- Freeradius-Users - lists.freeradius.org

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 18 Jan '06

18 Jan '06

Here is another debug of the failure Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.crt" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Root.crt" tls: private_key_password = "demo" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "../etc/raddb/huntgroups" preprocess: hints = "../etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "../etc/raddb/users" files: acctusersfile = "../etc/raddb/acct_users" files: preproxy_usersfile = "../etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "../var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=88, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 88 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 88 with timestamp 43ce52ec Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=89, length=155 User-Name = "tripp1" User-Password = "tripp1" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tripp1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp1/tripp1] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 89 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 89 with timestamp 43ce52f5 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=90, length=154 User-Name = "tripp" User-Password = "tripp1" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp1] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 90 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 90 with timestamp 43ce52fe Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=91, length=154 User-Name = "tripp" User-Password = " " NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns ok for request 3 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/ ] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 91 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 91 with timestamp 43ce530d Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=92, length=155 User-Name = "tripp1" User-Password = "tripp1" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tripp1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns ok for request 4 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp1/tripp1] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 92 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 92 with timestamp 43ce5314 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=93, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 755 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns ok for request 5 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 755 cli 24.73.134.236) Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 93 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 93 with timestamp 43ce531c Nothing to do. Sleeping until we see a request. Terminate batch job (Y/N)? Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Sills, Tripp Sent: Wednesday, January 18, 2006 9:12 AM To: FreeRadius users mailing list Subject: RE: CIsco Pix and FreeRadius.... I am not altering the users file all I have in it is : I was using the same username and password for both. Below is my users file. # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # You don't need to specify a password if you set Auth-Type += System # on the list of authentication requirements. The RADIUS server # will then check the system password file. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Auth-Type := Local, User-Password == "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # "John Doe" User-Password == "hello" Reply-Message = "Hello, %u" test User-Password == "testing123" Reply-Message = "Hello, %u" # Test TLS Certificate based user FreeRADIUS.net-Client User-Password == "demo" Reply-Message = "Hello, %u" # # Dial user back and telnet to the default host for that port # #Deg Auth-Type := Local, User-Password == "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Auth-Type := Local, User-Password == "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # against the system database, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell", Auth-Type := System # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # #DEFAULT Auth-Type = System # Fall-Through = 1 # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Defaults for all framed connections. # DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Shell-User # On no match, the user is denied access. tripp Auth-Type := Local, User-Password == "tripp" tripp1 Auth-Type := System, User-Password == "tripp1" Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, January 17, 2006 1:32 PM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > Notice the first request that comes from the 10.2.0.69...It is using the > test aaa-server from the PIX itself. The other 2 are when I am > connecting to the VPN client and trying to authenicate. It says Auth > Type unknown. Any ideas Alan? The only differences is in which entries it matches in the "users" file. Read those entries to see what it's doing, and why. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Dummy newbie question
by Fernando 18 Jan '06

18 Jan '06

Hy! I have a dummy question... running radtest, i get a Accept-Accept, and everything seems ok, but the database radacct table doesn't get updated, in fact the table is blank after many tests. Is it normal? Or i've mistaken something? Thanks for the help Fernando S. SanInternet Systems www.saninternet.com

