comes to the authorization module it fails. Here's part of the log: Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) ............... rad_recv: Access-Request packet from host 192.168.51.162:1024, id=50, length=279 Acct-Session-Id = "2a6bb0b4-00000017" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1496 Framed-IP-Address = 255.255.255.254 User-Name = "MYDOMAIN\\prueba_freeradius" Calling-Station-Id = "00-04-23-8D-4B-0E" Service-Type = Framed-User EAP-Message = 0x02b1006c190017030100610d895f029ebe43af255559638cf1e7e9d0639a11e7d7dfec4a794bee5fbee0a2bf64947cd8a99ad354fa03d6a0913904068c58dd975f8a122a929bc477b2af67b8907c9a4c6a2765188e878ca77f07e45a5329a20fd473989289fdfe3c23eb646b State = 0x908673323bd5eac7e882e906e316049f Colubris-AVPair = "ssid=aamm" Message-Authenticator = 0x8e2b19ea1dfd0d6f0f5b4c895f619818 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN\prueba_freeradius" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "prueba_freeradius" rlm_realm: Proxying request from user prueba_freeradius to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 14 radius_xlat: '/usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509' rlm_detail: /usr/local/radius_regex/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509 modcall[authorize]: module "auth_log" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 177 length 108 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 14 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba_freeradius radius_xlat: '(uid=prueba_freeradius)' radius_xlat: 'ou=Central,dc=bcn,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Central,dc=bcn,dc=es, with filter (uid=prueba_freeradius) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value xxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba_freeradius authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 14 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 14 modcall: leaving group authorize (returns updated) for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02b100551a02b1005031d780cac8a727745249e57389beb21e6800000000000000004a4d93fb40b1108062905326a78ff4081fea67b75e569815004d59444f4d41494e5c7072756562615f66726565726164697573 PEAP: Setting User-Name to MYDOMAIN\prueba_freeradius PEAP: Adding old state with dc 47 PEAP: Sending tunneled request EAP-Message = 0x02b100551a02b1005031d780cac8a727745249e57389beb21e6800000000000000004a4d93fb40b1108062905326a78ff4081fea67b75e569815004d59444f4d41494e5c7072756562615f66726565726164697573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "MYDOMAIN\\prueba_freeradius" State = 0xdc47453244df028b4a9c81ff38a17be9 Acct-Session-Id = "2a6bb0b4-00000017" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1496 Framed-IP-Address = 255.255.255.254 Calling-Station-Id = "00-04-23-8D-4B-0E" Service-Type = Framed-User Colubris-AVPair = "ssid=aamm" NAS-IP-Address = 192.168.51.162 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN\prueba_freeradius" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "prueba_freeradius" rlm_realm: Proxying request from user prueba_freeradius to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 14 radius_xlat: '/usr/local/radius_regex/var/log/radius/radacct/127.0.0.1/auth-detail-20060509' rlm_detail: /usr/local/radius_regex/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius_regex/var/log/radius/radacct/127.0.0.1/auth-detail-20060509 modcall[authorize]: module "auth_log" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 177 length 85 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 14 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba_freeradius radius_xlat: '(uid=prueba_freeradius)' radius_xlat: 'ou=Central,dc=bcn,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Central,dc=bcn,dc=es, with filter (uid=prueba_freeradius) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value xxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba_freeradius authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 14 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 14 modcall: leaving group authorize (returns updated) for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 14 rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? rlm_mschap: Told to do MS-CHAPv2 for MYDOMAIN\prueba_freeradius with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 14 modcall: leaving group MS-CHAP (returns reject) for request 14 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 14 modcall: leaving group authenticate (returns reject) for request 14 auth: Failed to validate the user. Login incorrect: [prueba_freeradius/<no User-Password attribute>] (from client localhost port 8 cli 00-04-23-8D-4B-0E) PEAP: Got tunneled reply RADIUS code 3 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-CHAP-Error = "\261E=691 R=1" EAP-Message = 0x04b10004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8153428 3 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-CHAP-Error = "\261E=691 R=1" EAP-Message = 0x04b10004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 14 modcall: leaving group authenticate (returns handled) for request 14 Sending Access-Challenge of id 50 to 192.168.51.162 port 1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01b200261900170301001b6c9a8c161b62aec589f4a4f92e58f4c76ec7ae250761970d9213c7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa18cd510394250c8136571f619e429e0 Finished request 14 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.51.162:1024, id=36, length=209 Acct-Session-Id = "2a6bb0b4-00000017" NAS-Port = 8 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1496 Framed-IP-Address = 255.255.255.254 User-Name = "MYDOMAIN\\prueba_freeradius" Calling-Station-Id = "00-04-23-8D-4B-0E" Service-Type = Framed-User EAP-Message = 0x02b200261900170301001bd89d386a7c80dcf210c271671421915148555085d02e7c2a34149e State = 0xa18cd510394250c8136571f619e429e0 Colubris-AVPair = "ssid=aamm" Message-Authenticator = 0xacf972ea063d9318ee2b2dad1613cc3c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN\prueba_freeradius" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "prueba_freeradius" rlm_realm: Proxying request from user prueba_freeradius to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 15 radius_xlat: '/usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509' rlm_detail: /usr/local/radius_regex/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius_regex/var/log/radius/radacct/192.168.51.162/auth-detail-20060509 modcall[authorize]: module "auth_log" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: EAP packet type response id 178 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 15 rlm_ldap: - authorize rlm_ldap: performing user authorization for prueba_freeradius radius_xlat: '(uid=prueba_freeradius)' radius_xlat: 'ou=Central,dc=bcn,dc=es' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Central,dc=bcn,dc=es, with filter (uid=prueba_freeradius) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value xxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user prueba_freeradius authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 15 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 15 modcall: leaving group authorize (returns updated) for request 15 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 15 modcall: leaving group authenticate (returns invalid) for request 15 auth: Failed to validate the user. Login incorrect: [prueba_freeradius/<no User-Password attribute>] (from client ap port 8 cli 00-04-23-8D-4B-0E) Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 36 to 192.168.51.162 port 1024 After reading the comments of with_ntdomain_hack, what i get is this: The first time windows sends the id, the User-Name = MYDOMAIN\\username, but when he response the access-challenge the User-Name = username. I wonder why the server expects MYDOMAIN\\username. After the realm the server will only see User-Name = username in ldap-authorization. And as windows sends for replying the challenge only username, I thought this second time realm was not going to be aplicable. So I think I don't understand this operation. And as I don't understand it I can't work out a new configuration like: freeradius 1.1.1 + ldap + machine authentication. User-Name = host/username I have tried it making a new realm with this configuration radiusd.conf realm hostdm { format = prefix delimiter = "/" ignore_default = no ignore_null = no } authorize { preprocess hostdm # other modules } proxy.conf: realm host { type = radius authhost = LOCAL accthost = LOCAL strip } But I got me into the same situation as with ntdomain + with_ntdomain_hack=no. Then I try with the hints file: DEFAULT User-Name =~ "^([^/]+)/([^/]+)" User-Name := `%{2}` But the same. So I don't know what to do. Is there another feature like with_ntdomain_hack for this ? I could put some logs if needed. If there is something unintelligible please tell me, because my english is terrible, as you can notice. Thanks.

1 0

freeradius port to windows
by jasonatx0001 09 May '06

09 May '06

Anyone know of a Windows port of freeradius ? -- View this message in context: http://www.nabble.com/freeradius-port-to-windows-t1578157.html#a4284227 Sent from the FreeRadius - User forum at Nabble.com.

3 3