- Freeradius-Users - lists.freeradius.org

RE: sql counter clarification and issues
by Ross Tsolakidis 13 Jul '05

13 Jul '05

Thanks for clearing that up Marcin :) Does anyone else have any other suggestions on how to extract daily totals ? Regards, -- Ross -----Original Message----- From: Marcin Jessa [mailto:lists@yazzy.org] Sent: Wednesday, 13 July 2005 4:38 PM To: Ross Tsolakidis Cc: freeradius-users(a)lists.freeradius.org Subject: Re: sql counter clarification and issues On Wed, 13 Jul 2005 12:15:45 +1000 "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > Thanks for responding Marcin, just to double check: > > > I added those details into radgroupcheck: > mysql> select * from radgroupcheck; > +----+-----------+---------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+---------------------+----+-------+ > | 1 | 24Hours | Max-Daily-Session | := | 86400 | > | 2 | 24Hours | Max-Weekly-Session | := | 86400 | > | 3 | 24Hours | Max-Monthly-Session | := | 86400 | > | 4 | 24Hours | Max-All-Session | := | 86400 | > | 5 | 10Mins | Max-Daily-Session | := | 600 | > | 6 | 10Mins | Max-Weekly-Session | := | 600 | > | 7 | 10Mins | Max-Monthly-Session | := | 600 | > | 8 | 10Mins | Max-All-Session | := | 600 | > +----+-----------+---------------------+----+-------+ > 8 rows in set (0.00 sec) > > mysql> > > == > > My sqlcounter.conf is exactly the same. > > I have added this: > $INCLUDE ${confdir}/sqlcounter.conf > Into the radiusd.conf > > == > > When I fire up radius in debug mode I get these messages for sqlcounter: > > Module: Loaded SQL Counter > sqlcounter: counter-name = "Daily-Session-Time" > sqlcounter: check-name = "Max-Daily-Session" > sqlcounter: key = "User-Name" > sqlcounter: sqlmod-inst = "sql" > sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - > UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' > AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" > sqlcounter: reset = "daily" > rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 > rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 > rlm_sqlcounter: Current Time: 1121220718 [2005-07-13 12:11:58], Next > reset 1121263200 [2005-07-14 00:00:00] > rlm_sqlcounter: Current Time: 1121220718 [2005-07-13 12:11:58], Prev > reset 1121176800 [2005-07-13 00:00:00] > Module: Instantiated sqlcounter (dailycounter) > > == > > I read the experimental.conf but I can't seem to understand where the > counters are reset, which table ? > Could you give me an example of the table so I can see what it should > look like ? (daily totals) I don't really have any need to disconnect > people after a certain period of time, just need daily and monthly > totals. Then sqlcounter is not for you. If you need stats, those are stored in radacct table and can be sorted with SQL queries + maybe some code. Take a look at dialupadmin, how it's done there. > Thanks again, greatly appreciated ! :) > > > Regards, > -- > Ross > > -----Original Message----- > From: Marcin Jessa [mailto:lists@yazzy.org] > Sent: Tuesday, 12 July 2005 6:03 PM > To: FreeRadius users mailing list > Cc: Ross Tsolakidis > Subject: Re: sql counter clarification and issues > > On Tue, 12 Jul 2005 15:21:52 +1000 > "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > > Ok, now I'm really confused :( > > > > Can someone please clarify exactly what does the sqlcounter module > > do > ? > > Basically I need to calculate the data on a daily basis for each user. > > sqlcounter works fine. > Your radgroupcheck or radcheck needs to have the same attributes you > have in your sqlcounter config. > Check out mine: > http://www.yazzy.org/configs/linux/freeradius/sqlcounter.conf > > mysql> select * from radgroupcheck; > +----+-----------+---------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+---------------------+----+-------+ > | 1 | 24hours | Max-Daily-Session | := | 86400 | > | 2 | 24hours | Max-Weekly-Session | := | 86400 | > | 3 | 24hours | Max-Monthly-Session | := | 86400 | > | 4 | 24hours | Max-All-Session | := | 86400 | > | 5 | 10mins | Max-Daily-Session | := | 600 | > | 6 | 10mins | Max-Weekly-Session | := | 600 | > | 7 | 10mins | Max-Monthly-Session | := | 600 | > | 8 | 10mins | Max-All-Session | := | 600 | > +----+-----------+---------------------+----+-------+ > 8 rows in set (0.00 sec) > > Read experimental.conf, it describes the module. > It count's user's online time stored in the raddacct table and based > on that info allows user to log in if her allowed session time is not > exceeded. > This can be done on daily, weekly, monthly or total basis. > > > Thanks for your patience :) > > Read former postings to the list describing the behaviour and > functionality of the module. > People tend to be more patient if they know you did some work on your > own. > > Cheers, > Marcin Jessa > > > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > > Ross Tsolakidis > > Sent: Tuesday, 5 July 2005 2:14 PM > > To: FreeRadius users mailing list > > Subject: RE: sql counter clarification and issues > > > > Yes the server is receiving accounting packets. > > The SQL rows are updating every 5 mins, (I have the NAS set to send > > accounting packets every 5 mins). > > > > I run it in debug mode, I see: > > Module: Loaded SQL Counter > > sqlcounter: counter-name = "Daily-Session-Time" > > sqlcounter: check-name = "Max-Daily-Session" > > sqlcounter: key = "User-Name" > > sqlcounter: sqlmod-inst = "sqlcca3" > > sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - > > UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE > UserName='%{%k}' > > AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" > > sqlcounter: reset = "1h" > > rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 > > rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 > > rlm_sqlcounter: num=1, last=h > > rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Next > > reset 1120536000 [2005-07-05 14:00:00] > > rlm_sqlcounter: num=1, last=h > > rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Prev > > reset 1120532400 [2005-07-05 13:00:00] > > Module: Instantiated sqlcounter (dailycounter) > > > > But no reset. > > > > Does anyone have this working, if so, what am I looking for, what am > > I > > > supposed to see ? > > > > Thanks :) > > > > Regards, > > -- > > Ross > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > > Alan DeKok > > Sent: Tuesday, 5 July 2005 2:05 AM > > To: FreeRadius users mailing list > > Subject: Re: sql counter clarification and issues > > > > "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > > At midnight every night will it begin a new row in SQL ? > > > > I don't know, I've never used the module. > > > > > Because at the moment there are no new rows being created, no > > > counters > > > > > being reset. > > > > Is the server receiving accounting packets? > > > > Run it in debug mode with "reset=hour", and spend some time > > looking at what it's doing. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

