- Freeradius-Users - lists.freeradius.org

Freeradius + LDAP
by Brekler Custodio 10 Dec '12

10 Dec '12

Hello guys, i was wondering, anyone knows how to configure an LDAP (phpldapadmin) to work with freeradius ?I search all over the web and couldnt find a tutorial that teachs how to configure a simple DB to work with FR.The FR is configured already, its very simple, but the LDAP i cant handle.

1 0

Re: open with mac authentication.
by Tzvika Gelber 09 Dec '12

09 Dec '12

Thank you very much. > > Tzvika Gelber wrote: > > I created a new user with the MAC address of the client as the user and > > password : > ... > > 00C0CA32A157 Cleartext-Password := "00C0CA32A157" > ... > > User-Name = "00c0ca32a157" > > User-Password = "00c0ca32a157" > > You do realize that they are different, right? > > The comparisons in the users file are case-sensitive. > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Sun, 9 Dec 2012 09:38:03 -0600 > From: Dan Letkeman <danletkeman(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: computer authentication > Message-ID: > <CAPY== > jnnw7fUHHpB1FvqPqMu8gQtuFERP_9WMWv__n7sVQec0w(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Thank you Matthew for the clarification I could successfully get the > windows 7 client to try and make a request (you defiantly need to have the > certs imported into exactly the correct spots). But now my debug log says > that its failing. This is a default 2.1.12 install with the switch added > to the clients.conf file. > > > rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=204, > length=180 > User-Name = "host/user(a)example.com" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x41f4a411366a244a23e887c859436d0b > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] Looking up realm "example.com" for User-Name = "host/ > user(a)example.com" > [suffix] Found realm "example.com" > [suffix] Adding Stripped-User-Name = "host/user" > [suffix] Adding Realm = "example.com" > [suffix] Proxying request from user host/user to realm example.com > [suffix] Preparing to proxy authentication request to realm "example.com" > ++[suffix] returns updated > [eap] Request is supposed to be proxied to Realm example.com. Not doing > EAP. > ++[eap] returns noop > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > ++[pap] returns noop > WARNING: Empty pre-proxy section. Using default return values. > Sending Access-Request of id 231 to 127.0.0.1 port 1812 > User-Name = "host/user" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x00000000000000000000000000000000 > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > Proxy-State = 0x323034 > Proxying request 0 to home server 127.0.0.1 port 1812 > Sending Access-Request of id 231 to 127.0.0.1 port 1812 > User-Name = "host/user" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x00000000000000000000000000000000 > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > Proxy-State = 0x323034 > Going to the next request > Waking up in 0.9 seconds. > rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=231, > length=171 > User-Name = "host/user" > Service-Type = Framed-User > Framed-MTU = 1500 > Called-Station-Id = "9C-AF-CA-F4-40-10" > Calling-Station-Id = "64-31-50-7D-72-DE" > EAP-Message = > 0x0201001a01686f73742f75736572406578616d706c652e636f6d > Message-Authenticator = 0x0d22b2b1d5102149a8c1c731bc6613dd > NAS-Port-Type = Ethernet > NAS-Port = 50016 > NAS-Port-Id = "GigabitEthernet0/16" > NAS-IP-Address = 10.11.200.73 > Proxy-State = 0x323034 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "host/user", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 26 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. Authentication > may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Identity does not match User-Name, setting from EAP Identity. > [eap] Failed in handler > ++[eap] returns invalid > Failed to authenticate the user. > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> host/user > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 1 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 1 > Sending Access-Reject of id 231 to 127.0.0.1 port 1814 > Proxy-State = 0x323034 > Waking up in 4.9 seconds. > rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=231, > length=25 > Proxy-State = 0x323034 > # Executing section post-proxy from file /etc/raddb/sites-enabled/default > +- entering group post-proxy {...} > [eap] No pre-existing handler found > ++[eap] returns noop > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> host/ > user(a)example.com > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Sending Access-Reject of id 204 to 10.11.200.73 port 1645 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 1 ID 231 with timestamp +14 > Cleaning up request 0 ID 204 with timestamp +14 > Ready to process requests. > > > > On Fri, Dec 7, 2012 at 2:23 PM, Matthew Newton <mcn4(a)leicester.ac.uk> > wrote: > > > On Fri, Dec 07, 2012 at 12:39:13PM -0600, Dan Letkeman wrote: > > > Sorry, I was not clean with my setup information. We do not have a > > domain, > > > these are stand alone windows 7 devices. We also have some tablets and > > > some linux boxes. Concern right now is the Windows 7 devices. I > didn't > > > know that you cannot do machine authentication without a domain.... > > > > You can, but you'll need to handle the certificates on the hosts > > manually. That's usually such a pain that the only real solution > > is to use AD. If you've got a small number of devices, or can > > write some other automated method of deploying certs, then it can > > be possible to handle. > > > > What you /can't/ do is both User auth (mschap - username + > > password) *and* Computer auth (certificates - EAP-TLS) in the same > > connection, as the default Windows supplicant, like most, doesn't > > support client certificates with PEAP (and user auth - mschap - > > needs to be inside PEAP). > > > > > User authentication in my environment is just not an option because all > > of > > > the devices need to have a connection to the network at all times even > if > > > nobody is logged in. Should I be using PEAP/EAP-TLS instead? > > > > There are no good reasons for doing PEAP/EAP-TLS unless you want > > to use SoH. PEAP adds overhead to the auth, with no added benefit. > > > > > If so do you know of any good setup documentation for that? > > > > I wrote up how to do PEAP/EAP-TLS a while back - you can find it > > here: http://q.asd.me.uk/pet > > > > That said - your connection is trying to do PEAP, so you've > > configured your client for either 'certifiates' or mschap inside > > PEAP. I forget the exact options in the interface, but you need to > > choose 'certificates' rather than 'PEAP', then select the client > > certificate that you want to auth with - which will be one that is > > signed by the same CA that the CA_file option in your FreeRADIUS > > eap.conf file points to. Make sure it's set to 'Computer' auth, > > not 'User' or 'User + Computer'. > > > > In theory, you'll then find that it Just Works. But the Windows > > config interface takes a bit of head scratching to get around > > until you understand what it's doing under the hood. > > > > Cheers > > > > Matthew > > > > > > -- > > Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> > > > > Systems Architect (UNIX and Networks), Network Services, > > I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom > > > > For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > >

