- Freeradius-Users - lists.freeradius.org

Re: Error -1635
by Hubert Kupper 08 Feb '06

08 Feb '06

On 7 Feb 2006 at 22:10, Sayantan Bhowmick wrote: > Hi, > Can you provide us with a DSTrace log with the +NMAS switch. That > might give some more information. Also please report a support request > with Novell. > > Regards, > -Sayantan Hi, the +NMAS switch did not log anything of the request in dstrace.dbg or dstrace.log Here is a radius output of a request. I changed ip's and usernames into dummy. Regards Hubert Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "dummy ip" ldap: port = 636 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "dummy" ldap: tls_mode = yes ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "dummy-pw" ldap: basedn = "o=dummy dn" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x5555557823f0 Module: Instantiated ldap (ldap) ldap: server = "dummy ip" ldap: port = 636 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "dummy" ldap: tls_mode = yes ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "dummy pw" ldap: basedn = "dummy dn" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_pcr-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_pcr-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_pcr rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x555555783cd0 Module: Instantiated ldap (ldap_pcr) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded Counter counter: filename = "/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1674 rlm_counter: Current Time: 1139401918 [2006-02-08 13:31:58], Next reset 1139439600 [2006-02-09 00:00:00] Module: Instantiated counter (daily) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host dummy ip:1035, id=34, length=120 User-Name = "dummy" NAS-Identifier = "localhost" MS-CHAP-Challenge = 0x5edcdfc03a7c70a32ee04de17c30d065 MS-CHAP2-Response = 0x2200182aaa5caafc1f4bf132ba16db2c97d3000000000000000079c66d5dbb22d0f3a1dd67632e9056b9a0ab98909272d999 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/dummy ip/auth-detail-20060208' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/dummy ip/auth-detail-20060208 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "dummy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for dummy radius_xlat: '(cn=probe)' radius_xlat: 'o=dummy' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dummy ip:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=dummy,o=dummy/radtest to dummy ip:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=dummy, with filter (cn=dummy) rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user dummy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for dummy radius_xlat: '(cn=dummy)' radius_xlat: 'ou=dummy,ou=dummy,o=dummy' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dummy ip:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=dummy,o=dummy/radtest to dummy ip:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=pcr,ou=urz,o=dummy, with filter (cn=dummy) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_pcr" returns notfound for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for dummy with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [dummy/<no User-Password attribute>] (from client uni port 0) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 0 modcall[post-auth]: module "ldap" returns noop for request 0 modcall[post-auth]: module "ldap_pcr" returns noop for request 0 modcall: group Post-Auth-Type returns noop for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 34 to dummy ip:1035 MS-CHAP-Error = ""E=691 R=1" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 34 with timestamp 43e9e4ed Nothing to do. Sleeping until we see a request. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms

1 0

rlm_attr_filter local proxied domains
by Bart van Daal 08 Feb '06

08 Feb '06

Hi All, I was wondering if I could use rlm_attr_filter to filter out attributes from LOCAL proxied domains. e.g. in proxy.conf realm EDPNET { type = radius authhost = LOCAL accthost = LOCAL } I tried adding EDPNET to the attr file but the attr_filter returns noop thank you for any pointers in the right direction. kind regards, Bart

1 0

Proxy reply and setting attribute in users file
by Sandworm 08 Feb '06

08 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all In the 'users' file, I have the following lines: DEFAULT Huntgroup-Name == "Security-Devices", LDAP-Group == "group1", Proxy-To-Realm := 'innerradius' Class:="OU=vpngroupa;", Fall-Through = No DEFAULT Huntgroup-Name == "Security-Devices", LDAP-Group == "group2", Proxy-To-Realm := 'innerradius' Class:="OU=vpngroupb;", Fall-Through = No (The Inner Radius server provides the authentication - one time password). The problem is that setting the Class attribute does not happen. Presumably, this is because of the setting "post_proxy_authorize = no" in the file proxy.conf. When post_proxy_authorize is set to "Yes", the Class attribute does get set, but then the 'users' file is traversed twice, which is obviously an overhead, considering that the 'users' file has many other unrelated entries, not just the ones shown here. Also, setting "post_proxy_authorize = yes" is just there for "backwards compatibility", as per the comments in the proxy.conf file, and is not the preferred setting, I presume, in the future. My question then is, how do I set the Class attribute for the various different cases, two examples of which are shown above, if not as I have shown above? Would that be via the post_proxy section? If so, could anyone give me an example of how this could be done? FYR, this is being run on FreeRadius 1.0.1 on Redhat Enterprise Linux 3. Thanks SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkPpQ+oACgkQmw4BJyaatJ18GACfYQOFEn8SBhZ4IQYyQYbBBMKD3/4A n23uYwysIQqPu1oWrrp500gbHJ1/ =Svg+ -----END PGP SIGNATURE-----

1 0

grouping rlm_ippool's
by Mike O'Connor 07 Feb '06

07 Feb '06

Hi Some time ago there was a question about rlm_ippool and if it was possible to group them ie ippool main_pool_1 {} ippool main_pool_2 {} accounting { group main_pool { main_pool_1 main_pool_2 } sql } post-auth { group main_pool { main_pool_1 main_pool_2 } } I have done some testing it it does not seem to work. (using freeradius-1.0.5) Do any one have any idea of how this could be made to work and/or have I not got this configuration correct. Thanks Mike

