- Freeradius-Users - lists.freeradius.org

freeradius 1.1.0 on mac os x 10.4.5 not working
by John Bass 18 Feb '06

18 Feb '06

Hi All, I'm attempting to run freeradius 1.1.0 on mac os x 10.4.5 without much luck. I searched the web and found that someone posted an identical problem with no resolution. Attached is output from a darwin ports install along with output from 'radiusd -X'. I've tried compiling from the source as is and with the shared library option disabled. In all cases I get the same result. Any ideas? Thanks! -- John Bass john_bass(a)ncsu.edu (919) 515-0154 www.cnl.ncsu.edu www.centaurlabs.net Never ask a barber if you need a haircut.

1 0

Re: Adding Extra Attribute
by Abdul Lateef 18 Feb '06

18 Feb '06

Hi Alan, Thank you for your kind of information. i look to dictionary.cisco and i found Cisco-Command-Code, and it is really working well for me. -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 ICQ: 276994704 MSN: abdulzu(a)hotmail.com GoogleTalk: lateef.np(a)gmail.com YM!: abdul_zu Doha Qatar http://www.hatif.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

problems with EAP-TTLS with Intermec GUN 2415
by Johan Arens 18 Feb '06

18 Feb '06

Hi I'm trying to setup a freeradius server, to be able to authenticate some handheld devices (Intermec 2415). The auth protocol supported by the handheld is EAP-TTLS. I've Debian Sarge, and I compiled my self freeradius 1.0.5 with openssl-0.9.7e. (my compilation options ./configure --with-openssl-includes=/usr/include --with-openssl-libraries=/usr/lib/ssl -disable-shared -sysconfdir=/etc --prefix=/usr/local ) I got the certificates from Intermec for the server and the cacert. I cannot authenticate with the radius, I got this error when the handheld try to auth : Wed Feb 15 15:27:42 2006 : Info: Ready to process requests. Wed Feb 15 15:28:21 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 15 15:28:21 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message However, if I enable the radius inside the access point, the handheld can authenticate. This tells me that the handheld has been configured properly. What is missing in my freeradius config ? Thanks in advance Johan The detailed debug log (radiusd -X) Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAPv2" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/intermec/server.pem" tls: certificate_file = "/etc/raddb/certs/intermec/server.pem" tls: CA_file = "/etc/raddb/certs/intermec/cacert.cer" tls: private_key_password = "BigSecretPass" tls: dh_file = "/dev/null" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.1:1024, id=6, length=134 User-Name = "anonymous" NAS-IP-Address = 192.168.0.1 Called-Station-Id = "00-10-40-01-90-09" NAS-Identifier = "31100100221" NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Calling-Station-Id = "00-02-2d-3c-ef-79" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x61efabf1e39ae3a5983e1b7c7ed39037 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/192.168.0.1/auth-detail-20060216' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20060216 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 6 to 192.168.0.1:1024 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8101bb02421a224e415fb643fd5a5a70 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 6 with timestamp 43f489f3 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.0.1:1024, id=7, length=210 State = 0x8101bb02421a224e415fb643fd5a5a70 User-Name = "anonymous" NAS-IP-Address = 192.168.0.1 Called-Station-Id = "00-10-40-01-90-09" NAS-Identifier = "31100100221" NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Calling-Station-Id = "00-02-2d-3c-ef-79" EAP-Message = 0x020100481500160301003d01000039030143ea8be941bd45d21f3b9c251cd225b597150a6d8b46a8ff186ca6f97e3436e5000012000a000500040064006200600009000800030100 Message-Authenticator = 0xd071d95101e82c9471633db7d877d373 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/192.168.0.1/auth-detail-20060216' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20060216 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 72 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 