- Freeradius-Users - lists.freeradius.org

integrate with other protocol
by Priscilla B 08 Feb '06

08 Feb '06

Hallo everyone, I have a short question, Is it possible for other protocol to integrate it with freeradius? This protocol is run by a deamon and I want to send the result of this process as access request (that will forwarded by NAS to server) this is what I thought, do you think it is possible? Is there any library that I can use to extend this function? Thanks a lot folks, Pris __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

fast auth time with EAP_TLS?
by Andrea G Forte 08 Feb '06

08 Feb '06

Dear all, I have setup a RADIUS server (freeradius of course) with an authenticator (hostapd 0.4.7) and a supplicant (wpa_supplicant 0.4.7). Both the last two use hostap-driver 0.4.7. I am using EAP-TLS (client and server certificates generated by the CA.all script included in freeradius) with RSN (CCMP). I am not sure if something is wrong in the authentication process. The problem is that it is taking too little time for the authentication process to complete. In the attached file you can see one authentication process captured using kismet and then parsed with Ethereal. As you cane see the time from Assoc. resp to the first encrypted data packet is only 222 msec. About a year ago it was of the order of one second (and all the literature says so). Has WPA2 improved the authentication time so much? Am I doing something wrong in setting up EAP-TLS? Your help is very much appreciated. Thank you, Andrea No. Time Source Destination Protocol Info 3037 10.711982 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3037 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3060 10.774339 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3060 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3061 10.777773 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3061 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3062 10.782807 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3062 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3091 10.927769 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Authentication Frame 3091 (30 bytes on wire, 30 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3093 10.929806 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Authentication Frame 3093 (30 bytes on wire, 30 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3095 10.930709 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Association Request, SSID: "test" Frame 3095 (62 bytes on wire, 62 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3098 10.932869 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Association Response Frame 3098 (36 bytes on wire, 36 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3107 10.970317 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Request, Identity [RFC3748] Frame 3107 (46 bytes on wire, 46 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3111 10.983395 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Request, EAP-TLS [RFC2716] [Aboba] Frame 3111 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3118 11.017082 LinksysG_15:ab:62 LinksysG_18:f4:9d TLS Client Hello Frame 3118 (142 bytes on wire, 142 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3122 11.027284 LinksysG_18:f4:9d LinksysG_15:ab:62 TLS Server Hello, Certificate, Certificate Request, Server Hello Done Frame 3122 (1070 bytes on wire, 1070 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3124 11.032757 LinksysG_15:ab:62 LinksysG_18:f4:9d EAP Response, EAP-TLS [RFC2716] [Aboba] Frame 3124 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3127 11.038553 LinksysG_18:f4:9d LinksysG_15:ab:62 TLS Server Hello, Certificate, Certificate Request, Server Hello Done Frame 3127 (483 bytes on wire, 483 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3131 11.059361 LinksysG_15:ab:62 LinksysG_18:f4:9d TLS Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message Frame 3131 (1444 bytes on wire, 1444 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3138 11.081295 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Request, EAP-TLS [RFC2716] [Aboba] Frame 3138 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3140 11.083268 LinksysG_15:ab:62 LinksysG_18:f4:9d TLS Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message Frame 3140 (308 bytes on wire, 308 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3149 11.094655 LinksysG_18:f4:9d LinksysG_15:ab:62 TLS Change Cipher Spec, Encrypted Handshake Message Frame 3149 (105 bytes on wire, 105 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3151 11.103162 LinksysG_15:ab:62 LinksysG_18:f4:9d EAP Response, EAP-TLS [RFC2716] [Aboba] Frame 3151 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3154 11.106911 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Success Frame 3154 (40 bytes on wire, 40 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3156 11.107979 LinksysG_18:f4:9d LinksysG_15:ab:62 EAPOL Key Frame 3156 (131 bytes on wire, 131 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3160 11.116155 LinksysG_15:ab:62 LinksysG_18:f4:9d EAPOL Key Frame 3160 (153 bytes on wire, 153 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3162 11.123636 LinksysG_18:f4:9d LinksysG_15:ab:62 EAPOL Key Frame 3162 (187 bytes on wire, 187 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3195 11.154024 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3195 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 ac 81 63 5f 1f 6b 2b ca c9 f2 db 37 5d 74 fc 18 ..c_.k+....7]t.. 0010 94 44 ac 48 4a f5 1b 57 97 63 4c ef 07 57 22 02 .D.HJ..W.cL..W". 0020 7c 65 5a cd 66 6b ca 5c c3 83 da c5 9d 40 ca |eZ.fk.\.....@. No. Time Source Destination Protocol Info 3196 11.154749 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3196 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 ac 81 63 5f 1f 6b 2b ca c9 f2 db 37 5d 74 fc 18 ..c_.k+....7]t.. 0010 94 44 ac 48 4a f5 1b 57 97 63 4c ef 07 57 22 02 .D.HJ..W.cL..W". 0020 7c 65 5a cd 66 6b ca 5c c3 83 da c5 9d 40 ca |eZ.fk.\.....@. No. Time Source Destination Protocol Info 3197 11.157232 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3197 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 ac 81 63 5f 1f 6b 2b ca c9 f2 db 37 5d 74 fc 18 ..c_.k+....7]t.. 0010 94 44 ac 48 4a f5 1b 57 97 63 4c ef 07 57 22 02 .D.HJ..W.cL..W". 0020 7c 65 5a cd 66 6b ca 5c c3 83 da c5 9d 40 ca |eZ.fk.\.....@. No. Time Source Destination Protocol Info 3198 11.172835 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3198 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 1d 51 9a 06 06 80 33 80 dc d1 aa 9b 3b c7 c5 b6 .Q....3.....;... 0010 3c c8 5b ec 78 af a8 0d f1 ba 0f f8 a5 a7 b2 50 <.[.x..........P 0020 03 e6 1f e8 0f e5 66 f5 5b 9d 11 de 99 b8 b3 ......f.[...... No. Time Source Destination Protocol Info 3212 11.192806 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3212 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 b3 bb a4 d0 7a eb 53 51 55 39 93 18 fa 83 2d 21 ....z.SQU9....-! 0010 85 9d 55 a3 eb 9f 93 7d b7 9e 72 04 ee 49 ef 0b ..U....}..r..I.. 0020 8d 62 f9 54 d0 b9 85 02 87 f2 e8 36 6e 76 ee .b.T.......6nv.