3 2

Decrypt Chap Password
by Joseph 07 Feb '06

07 Feb '06

Is there an easy way to see what password is being sent to FR when the pass is sent as Chap-Password ? -- respectfully, Joseph

2 1

Auth question
by Nick Marino 07 Feb '06

07 Feb '06

Can anyone tell me why I am getting trashed passwords when attempting to authenticate? Login incorrect: [nickm/d\313f`&\247+>4\203\360/\367] Nick Marino - IT Solutions

6 12

Building on Solaris 10
by Paul Khavkine 07 Feb '06

07 Feb '06

Hi guys. When building FreeRADIUS on Solaris, which compiler should i use ? Has anyone built FR with the Sun compiler ? Thanx Paul

1 0

System hangs with Apache SSL mod_auth_radius sending authentication information to a radius - my sql server.
by Frank Reiss 07 Feb '06

07 Feb '06

System hangs with Apache SSL mod_auth_radius sending authentication information to a radius - mysql server. Hi everyone, I am having a problem with my apache web server hanging and am looking for help. I have check the log files and am finding nothing to indicate the cause of the system hangs. The web server which hangs is Fedora Core 4 The Radius - Mysql server is Redhat EL4 httpd.conf excerpts. LoadModule cgi_module modules/mod_cgi.so LoadModule radius_auth_module /usr/lib/httpd/modules/mod_auth_radius-2.0.so #</IfModule> # End of proxy directives. ###################################################################### # # Add to the BOTTOM of httpd.conf # If we're using mod_auth_radius, then add it's specific # configuration options. # <IfModule mod_auth_radius-2.0.c> # # AddRadiusAuth server[:port] <shared-secret> [ timeout [ : retries ]] # Use localhost, the old RADIUS port, secret 'testing123', # time out after 5 seconds, and retry 3 times. AddRadiusAuth imp-dell-21:1812 password 5:3 # ServerName RadiusPassword in clients.conf file # # AuthRadiusBindAddress <hostname/ip-address> # # Bind client (local) socket to this local IP address. # The server will then see RADIUS client requests will come from # the given IP address. # # By default, the module does not bind to any particular address, # and the operating system chooses the address to use. # # # AddRadiusCookieValid <minutes-for-which-cookie-is-valid> # # the special value of 0 (zero) means the cookie is valid forever. # AddRadiusCookieValid 5 </IfModule> /var/www/html/.htaccess file is unchanged ###################################################################### # # A sample per-directory access-control configuration, to be used # as a '.htacces' file. # # # Use basic password authentication. # AuthType Digest won't work with RADIUS authentication. # AuthType Basic # # Tell the user the realm to which they're authenticating. # This string should be configured for your site. # AuthName "RADIUS authentication for localhost" # # don't use 'mod_auth'. # You might want to disable other authentication types here. # You can get a similar effect by commenting out the # 'AddModule mod_auth_*' lines, previously in httpd.conf # AuthAuthoritative off # # Use mod_auth_radius for all authentication, and make the responses # from it authoritative. # AuthRadiusAuthoritative on # # Make a local variation of AddRadiusCookieValid. The server will choose # the MINIMUM of the two values. # # AuthRadiusCookieValid <minutes-for-which-cookie-is-valid> # AuthRadiusCookieValid 5 # # Set the use of RADIUS authentication at this <Location>" # # Locally set the RADIUS authentication active. # # If there is a directory which you do NOT want to have RADIUS # authentication for, then use a <Directory> directive, and # set "AuthRadiusActive Off" # AuthRadiusActive On # # require that mod_auth_radius return a valid user, otherwise # access is denied. # require valid-user The error logs do not record what the problem is. Any ideas? Frank Reiss

1 0

NAS online/offline?
by nikwan (sent by Nabble.com) 07 Feb '06

07 Feb '06

Hypothetically situation: You have users logged into a NAS. the NAS goes down without warning (power failure...) Users who where logged in now have sessions which are not complete (acctstoptime is set to NULL). In my case Simultaneous logins is disabled and need to be so. Therefore once the NAS is brought back up. the users cant log back in, as radius will not authorize the users as they are apparently logged in. My question is... How do i set the accstoptime to the time when the NAS goes down. Is there a way to see when a NAS dies.... Any input will be greatly appreciated -- View this message in context: http://www.nabble.com/NAS-online-offline--t1075858.html#a2800675 Sent from the FreeRadius - User forum at Nabble.com.

5 5

sqlcounter and dialup admin issue
by Georgi Alexandrov 07 Feb '06

07 Feb '06

hello list, i'm using freeradius 1.1.0 with mysql 5.0.x and dialup_admin i want to use the monthly counter function of the sqlcounter module. I've added "checkItem MaxMonthlySession MaxMonthlySession" to sql.attrmap also added: MaxMonthlySession to user_edit.attrs in the radiusd.conf added "monthlycounter" in the authorize section. freeradius loading the module: http://pastebin.com/542929 I add a user from dialup_admin with a maxmonthlysession = 14400 for example and when the user tries to log in radius says: " 1. Tue Feb 7 10:47:14 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [het] 2. Tue Feb 7 10:47:14 2006 : Auth: Login incorrect: [het/het] (from client pppoe-as port 0 cli 00:0A:EB:40:9F:FD) " if i don't specify maxmonthlysession the user logs fine. any idea? -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

1 0