- Freeradius-Users - lists.freeradius.org

(no subject)
by Herman Swensson 15 Feb '06

15 Feb '06

Hi, I have installed Radius and get the next eror radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "(null)" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 20360:error:0200100E:system library:fopen:Bad address:bss_file.c:259:fopen('','r') 20360:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: 20360:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:758: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1902] Unknown module "eap". radiusd.conf[1849] Failed to parse authenticate section. What have I to change Greeting Herman -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.15.8/260 - Release Date: 14-2-2006

2 2

silently drop packet (access-request)
by Andriy Gapon 15 Feb '06

15 Feb '06

Is there a way to force a silent drop of a packet instead of sending Access-Reject ? I am interested in both doing this through configuration file(s) and doing this from a module (e.g. with some special return code or attribute). On a somewhat related note: is there way to make FreeRADIUS server drop/reject all incoming packets without Message-Authenticator the same way it does this for packets with invalid/incorrect value in that attribute ? Preferably through configuration, without changes in code. -- Andriy Gapon

2 6

PAP credentials against AD?
by Josh Howlett 15 Feb '06

15 Feb '06

Is it possible to authenticate PAP credentials from the NAS against a Windows domain using NTLM? I've tried using the mschap module, but it expects to see a Challenge that the NAS doesn't provide. thanks, josh.

3 3

Tagged VSA
by Klier, Martin 15 Feb '06

15 Feb '06

We are using tagged VSA (i.e. SIP-From). I think, it isn't standard. without the has_tag entry, behind the regarding attribute in the dictionary file, i see in Debug Mode: SIP-From = "\001sip:abcd@xyz:5060" SIP-From = "\002sip:abcd@xyz:5060" With "has_tag" entry SIP-From:1 = "sip:abcd@xyz:5060" SIP-From:2 = "sip:abcd@uvw:5060" Is it possible, to write the the two tagged attributes (with has_tag entry) in a mysql- database at all ? If it is, how the variable ( %{SIP-From} ) in the sql.conf has to look like Used version 1.0.2-5 regards, Martin

2 1

how to disconnect user after quota given to him finishes ?
by Rupesh Amatya 15 Feb '06

15 Feb '06

Dear all, I am using Freeradius(with mysql as database for users ) with Mikrotik as NAS. This for PPPOE users. I used Dialup Admin to manage freeradius. There is default package of 4hours/day but the users do not get disconnect after 4 hours. It just shows " Out of Quota". What needs to be done to automatically disconnect user after the daily quota is finished ? Hope to get help ..... Thanking you Rupesh

2 1

using scripts for sql.conf
by Maqbool Hashim 15 Feb '06

15 Feb '06

Hi, Is it possible to reference a script from within sql.conf? I'd like to do some checks and inserts on the sql database just before the auth_check query in sql.conf. Whats the best way of doing this? Thanks Maqbool

3 4

ascend-data-filters
by squirrel＠isot.com 15 Feb '06

15 Feb '06

I been told that I need to configure "ascend-data-filters" to pass ADF's to make port 25 work for our dialup users. Does he mean something like this? Ascend-Data-Filter = "ip in forward destport = 25" ************************************** Computer problems? ................... ..............http://www.multibyte.net

3 3

Question about Authentication flow.
by Robert Myers 15 Feb '06

15 Feb '06

I'm trying to understand how to send dynamic replies based on user. If I authenticate via LDAP or some other mechanism, I can authorize via the sql tables? Is that right? -Bob

