- Freeradius-Users - lists.freeradius.org

Re:no response from server on other machine
by yao guoxian 29 Dec '05

29 Dec '05

> If the server doesn't respond on localhost, then either it isn't >running, or you edited the configuration files to break it. > Alan DeKok. Thank you for your suggestion. The fact is Radius works correctly on the localmachine (the same machine on which FreeRadius 1.0.5 was installed).However, when a authentication request was sent to Radius Server from the other machine. The request got no response. I don't know the reason. Can you give me a detail on how to resovle the problem?

4 3

Selecting one of multiple Ldap server in users file
by Gerald Richter 29 Dec '05

29 Dec '05

Hi, I want to use more than one ldap server to authenticate users. I have setup a users file that sets the Autz-Type so one of two ldap server are selected for authorization. Since it is not known which kind of authentication information is provied by the user, chap is also included, like Authorize { preprocess suffix file Auth-Type aldap1 { chap ldap1 } Auth-Type aldap2 { chap ldap2 } } My problem is now when it comes the authentication, because both instances of the ldap module sets the Auth-Type to LDAP, it will only work with one ldap server. Also I cannot set the Auth-Type in the users file, because it might also be set to CHAP by the chap module. How can I specify which ldap server to use for authentication in such a case? Is there a possibility to include the module instance name in the Auth-Type? Thanks Gerald --------------------------------------------------------------------------- Gerald Richter ecos electronic communication services gmbh IT-Securitylösungen * Webapplikationen mit Apache/Perl/mod_perl/Embperl Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz E-Mail: richter(a)ecos.de Voice: +49 6133 939-122 WWW: http://www.ecos.de/ Fax: +49 6133 939-333 --------------------------------------------------------------------------- ECOS BB-5000 Firewall- und IT-Security Appliance: www.bb-5000.info --------------------------------------------------------------------------- ** Virus checked by BB-5000 Mailfilter **

3 6

Adapting Reply-Msg to Reject cause
by Yannick Deltroo 28 Dec '05

28 Dec '05

Hello, I'm using Freeradius with rlm_sql & sqlcounter to authorize access to hotspots. I would like to set a specific Reply-Message (which is displayed in the user browser) depending the Reject cause, for instance: - Reply-Msg="Account has expired" (if reject because of Expiration == XXXX) - Reply-Msg="Time credit is exhausted" (if reject because of Max-All-Session := XXXX) - Reply-Msg="Access not allowed from this NAS" (if reject because of Nas-Identifier !=XXXX) - Reply-Msg="Wrong password" (if cannot authenticate) How can I do that without writing a custom authorization script ? Thanks for yout help. Yannick Deltroo

1 0

AcctStopTime - AccStartTime != AcctSessionTime
by Ezequiel O. Block 28 Dec '05

28 Dec '05

Hi to all, +----------+---------------------+---------------------+-----------------+ | UserName | AcctStartTime | AcctStopTime | AcctSessionTime | +----------+---------------------+---------------------+-----------------+ | pepe | 2005-12-02 16:24:45 | 2005-12-02 16:25:46 | 63 | | pepe | 2005-12-02 16:26:23 | 2005-12-02 16:27:12 | 52 | | pepe | 2005-12-02 16:29:02 | 2005-12-02 16:29:09 | 9 | | pepe | 2005-12-02 17:43:37 | 2005-12-02 18:03:32 | 1197 | | pepe | 2005-12-02 18:09:16 | 2005-12-02 18:15:45 | 391 | First line should be 61 Second line should be 49 Third line should be 7 etc. In some rows there are even bigger differences, shouldn´t be AcctSessionTime the difference of AcctStopTime - AcctStartTime ? Thanks in advance, Ezequiel. -- Ezequiel O. Block Cooperativa La Lonja, Servicios de Internet. T 02322-474537 F 02322-470406 E ezequielb(a)pilar-ciudad.com.ar

2 1

Re: EAP-MD5 Authentication problem
by Marco Spiga 28 Dec '05

28 Dec '05

Hello!!! I don't know why the 'radeapclient -s -xx 127.0.0.1 auth testing123 <req.txt' command don't authenticate whith radiusd. The req.txt file contains: User-Name = "test" User-Password = "password" EAP-MD5-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 EAP-Code = Response Called-Station-Id = "00-06-25-57-18-B6" Calling-Station-Id = "00-06-23-27-38-E6" EAP-Id = 210 EAP-Type-Identity = "test" Message-Authenticator = 0x0 -------------------------------------------------------------------- the radius.conf file contain: modules { ... eap { default_eap_type = md5 md5 { } ... } ... } authorize { ... eap } authenticate { eap } the eap.conf file contain: eap { default_eap_type = md5 md5 { } } the users file contain: "test" Auth-Type := EAP, User-Password == "password" Reply-Message = "Hello, %u" Where is the error ? Please. Bye!

