- Freeradius-Users - lists.freeradius.org

Problems with the PEAP configuration
by Mario Alberto Cruz Gartner 08 Jul '05

08 Jul '05

Hi! I'd finally knew why the client (Xp-SP2) was sending the username "PEAP-MacAddress" to the radius. I have installed the "Cisco Aironet Client Utility" (and the aironet drivers), and this software changed the EAP methods on XP and sends the mentioned user instead of the real one when tries PEAP auth. Now, the real username comes to the radius, the authorize comes ok, but the authenticate returns "handled" and the client doesn't authenticates well. I was looking the debug output and now i don't see where i can dig for details. EAP/TLS works fine already. Maybe i'm misleading something? What i'm doing wrong? Again, thks a lot for your help, it's annoying answer to too many similar questions, i know, but i didn't find something to do now of this. AND, i was thinking on make an updated version of the guides so ppl with less exp (like me!) can read and don't disturb you. =)

1 1

High performance request remapping / rewriting
by Phil Mayers 08 Jul '05

08 Jul '05

All, We are looking to implement mac-based vlans with a radius backend. I'm hoping freeradius is the obvious choice, but I'm having a hard time seeing how to do what I need. What I'm looking to is feed FreeRadius from our host registration database. Each NAS (switch) may potentially have different VLANs on it, and each registered host may fall into a different vlan "type", so the radius server needs to map: (clientmac, nasipaddress) -> vlantag However, there are ~20k MAC addresses and ~1200 NASes (switches), so clearly I can't do this: DEFAULT Calling-Station-Id = "<mac0>", NAS-IP-Address = "<switch0>" DEFAULT Calling-Station-Id = "<mac0>", NAS-IP-Address = "<switch1>" DEFAULT Calling-Station-Id = "<mac0>", NAS-IP-Address = "<switch2>" ... DEFAULT Calling-Station-Id = "<mac20k>", NAS-IP-Address = "<switch1k>" ...because it's 20 million entries. The file as a users compiled to dbm is >4Gb :o( I wanted to do some kind of optimisation - the switches are grouped into zones in our database, and vlans are specific to these zones (normally a building), so actually something like: nasip -> zone (clientmac, zone) -> vlan ...but that's still too large, so maybe: nasip -> zone clientmac -> clienttype (there are 5 types - unreg, guest, roaming, home, blocked) (clienttype, zone) -> vlan ...which would be much smaller, but I can't see how you do this. I must admit to being somewhat confused about the request, check and reply items, but from what I can tell a "users" item consists of: username OR DEFAULT <space> [comma-separated items to check against request] <newline> [comma-separated items to add to reply] ...so even with Fall-Through=Yes you can never do this: DEFAULT NAS-IP-Address = blah Zone = "foo" DEFAULT Calling-Station-Id = "00-11-22-33-44-55", User-Password = "00-11-22-33-44-55" Kind = "guest" # Fallback - unknown hosts DEFAULT Calling-Station-Id =~ "^[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}-[0-9A-F]{2}$" , User-Password = `%{0}` Kind = "unreg" DEFAULT Zone = "foo", Kind = "unreg" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID := "1" DEFAULT Zone = "foo", Kind = "guest" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID := "2" ...because Zone and Kind are set in the reply, so can't be matched further down. rlm_attr_rewrite has the beginnings of what is needed, but a linear search through 20k regexps for the hosts, followed by 1k regexps for the switches clearly isn't going to work. Ideally an apache-like feature of DBM mapping is what's needed of something like: /etc/raddb/radiusd.conf: attr_rewrite nas2zone { attribute = NAS-IP-Address searchin = packet searchfor = "(.*)" replacewith = "%{dbm:nas2zone:%{1}}" new_attribute_name = "Zone" } ...and similarly for Calling-Station-Id -> kind The issue is that this needs to go very very fast - at peak times (e.g. say a reboot of a PC cluster during overnight maintenance) the DHCP servers get ~50 requests/second, so a radius server(s) would need to answer with similar performance. I originally tried to do this with rlm_sql direct to our registration database, but the performance was abominal (which is not an SQL issue) and eventually it hung the radius server anyway (rlm_sql_postgresql). In any event I was never super-keen on that for security reasons, though the fact it was instant-updating once a registration was processed was very handy. I'm assuming rlm_exec would have similar if not worse performance characterisitcs (spawning 50 processes a second during peak times does not strike me as overly sensible). Is there an rlm_socket: socket mac_vlan { path = "/var/run/mac_vlan.unixsock" wait = yes input_pairs = request output_pairs = reply } ...i.e. keep a persistent connection to something open. I'd appreciate any suggestions.

