- Freeradius-Users - lists.freeradius.org

RE: Changes to dialupadmin
by Jonathan De Graeve 22 Apr '06

22 Apr '06

Latest version attached, hope you can add it to the bugzilla Thx J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Nicolas > Baradakis > Verzonden: zaterdag 22 april 2006 18:09 > Aan: FreeRadius users mailing list > Onderwerp: Re: Changes to dialupadmin > > Jonathan De Graeve wrote: > > > I want to publish my enhancements to dialupadmin to the freeradius > > devels. > > > > How can I do this? > > Please post your patches to the bugzilla. > http://bugs.freeradius.org/ > > -- > Nicolas Baradakis > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Changes to dialupadmin
by Jonathan De Graeve 22 Apr '06

22 Apr '06

I want to publish my enhancements to dialupadmin to the freeradius devels. How can I do this? J.

2 1

Patch adding Monthly volume statistics
by Jonathan De Graeve 22 Apr '06

22 Apr '06

This patch adds monthly volume statistics to the user_accounting.php3 page. Patch agains freeradius-1.0.5

1 0

How it is better to start a script in FreeRadius to change User-Name and realm at proxing?
by Dmitry Lyubimkov 22 Apr '06

22 Apr '06

FreeRadius is used for proxing (user@realm) to others RADIUS servers. Also we change the some attributes at proxing. Некоторое время назад была задача при получении accounting менять аттрибут User-Name в зависимости от аттрибутов User-Name, Calling-Station-ID, Called-Station-ID, ... Some time there was a task to change User-Name attribute at reception of accounting message (depending on User-Name,Calling-Station-ID, Called-Station-ID, ...) We have written a script on python, and have added to preproxy_users file DEFAULT User-Name := `%{exec:/usr/bin/python -u /path/to/script.py %{Packet-Type} %{Acct-Status-Type} %u %i %{Called-Station-Id}}` And write files in pre-proxy section of radius.conf file Now before sending proxied messages our script runs and changes User-Name It certainly is not so convenient because script runs always but it is necessary for us only at accounting, but we considered it in a script. Now the task became wider - before proxing it is necessary to replace not only name of the subscriber (User-Name) but also it's realm. The script we can alter easily. But the matter is that the used mechanism of its start does not approach. At the moment of start from pre-proxy FreeRadius were already determined with proxing - on what RADIUS server it will send this message And in User-Name attribute FreeRadius waits the name without realm. Help me please where and how it is better to put script to have an opportunity to change User-Name attribute before FreeRadius will make decision about proxing? Tnx Dmirty

