- Freeradius-Users - lists.freeradius.org

rlm_ldap: could not start TLS
by Marc Delisle 03 Apr '06

03 Apr '06

Hi, I'm trying to make freeradius 1.1.0 contact a LDAP server. I configured freeradius --with-edir. The error I get is "rlm_ldap: could not start TLS Can't contact LDAP server" I followed this document http://www.novell.com/coolsolutions/tip/15922.html except that in my case, the LDAP server is on Netware 6.5 SP5. On this Netware server, LDAP responds correctly over SSL, as tested with Novell's ldapsearch on port 636. In radiusd.conf, in the ldap section, I use tls_cacertfile = /usr/local/freeradius/etc/raddb/certs/rootder.b64 which is the self-signed certificate exported from the Netware's CA object. I can provide other details about my "LDAP server" object in Netware upon request. Thanks in advance, Marc Delisle

4 5

Problem with LDAP against Active Directory
by domjullier＠rhone.ch 03 Apr '06

03 Apr '06

Hi folks, I want authenticate users from a WLAN with freeradius. The Users are stored in the Active Directory of a Windows 2003 Server. With some Tutorials from the Internet I have configured freeradius to make that. Unfortunately the Authentication function not succesfully. Thats the output from FreeRadius during the Authentication: rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 NAS-Port-Type = Ethernet Service-Type = Login-User User-Name = "ldap" User-Password = "ldap" Called-Station-Id = "00:01:02:ad:64:f7" Calling-Station-Id = "00:c0:49:54:b5:43" NAS-Port = 1 Mon Apr 3 11:12:08 2006 : Debug: Processing the authorize section of radiusd.conf Mon Apr 3 11:12:08 2006 : Debug: modcall: entering group authorize for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No '@' in User-Name = "ldap", looking up realm NULL Mon Apr 3 11:12:08 2006 : Debug: rlm_realm: No such realm "NULL" Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 2 Mon Apr 3 11:12:08 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 2 Mon Apr 3 11:12:08 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: - authorize Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: performing user authorization for ldap Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: '(uid=ldap)' Mon Apr 3 11:12:08 2006 : Debug: radius_xlat: 'ou=Sion, o=ad.ch' Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: attempting LDAP reconnection Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: closing existing LDAP connection Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: (re)connect to ad.ch:389, authentication 0 Mon Apr 3 11:12:08 2006 : Debug: rlm_ldap: bind as / to ad.ch:389 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: Bind was successful Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing search in ou=Sion, o=ad.ch, with filter (uid=ldap) Mon Apr 3 11:12:18 2006 : Error: rlm_ldap: ldap_search() failed: Operations error Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: search failed Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "ldap" returns fail for request 2 Mon Apr 3 11:12:18 2006 : Debug: modcall: group authorize returns fail for request 2 Mon Apr 3 11:12:18 2006 : Debug: Finished request 2 Mon Apr 3 11:12:18 2006 : Debug: Going to the next request Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:18 2006 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 Mon Apr 3 11:12:18 2006 : Debug: Discarding duplicate request from client testnet:4596 - ID: 13 Mon Apr 3 11:12:18 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:18 2006 : Debug: Cleaning up request 2 ID 13 with timestamp 4430e6e8 Mon Apr 3 11:12:18 2006 : Debug: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.210.15:4596, id=13, length=100 NAS-Port-Type = Ethernet Service-Type = Login-User User-Name = "ldap" User-Password = "ldap" Called-Station-Id = "00:01:02:ad:64:f7" Calling-Station-Id = "00:c0:49:54:b5:43" NAS-Port = 1 Mon Apr 3 11:12:18 2006 : Debug: Processing the authorize section of radiusd.conf Mon Apr 3 11:12:18 2006 : Debug: modcall: entering group authorize for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No '@' in User-Name = "ldap", looking up realm NULL Mon Apr 3 11:12:18 2006 : Debug: rlm_realm: No such realm "NULL" Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Mon Apr 3 11:12:18 2006 : Debug: modcall[authorize]: module "files" returns notfound for request 3 Mon Apr 3 11:12:18 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 3 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: - authorize Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: performing user authorization for ldap Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: '(uid=ldap)' Mon Apr 3 11:12:18 2006 : Debug: radius_xlat: 'ou=Sion, o=ad.ch' Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: attempting LDAP reconnection Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: closing existing LDAP connection Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: (re)connect to ad.ch:389, authentication 0 Mon Apr 3 11:12:18 2006 : Debug: rlm_ldap: bind as / to ad.ch:389 Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: Bind was successful Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: performing search in ou=Sion, o=ad.ch, with filter (uid=ldap) Mon Apr 3 11:12:28 2006 : Error: rlm_ldap: ldap_search() failed: Operations error Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: search failed Mon Apr 3 11:12:28 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Apr 3 11:12:28 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 3 Mon Apr 3 11:12:28 2006 : Debug: modcall[authorize]: module "ldap" returns fail for request 3 Mon Apr 3 11:12:28 2006 : Debug: modcall: group authorize returns fail for request 3 Mon Apr 3 11:12:28 2006 : Debug: Finished request 3 Mon Apr 3 11:12:28 2006 : Debug: Going to the next request Mon Apr 3 11:12:28 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:28 2006 : Debug: Waking up in 6 seconds... Mon Apr 3 11:12:34 2006 : Debug: --- Walking the entire request list --- Mon Apr 3 11:12:34 2006 : Debug: Cleaning up request 3 ID 13 with timestamp 4430e6f2 Mon Apr 3 11:12:34 2006 : Debug: Nothing to do. Sleeping until we see a request. Where can I fix the misstake which produce this error? greets dominique