3 2

RE: FreeRADIUS with PEAP(MSCHAPv2), MySQL and LDAP?
by Palmer J.D.F. 18 Jan '06

18 Jan '06

Hi Phil, Many thanks for the reply. I'm sorry the detail was lacking I'll try to explain myself a little better now. Firstly, what we do already and why I want to use MySQL... At the moment we run FR as a RADIUS proxy that proxies requests to a number of RADIUS servers based on the username. Presently we use the 'users' file to do this, the users file is built from our mail tables; amongst other things the users file maps a username to a home RADIUS server and a VLAN; basically I want to use MySQL to replace the users file; I don't want to actually authenticate against details in the MySQL database. The reason we use the mail tables is that it contains every user and the respective server that their mail goes to, we use the SMTP server name to determine which domain a user's RADIUS requests should be sent to. We use the Proxy_To_Realm directive in the users file to forward a user's request to the correct server. The reason I now want to use a database is because it will give us the ability to add more user data fields and a database would be more manageable, as the current users file has 38554 entries and is growing. Why I want to use LDAP... All of our user data is held in various MS ADS or Novell NDS directories, currently we run an IAS machine on each of our AD domains to handle the proxied requests forwarded by the FR server; my thinking was that it seems a little pointless to have these IAS boxes if I could use FR to set up the PEAP tunnels then verify the user's credentials against the appropriate domain's LDAP server. I ideally want to use PEAP(MSCHAPv2) though, mainly from a support, but also from an encryption strength point of view; however it appears that unless something clever can be done to verify MSCHAPv2 against MS or Novell LDAP it looks like I may be stuck with the nasty IAS boxes. I hope that makes some sense. Many thanks, Jezz Palmer. > -----Original Message----- > From: freeradius-users- > bounces+j.d.f.palmer=swansea.ac.uk(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+j.d.f.palmer=swansea.ac.uk(a)lists.freeradius.org] On Behalf Of Phil > Mayers > Sent: 17 January 2006 21:03 > To: FreeRadius users mailing list > Subject: Re: FreeRADIUS with PEAP(MSCHAPv2), MySQL and LDAP? > > Palmer J.D.F. wrote: > > Hi, > > > > > > > > I am currently trying to create a new auth system for our WPA 802.1x > > WiFi network. > > > > Thus far I have the server authenticating using PEAP(MSCHAPv2) against a > > users file containing a simple test user/pass pair. > > > > What I would now like to do is use MySQL to contain user data such as > > the VLAN to be assigned to that user and which LDAP server their account > > Assuming you know how to make the VLAN assignment work at all, then this > is trivial. > > Assigning a completely dynamic LDAP server might be a little more tricky. > > If you know what set of LDAP server(s) you want to use in advance, then > you could do this: > > modules { > ldap ldap1 { > # config here > } > ldap ldap2 { > # config here > } > } > > authorize { > preprocess > mysql > mschap > eap > > Autz-Type Ldap1 { > ldap1 > } > Autz-Type Ldap2 { > ldap2 > } > } > > The "mysql" module/tables will need to set Autz-Type on the requests, at > which point the authorize stanza will be run *again* executing the > conditional sections. > > ...however making this work correctly in the presence of eap/ms-chapv2 > will not be straightforward, and in any event you have the other issue... > > > exists on, then use LDAP to verify the credentials. > > The only "verification" LDAP can do of credentials is to proxy PAP > requests to LDAP simple binds. You cannot check MS-CHAP "against" an > LDAP server. > > However using LDAP as a database, as it was intendended, then *if* the > LDAP server contains either plaintext password or the NT/LM hashes, the > radius server can read them, and the ldap module is configured to get > them from LDAP, then FreeRadius can perform the MS-CHAP inside itself. > > > > > The idea being that a PEAP request comes in, tunnel gets built etc, the > > user gets looked up in the MySQL database, the credentials are then > > authenticated against the correct LDAP (or RADIUS) server, then on > > success an access-accept along with the user's VLAN is passed back to > > the NAS. > > This seems extremely hard work. Why would you use both MySQL and LDAP? > > > > > > > > > The question is, is it possible for PEAP(MSCHAPv2) and LDAP with MySQL > > to interact in this way? > > Your question is not precise enough for me to be sure exactly what you > want. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 2

dictionary.3gpp2 note
by Alexander Serkin 18 Jan '06

18 Jan '06

hi, According to http://www.3gpp2.org/Public_html/specs/P.S0001-B_v2.0_041004.pdf (page 65) the attribute 41 (3GPP2-R-P-Session-Id) in dictionary.3gpp2 should be integer, not string. And i'd remove the comment '#' on it in the file. Thanks, -- als

1 0

Error: Assertion failed in request_list.c, line 1119
by masetio 18 Jan '06

18 Jan '06

i'm using freeradius-snapshot-20060115 i have error --> Tue Jan 17 19:56:34 2006 : Error: rlm_sql: Failed to create the pair: Unknown at tribute "1" Tue Jan 17 19:56:34 2006 : Error: rlm_sql (sql): Error getting data from databas e Tue Jan 17 19:56:34 2006 : Error: rlm_sql (sql): SQL query error; rejecting user Tue Jan 17 20:00:16 2006 : Info: Ready to process requests. Tue Jan 17 20:00:55 2006 : Error: Assertion failed in request_list.c, line 1119 i dont understan with code request_list.c ??? plz... How to debug this problem ? -- ~_|[]~