003d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0446], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 7 to 192.168.0.1:1024 EAP-Message = 0x0102040a15c0000004a3160301004a02000046030143f489f93df161b2e89390e55fd234535674a79034f30794cb9c234a4c5f40ca20390aa743f1124ba1362817c3efd596cb723cf00ba4e087e110a48a95aae24e27000a0016030104460b00044200043f00043c30820438308203a1a003020102020200d7300d06092a864886f70d01010505003081af310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130745766572657474312a3028060355040a1321496e7465726d656320546563686e6f6c6f6769657320436f72706f726174696f6e311d301b060355040b131453656375726974 EAP-Message = 0x7920456e67696e656572696e67312e302c060355040313254576657265747420496e7465726d65646961746520526f6f74204365727469666963617465301e170d3034313133303134313230355a170d3231313132363134313230355a308190310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130745766572657474312a3028060355040a1321496e7465726d656320546563686e6f6c6f6769657320436f72706f726174696f6e311d301b060355040b1314536563757269747920456e67696e656572696e67310f300d0603550403130644372d49544330819f300d06092a864886f70d EAP-Message = 0x010101050003818d0030818902818100b211bc2380c6c9f07cc6f8e450d301f97eb9b5085f2d7b3d37e6f33e320f7c4becd44eb3e60d62b4e7bb9f9337c37e5840213d1f123937e45b061a14191891e9363386d4f014d4abecbaed6746e8dc9a125c2b3279547d975a033bf39aaa79ca2558b0d498db180620cdcde2f0b8cfa500e52c5c1378c0a6ff514531e9b2716d0203010001a382017e3082017a30090603551d1304023000300b0603551d0f0404030205e030270603551d250420301e06082b0601050507030306082b0601050507030206082b06010505070301302c06096086480186f842010d041f161d4f70656e53534c2047656e657261 EAP-Message = 0x746564204365727469666963617465301d0603551d0e04160414b7bbf4e9358908fc1b817d12dfb865725d5624053081e90603551d230481e13081de801427af545487c3c798e81afe4597a2b63ac07881f5a181c2a481bf3081bc310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130745766572657474312a3028060355040a1321496e7465726d656320546563686e6f6c6f6769657320436f72706f726174696f6e311d301b060355040b1314536563757269747920456e67696e656572696e67313b303906035504031332496e7465726d656320546563686e6f6c6f6769657320436f EAP-Message = 0x72706f726174696f6e20526f6f742043657274696669 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd25d03bb73b96d7b492916c20bbf44c2 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:1024, id=8, length=144 State = 0xd25d03bb73b96d7b492916c20bbf44c2 User-Name = "anonymous" NAS-IP-Address = 192.168.0.1 Called-Station-Id = "00-10-40-01-90-09" NAS-Identifier = "31100100221" NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Calling-Station-Id = "00-02-2d-3c-ef-79" EAP-Message = 0x020200061500 Message-Authenticator = 0x32438ef113d8e8232b1ad69ffa9ef400 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/var/log/radius/radacct/192.168.0.1/auth-detail-20060216' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.1/auth-detail-20060216 modcall[authorize]: module "auth_log" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 8 to 192.168.0.1:1024 EAP-Message = 0x010300ad1580000004a363617465820101300d06092a864886f70d01010505000381810017814c3dc897e685aee5e734509712728a2cf5d4cce575147bcc0f974af3477fbd8d202d1f173ac76c03925e6870be35567d27e84d8096458dad6b99cdcf66e6d5967e920a64e0a4dacb6cee087b3768725bae1784d29ad41311bfb9e4dc8ade93390fe481def6c25a60c3c3d1e883e024d279fc6cbbe3723af4a76cfc0c9d6c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8c3b86d02966b223e117138d5c1d946e Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 7 with timestamp 43f489f9 Cleaning up request 2 ID 8 with timestamp 43f489f9 Nothing to do. Sleeping until we see a request. My eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { #challenge = "Password: " #auth_type = PAP } tls { private_key_password = BigSecretPassword private_key_file = ${raddbdir}/certs/intermec/server.pem certificate_file = ${raddbdir}/certs/intermec/server.pem CA_file = ${raddbdir}/certs/intermec/cacert.cer dh_file = /dev/null random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no #check_cert_cn = %{User-Name} } ttls { default_eap_type = mschapv2 #default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } Users gun Auth-Type := EAP, User-Password := "gun123"