1 0

VLAN and SSID
by Antonio Matera 03 Apr '06

03 Apr '06

Hallo, I have a problem with the authentication on different VLAN. I write for you my example: I have two VLAN (VLAN1 and VLAN2) conneccted to two SSID (SSID1 and SSID2) on my Cisco 1200 AP. I have the same authentication on both connection (EAP-TLS). In my users file I have two user: user1 Auth-Type := EAP Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN the authentication works fine but , for example, if I connect the WinXP client on the SSID1 with the certificate user of the VLAN2, I have this situation: The client is connected to the VLAN2 but the SSID of the wireless connection is SSID1. It is possible to prevent the connection to the select SSID if the certificate of the user is incorrect? Thanks, bye

4 12

CallingStationId
by Mordor Networks 03 Apr '06

03 Apr '06

Hello, I finally have a working rp-pppoe+pppd+linux+radius+mysql setup handling lots of connections :) I used to handle pppoe connections on freebsd, and when a connection is established, the field "CallingStationId" of the radacct table on mysql had the mac address of the calling user. rp-pppoe (or maybe linux pppd) seems not to do this by default and the field in question is left blank. Does anybody know a way to solve this? Thanks in advance..

3 3

RE: pppoe-server
by Seferovic Edvin 02 Apr '06

02 Apr '06

Hi, 1. try sending the interval in the Acct-Interim-Interval attribute to your pppoe-server 2. try to send the questions to the mailing list Regards, Edvin ________________________________________ From: Wassim abbas [mailto:wassim.abbas@gmail.com] Sent: Montag, 03. April 2006 00:18 To: edvin.seferovic(a)kolp.at Subject: Re: (no subject) Hello 1. modify your pppoe-server to send accouting updates every hour or less How?

1 0

(no subject)
by i-isp＠gmx.at 02 Apr '06

02 Apr '06

hi, i have freeradius + mysql + cisco + pppoe clients. the pppoe client is 3 day online. the radius have 1 line with input/output octets the statistic for the users must to every hours the input/output octets have you a idea? best regrds harald -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

2 3

Disconnect Users
by mohammad flaifel 01 Apr '06

01 Apr '06

Hi all,I still woundering how to disconnect a PPPOE user when he/she reaches a download limit?is there a direct way to do it? or we can do a work around?Flaifel

1 0

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 01 Apr '06

01 Apr '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > I was wondering if someone has any idea of how to solve the problem of > special characters(e.g. $) in FreeRadius 1.1.0. Have you tried FreeRADIUS 1.1. which was released last week? According to the ChangeLog the bug #261 has been fixed and it was the "attributes retreived from ldap are truncated at first space" bug, which sounded very similar to our problem: http://bugs.freeradius.org/show_bug.cgi?id=261 -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 7

RE: Version 1.1.1 stops responding
by King, Michael 31 Mar '06

31 Mar '06

I'm running it in debug mode (and piping it to a file) Freeradius -X -A >crash.log After a few hours this is what I got. On the command line. rad2:/home/mking# /usr/sbin/freeradius -X -A >crash.log Killed rad2:/home/mking# The last few lines from the log file are rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello And that's it? Unfortunatly, I deleted the log file by mistake. (I really should drink my coffee before typing) I'm attempting to recreate it now. It shouldn't be long, (I hope)

4 4

Radrelay and detail file permissions
by Ben Plimpton 31 Mar '06

31 Mar '06

I have setup radius to log detail files for radrelay to use. I think that I followed the documentation exactly except for the name of the detail file. detail detail-combined { detailfile = ${radacctdir}/detail-combined detailperm = 0600 dirperm = 0755 locking = yes } accounting { detail detail-combined } FreeRadius logs to this file properly if I don't startup radrelay and the permissions remain as I would expect they should: -rw------- 1 radiusd radiusd 1166 Mar 31 12:02 detail-combined But when I start radrelay the permissions change: [root@ns1-new radacct]# radrelay -a /var/log/radius/radacct \ -d /etc/raddb -n ns2-new detail-combined [root@ns1-new radacct]# ls -la total 44 drwx------ 9 radiusd radiusd 4096 Mar 31 12:08 . drwx------ 3 radiusd radiusd 4096 Mar 31 12:02 .. drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 11:42 127.0.0.1 drwxr-xr-x 2 radiusd radiusd 4096 Mar 17 16:17 216.17.128.39 drwxr-xr-x 2 radiusd radiusd 4096 Feb 7 00:30 216.237.65.2 drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 00:00 216.237.67.198 drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 09:34 216.237.67.217 drwxr-xr-x 2 radiusd radiusd 4096 Feb 14 09:49 216.237.72.66 drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 10:39 216.237.77.3 -rw------- 1 root root 0 Mar 31 12:08 detail-combined [root@ns1-new radacct]# I start getting error like this in my radius.log which I would expect with the file permissions the way they are and radiusd cannot log to the detail file properly and as a result, radrelay cannot send the accounting request to the remote server: Fri Mar 31 12:11:13 2006 : Error: rlm_detail: Couldn't open file /var/log/radius/radacct/detail-combined: Permission denied Am I missing something with the way I am starting up radrelay? Or are there permissions that I need to check somewhere else? Should radrelay be run as user radiusd? If so, how would I do that? Also. My system is running Fedora Core 4 - FreeRadius Ver 1.0.4 Any help is greatly appreciated. Thanks -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

2 1