- Freeradius-Users - lists.freeradius.org

Freeradius .. EAP/PEAP ... no accounting
by Simone 09 Nov '05

09 Nov '05

hi all.. I have installed a freeradius 1.0.5.. For my project i need to use it for authenticate and log (accounting) the wi-fi customer on an area of my city.. All is done ok.. the Hot-spot is configured for work with Radius using WPA - EAP using PEAP and radius.. Freeradius is configured with TLS and PEAP and the authentication way working correctly.. I'm able to use my winXp client with Wi-fi.. connecting to the Hotspot and get the IP address via DHCP.. all great.. DAMN !!! freeradius don't log the accounting and i don't find what is the problem.. all the config on radiusd.conf about auth and accounting seem to be ok.. Some part of radiusd.conf =============== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ....... ....... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ......... ......... # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 } # # Many people want to log authentication requests. # Rather than modifying the server core to print out more # messages, we can use a different instance of the 'detail' # module, to log the authentication requests to a file. # # You will also need to un-comment the 'auth_log' line # in the 'authorize' section, below. # detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } ........... ........... # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } ============================= Anyone could tell me .. "stupid here the error" :)) thanks for help..

2 1

dialup_admin online users problems
by Eric Tanguy 09 Nov '05

09 Nov '05

Hi, i use freeradius-1.0.1 with mysql on Fermi Linux LTS Release 3.0.1 and dialup_admin1.62 I have a problem in showing the online user in dialup_admin. when a user over ppp connect on NAS, it doesn't appear in user online because nothing is writing into the radacct table and i don't know why. it 's different when an administrator connect into the NAS iver telnet or ssh, this session is writing into the radacct table. can anyone help me. -- mailto : eric.tanguy(a)gicm.fr G.I.C.M. Infrastructure & réseau 32 Rue Mirabeau, 29480 Le Relecq-Kerhuon Tél : +33 298003671 Fax : +33 298284005 -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

1 0

Segmentation Fault
by Linda Pagillo 09 Nov '05

09 Nov '05

I just installed the newest version of Freeradius (1.0.5) on my Linux Redhat 9 server. All went well except this... when i start the radius in debug mode.. all starts fine, but when the first user tries to authenticate, i get a Segmentation Fault and the radius stops. Any ideas? Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

10 27

JRadius
by Raoul Demour 08 Nov '05

08 Nov '05

Hello Does anyone have ever tried JRadius (jradius.sf.net)? As I'm more familiar whith Java than C, I wonder if I'm not going to use it to handle EAP-SIM (I am not completly sure I can do so, but if it is possible I will do so). Any experience is welcome. __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