1 0

ascend-data-filters missing from access-accept
by Christopher Carver 21 Apr '06

21 Apr '06

Hi, I'm having some trouble getting all the Ascend-Data-Filter attributes I set in the users file returned in an access-accept packet. Its strange because some of the filters get returned, but others do not. Its creating a real problem for me. Here is the stanza where I match and attach the attributes. Note that there is no other area in my users file where Ascend-Data-Filters are being used. DEFAULT Huntgroup-Name == xxxyyyzzz Ascend-Data-Filter += "ip out drop udp dstport = 135", Ascend-Data-Filter += "ip out drop udp dstport = 136", Ascend-Data-Filter += "ip out drop udp dstport = 137", Ascend-Data-Filter += "ip out drop udp dstport = 138", Ascend-Data-Filter += "ip out drop udp dstport = 139", Ascend-Data-Filter += "ip out drop udp dstport = 445", Ascend-Data-Filter += "ip out drop udp dstport = 587", Ascend-Data-Filter += "ip out drop udp dstport = 1433", Ascend-Data-Filter += "ip out drop udp dstport = 1434", Ascend-Data-Filter += "ip out drop udp dstport = 4444", Ascend-Data-Filter += "ip out drop tcp dstport = 135", Ascend-Data-Filter += "ip out drop tcp dstport = 136", Ascend-Data-Filter += "ip out drop tcp dstport = 137", Ascend-Data-Filter += "ip out drop tcp dstport = 138", Ascend-Data-Filter += "ip out drop tcp dstport = 139", Ascend-Data-Filter += "ip out drop tcp dstport = 445", Ascend-Data-Filter += "ip out drop tcp dstport = 587", Ascend-Data-Filter += "ip out drop tcp dstport = 1433", Ascend-Data-Filter += "ip out drop tcp dstport = 1434", Ascend-Data-Filter += "ip out drop tcp dstport = 4444", Ascend-Data-Filter += "ip out forward 0", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/32", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/32", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/32", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/30", Ascend-Data-Filter += "ip in forward 0 dstip xxx.xxx.xxx.xxx/30", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in drop tcp dstport = 587", Ascend-Data-Filter += "ip in forward 0", Fall-Through = no Here is the output using radclient on an auth packet that matches that huntgroup: su-2.05b# radclient -f auth localhost:6969 auth nas41v29 Received response ID 72, code 2, length = 1004 Ascend-Data-Filter = "ip output drop udp dstport = 135" Ascend-Data-Filter = "ip output drop udp dstport = 136" Ascend-Data-Filter = "ip output drop udp dstport = 137" Ascend-Data-Filter = "ip output drop udp dstport = 138" Ascend-Data-Filter = "ip output drop udp dstport = 139" Ascend-Data-Filter = "ip output drop udp dstport = 445" Ascend-Data-Filter = "ip output drop udp dstport = 587" Ascend-Data-Filter = "ip output drop udp dstport = 1433" Ascend-Data-Filter = "ip output drop udp dstport = 1434" Ascend-Data-Filter = "ip output drop udp dstport = 4444" Ascend-Data-Filter = "ip output drop tcp dstport = 135" Ascend-Data-Filter = "ip output drop tcp dstport = 136" Ascend-Data-Filter = "ip output drop tcp dstport = 137" Ascend-Data-Filter = "ip output drop tcp dstport = 138" Ascend-Data-Filter = "ip output drop tcp dstport = 139" Ascend-Data-Filter = "ip output drop tcp dstport = 445" Ascend-Data-Filter = "ip output drop tcp dstport = 587" Ascend-Data-Filter = "ip output drop tcp dstport = 1433" Ascend-Data-Filter = "ip output drop tcp dstport = 1434" Ascend-Data-Filter = "ip output drop tcp dstport = 4444" Ascend-Data-Filter = "ip output forward 0" Ascend-Data-Filter = "ip input drop tcp dstport = 25" Ascend-Data-Filter = "ip input drop tcp dstport = 587" Ascend-Data-Filter = "ip input forward 0" Idle-Timeout = 1800 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.255 There's no other place Ascend-Data-Filter is used in the users file, so, there's no chance of that messing it up. This is confusing because it seems to add some but not others. Basically it causes email not to work for the users because the drop rule for port 25 traffic gets added but the allow rule to our mail server does not. Any ideas? Thanks! Chris Carver

2 3

help
by Abey Thomas 21 Apr '06

21 Apr '06

-- Regards, Abey Babu Thomas

2 1

ldap authentication failure
by Abey Thomas 21 Apr '06

21 Apr '06

Thanks Alan . I did EAP and telnet works fine! I have set up the freeradius and using lotus notes LDAP I am able to get authenticated for a TELNET session with CISCO 2950. However in the same setup when I try to get the port authenticated for the WinXP client using EAP-MD5 it is being rejected Help Requested **************************************************************************************************** TEST PLATFORM **************************************************************************************************** LDAP : Lotus Notes Directory Radius : Freeradius 1.0.1 Switch : Cisco 2950 OS : Windows XP with SP2 **************************************************************************************************** Successfull telnet authentication using radius to Cisco 2950 **************************************************************************************************** Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.1:1812, id=56, length=78 NAS-IP-Address = 172.16.1.1 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "abey" Calling-Station-Id = "172.16.2.1" User-Password = "abeypass" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for abey radius_xlat: '(uid=abey)' radius_xlat: 'o=example' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.1:389, authentication 0 rlm_ldap: bind as / to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=example, with filter (uid=abey) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user abey authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "abey" with password "abeypass" rlm_ldap: user DN: CN=Abey Thomas,O=example rlm_ldap: (re)connect to 192.168.1.1:389, authentication 1 rlm_ldap: bind as CN=Abey Thomas,O=example/abeypass to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user abey authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 56 to 172.16.1.1:1812 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 56 with timestamp 44481b5d Nothing to do. Sleeping until we see a request. **************************************************************************************************** Unsuccessful authentication using WinXP EAP-MD5 with LDAP **************************************************************************************************** rad_recv: Access-Request packet from host 172.16.1.1:1812, id=65, length=162 NAS-IP-Address = 172.16.1.1 NAS-Port = 50035 NAS-Port-Type = Ethernet User-Name = "abey" Called-Station-Id = "00-14-69-B1-DE-63" Calling-Station-Id = "00-16-17-29-73-6A" Service-Type = Framed-User Framed-MTU = 1500 State = 0x20e0298dbd677f901ed08b90898c8919 EAP-Message = 0x0201001c0410cbc40efb162c0ae53832615a88e73548616265796274 Message-Authenticator = 0xae7f4801c3431879926a3ec72e5bcc5b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for abey radius_xlat: '(uid=abey)' radius_xlat: 'o=example' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=example, with filter (uid=abey) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user abey authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_eap: EAP packet type response id 1 length 28 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type LDAP rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'abey' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 65 to 172.16.1.1:1812 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 64 with timestamp 44483e3e Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 65 with timestamp 44483e3f Nothing to do. Sleeping until we see a request. **************************************************************************************************** radiusd.conf **************************************************************************************************** prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { eap { default_eap_type = md5 timer_expire = 120 md5 { } leap { } } ldap { server = "10.1.1.111" basedn = "o=slashsupport" filter = "(uid=%u)" } preprocess { } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } } authorize { ldap eap files } authenticate { eap Auth-Type LDAP { ldap } } **************************************************************************************************** users **************************************************************************************************** userone User-Password == "userpass" # DEFAULT Auth-Type := LDAP # Fall-Through = 1 # ************************************************************************* Regards, Abey Babu Thomas