2 1

ippool corrections
by Marek Gradzki 08 Jul '05

08 Jul '05

Hi there! I have installed and run FreeRadius Server on Solaris 8 (x86 and sparc). Authorization and authentication works with LDAP protocol with OpenLDAP server. Accounting is processed by SQL database (PostgreSQL). I use these radius servers to perform AAA operations as a response to request send from device terminating PPPoE sessions. Also I have to use radius server feature to dynamically assign IP addresses to client sessions. So I have assumed that rlm_ippool module is right for this task. But unfortunately all sessions that are terminated in the box working with radius come to this device by the same port. So I had to rewrite a little bit rlm_ippool module to verify used ip addresses not only by nas device and nas port but also by user name. Unfortunately I have no opportunity to test this rewriten module in orther configurations. If anyone is interested in testing this module please email me, because I would like to be sure that this module will work in other configuration (maybe not everyone), no only in mine. Anyway I will have to verify my corrections because rlm_ippool_tools displays some strange informations on teh screen. mgradzki(a)ost.net.pl

2 1

"LOGIN INCORRECT" and "LOGIN OK"
by Bruno Machado 08 Jul '05

08 Jul '05

Hi friends There are a weird something happening here. This is our log about a user: Wed Jun 29 22:36:03 2005 : Auth: Login incorrect: [user(a)domain.com.br/<no User-Password attribute>] (from client 10.5.0.2 port 5060) Wed Jun 29 22:36:04 2005 : Auth: Login incorrect: [user(a)domain.com.br/<no User-Password attribute>] (from client 10.5.0.2 port 5060) Wed Jun 29 22:36:57 2005 : Auth: Login incorrect: [user(a)domain.com.br/<no User-Password attribute>] (from client 10.5.0.2 port 5060) Wed Jun 29 22:37:00 2005 : Auth: Login OK: [user(a)domain.com.br/<no User-Password attribute>] (from client 10.5.0.2 port 5060) Wed Jun 29 22:37:00 2005 : Auth: Login incorrect: [user(a)domain.com.br/<no User-Password attribute>] (from client 10.5.0.2 port 5060) I already tried to discover the problem, but I didn't find anything. We are using Radius in a VoIP system. If I configure my SIP client with user's informations, Radius allows my access to the system. Unfortunatly, when the data arrive from the SIP client's user, Radius deny it. Rarely Radius returns "LOGIN OK". Weird... Maybe the ADSL Router's user can be corrupting the data? And our system is working perfectly for the other users. Thanks for any comments. Bruno Machado _______________________________________________________ Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora! http://br.acesso.yahoo.com/