3 2

Problem with EAP/TLS and XP SP2
by Hal Pomeranz 08 Nov '05

08 Nov '05

Radius Server: Freeradius 1.0.5 on Solaris 8 (Sparc) Client: Windows XP (SP2), Intel PRO/Wireless 2915 (a/b/g) Access Point: DLink DI-784 I'm having trouble getting my laptop (running Windows XP SP2) to authenticate to my access point using EAP/TLS. XP shows the wireless interface hung forever in "Attempting to authenticate" state. I've been beating my head against this all day without success, although I think I'm close and just missing something stupid and obvious. In the debugging log from "radiusd -X" below, I can see my laptop communicating with the radius server. I'm definitely seeing the correct username ("HalPomeranz") from the certificate I installed on the laptop. The radius server is finding the username entry in my "users" file. The only thing that looks like an error is the lines that read: rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A I Googled a bit for this error message and turned up some mailing list traffic describing similar problems, but no solutions. Perhaps this is a red herring, however. Note that I am successfully using this same radius server to authenticate some older clients which use LEAP to connect via a different access point, so I'm thinking my radius config is basically sound. Does anybody have any suggestions for how to resolve my problem? Anybody seen anything like this before? Thanks in advance... -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Hal Pomeranz, Founder/CEO Deer Run Associates hal(a)deer-run.com Network Connectivity and Security, Systems Management, Training -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /var/freeradius/etc/raddb/proxy.conf Config: including file: /var/freeradius/etc/raddb/clients.conf Config: including file: /var/freeradius/etc/raddb/snmp.conf Config: including file: /var/freeradius/etc/raddb/eap.conf Config: including file: /var/freeradius/etc/raddb/sql.conf main: prefix = "/var/freeradius" main: localstatedir = "/var/freeradius/var" main: logdir = "/var/freeradius/var/log/radius" main: libdir = "/var/freeradius/lib" main: radacctdir = "/var/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/freeradius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/freeradius/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/var/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /var/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/var/freeradius/etc/raddb/certs/server_key.pem" tls: certificate_file = "/var/freeradius/etc/raddb/certs/server_cert.pem" tls: CA_file = "/var/freeradius/etc/raddb/certs/cacert.pem" tls: private_key_password = "" tls: dh_file = "/var/freeradius/etc/raddb/certs/dh" tls: random_file = "/var/freeradius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/var/freeradius/etc/raddb/huntgroups" preprocess: hints = "/var/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/var/freeradius/etc/raddb/users" files: acctusersfile = "/var/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/var/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.4:1435, id=199, length=139 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100100148616c506f6d6572616e7a Message-Authenticator = 0xe476642b4d621276fdcfa07fc848c5d6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 199 to 192.168.100.4:1435 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf5332abd7af77b9911176ec9aa69e0e8 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.4:1435, id=200, length=221 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200500d800000004616030100410100003d030143696dabf9029fc190693ca4dc70364a394a56ff89289a020122f2e7346c770500001600040005000a000900640062000300060013001200630100 State = 0xf5332abd7af77b9911176ec9aa69e0e8 Message-Authenticator = 0x438ea47659b46e7e17bb9a54f66f02be Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0510], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 200 to 192.168.100.4:1435 EAP-Message = 0x0103040a0dc0000005c7160301004a02000046030143696da6a2b012e765aa3f113c4c1ed6e28c40f51807859cd4394962388ae6e0202f9cf584c484b68b3aa0eb66ee1d1edec787b87407a2bf043891da3dc798f42b00040016030105100b00050c00050900024730820243308201aca003020102020101300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139323533385a170d3036313130323139323533385a3069310b300906 EAP-Message = 0x0355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573311a301806035504031311646565722e646565722d72756e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c0511b635bded2881c4db827a89c521fbcc5a06b435b4ad56cd1b9b8ad0e78815ef2bd5d1e60e7a4c7f6b1a154cde960cf5de365fdd2fa462b3b90934d252245e87996b4031326e118dc68f9c9f6e3efb08958ba388f7677c47ecbf35514a74f27926b6a39d7f452c9caa2fb9d98fd3bdde64c4aa8f1b81228f502d1 EAP-Message = 0x117dcd5f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003818100243b1d366876ce82374e51d6e84e0a7e93a70558baad71a2a43ddc3602bc87df8c8d96fc2e903e1b68ae3bfdd5e1e8e1764d7d636d7bcdd0aa4a2f33598115ad1b6d90d43596654f4f956f26ad6cfc6d47330bc0d2a57e8e1998b9fc6da570c117a643bb699091f80f5aff0c44f6bb875ef27e0d79fbfda8ca01763debfff8960002bc308202b830820221a003020102020100300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d0603 EAP-Message = 0x5504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139313931355a170d3036313130323139313931355a304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f63696174657330819f300d06092a864886f70d010101050003818d0030818902818100c16d27eab105d0e179e6a58207dd1b7d0c1a5a64f761506275abebf495254f4e242f9d13926e56bfe0bb8d9130afca9287746c12c5eed4f0ae5233ecc412bba6693cf9fad4e1db0f EAP-Message = 0x4f4b39c0f47ed5293975a9448d479ca38fbddeef68e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf608c3c340e7dcd273e77d1ca5afd315 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.4:1435, id=201, length=147 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 State = 0xf608c3c340e7dcd273e77d1ca5afd315 Message-Authenticator = 0x399bf08221ad337dec5353e34d1f3f9e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 201 to 192.168.100.4:1435 EAP-Message = 0x010401d10d80000005c709eeaeeb99893a248df35086a268947b61542d3988e761db738040976f08e84fd7830203010001a381a73081a4301d0603551d0e0416041400b41eff09bcce9ad9f1b04ba50419a7db44a7f030750603551d23046e306c801400b41eff09bcce9ad9f1b04ba50419a7db44a7f0a151a44f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573820100300c0603551d13040530030101ff300d06092a864886f70d010104050003818100b8ddea1e6f5851b78cca0feab23bd8 EAP-Message = 0x9b7d268ab9250ccd7a7d720d6c2cf103477a6445773dca5be28fd44611b9e4a2a9a6331550fbad950e21fea1ff8e70a3d178c9d1ebf13b12cd80d6ce561be9699a922a722207d4950140bb0aeb3d8b3e22021a83c91948f1903b4eaedb66a1288837436871f1a57bda39f374a3fb8af28b160301005e0d0000560201020051004f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f6369617465730e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x86870d983715d15f6919bdba762433c2 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.100.4:1435, id=202, length=147 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400060d00 State = 0x86870d983715d15f6919bdba762433c2 Message-Authenticator = 0xeda680bdf69e5dd588260e1c36169581 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 202 to 192.168.100.4:1435 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2b04eed7fe0be0ec28fbba826e52b47c Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 199 with timestamp 43696da6 Cleaning up request 1 ID 200 with timestamp 43696da6 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 201 with timestamp 43696da7 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 202 with timestamp 43696da8 Nothing to do. Sleeping until we see a request.