3 10

freeradius 1.1.0 on mac os x server 10.4.5 not working
by John Bass 18 Feb '06

18 Feb '06

Hi All, I'm attempting to run freeradius 1.1.0 on mac os x 10.4.5 without much luck. I searched the web and found that I'm not alone. Here's an example: http://translate.google.com/translate?hl=en&sl=fr&u=http://www.nantes- wireless.org/forum/viewtopic.php%3Fp%3D18333%26sid% 3Dd8adcfdfe20a490158ec39faaa603bcf&prev=/search%3Fq%3DSymbol%2Bnot% 2Bfound:%2B_debug_flag%26hl%3Den%26lr%3D%26client%3Dsafari%26rls%3Den Here is output from an install using darwin ports then radiusd in debug mode... miles:/opt/local/bin root# ./port install freeradius ---> Fetching freeradius ---> Attempting to fetch freeradius-1.1.0.tar.gz from ftp:// ftp.freeradius.org/pub/radius/ ---> Verifying checksum(s) for freeradius ---> Extracting freeradius ---> Configuring freeradius ---> Building freeradius with target all ---> Staging freeradius into destroot ---> Packaging tgz archive for freeradius 1.1.0_0 ---> Installing freeradius 1.1.0_0 ---> Activating freeradius 1.1.0_0 ---> Cleaning freeradius miles:/opt/local/bin root# cd /opt/local/ miles:/opt/local root# ls bin etc include lib libexec man sbin share var miles:/opt/local root# cd bin miles:/opt/local/bin root# ls daemondo radclient radrelay radwho rlm_dbm_parser port radeapclient radsqlrelay radzap smbencrypt portindex radlast radtest rlm_dbm_cat miles:/opt/local/bin root# cd .. miles:/opt/local root# cd sbin/ miles:/opt/local/sbin root# ls .turd_DarwinPorts checkrad radwatch check-radiusd-config radiusd rc.radiusd miles:/opt/local/sbin root# ./radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/local/etc/raddb/proxy.conf Config: including file: /opt/local/etc/raddb/clients.conf Config: including file: /opt/local/etc/raddb/snmp.conf Config: including file: /opt/local/etc/raddb/eap.conf Config: including file: /opt/local/etc/raddb/sql.conf main: prefix = "/opt/local" main: localstatedir = "/opt/local/var" main: logdir = "/opt/local/var/log/radius" main: libdir = "/opt/local/lib" main: radacctdir = "/opt/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/local/lib radiusd.conf[1541] Failed to link to module 'rlm_exec': dlopen(/opt/ local/lib/rlm_exec-1.1.0.so, 9): Symbol not found: _debug_flag Referenced from: /opt/local/lib/rlm_exec-1.1.0.so Expected in: flat namespace miles:/opt/local/sbin root# I've tried compiling from the source as is and with the shared library option off. In all cases I get the same result. Any ideas? Thanks! -- John Bass john_bass(a)ncsu.edu (919) 515-0154 www.cnl.ncsu.edu www.centaurlabs.net Never ask a barber if you need a haircut.