2 1

class attribute wont pass
by Brian 08 Jul '05

08 Jul '05

Hello, I'm running freeradius 0.9.3 (I know.. it's old..), operating in a proxy configuration. I'm having issues with freeradius not passing the "class" attribute back to the NAS after receiving it from one of our proxy customers. I can't put the Class attribute in the user's file because the proxy customer uses different values per customer. We only have one customer that passes the class attribute to us, so this is the first instance where we are having this issue. I've tried changing the attribute value from "octet" to "string" in the dictionary file as was suggested previously on the mailing list, but it doesn't make a difference :-( Here is debug output from radiusd: rad_recv: Access-Request packet from host 63.110.xxx.xx:3401, id=75, length=211 User-Name = "user(a)realm.com" User-Password = "6875" NAS-IP-Address = 63.215.xx.xxx NAS-Port = 807 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 28800 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 50667 Called-Station-Id = "317270xxxx" Calling-Station-Id = "317862xxxx" NAS-Identifier = "nas.ind.Level3.net" Acct-Session-Id = "483826947" NAS-Port-Type = Async Ascend-NAS-Port-Format = 4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 73 modcall[authorize]: module "attr_filter" returns noop for request 73 rlm_realm: Looking up realm "realm.com" for User-Name = "user(a)realm.com" rlm_realm: Found realm "realm.com" rlm_realm: Proxying request from user user to realm realm.com rlm_realm: Adding Realm = "realm.com" rlm_realm: Preparing to proxy authentication request to realm "realm.com" modcall[authorize]: module "suffix" returns updated for request 73 users: Matched DEFAULT at 537 modcall[authorize]: module "files" returns ok for request 73 hints: Matched DEFAULT at 49 modcall[authorize]: module "preprocess" returns ok for request 73 modcall: group authorize returns updated for request 73 Sending Access-Request of id 1 to 63.174.xxx.xx:1645 User-Name = "user(a)realm.com" User-Password = "6875" NAS-IP-Address = 63.215.xx.xxx NAS-Port = 807 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 28800 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 50667 Called-Station-Id = "317270xxxx" Calling-Station-Id = "317862xxxx" NAS-Identifier = "nas.ind.Level3.net" Acct-Session-Id = "483826947" NAS-Port-Type = Async Ascend-NAS-Port-Format = 4 Proxy-State = 0x3735 Waking up in 1 seconds... rad_recv: Access-Accept packet from host 63.174.xxx.xx:1645, id=1, length=218 Proxy-State = 0x3735 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Filter = "ip in forward tcp est" Ascend-Data-Filter = "ip in forward dstip 63.174.xxx.x/24 0" Ascend-Data-Filter = "ip in drop tcp dstport = 25" Ascend-Data-Filter = "ip in forward 0" Idle-Timeout = 1800 Session-Timeout = 21600 Propel-Accelerate = 1 X-Ascend-Idle-Limit = 1800 X-Ascend-Maximum-Time = 28800 Class = "IEAS1\005378602\003292" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 73 attr_filter: Matched entry DEFAULT at line 84 modcall[authorize]: module "attr_filter" returns updated for request 73 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 73 users: Matched DEFAULT at 537 modcall[authorize]: module "files" returns ok for request 73 hints: Matched DEFAULT at 49 modcall[authorize]: module "preprocess" returns ok for request 73 modcall: group authorize returns updated for request 73 rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [user(a)realm.com/6875] (from client acs223 port 807 cli 3178623267) Sending Access-Accept of id 75 to 63.110.xxx.xx:3401 Service-Type := Framed-User Framed-IP-Address := 255.255.255.254 Framed-IP-Netmask := 255.255.255.255 Framed-Protocol := PPP Ascend-Data-Filter = "ip in forward tcp est" Ascend-Data-Filter = "ip in forward dstip 63.174.xxx.x/24 0" Ascend-Data-Filter = "ip in drop tcp dstport = 25" Ascend-Data-Filter = "ip in forward 0" Session-Timeout = 21600 X-Ascend-Maximum-Time = 28800 Framed-Compression = Van-Jacobson-TCP-IP Idle-Timeout = 900 X-Ascend-Idle-Limit = 900 Finished request 73 -------- As you can see in the debug output, the freeradius server receives the class attribute from 63.174.xxx.xx, but when sending back to the NAS at 63.110.xxx.xx, the Class attribute is not being tagged on. Any help / direction would be greatly appreciated! Thanks. Brian Taylor