2 3

FreeRADIUS w/ TKIP, PEAP, EAP, MS-CHAP v2 - relocation error
by John Metcalfe 08 Feb '06

08 Feb '06

We are using FreeRADIUS version 1.0.2 with OpenSSL version 0.96. The client supplicant is WinXP SP2 with WPA TKIP, PEAP and EAP MS-CHAP v2 configured. The NAS is a Symbol WS5100 WLAN switch configured to use RADIUS, TKIP and PEAP. We configured RADIUS and it starts (in debug mode) and we are able login to the server with test client software using raduser and shared secret password. On the XP client we are able to enter credentials (raduser and shared secret) and the Symbol switch receives and forwards the request to the RADIUS server with the following error in the switch log file: "failed 802.1x authentication for BSS " Then RADIUS stops with the following error: radiusd: relocation error: /usr/lib/freeradius/rlm_eap_tls-1.0.2.so: undefined symbol: SSL_set_msg_callback We understand that the version of openSSL may be out of date but we can't upgrade due to other issues and dependancies. Any help or suggestions is greatly appreciated. Below is the complete startup in debug mode with error listed above at the end. Thanks again. John ========== Complete RADIUS startup below ======================== rad_recv: Access-Request packet from host 10.203.10.51:10369, id=123, length=140 User-Name = "raduser" NAS-IP-Address = 10.203.10.51 Called-Station-Id = "00:A0:F8:6E:1E:10" Calling-Station-Id = "00:05:4E:4F:2B:23" NAS-Identifier = "swdevlab_5100_1" NAS-Port = 29 Framed-MTU = 1000 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000c0172616475736572 Message-Authenticator = 0xabd78f651fd43d26ca7a7707c1a4f402 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry raduser at line 75 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls radiusd: relocation error: /usr/lib/freeradius/rlm_eap_tls-1.0.2.so: undefined symbol: SSL_set_msg_callback ========================== end ================================= John Metcalfe, Jr. IT Specialist - AIS IBM Business Consulting Services, Public Sector Telephone: 240-396-5305 email: metcalfej(a)us.ibm.com