2 1

Problems with number of instances of freeradius
by Markus.Wintruff＠dataport.de 17 Feb '06

17 Feb '06

Hello, heres my Problem: we have freeradius on two different architectures: solaris(debian) and intel(debian) on solaris/debian freeradius starts with five instances on intel/debian it starts with only one instance. If i change the settings in radius.conf there ist no change. Some ideas? regards Markus

3 2

Custom message for overquota users
by Maykel Moya 17 Feb '06

17 Feb '06

How can I send a custom message to users overquota. I have many complaints from users because they think their passwd are wrong when their access is denied for being overquota. Regards, maykel

2 1

Freeradius - Cisco L2TP Tunnel - Authentication problem.
by Tony Spencer 17 Feb '06

17 Feb '06

Hi I have an issue with authentication using Freeradius (freeradius-1.0.1-3) We were running L2TPNS on a Linux box and authenticating fine using CHAP to the Freeradius server. However because of increased volume of users (DSL and Dial) we need to move to a Cisco 7200 so it could terminate the tunnel. The tunnel terminates fine but authentication is failing because the Cisco is sending PAP authentication and we use CHAP, in fact I would know how to move to PAP anyway. No matter what we put into the Cisco config it still uses PAP, even telling it to refuse PAP. The Cisco is running IOS 12.2.(6) and here is the relevant lines of config for the tunnel and authentication: ######################## aaa new-model aaa authentication ppp default group radius aaa authorization network default group radius if-authenticated aaa accounting network default start-stop group radius multilink virtual-template 1 vpdn enable ! vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname tunnel local name gw1 l2tp tunnel password 7 xxxxxxxxxx source-ip 10.0.0.1 interface Virtual-Template1 ip unnumbered FastEthernet1/0 ip mroute-cache no logging event link-status no keepalive timeout absolute 4320 0 no peer default ip address ppp authentication chap callin ppp multilink ! ip local pool IP-POOL 192.168.0.1 192.168.1.254 ip classless ip route 0.0.0.0 0.0.0.0 10.0.0.254 no ip http server ip pim bidir-enable ! radius-server host 192.168.1.12 auth-port 1645 acct-port 1646 key xxxxxx radius-server retransmit 2 ############### Here is a line from the radius users file that authentication is failing for: ###### user1 Auth-Type := Local, User-Password== "jijyocspok" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.2.22, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP ###### Here is the radius log entries for when the login fails from the Cisco and passes from the L2TPNS server: #### Thu Feb 16 23:30:41 2006 : Auth: Login incorrect: [user1/jijyocspok] (from client l2tp port 3) Fri Feb 17 08:22:43 2006 : Auth: Login OK: [user1/<CHAP-Password>] (from client l2tp port 3) ###### I was wondering if anyone had seen a problem like this before and found a solution. Is the Cisco at fault, does it have a bug in it? Should I just move to PAP authentication, is so how do I do that? But doesn't Windows PC's send CHAP? Would it still work? Any help would be appreciated. Thanks Tony

3 3

load and threads
by Velikanov 17 Feb '06

17 Feb '06

Good day. I use FreeRadius 1.1.0 with Oracle DB on Red Hat Enterprise Linux ES release 3 (Taroon Update 3) Kernel 2.4.21-20.ELsmp on an i686 I made a test load on server and everything is good when I start Freeradius in debug mode # /usr/local/sbin/radiusd -X top shows me 13:04:10 up 70 days, 1:06, 5 users, load average: 1,77, 1,57, 1,88 114 processes: 111 sleeping, 3 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 66,7% 0,0% 3,5% 0,0% 0,0% 0,3% 29,2% Mem: 2307652k av, 2283924k used, 23728k free, 0k shrd, 116652k buff 1578192k actv, 300500k in_d, 36092k in_c Swap: 2048152k av, 219780k used, 1828372k free 1694328k cached But when I start Freeradius in work mode # /usr/local/sbin/radiusd under the same test load top shows me in 10-15 minutes: 11:50:27 up 69 days, 23:52, 3 users, load average: 37,25, 30,91, 31,58 114 processes: 92 sleeping, 22 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 91,1% 0,0% 8,7% 0,0% 0,0% 0,0% 0,0% Mem: 2307652k av, 2250580k used, 57072k free, 0k shrd, 151768k buff 1541388k actv, 299248k in_d, 35108k in_c Swap: 2048152k av, 178648k used, 1869504k free 1671720k cached I see radiusd threads when do the command #ps -efm | grep radiusd in radius.log there are very many such string: Fri Feb 17 12:08:40 2006 : Error: WARNING: Unresponsive child (id 1347701680) fo r request 2937 and such string: Fri Feb 17 12:06:16 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 My questions are: 1. What is the reason of such FreeRadius behavior? What must I do? 2. Why load of server during #radiusd -X is lover then during #radiusd ? Seems to be vice-versa? 3.How must I start FreeRadius to make many processes (not threads), maybe it help me to decrease the load of server and to increase the speed of packets handling Thanks.