2 2

Debug vs. Run mode
by Jamie Chitester 08 Jul '05

08 Jul '05

I have a problem. I am running fedora core 4 FreeRADIUS 1.0.2 and MySQL 4.1.11 I am using NTRadPing Test Utility to test the radius server I can get Access-Accept response from MySQL only when I am running in debug mode (radiusd -X) If I run /etc/init.d/radiusd start and try to authenticate I get "no response from server (timed out)" Any ideas? Jamie Chitester Information Technology Department Manager City Light Gas & Water Phone: (573)888-5366 ext. 109 Cell: (573)888-7371 Fax: (573)888-3312 <http://www.clgw.net> http://www.clgw.net

3 2

Re: Freeradius and eDirectory
by Sayantan Bhowmick 08 Jul '05

08 Jul '05

Hi, FreeRADIUS is trying to do SYSTEM authentication. For SYSTEM authentication to work you need to have a Unix user with the same userid found in the request(in this case jmuser). So let me know which authentication type you want to use. If you want to use LDAP to authenticate your user one simple solution will be to comment out the DEFAULT entry which is setting the Auth-Type to SYSTEM in the users file. The users file is in the raddb directory. There will a couple of lines similar to the following. Just comment them. DEFAULT Auth-Type = System Fall-Through = 1 Also Universal Password is not read wrongly. Since System authentication fails a bind with a wrong password is performed to trigger the intruder detection feature of eDirectory. HTH. Regards, -Sayantan. >>> jmdanner(a)samford.edu 07/05/05 11:04 PM >>> Thanks - that worked. I'm getting a tls connect. Now I have a problem testing using radtest. Using the following syntax. radtest jmuser heath10er server13.samford.edu 199.20.16.13 testing123 >From the log the admin bind and login is OK - I've obscured the password, but it shows in the log exactly as it is in radiusd.conf. rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,ou=cts,o=dxmltemp/xxxxxx to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful Here's the excerpt showing the request from radtest. The password is represented correctly. rad_recv: Access-Request packet from host 199.20.16.13:33419, id=137, length=58 User-Name = "jmuser" User-Password = "heath10er" NAS-IP-Address = 255.255.255.255 NAS-Port = 199 Here's the attempted bind by the user. Note that the password presented is not "heath10er" but "aeath10er" and the bind fails. rlm_ldap: starting TLS rlm_ldap: bind as cn=jmuser,ou=R&D,ou=New Users,o=DXMLTEMP/aeath10er to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) Changed the Universal Password to "aeath10er" and got the following. rlm_ldap: starting TLS rlm_ldap: bind as cn=jmuser,ou=R&D,ou=New Users,o=DXMLTEMP/beath10er to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) It appears that the Universal Password is being misread. Can that be true? Full log is below. Thanks Mearl >>> sbhowmick(a)novell.com 6/27/2005 10:55:07 PM >>> Hi, You need to extract the Self Signed certificate of the CA (from inside the Security Container). Once you have extracted that you need to configure tls_cacertfile in the ldap section of radiusd.conf. You have configured the tls_certfile. Once you do that it should start working. -Sayantan. >>> jmdanner(a)samford.edu 06/27/05 9:20 PM >>> I'm having trouble getting a TLS connection from freeradius to my Novell LDAP Server. I've used Novell's document "Integrating Novell eDirectory with FreeRadius" to set it up. The radius -X log shows "rlm_ldap: could not start TLS Connect error" I've configured ldap.conf to use the same certificate and am able to do a successful search using: ldapsearch -vvv -h gwtemp.samford.edu -x -Z -b o=dxmltemp "cn=jmuser" dn FreeRadius 1.0.4 compiled --with-edir Redhat AS3 update 5 on an IBM p615 openldap-2.0.27-17 openssl-0.9.7a-33.15 Netware 6.5 SP3 on Dell hardware. Mearl Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "gwtemp.samford.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=admin,ou=cts,o=dxmltemp" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "demand" ldap: password = "xxxxx-xxxxx" ldap: basedn = "o=dxmltemp" ldap: filter = "(uniqueID=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x1016f6d8 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 199.20.16.13:33419, id=137, length=58 User-Name = "jmuser" User-Password = "heath10er" NAS-IP-Address = 255.255.255.255 NAS-Port = 199 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jmuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jmuser radius_xlat: '(uniqueID=jmuser)' radius_xlat: 'o=dxmltemp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gwtemp.samford.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,ou=cts,o=dxmltemp/xxxxxx to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=dxmltemp, with filter (uniqueID=jmuser) rlm_ldap: checking if remote access for jmuser is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jmuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gwtemp.samford.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=jmuser,ou=R&D,ou=New Users,o=DXMLTEMP/aeath10er to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) rlm_ldap: ldap_release_conn: Release Id: 0 modcall[post-auth]: module "ldap" returns reject for request 0 modcall: group Post-Auth-Type returns reject for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 199.20.16.13:33419, id=137, length=58 Sending Access-Reject of id 137 to 199.20.16.13:33419 Reply-Message = "NDS error: failed authentication (-669)" --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 137 with timestamp 42cabe38 Nothing to do. Sleeping until we see a request. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 13