1 0

No SSL info available. Waiting for more SSL data with Red Hat 7.1
by Dick 13 Jul '05

13 Jul '05

Hi all, At home I've configured a perfectly working freeradius with PEAP/MSCHAPv2, I'd like to transfer it to my work to some really old red hat 7.1 boxes. First I configured and freeradius from source and installed in prefix /usr/local but it crashed on the old ssl, so I grabbed the latest openssl configured it and installed in /usr/local as well, recompiled freeradius with the appropiate ssl directories and it ran! I transferred the configuration from my server at home and converted the appropiate paths. I tried authenticating on but it failed, the only suspicious thing I could find is: rlm_eap_tls: No SSL info available. Waiting for more SSL data. After three of these attempts the supplicant (winxp sp2) seems to bail out, xsupplicant seems to give it some more tries. What am I missing? TIA Dick

2 8

RE: Aruba-Switch_NAS-Problem
by Guy Davies 13 Jul '05

13 Jul '05

Ready to process requests. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown ! client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. [GD] Looks to me like you didn't configure 10.1.2.254 as a valid client of the RADIUS server. Look in clients.conf. Rgds, Guy This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 13 Jul '05

13 Jul '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, July 13, 2005 2:20 PM > To: FreeRadius users mailing list > Subject: Re: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy > > Zawacki Jason D Ctr AFRL/IFOS <Jason.Zawacki.ctr(a)rl.af.mil> wrote: > > I've been trying to get this to work, but it appears, to > me, that the > > redundancy is only used for part of the auth process. > > What "auth" process? Authorize or authenticate? > > > When looking up the > > DN for the user who is trying to authenticate, redundancy works. > > During the "authorize" stage. > > > After that > > though, it appears that only the first module in the > redundant list is > > tried. > > Which redundant list? You listed two. > > > authenticate { > > Auth-Type LDAP { > > redundant { # wasn't sure if this was necessary > > svr1 > > If you want redundancy for authentication, you can list that. > > > I test by simulating a failure of svr1 using: > > Ok. The debug log shows: > > > modcall[authorize]: module "svr1" returns fail for request 0 > ... > > modcall[authorize]: module "svr3" returns fail for request 0 > ... > > modcall[authorize]: module "svr2" returns ok for request 0 > > So the redundancy in the "authorize" section works. > > > rlm_ldap::ldap_groupcmp: Search returned error > > You're using the LDAP-Group attribute, which is set to use svr1, > which is down. There's currently no fail-over for the LDAP-Group > attribute. > I dig, that's kind of what I thought (even if I didn't word it correctly). Thanks for your help! Jason > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