4 7

compile issues with freeradius 1.0.5 on solaris 10
by Garrett.Marks＠wichita.edu 08 Nov '05

08 Nov '05

Hello, I was having problems compiling freeradius-1.0.5 on Solaris 10 (sparc) that were rather difficult to troubleshoot. I managed to get the compilation completed successfully, but it seems that maybe there could be some changes to improve the experience others have with compiling freeradius on Solaris 10 in the future. The problem I had, and another poster had, centers around configuring freeradius to compile with openssl. The full set of configure options I used were as follows: ./configure \ --prefix=/usr/local/freeradius \ --with-threads \ --with-ldap \ --with-openssl-includes=/usr/sfw/include/openssl \ --with-openssl-libraries=/usr/sfw/lib \ --with-rlm-ldap-include-dir=/usr/local/openldap/include \ --with-rlm-ldap-lib-dir=/usr/local/openldap/lib \ With no changes to my environment I get the following error: .... gcc -L../lib -o radwho radwho.o util.o log.o conffile.o -L/usr/sfw/lib -lssl -L/usr/sfw/lib -lcrypto -lnsl -lresolv -lsocket -lposix4 -lpthread -lradius -lcrypt Undefined first referenced symbol in file MD5Init ../lib/libradius.a(radius.o) (symbol belongs to implicit dependency /usr/lib/libmd5.so.1) MD5Final ../lib/libradius.a(radius.o) (symbol belongs to implicit dependency /usr/lib/libmd5.so.1) MD5Update ../lib/libradius.a(radius.o) (symbol belongs to implicit dependency /usr/lib/libmd5.so.1) ld: fatal: Symbol referencing errors. No output written to radwho ... The error does not occur when I run the configure from above leaving out the two openssl options. This was fixed by adding the following to my environment: LIBS=-lmd5 export LIBS * - This issue and workaround was mentioned by a previous poster. Should md5 be added to the list of libraries automatically defined during the configure process for the above? Then I get the following error: ... gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/sfw/include/openssl -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include -DHOSTINFO=\"\" -DRADIUSD_VERSION=\"1.0.5\" -c radclient.c radclient.c: In function `main': radclient.c:788: error: `RADIUS_DICTIONARY' undeclared (first use in this function) radclient.c:788: error: (Each undeclared identifier is reported only once radclient.c:788: error: for each function it appears in.) gmake[4]: *** [radclient.o] Error 1 gmake[4]: Leaving directory `/tmp/freeradius-1.0.5/src/main' ... This was a rather perplexing error as upon investigation of the radclient.c source and the freeradius-1.0.5/src/include directory, RADIUS_DICTIONARY is defined in ../include/conf.h and radclient.c has an include statement for conf.h. It is even more perplexing when investigating the gcc command from above, clearly the conf.h should be findable through the "-I../include" portion of the command. Following a suggestion, I set my CFLAGS env variable to CFLAGS="-I../include -I/usr/local/openldap/include" to force the -I../include to appear further up in the gcc command. To my surprise that allowed the compilation to finish successfully. After further investigation we discovered that there is also a "conf.h" file in the /usr/sfw/include/openssl directory which appears before the -I../include in the gcc command formed above. Therefore the radclient.c sees the openssl conf.h which does not have the `RADIUS_DICTIONARY' defined, thus the error. I checked the openssl source not from Sun and they have a "conf.h" as well. I could imagine a couple of possible fixes for this issue: 1) Modify configure to place the -I/usr/sfw/include/openssl (the ssl include path) to be after the -I../include? or 2) Change the name of conf.h to something more descriptive and specific to freeradius to avoid conflicts like this? Another interesting aspect is that with 1.0.4, it seems as if the --with-openssl-lib= option wasn't really working, because even with that set it wouldn't find ssl or libcrypt unless I set LD_LIBRARY_PATH. Now with 1.0.5 I don't have to set LD_LIBRARY_PATH. -Garrett Marks