1 1

eap authentication and proxy radius
by Matteo Paoli 18 Jan '06

18 Jan '06

It's possible configure Freeradius to request two eap authentication? For example, the supplicant starts the eap-tls and the authentication is ok. But the server radius don't send Access Accept but it requests a new authentication (for example eap-md5). If also eap-md5 is ok, the supplicant is authenticated. authentication supplicant = (authentication eap-tls) && (authentication eap-md5) If the first answer is Yes. It's possible that the first authentication is forwarded to remote radius server and the second one is resolved locally? authentication supplicant = (authentication eap-tls on remote radius server) && (authentication eap-md5 on proxy radius server) Many thanks, Matteo Paoli -- Matteo Paoli

2 1

freeradius-1.1.0 + oracle + fedora
by Fred Casavant 17 Jan '06

17 Jan '06

I'm running Fedora (FC4) with the Oracle Instantclient 10g rpms (basic,devel,sqlplus,jdbc) and I'm trying to compile freeradius 1.1.0 with oracle support but the oracle module doesn't compile at all. It seem like the rlm_sql_oracle configure and makefile are buggy as hell or they only support an Oracle8 installation. It look like the with-oracle-home-dir and with-oracle-include-dir and with-oracle-lib-dir configure switches are useless because even when I set them up properly it doesn't seem to be using them and it doesn't compile. At first it was complaining about some missing oci.h even if it's there. So after reading the config.log I created some soft link so that it's finding it but then it was complaining about some other missing stuff so I did some other soft links. So now I'm at something like four soft link all around my system and it still doesn't compile :) I tried to edit the configure.in and the makefile files (I'm a newbie when it come to makefile and configure and autoconf stuff) and it still doesn't work. So I don't know what to do next. I'm very close to scrap the whole oracle plan and switch to mysql or to flat raddb file. Is there anyone that successfully compile the rlm_sql_oracle module in FC4 (or any fedora for that matter)?

1 0

FreeRADIUS with PEAP(MSCHAPv2), MySQL and LDAP?
by Palmer J.D.F. 17 Jan '06

17 Jan '06

Hi, I am currently trying to create a new auth system for our WPA 802.1x WiFi network. Thus far I have the server authenticating using PEAP(MSCHAPv2) against a users file containing a simple test user/pass pair. What I would now like to do is use MySQL to contain user data such as the VLAN to be assigned to that user and which LDAP server their account exists on, then use LDAP to verify the credentials. The idea being that a PEAP request comes in, tunnel gets built etc, the user gets looked up in the MySQL database, the credentials are then authenticated against the correct LDAP (or RADIUS) server, then on success an access-accept along with the user's VLAN is passed back to the NAS. The question is, is it possible for PEAP(MSCHAPv2) and LDAP with MySQL to interact in this way? Many thanks, Jezz Palmer.

2 1

unsubscribe
by Cian Phillips 17 Jan '06

17 Jan '06

unsubscribe

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 17 Jan '06

17 Jan '06

Notice the first request that comes from the 10.2.0.69...It is using the test aaa-server from the PIX itself. The other 2 are when I am connecting to the VPN client and trying to authenicate. It says Auth Type unknown. Any ideas Alan? Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.crt" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Root.crt" tls: private_key_password = "demo" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "../etc/raddb/huntgroups" preprocess: hints = "../etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "../etc/raddb/users" files: acctusersfile = "../etc/raddb/acct_users" files: preproxy_usersfile = "../etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "../var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=85, length=93 User-Name = "tripp" User-Password = "tripp" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=000.000.000.000" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry tripp at line 224 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [tripp/tripp] (from client BorderPatrol port 0) Sending Access-Accept of id 85 to 10.2.0.69:1025 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 85 with timestamp 43cd26ed Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=86, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 739 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 739 cli 24.73.134.236) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 86 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 86 with timestamp 43cd273a Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=87, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 739 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 739 cli 24.73.134.236) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 87 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 87 with timestamp 43cd2740 Nothing to do. Sleeping until we see a request. Terminate batch job (Y/N)? -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, January 16, 2006 10:33 PM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > It says Auth-Type found Local but when I run with the VPN client it > says unknown auth type. Please any help would be great! Help us help you. Read the README, INSTALL, and FAQ. Then follow the instructions there for debugging the server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1