1 0

Open+ MAC authentication failed.
by Tzvika Gelber 09 Dec '12

09 Dec '12

Hello, I'm trying to have a WiFi client to be authenticated in the OPEN+MAC method The AP is already known as a client of the Freeradius and any other form of Radius authentication i tried worked so far (WPA, WPA2) I'm using PEAP and the clients are Windows XP (if it makes any difference) I created a new user with the MAC address of the client as the user and password : (this is a none internet connected client) ###this is for OPEN+MAC AUTH 00C0CA32A157 Cleartext-Password := "00C0CA32A157" ####### and i keep getting this error when it's trying to get the IP from the DHCP Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.3 port 55965, id=5, length=128 User-Name = "00c0ca32a157" User-Password = "00c0ca32a157" Calling-Station-Id = "00-C0-CA-32-A1-57" NAS-IP-Address = 10.10.10.3 Called-Station-Id = "00-18-25-02-11-D2:103-mac" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Framed-MTU = 1400 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "00c0ca32a157", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00c0ca32a157 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 5 to 10.10.10.3 port 55965 Waking up in 4.9 seconds. Cleaning up request 0 ID 5 with timestamp +12 Ready to process requests. what am i missing? or (however unlikely) freeradius does not support this type of authentication any more? Thank you -- ____ Sometimes you just glow in the dark...

2 1

(no subject)
by Jed Gainer 08 Dec '12

08 Dec '12

Hello everyone, in /etc/raddb/sql/mysql/counter.conf there is %b unix time value of beginning of reset period which makes things like sqlcounter counterChilliSpotMaxTotalOctetsDaily { counter-name = ChilliSpot-Max-Total-Octets-Daily check-name = CS-Total-Octets-Daily counter-type = data reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } possible how would i get the value of %b for a user from say PHP so i can calc and show them how much bandwidth they have left?