2 1

How to kick a logged user
by Eduardo Bejar 08 Feb '06

08 Feb '06

Hi, I´ve been searching a while about how to kick a logged user or force terminate it´s session. It seems that this has been asked before on the list, but I didn´t find an answer different from "radius can´t do that". The only answer that I´ve found is that it´s required an external script for this. Section 4.3 of the Freeradius FAQ mentions a radkill program, but the link included is dead. And also says "try using SNMP". I haven´t also been able to find information on how to use SNMP for this, so I ask the list: Can anyone post a link to download radkill? Or Can anyone explain me how to do this with SNMP? Or perhaps, Can anyone post a procedure to kick a logged user? Thanks for your replies, Edo

4 4

Using STORED PROCEDURE with Freeradius
by Saeed Ahmed 08 Feb '06

08 Feb '06

Hi, For some reasons I've to use Stored procedure With Freeradius but I am getting following error from mysql: Error: 1312 SQLSTATE: 0A000 (ER_SP_BADSELECT) Message: PROCEDURE %s can't return a result set in the given context You can consider the following example: Instead of following authorize_check_query authorize_check_query = "SELECT id, UserName, Attribute, Value, op, uid \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" I want to use this: authorize_check_query = "CALL molo('%{SQL-User-Name}')" And this is my stored proc in mysql: DELIMITER $$; DROP PROCEDURE IF EXISTS `radius`.`molo`$$ CREATE PROCEDURE `molo`(did VARCHAR(10)) BEGIN DECLARE rid INT; DECLARE ruid VARCHAR(15); DECLARE rattr VARCHAR(15); DECLARE rop CHAR(2); DECLARE rval VARCHAR(10); SELECT id, UserName, Attribute, Value, op INTO rid,ruid,rattr,rop,rval from radcheck WHERE UserName=did; SELECT rid,ruid,rattr,rop,rval; END$$ DELIMITER;$$ I can call this stored proc From any mysql client successfully, but if I call it from sql.conf it gives error: 1312. Any solution please? Thanks in advance Saeed Ahmed.

4 5

rlm_ldap: do_xlat vs. attributes with multiple values
by Andriy Gapon 08 Feb '06

08 Feb '06

I use rlm_ldap for authorization only in quite a specific way, but here's a simple model/description of what I do: ##### ldap.attrmap ######## replyItem Reply-Message rbPackage ########################### LDAP attribute rbPackage can have multiple values (its type is IA5String), I want to see multiple Reply-Message RADIUS attributes in Access-Accept. I am currently using radclient for the testing. The problem is that I do get what I want if have "do_xlat = no" in rlm_ldap configuration, but if set "do_xlat = yes", then only Reply-Message is received. I looked a little bit in the code and it seems that the problem is with the following calls: if ((reply_tmp = ldap_pairget(conn->ld, msg, inst->reply_item_map,reply_pairs,0)) != NULL) { if (inst->do_xlat){ pairxlatmove(request, reply_pairs, &reply_tmp); pairfree(&reply_tmp); } else pairadd(reply_pairs,reply_tmp); But pairxlatmove() has the following peculiarity: it checks for the attributes from source to be present in target and, while doing so, it also acts on newly added attributes. Thus, if source contains multiple pairs with the same attribute, all those pairs could be "condensed" into one by pairxlatmove(). Not sure if this a problem of pairxlatmove() or a problem of its incorrect usage in rlm_ldap. Anyway, is there a way to achieve my goal consistently regardless of do_xlat setting ? I feel like I could this by prepending values in rbPackage with "=" or ":=" (I am not with these things yet), but I really wouldn't like to mangle the values in LDAP. -- Andriy Gapon