2 1

freeradius 1.1.0 doesn't cope well with reloads
by André Lemos 17 Feb '06

17 Feb '06

1 0

Basic problems getting things to run
by Geoff Silver 17 Feb '06

17 Feb '06

Hi Folks, I've been tasked at my work w/ getting a radius backend working with our Cisco 3000 concentrators to do certificate auth. We're currently running an old version of gnu radius for our standard radius auth, but I'd like to move to freeradius so that we can eventually use some features like the ldap backend. In the mean time, I've just been trying to get it working, and I've been coming up short. Forgive me if I'm missing something incredibly obvious, but I absolutely can't get auth to work. ever. For starters, here's what I see when running 'radiusd -AX': rad_recv: Access-Request packet from host 127.0.0.1:34193, id=136, length=61 Attr-1 = 0x6a617468616e69736d Attr-2 = 0xad790d5790cec60e1f908174aabe7335 Attr-4 = 0x7f000001 Attr-5 = 0x00000001 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry jathanism at line 121 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [jathanism] (from client localhost port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- That's running the following locally for testing as the client: # echo 'User-Name= "jathanism", Password = "jathanism", NAS-IP-Address = 127.0.0.1, NAS-Port = 1' | /opt/reverb/bin/radclient -d /opt/reverb/share/dictionary -x 127.0.0.1 auth 1234test1234 Sending Access-Request of id 136 to 127.0.0.1 port 1812 User-Name = "jathanism" Password = "jathanism" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=136, length=20 My user's file right now looks like: jathanism Auth-Type := Local User-Password == "jathanism" DEFAULT Auth-Type := Accept Though I've tried as little as just the DEFAULT line, as well as specifying "Accept" for a specific user. I've also tried PAP and CHAP, none of which are ever successful. My clients.conf file looks like: client 127.0.0.1 { secret = 1234test1234 shortname = localhost nastype = other # localhost isn't usually a NAS... } And what I suspect are the most important parts of my radiusd.conf look like: authorize { preprocess files chap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } } I had tried adding an 'Auth-Type Accept' or 'Auth-Type Local' line, but couldn't get them to work either. The thing that worries me most is the "auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" error throw by radiusd - no matter what I've tried to do to the radiusd.conf or users files, it ALWAYS says that. The "WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS!" also frightens me, though I wonder if that's related (the secret is definitely right, because if I change it, radclient tells me the secret is wrong). I'm completely at a loss right now. I've looked at auth.c and some of the other code, and it seems to me that auth_type just isn't ever getting populated. Incidentally, the comments in the users file indicate stuff like: bob Auth-Type := Local, User-Password == "bobpass" should work, but radiusd won't start unless it looks like: bob Auth-Type := Local User-Password == "bobpass" I can't tell if that's a documentation problem, or a bug, or indicitative of some larger issue, but I thought I'd mention it. FWIW, I've tried both freeradius 1.0.5 and 1.1.0. They were built on Red Hat EL 3.0 Advanced Server with the stock Red Hat build tools. Thanks for any help anyone can provide. I hate to go back to gnu radius, but I've got to get this working by next Friday or else I won't have much of a choice. If anyone willing to assist would like any additional info/configs/strace output/etc, just ask and I'd be happy to provide them.

2 2