2 1

PostgreSQL tables in a schema
by Milen A. Radev 21 Apr '06

21 Apr '06

Is it possible to place the necessary tables in a separate schema? We need to cross-reference some tables and it would be very convenient if we could place the tables inside the same database together with our other schemas. I saw that same table names are specified in the configuration file (postgresql.conf). Probably it would be easy to prepend the schema name. But I saw some other tables in the DB that are not mentioned in the conf file. -- Milen A. Radev

2 1

EAP-TLS + LDAP
by sukhvinder kumar 21 Apr '06

21 Apr '06

Hi, I'm using RHEL AS release 3 , openldap-2.2.13-2 , FreeRADIUS Version 1.1.1. When i'm authenticating the users locally its working fine, but when i'm using EAP-TLS it gives the below error. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/freeradius/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 60 main: cleanup_delay = 6 main: max_requests = 2048 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.31.18.15 IP address [10.31.18.15] main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "10.31.16.32" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=PwC-Saket" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "providian" ldap: basedn = "dc=PwC-Saket" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 8 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x811aca0 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/openssl/misc/demoCA/private/cakey.pem" tls: certificate_file = "/usr/local/openssl/misc/demoCA/newcerts/A5E6ED1687D6A72A.pem" tls: CA_file = "/usr/local/openssl/misc/demoCA/cacert.pem" tls: private_key_password = "secret" tls: dh_file = "/usr/local/freeradius/etc/raddb/certs/dh" tls: random_file = "/usr/local/openssl/misc/demoCA/private/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/freeradius/etc/raddb/users" files: acctusersfile = "/usr/local/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = no radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.31.18.15:1645 Listening on accounting 10.31.18.15:1646 Ready to process requests. rad_recv: Access-Request packet from host 10.31.17.248:1116, id=0, length=200 Message-Authenticator = 0x256b1d89be3ce1e22d71fecbf6022589 Service-Type = Framed-User User-Name = "cgarg" Framed-MTU = 1488 Called-Station-Id = "00-80-48-35-3B-3B:test" Calling-Station-Id = "00-12-F0-02-FB-68" NAS-Identifier = "Wireless-G Access Point (SMA)" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a016367617267 NAS-IP-Address = 10.31.17.248 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/10.31.17.248/auth-detail-20060419' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.31.17.248/auth-detail-20060419 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cgarg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: leaving group LDAP (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [cgarg/<no User-Password attribute>] (from client TESTING-BDC port 1 cli 00-12-F0-02-FB-68) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.31.17.248 port 1116 Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4445e06f Nothing to do. Sleeping until we see a request. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Pls avdice me where i'm going wrong. Regards, sukhvinder __________________________________________________________ Yahoo! India Matrimony: Find your partner now. Go to http://yahoo.shaadi.com __________________________________________________________ Yahoo! India Matrimony: Find your partner now. Go to http://yahoo.shaadi.com

5 6

integration with edirectory
by Doyle Collings 21 Apr '06

21 Apr '06

Has anybody successfully used the Integrating Novell eDirectory with FreeRadius document that is available on the Novell Web site?

3 2