Re: Radius not configured properly
by Michael Cooper 08 Jul '05

08 Jul '05

Hey everyone, I am very new to this so if I screw up and ask a stupid question I apologize, I have freeradius it's version 1.0.2 (I will upgrade when I understand better what's going on) installed on a Mandriva LE 2005 Box and it's the default install not configured as of yet. I added a user via Dialup Admin and then there is the test user also. My network consists of 2 - Portmaster 3 NAS boxes for Dial up and I have 7 Wireless APs (Not concerned about these yet) in the field. I ran radtest against the server with this command -> radtest test test123 127.0.0.1:1645 1645 n4sc4r and also with mcooper and mypass. >From what i have read just getting a response is a good thing, from what I understand the server giving a response is half the battle. So I have that working, but not sure where to go or how to configure from here. The following is the response I got not sure what thios is telling me could someone help me out please? Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 124 with timestamp 42ce6f71 Nothing to do. Sleeping until we see a request. Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32847, id=124, length=56 Discarding duplicate request from client mail2:32847 - ID: 124 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 124 with timestamp 42ce6f6b Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:32847, id=124, length=56 User-Name = "test" User-Password = "test123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 radius_xlat: '' modcall[authorize]: module "sql" returns fail for request 5 modcall: group authorize returns fail for request 5 Thanks in advance, Michael A Cooper BCCISP.net http://www.bccisp.net 281-854-2079 "Technology that counts, voices that matter!"

1 0

Cisco attributes for Freeradius using MySQL db for auth
by Okka Radius 08 Jul '05

08 Jul '05

Defined them in the radgroupreply table and used the += in the op row in that table and voila .. Did'nt have to stick them in the users or hints files in the raddb conf dir ... See example ... rlm_pap: login attempt by "user@realm" with password test3 rlm_pap: Using password "userpassword" for user user@realm authentication. rlm_pap: Using clear text password. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 14 modcall: group Auth-Type returns ok for request 14 Sending Access-Accept of id 3 to clientipaddress:3390 Service-Type = Framed-User Framed-Protocol = PPP Cisco-AVPair += "ip:ip-unnumbered=Loopback51" Cisco-AVPair += "ip:addr-pool=ipnetpool2"

1 0

Proxying with Calling-Station-Id
by Stylianos Stylianou 08 Jul '05

08 Jul '05

Hi, I am trying to configure freeradius to proxy requests to another radius based on the Calling Station Id. Can anyone help me how to configure my radius server to do this? Thanks.

2 1