2 3

computer authentication
by Dan Letkeman 07 Dec '12

07 Dec '12

Hello, I'm having some trouble with my setup and I am not sure where things have gone wrong. I don't think there is anything from with the freeradius server or the switch setup. My goal is to get computer authentication working, and from what I understand from this post it should just work with the default setup with only two modifications: See the post from Phil Mayers http://freeradius.1045715.n5.nabble.com/PEAP-with-Machine-auth-td4939666.ht… Here is my debug log: rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=236, length=158 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0201000f01686f73742f44414e3031 Message-Authenticator = 0xd542a2a3a3407e6908953cd7dca08817 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 236 to 10.11.200.73 port 1645 EAP-Message = 0x010200160410dda0857597b1b9c5d2114f6c83f2606d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096017b44e4c1b393ed153b7774 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=237, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020200060319 Message-Authenticator = 0x36c72a6e152d0376c4c2e898ed25103b NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096017b44e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 237 to 10.11.200.73 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096007a59e4c1b393ed153b7774 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=238, length=266 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0203006919800000005f160301005a01000056030150c2020ad42f8473aaa4763bfe5559b68809e4731258d02a19bd5a83025e02fc000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0x0a4d04f9f52dbc7c000f26f2b9046e3d NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096007a59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 238 to 10.11.200.73 port 1645 EAP-Message = 0x0104040019c0000008a216030100310200002d030150c1ad7788786b10acec0131f1a69bc414f87718bb71685367e6e6a53ec0a1e600002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3132313230363138333330375a170d3133303230343138333330375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100badff6cb7179506abce81b22c0c12ce92f128d1fc2ffd51b159010f8bd9aa0352e9eb68fa01ede9d61214a39d78d2972b5406699eae304 EAP-Message = 0xb40a74524471ec05582582a7aa9710aabd4a895773a02042e67db8e42572635efda35a45df5c9518a02c6a7e75a64051d60d436bfa62bfd6e5f88a8ebf3ba48c19e48a25c8662e19a29d92cb6317e067b7c6cb4f24976519a55c2681eb97f8d5974f8244dc50f641b03615ee14d5c8085664bff3c1be7247c1e4d98c9120319edfb4c167d0888140cbc768a81e8d1d016a0d093490a913578946ea9b21706066f1428370666364ed5f80919a0ca2d368daf1c85311c8375a27adb09e7d5bb7800c1bf66af0a86690470203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003820101004857 EAP-Message = 0xf861c78b2469007a3a0faeca30c4dd0c107a661f63e949e4ddfb4ffd28045199bd58e642837569ffa14e8521d161b0940802b3ad216b021a30c322814659bc1d6224205d65000c39c6edcea942e8c06965e1b9f6fb7f1654191940a392c2ef81a11d25fb73ce358bd6eadca1ef0e15f8572c232a04ec1629f0e727021ced7bd079d72cdb2d86bcc8ffdf334842f089ab15936eb7ba0cffcc0e9b37a37a216f0ed402d7200f210a7352cb339affdae7e5b6ba90f4108b22a3b1b713057809817b46cc6733fe03884dfb9f895552203bf1e1e403cf1f663a831936d41c25b9514f360416020b0fdb33a3b573396f3ae552c08799d85a40efb32cda9d1e60 EAP-Message = 0xa00004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096037d59e4c1b393ed153b7774 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=239, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020400061900 Message-Authenticator = 0x57fa2f2fa8a12654c84ef47f24b9300c NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096037d59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 239 to 10.11.200.73 port 1645 EAP-Message = 0x010503fc1940a003020102020900a33fb10c1664a44e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3132313230363138333330375a170d3133303230343138333330375a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100ba09abda0f9f2632773b404162045d145d1961f5d44cf7feafb38e5d352d7b7a47091b9156ef81be2c8d1ed9994cc2d88b530cdaa51bdc2d4f3132329fd958ffb5fe7f8a2a2d0c699ce8d434041d80898eb0a0ff623813aeb5d0f8e82dc094db92237c3b17987a19 EAP-Message = 0x5711bd563ba0d6f947104787918866aa0c6fdc717bef128d0038637d4fa15a0a8428f3ff47235404c78e050425cd6ea33ad80dc5fc7dda16a76d4f49d679ac0cdac557620d3c7fb5dd508889d75c014f2bab7281a6514e9ef8801b49b2b62d7346e381ef28280ba2654505b85c1cc63ecb7664dfd46e3e1561d87c24ee7bd2ffea5e3282b2c722ccafb1ffe460fa8612ae82267c3e1df60d0203010001a381fb3081f8301d0603551d0e041604149a8d8e6f296e96fcc7d303cccfeeae2052615f093081c80603551d230481c03081bd80149a8d8e6f296e96fcc7d303cccfeeae2052615f09a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a33fb10c1664a44e300c0603551d13040530030101ff300d06092a864886f70d010105050003820101002a98ee33183e9c46aafd4385195180fff00f029253c1c1818934722dc09e3722378f93ecf6a21a98cf44c848e524a051bfa6c0d5b22b26088b06313e84de17bc22e7d9a3a87d466abd8ffc EAP-Message = 0x1e707bf177e925d2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096027c59e4c1b393ed153b7774 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=240, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020500061900 Message-Authenticator = 0xbb0a37ac80ac127d37623ac19d8cb7d7 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096027c59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 240 to 10.11.200.73 port 1645 EAP-Message = 0x010600bc1900c35695b88d735375e6daf6e9fd7517c11036a05a4e769075fda1f4931e91e5a98d20c5f13886c0502b7e5fadd8851996d4cf5f418695e9e485411c391758f37c7ee4a00cf3f5eeebec0deb2bbfdfbdcc9a7df103311f69d7e81dba31d00cc887f1c93b24bc2bd77affe2451277fb4df09d82bbe43269c1b591503e03c5f678db04a77d6a42e55816b412aedf69c2b379d07157c74d5efe0b1ff411a138624d54324d91438a42c0d71567a80f1316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096057f59e4c1b393ed153b7774 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=241, length=499 