2 1

Framed-Route and proxying
by Jason Frisvold 08 Nov '05

08 Nov '05

Hi there, I'm looking for a way to force certain users through a proxy. I *think* Framed-Routes are the way to go. Can someone help me out a little? Our users either dial in via a Patton RAS unit, or a Redback SMS-500. Any help would be appreciated. Thanks! -- Jason 'XenoPhage' Frisvold XenoPhage0(a)gmail.com

3 4

Strange issue.
by shadur＠systemec.nl 08 Nov '05

08 Nov '05

A while ago I upgraded our freeradius server to 1.0.2 from a 0.9.x version, and ever since our ISDN dial-up users can not gain access when their login type in radcheck is Crypt-Password. If I change them to a User-Password attribute and the cleartext password, it works. I've compiled a debug log at http://tenchi.systemec.nl/~shadur/radlog.txt with the SQL query outputs added below the queries where they are made. This exact setup worked with 0.9.x ; I've ru -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://marduk.systemec.nl/~shadur/shadur.key.asc

2 1

RE: Solaris Make Problems
by Nicholas Thompson 08 Nov '05

08 Nov '05

I finally got freeradius to make without errors. However to do this I had to manually change the Makefile (in src/modules/rlm_sql/drivers/rlm_sql_mysql)and take out these options -x03 -mt and -xarch=v8, but I am not sure if this will affect the stability or useage of freeradius. >-xarch=v8 sounds like a Sun cc option. It's a good idea to work just with >one compiler, sun or gnu. Adjust the PATH that ./configure and make just >see on compiler. >I dont have the sun compiler. I am using GCC version 3.3.2 and the gnu linker version 2.14 >both of these are located in /usr/local/bin and that is the first directory in my path. > I am new to freeradius. I have a Solaris 8 machine with OpenSSL > version 0.9.8 and MySQL version 5.0.15 (max). Configure completes > without any problems however make fails. I have read many > suggestions on the list, and tries all of them. Such as setting the > LD_LIBRARY_PATH, I even tried to configure and make with just static > libraries. Could there be a problem with freeradius and MySQL5? > Here is a copy of the make output errors: > make[10]: Entering directory `/export/home/nicholas/freeradius-1.0. > 5/src/modules/rlm_sql/drivers/rlm_sql_mysql' > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c > sql_mysql.c -o sql_mysql.o > gcc: language arch=v8 not recognized > gcc: sql_mysql.c: linker input file unused because linking not done -xarch=v8 sounds like a Sun cc option. It's a good idea to work just with one compiler, sun or gnu. Adjust the PATH that ./configure and make just see on compiler. > /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld - > module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o > -o rlm_sql_mysql.a > (cd . && ln -s sql_mysql.lo sql_mysql.o) > ln: cannot create sql_mysql.o: File exists > make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 1

Re: Freeradius the right tool as Windows Authentication Proxy?
by Thomas Stieglitz 08 Nov '05

08 Nov '05

Hello Helen, thank you for your informative answer! > It's possible, but I don't think RADIUS is the right tool. Which one or which technics do you think ist the right solution for my problem? Greetings, Tom Stieglitz FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 07.11.05 18:38:23: > > Thomas Stieglitz <Starglider7(a)web.de> wrote: > > We're running an apache 1.X webserver, which is located at an > > external provider. My problem is, that we need to authenticate > > webusers against our Windows 2000 Active Directory, which is located > > in our companies' local network. > > I would recommend using an Apache module for this task. Maybe > mod_ntlm, or mod_smb would be appropriate. > > > 1) Is this idea a possible solution ... the right use of an radius-server? And, if yes: is freeradius the right tool for it? > > It's possible, but I don't think RADIUS is the right tool. > > > 2) If yes: Is it also possible, to gain group information about a user. (i. e. Is Fred Member of Group Foo? Which groups is Fred member of?) > > Yes, but you can't use RADIUS to send that information to Apache. > > > 3) if yes: how do I find an entry point for further information about this special subject? > > If the documentation doesn't already contain the information you > need, use google to search mailing list archives. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2