LDAP authentication
by Florin Andrei 13 Jul '05

13 Jul '05

Description of situation first, freeradius question at the end: I am doing plain user/pass authentication against an LDAP server using ldapsearch: $ ldapsearch -H ldap://XXXXXXXX -b 'o=XXXXXXXXXXXXX,c=us' -D 'uid=XXXXX,o=XXXXXXXXXXXXXX,c=us' -x -W uid=XXXXX Enter LDAP Password: [snip] result: 0 Success [snip] The packet trace looks like this: #################################################### No. Time Source Destination Protocol Info 4 0.001468 somecomputer.somedomain.com someserver.somedomain.com LDAP MsgId=1 Bind Request, DN=uid=XXXXX,o=YYYYYYYYYY,c=us Frame 4 (123 bytes on wire, 123 bytes captured) Internet Protocol, Src Addr: somecomputer.somedomain.com (XXX.YYY.ZZZ.38), Dst Addr: someserver.somedomain.com (AAA.BBB.CCC.18) Lightweight Directory Access Protocol LDAP Message, Bind Request Message Id: 1 Message Type: Bind Request (0x00) Message Length: 50 Response In: 6 Version: 3 DN: uid=XXXXX,o=YYYYYYYYYY,c=us Auth Type: Simple (0x00) Password: 1234567890 No. Time Source Destination Protocol Info 6 0.067801 someserver.somedomain.com somecomputer.somedomain.com LDAP MsgId=1 Bind Result Frame 6 (96 bytes on wire, 96 bytes captured) Internet Protocol, Src Addr: someserver.somedomain.com (AAA.BBB.CCC.18), Dst Addr: somecomputer.somedomain.com (XXX.YYY.ZZZ.38) Lightweight Directory Access Protocol LDAP Message, Bind Result Message Id: 1 Message Type: Bind Result (0x01) Message Length: 23 Response To: 4 Time: 0.066333000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: +0gg4KMBV5FZkjyC #################################################### I don't really care about any information that's returned, I only want to authenticate against LDAP. Can I configure freeradius to do the same? I tried a few configurations in radiusd.conf but everything seems to trigger a behaviour that's different from ldapsearch. LDAP is currently used to authenticate various things, and I'd like to point a Radius server to it to use the same user passwords. -- Florin Andrei http://florin.myip.org/

3 3

FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 13 Jul '05

13 Jul '05

Hey folks, Has anyone gotten redundancy working when using LDAP to perform authentication and authorization? I've been trying to get this to work, but it appears, to me, that the redundancy is only used for part of the auth process. When looking up the DN for the user who is trying to authenticate, redundancy works. After that though, it appears that only the first module in the redundant list is tried. Then it ultimately fails. The LDAP servers are 3 Windows DCs. authorize { redundant { svr1 svr3 svr2 notfound = return } files } authenticate { Auth-Type LDAP { redundant { # wasn't sure if this was necessary svr1 svr3 svr2 } } } I test by simulating a failure of svr1 using: route add -host <svr1 IP> 127.0.0.1 -blackhole Svr3 happens to be down for maintenance at the moment Thanks for any help, Jason Log: rad_recv: Access-Request packet from host x.x.x.x:3104, id=14, length=54 User-Name = "username" User-Password = "XXXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for usersname radius_xlat: 'XXXXXXXX' radius_xlat: 'XXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXX to XXXXXXXXXXXX rlm_ldap: XXXXXXXXXX bind to XXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr1" returns fail for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: 'XXXXXXXXXXXXXXXXXXX' radius_xlat: 'XXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr3 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXX to XXXXXXXXXXXXXX rlm_ldap: XXXXXXXXXXXx bind to XXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr3" returns fail for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: 'XXXXXXXXXXXXXXXxxxxxx' radius_xlat: 'XXXXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr2 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXX to XXXXXXXXXXXXXXXX rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in XXXXXXXXXXXXXXXXXX, with filter (&(XXXXXXXX)(XXXXXXXXXX)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr2" returns ok for request 0 modcall: group redundant returns ok for request 0 radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' radius_xlat: '(&(objectClass=group)(member=XXXXXXXXXXXXXXXXXXXXXXXXXXXX))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXXX to XXXXXXXXXXXXXXXXXXXXXXXx rlm_ldap: XXXXXXXXXXXXXXXXXXXX bind to XXXXXXXXXXXXXXXXXXXXXXXX Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXX' radius_xlat: '(&(objectClass=group)(member=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxx))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXX to XXXXXXXXXXXXXXXXXXXXXXXX rlm_ldap: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX bind to XXXXXXXXXXXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error users: Matched entry DEFAULT at line 224 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [username] (from client client port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 14 to x.x.x.x:3104 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 14 with timestamp 42d548f0 Nothing to do. Sleeping until we see a request.