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x02060150198000000146160301010610000102010052d9ea3856c176e5673da4cbe02a911e8f5fb543684e6ae8649d79c8e15d3a4fb6c1ed37d45ed785d3891bbdf1c3868cde05e75d91280f2c026c15f4e968ef6cdd4094a8a59e2ad1ceac5c53ce8af6084b98de2668567a254913920f266e0a7bca00f50db7c7c26552fe2b171b0287003ffea4ba84143cc567a4cb7748f46312957f4997aed1b64f62c21d03bb7139f79e44534c0158175a629a98f4b585f87330442382e4e51b6de60635494d4e66a3aabd88b4c8874f268cd5ec3e5f334b84b75e06fd0fbc3afaa27a6af9303ed65e2af56d02a8aeaceadcd48679055748fa722d14f6c4961534 EAP-Message = 0x5a1cade40955c92b534083c6292fd0bac23cb7bb5bb1d90f14030100010116030100307e72a5c4189bf36cac8747ffabc198bd4f5d400baf2bb5cb001a022908448a37cf7ddea27654ff7fc282934932a55ffa Message-Authenticator = 0x11d9f6622d3f3949df452fd64e4e7a03 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096057f59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 241 to 10.11.200.73 port 1645 EAP-Message = 0x010700411900140301000101160301003088525279f0a666be9158b77193e0cb5d44491d1d577a8862254f5ef9f6dba07116b5e566e39572ba0e981cbd85b7bbc5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096047e59e4c1b393ed153b7774 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=242, length=167 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020700061900 Message-Authenticator = 0x211323fa12841ee03e548aa79f457385 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096047e59e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 242 to 10.11.200.73 port 1645 EAP-Message = 0x0108002b19001703010020ac4efbfa7535f97705d24f884cbcff69c35d3995a8cf49f9f54b5839d5fbbc70 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096077159e4c1b393ed153b7774 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=243, length=204 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0208002b190017030100207a18e0fc66bc4e107ff7c3add2fd502f7c9de5a24918f020cd08237c80606225 Message-Authenticator = 0x58eb948731c85961f83971425c7f49d0 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096077159e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - host/DAN01 [peap] Got inner identity 'host/DAN01' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000f01686f73742f44414e3031 server { [peap] Setting User-Name to host/DAN01 Sending tunneled request EAP-Message = 0x0208000f01686f73742f44414e3031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/DAN01" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900241a0109001f1030afe7e31b9243b22b1edc4da600654f686f73742f44414e3031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf36f0859f36612161ae524fe7d89d60e [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900241a0109001f1030afe7e31b9243b22b1edc4da600654f686f73742f44414e3031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf36f0859f36612161ae524fe7d89d60e [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 243 to 10.11.200.73 port 1645 EAP-Message = 0x0109004b190017030100406378cb7289eb8c26ab103a27d7ddd562178502ee511763eb4dcdd2148b2e2828f04def0d118c5f79480070084a5d6d20db5e2d378185c951aefa1db0ed8373f8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096067059e4c1b393ed153b7774 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=244, length=268 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x0209006b190017030100602ba93efbbefd59197061b3c1cfe8a8c3ed52c8c3bb04d8407d3a8a194ff63d304de6151122e5f2ee830478996fd21f1b386795640464bd68df45b537168ea55a5733946cd255eab36e80551b6b1e1e77b43b075925fd7722f626a31be711402d Message-Authenticator = 0xcc8e1ecd017ffb90d560f6c53e4646e3 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096067059e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900451a0209004031efe81adb9299be4739da1763d1702e44000000000000000000000000000000000000000000000000000000000000000000686f73742f44414e3031 server { [peap] Setting User-Name to host/DAN01 Sending tunneled request EAP-Message = 0x020900451a0209004031efe81adb9299be4739da1763d1702e44000000000000000000000000000000000000000000000000000000000000000000686f73742f44414e3031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/DAN01" State = 0xf36f0859f36612161ae524fe7d89d60e server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 69 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: host/DAN01 [mschap] Told to do MS-CHAPv2 for host/DAN01 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\tE=691 R=1" EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 244 to 10.11.200.73 port 1645 EAP-Message = 0x010a002b19001703010020b18b2f6ba2a15eb8ccf6796e5f1978974c30c0ab7e60faef3aab29c75ebfa183 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01794096097359e4c1b393ed153b7774 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.11.200.73 port 1645, id=245, length=204 User-Name = "host/DAN01" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "9C-AF-CA-F4-40-10" Calling-Station-Id = "64-31-50-7D-72-DE" EAP-Message = 0x020a002b19001703010020da286d0d7cd1b91d931d0059695ecf9ed2f5640c0975ae5ec20d8b34d2cc599a Message-Authenticator = 0xc4e84370ab6a69e7ccecf9b8f70ec4e0 NAS-Port-Type = Ethernet NAS-Port = 50016 NAS-Port-Id = "GigabitEthernet0/16" State = 0x01794096097359e4c1b393ed153b7774 NAS-IP-Address = 10.11.200.73 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "host/DAN01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/DAN01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 245 to 10.11.200.73 port 1645 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 236 with timestamp +39 Cleaning up request 1 ID 237 with timestamp +39 Cleaning up request 2 ID 238 with timestamp +39 Cleaning up request 3 ID 239 with timestamp +39 Cleaning up request 4 ID 240 with timestamp +39 Cleaning up request 5 ID 241 with timestamp +39 Cleaning up request 6 ID 242 with timestamp +39 Cleaning up request 7 ID 243 with timestamp +39 Cleaning up request 8 ID 244 with timestamp +39 Waking up in 1.0 seconds. Cleaning up request 9 ID 245 with timestamp +39 Ready to process requests.