3 5

Problem with freeRadius +openssle +EAP/TLs
by Adam Rogalski 28 Dec '05

28 Dec '05

Hi folks I'm new here and I'm trying to configure Radius for my home wireless network. I use RADIUS on fedora core 4, my AP is WRT54G and clients are on WindowsXp sp2. I made everythig with "how to" on page http://www.linuxjournal.com/article/8095. But I still don't have authentication with Radius. In radius log I get message rlm_eap_tls: Length Included Wed Dec 28 15:41:18 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Dec 28 15:41:19 2005 : Info: rlm_eap_tls: Length Included Wed Dec 28 15:41:19 2005 : Error: --> verify error:num=20:unable to get local issuer certificate Wed Dec 28 15:41:19 2005 : Error: TLS Alert write:fatal:unknown CA Wed Dec 28 15:41:19 2005 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Dec 28 15:41:19 2005 : Error: rlm_eap_tls: SSL_read failed in a system cal When I try to do radiusd -X -A I get Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "adam01" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. And now nothing is happen. So if you now how please help me

1 0

radius error file
by Kai Geek 28 Dec '05

28 Dec '05

#tail -f /var/log/radius/radius.log Wed Dec 28 13:31:21 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Dec 28 13:31:21 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Dec 28 13:31:21 2005 : Info: Ready to process requests. why problem in radius server ? -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

Hello Radius Server Problem
by Kai Geek 28 Dec '05

28 Dec '05

Hello, what your radius server starting problem? dont log /varlog/radius/radius.conf :( Switch IP : 10.0.0.250 <- Dlink (26 Port) Radius Server: 10.0.0.6 #ssh 10.0.0.6 #pico clients.conf client 10.0.0.250 { secret = testing shortname = des-deneme } #pico users tbaygul Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, # Framed-IP-Address = , # Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP root@****:/etc# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: ipaddr = 10.0.0.6 IP address [10.0.0.6] listen: port = 1812 listen: type = "auth" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Listening on authentication 10.0.0.6:1812 Ready to process requests. -- what is problem, please help me.. thank you +-+-+- BEGIN PGP SIGNATURE -+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) ___ / __) Kai "Ozgur" Geek \__ \ PGP ID: B1B63B6E (___/lackware Network Engineer +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Fw: segmentation fault on solaris,unable to call modules
by Qin Zhen 28 Dec '05

28 Dec '05

Hi developers, this is the output from gdb. i was trying to run freeradius-1.0.5 on Solaris 8. pls kindly assist. thanks in advance. Rgds, QZ (gdb) bt #0 0xff324878 in lt_dlsym (handle=0x81cd8, symbol=0xffbee4b8 "rlm_ldap") at ltdl.c:3330 #1 0x1c9a4 in linkto_module (module_name=0xffbee628 "rlm_ldap", cffilename=0x276c8 "radiusd.conf", cflineno=724) at modules.c:230 #2 0x1cc14 in find_module_instance (instname=0x4ef90 "ldap") at modules.c:347 #3 0x1e024 in do_compile_modsingle (component=1, ci=0x4f3b8, filename=0x276c8 "radiusd.conf", grouptype=0, modname=0xffbee87c) at modcall.c:814 #4 0x1e090 in compile_modsingle (component=1, ci=0x4f3b8, filename=0x276c8 "radiusd.conf", modname=0xffbee87c) at modcall.c:830 #5 0x1d0d0 in load_component_section (cs=0x4f2a0, comp=1, filename=0x276c8 "radiusd.conf") at modules.c:568 #6 0x1d57c in setup_modules () at modules.c:858 #7 0x147e0 in main (argc=2, argv=0xffbefa84) at radiusd.c:960 > ----- Original Message ----- > From: "Alan DeKok" <aland(a)ox.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, December 21, 2005 12:27 AM > Subject: Re: segmentation fault on solaris,unable to call modules > > >> "Qin Zhen" <qin.zhen(a)pacific.net.sg> wrote: >>> havent figured out how to solve the segmentation fault problem yet. any >>> suggestion? or anybody encountered the similar problem as me? >> >> Read doc/bugs >> >> Alan DeKok. >> - > "Qin Zhen" <qin.zhen(a)pacific.net.sg> wrote: >> Hi All, installing freeradius on Solaris is already a big headache, afterwards i encountered Segmentation fault as well. i am using Freeradius-1.0.5 if i commend up those modules called in radiusd.conf (e.g. files, preprocess,ldap, prefix under 'Authorize'), there is no segmentation fault error. so seems that it is not able to call any of the modules inside radiusd.conf. this configuration is able to work for freeradius-0.8 on solaris, as well as freeradius-1.0.5 on debian. pls advise. thanks in advance. >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

1 0

FR caching problem
by Lemaster, Rob 28 Dec '05

28 Dec '05

FreeRADIUS v.1.0.5 I am trying to enable caching on line 623 in radiusd.conf. When I turn on caching and reload, I get the following error: Info: Reloading configuration files. Info: Using deprecated naslist file. Support for this will go away soon. Info: HASH: Reinitializing hash structures and lists for caching... Error: rlm_unix: You MUST specify a shadow password file! Error: HASH: unable to create user hash table. disable caching and run debugs Error: radiusd.conf[605]: unix: Module instantiation failed. When I turn caching back off and reload, FreeRadius starts just fine: Info: Using deprecated naslist file. Support for this will go away soon. Info: Ready to process requests. I am using the /etc/passwd and /etc/group for authentication. I am not using /etc/shadow. Does FR require an /etc/shadow path even if it is not used? Any thoughts or suggestions? thanks

2 1