3 3

FreeRadius for VPN Secondary Authentication
by Eric 13 Jul '05

13 Jul '05

I am attempting to find a radius server which will support secondary authentication for my remote users going through a Checkpoint FW-1 with Securemote. I was hoping to require username/password and a certificate for authentication. Does anyone know if this is possible with FreeRadius and if so, how to go about setting this up. I know how to create certificates, but where do I set up the requirements, add users/passwords? FreeRadius 1.04 Thanks Eric __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Aruba-Switch_NAS-Problem
by alfonso celestino 13 Jul '05

13 Jul '05

Hi, everybody!! I have problems trying to authenticate wireless users, using a Switch Aruba as NAS. I will be grateful much someone could help!!!! Here's debug mode result moctezuma:~# /usr/local/radius/sbin/run-radius -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib:/usr/local/wldap/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/debian.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/debian.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/root.pem" tls: private_key_password = "wireless" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.com.mx/

1 0

eap-ttls pap proxy problem
by Tim Tyler 13 Jul '05

13 Jul '05

Alan, others, Ok, we are trying to get wireless clients configured for 802.1x authentication by using wpa configured with pap authentication. This works fine on the Freeradius server if we authenticate against system. However, when we try to proxy to other non eap supported radius servers, it fails and we have tried a lot of permutations. We know that proxy works if we simply use NTradPing test utility. However, our XP clients using SecureW2 or Mac OS X ver3 simply wont work. Below are our critical configuration lines as well as output from Debug. If anyone might tell us what we might be doing wrong, we would very much appreciate it! users: DEFAULT Auth-Type := PAP, Proxy-To-Realm = stu Fall-Through = 1 proxy.conf: realm stu { type = radius authhost = stu.beloit.edu:1645 accthost = stu.beloit.edu:1646 secret = testpass } eap.conf: eap { default_eap_type = ttls ignore_unknown_eap_types = yes } tls { private_key_password = tempprivate private_key_file = ${raddbdir}/certs/server_keycert.pem certificate_file = ${raddbdir}/certs/server_keycert.pem CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { # default_eap_type = md5 # copy_request_to_tunnel = yes # use_tunneled_reply = yes } Debug: rad_recv: Access-Request packet from host 144.89.40.251:1451, id=254, length=144 NAS-IP-Address = 144.89.40.251 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 User-Name = "leadacid@stu" Calling-Station-Id = "00119551d683" Called-Station-Id = "0001e6ffc493" NAS-Identifier = "ISR Test -don't use" EAP-Message = 0x020b0011016c6561646163696440737475 Message-Authenticator = 0x3a44d6f0ad7b1f8b6b550b65142e2b60 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: Looking up realm "stu" for User-Name = "leadacid@stu" rlm_realm: Found realm "stu" rlm_realm: Adding Stripped-User-Name = "leadacid" rlm_realm: Proxying request from user leadacid to realm stu rlm_realm: Adding Realm = "stu" rlm_realm: Preparing to proxy authentication request to realm "stu" modcall[authorize]: module "suffix" returns updated for request 5 rlm_eap: Request is supposed to be proxied to Realm stu. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall: group authorize returns updated for request 5 Sending Access-Request of id 0 to 144.89.40.6:1645 NAS-IP-Address = 144.89.40.251 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 User-Name = "leadacid" Calling-Station-Id = "00119551d683" Called-Station-Id = "0001e6ffc493" NAS-Identifier = "ISR Test -don't use" EAP-Message = 0x020b0011016c6561646163696440737475 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323534 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Reject packet from host 144.89.40.6:1645, id=0, length=25 Proxy-State = 0x323534 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 5 modcall[post-proxy]: module "eap" returns noop for request 5 modcall: group post-proxy returns noop for request 5 Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 144.89.40.251:1451, id=254, length=144 Sending Access-Reject of id 254 to 144.89.40.251:1451 Tim Tyler Network Engineer

2 1

Active Directory and FreeRadius
by Talwar, Puneet (NIH/NIAID) 13 Jul '05

13 Jul '05

HI, I was able to auth against AD by setting up KRB5 on RHEL. Now I would like to setup freeradius where I will have bunch of UNIX workstation that will point to the freeradius server using pam_radius_auth module and will auth against radius server using their AD credentials. So would anyone have an example of radiusd.conf file that I can see and get an idea how I might be able to setup freeradius server to point to the AD for auth purposes. Thanks,

2 1