2 4

hints and stripped-user-name
by Lewis Bergman 14 Feb '06

14 Feb '06

I have more hints trouble on another radius server. I want to look for a realm and strip it if it is there, else, send on the username untouched. Using a config that Alan gave me a while back to do the opposite I entered the below in my hints. Thought this would be easy but I am just not getting something. I think the two values I have tried to use (Stripped-User-Name and Strip-User-Name) are not yet set which is why the username comes up blank. So, how to strip the realm from the username and set User-Name to that? I have this in my hints: DEFAULT User-Name =~ ".*@", NAS-IP-Address == "69.39.33.242" User-Name := "%{Stripped-User-Name}" # also tried Strip-User-Name in place of Stripped-User-Name with same #result The parts of the radiusd -X I think are pertinent follow: rad_recv: Access-Request packet from host 69.39.33.242:1812, id=177, length=205 User-Name = "renisdn(a)camalott.com" --snip-- hints: Matched DEFAULT at 80 <-- this is the entry above from hints radius_xlat: '' <-- Stripped-User-Name not set yet? --snip-- rlm_realm: No '@' in User-Name = "", looking up realm NULL --snip-- auth: Failed to validate the user. Login incorrect: [/boilers1] (from client NAS0hpr1ABI port 14081) ^^-- so username is definately set to null Here is the full radiusd -X for this user: rad_recv: Access-Request packet from host 69.39.33.242:1812, id=177, length=205 User-Name = "renisdn(a)camalott.com" User-Password = "passhere" NAS-IP-Address = 69.39.33.242 NAS-Identifier = "69.39.33.242" NAS-Port = 14081 Acct-Session-Id = "renisdn(a)camalott.com1" USR-Interface-Index = 0 USR-Supports-Tags = 0 Service-Type = Login-User USR-Chassis-Call-Slot = 56 USR-Chassis-Call-Span = 1 USR-Chassis-Call-Channel = 1 USR-Connect-Speed = NONE NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 hints: Matched DEFAULT at 80 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched DEFAULT at 151 users: Matched DEFAULT at 330 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. Login incorrect: [/boilers1] (from client NAS0hpr1ABI port 14081) As always, help is greatly appreciated. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-1301 Cell 325-439-0533 fax 325-695-6841

2 1

freeradius and winxp
by Piotr Salwerowicz 14 Feb '06

14 Feb '06

Hello I have problem proably with freeradius server, i try to start 802.1x authentication on the dell and catalyst switch. My workstation is Wxp sp2 and w2k sp4. I run radius witx -X to debug and when i logging, the radius server still counting and counting something and never stop. It is strange for me when i type inncorect password or incorect user radius also still counting and counting. Now i don't have any idea, please help me or give me some clue my conf : users : popo User-Password == "popo" clients.conf: client 10.10.10.227 { secret = 0110 shortname = dell6k nastype = dell6k my logs when radius is in normal mode: logi z freeradiusa: Thu Feb 9 14:05:04 2006 : Info: rlm_eap_md5: Issuing Challenge Thu Feb 9 14:05:04 2006 : Auth: Login OK: [popo/<no User-Password attribute>] (from client dell6k port 18) and radiusd -X : Going to the next request rl_next: returning NULL Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.10.227 :49155, id=0, length=112 NAS-IP-Address = 10.10.10.227 NAS-Port-Type = Ethernet NAS-Port = 18 User-Name = "popopopo" State = 0xba656fbffecb7e21f8b14a205592085e4740eb4323fd697caf72865dba5e93af6a7c622a EAP-Message = 0x020400060319 Message-Authenticator = 0x805e7511c4ffddd5eff70207a317843b modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok rlm_eap: EAP packet type notification id 4 length 6 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated modcall: group authorize returns updated rad_check_password: Found Auth-Type EAP auth: type "EAP" modcall: entering group authenticate rlm_eap: EAP packet type notification id 4 length 6 rlm_eap: EAP Start not found rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: Unknown EAP type 25, reverting to default_eap_type rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns ok modcall: group authenticate returns ok Login OK: [popopopo/<no User-Password attribute>] (from client dell6k port 18) Sending Access-Challenge of id 0 to 10.10.10.227 :49155 EAP-Message = 0x01050016041068f7366937700d3b64c7935a1dc54b4e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8278bc4bd4c26c472df0bd2aadc6ec2a4740eb439efee1da2feaaa6028a9dd491d3a50b9 Finished request 5657 Going to the next request thx for help best regards popo ------------------------------------------------------------------- .pl 42,70 zl z VAT/rok >> http://link.interia.pl/f1902 <<

3 3