1 0

Re: Error -1635
by Hubert Kupper 08 Feb '06

08 Feb '06

On 7 Feb 2006 at 22:10, Sayantan Bhowmick wrote: > Hi, > Can you provide us with a DSTrace log with the +NMAS switch. That > might give some more information. Also please report a support request > with Novell. > > Regards, > -Sayantan Hi, the +NMAS switch did not log anything of the request in dstrace.dbg or dstrace.log Here is a radius output of a request. I changed ip's and usernames into dummy. Regards Hubert Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "dummy ip" ldap: port = 636 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "dummy" ldap: tls_mode = yes ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "dummy-pw" ldap: basedn = "o=dummy dn" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x5555557823f0 Module: Instantiated ldap (ldap) ldap: server = "dummy ip" ldap: port = 636 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "dummy" ldap: tls_mode = yes ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "dummy pw" ldap: basedn = "dummy dn" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_pcr-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_pcr-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_pcr rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x555555783cd0 Module: Instantiated ldap (ldap_pcr) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded Counter counter: filename = "/etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1674 rlm_counter: Current Time: 1139401918 [2006-02-08 13:31:58], Next reset 1139439600 [2006-02-09 00:00:00] Module: Instantiated counter (daily) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host dummy ip:1035, id=34, length=120 User-Name = "dummy" NAS-Identifier = "localhost" MS-CHAP-Challenge = 0x5edcdfc03a7c70a32ee04de17c30d065 MS-CHAP2-Response = 0x2200182aaa5caafc1f4bf132ba16db2c97d3000000000000000079c66d5dbb22d0f3a1dd67632e9056b9a0ab98909272d999 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/dummy ip/auth-detail-20060208' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/dummy ip/auth-detail-20060208 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "dummy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for dummy radius_xlat: '(cn=probe)' radius_xlat: 'o=dummy' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dummy ip:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=dummy,o=dummy/radtest to dummy ip:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=dummy, with filter (cn=dummy) rlm_ldap: Error reading Universal Password.Return Code = -1635 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user dummy authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for dummy radius_xlat: '(cn=dummy)' radius_xlat: 'ou=dummy,ou=dummy,o=dummy' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dummy ip:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=dummy,o=dummy/radtest to dummy ip:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=pcr,ou=urz,o=dummy, with filter (cn=dummy) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_pcr" returns notfound for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for dummy with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [dummy/<no User-Password attribute>] (from client uni port 0) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 0 modcall[post-auth]: module "ldap" returns noop for request 0 modcall[post-auth]: module "ldap_pcr" returns noop for request 0 modcall: group Post-Auth-Type returns noop for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 34 to dummy ip:1035 MS-CHAP-Error = ""E=691 R=1" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 34 with timestamp 43e9e4ed Nothing to do. Sleeping until we see a request. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms

1 0

rlm_attr_filter local proxied domains
by Bart van Daal 08 Feb '06

08 Feb '06

Hi All, I was wondering if I could use rlm_attr_filter to filter out attributes from LOCAL proxied domains. e.g. in proxy.conf realm EDPNET { type = radius authhost = LOCAL accthost = LOCAL } I tried adding EDPNET to the attr file but the attr_filter returns noop thank you for any pointers in the right direction. kind regards, Bart

1 0

Proxy reply and setting attribute in users file
by Sandworm 08 Feb '06

08 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all In the 'users' file, I have the following lines: DEFAULT Huntgroup-Name == "Security-Devices", LDAP-Group == "group1", Proxy-To-Realm := 'innerradius' Class:="OU=vpngroupa;", Fall-Through = No DEFAULT Huntgroup-Name == "Security-Devices", LDAP-Group == "group2", Proxy-To-Realm := 'innerradius' Class:="OU=vpngroupb;", Fall-Through = No (The Inner Radius server provides the authentication - one time password). The problem is that setting the Class attribute does not happen. Presumably, this is because of the setting "post_proxy_authorize = no" in the file proxy.conf. When post_proxy_authorize is set to "Yes", the Class attribute does get set, but then the 'users' file is traversed twice, which is obviously an overhead, considering that the 'users' file has many other unrelated entries, not just the ones shown here. Also, setting "post_proxy_authorize = yes" is just there for "backwards compatibility", as per the comments in the proxy.conf file, and is not the preferred setting, I presume, in the future. My question then is, how do I set the Class attribute for the various different cases, two examples of which are shown above, if not as I have shown above? Would that be via the post_proxy section? If so, could anyone give me an example of how this could be done? FYR, this is being run on FreeRadius 1.0.1 on Redhat Enterprise Linux 3. Thanks SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkPpQ+oACgkQmw4BJyaatJ18GACfYQOFEn8SBhZ4IQYyQYbBBMKD3/4A n23uYwysIQqPu1oWrrp500gbHJ1/ =Svg+ -----END PGP SIGNATURE-----

1 0

grouping rlm_ippool's
by Mike O'Connor 07 Feb '06

07 Feb '06

Hi Some time ago there was a question about rlm_ippool and if it was possible to group them ie ippool main_pool_1 {} ippool main_pool_2 {} accounting { group main_pool { main_pool_1 main_pool_2 } sql } post-auth { group main_pool { main_pool_1 main_pool_2 } } I have done some testing it it does not seem to work. (using freeradius-1.0.5) Do any one have any idea of how this could be made to work and/or have I not got this configuration correct. Thanks Mike

3 2