2 1

eap-mschapv2 and radius.log
by Scott Armitage 06 Dec '12

06 Dec '12

All, I have noticed a behaviour in the logging and I'm not sure if it is misconfiguration on my part, misunderstanding of the expected behaviour or a bug. If I attempt to log in using EAP-MSCHAPv2 inside of an eap method (e.g. PEAP/EAP-MSCHAPv2) I see "Login OK:" for the outer EAP regardless of the result of the inner EAP. e.g: Thu Dec 6 11:10:55 2012 : Auth: Login OK: [scott] (from client pepsi port 0 cli 02-00-00-00-00-01 via TLS tunnel) Thu Dec 6 11:10:55 2012 : Auth: Login OK: [scott] (from client pepsi port 0 cli 02-00-00-00-00-01 via TLS tunnel) Thu Dec 6 11:10:56 2012 : Auth: Login OK: [anonymous(a)lboro.ac.uk] (from client pepsi port 0 cli 02-00-00-00-00-01) This means if I have a user with a bad password I get the following in the log: Thu Dec 6 11:21:37 2012 : Auth: Login OK: [scott] (from client pepsi port 0 cli 02-00-00-00-00-01 via TLS tunnel) As the mschap module is waiting for the user to re-enter their password eventual it times out. Therefore this is the only entry in the log. Which is somewhat confusing, as it has actually failed but the only log entry is "Login OK". Has anyone else noticed this behaviour? or have I configured something wrong? Regards Scott Armitage

1 2

ldap eDir support in master branch
by Olivier Beytrison 06 Dec '12

06 Dec '12

Hi, Now that I have my packages, i've started deploying FR3 for our eduroam federation. And I just saw that the eDir support is gone. now my question is : 1. is it abandoned ? 2. is it not yet ported to the new rlm_ldap code ? Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

2 2

Freeradius stops. Received HUP signal.
by substance SUBSTANCE 06 Dec '12

06 Dec '12

Hello guys. I'm using FreeRADIUS server for a few months now. I'm running it on Ubuntu 11.10 server. FreeRADIUS Version 2.1.10. The problem is that I started FreeRADIUS daemon on November 18th, and it stopped working after one week ( users authentication was not working). Sun Nov 18 06:30:58 2012 : Info: HUP - loading modules Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "files" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "pap" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "detail" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "sql_log" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "auth_log" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "suffix" Sun Nov 18 06:30:58 2012 : Info: Module: Reloaded module "radutmp" Sun Nov 18 06:30:58 2012 : Info: Loaded virtual server inner-tunnel Sun Nov 18 06:30:58 2012 : Info: Loaded virtual server <default> Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Nov 18 19:12:12 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 18 19:12:12 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sun Nov 18 19:13:33 2012 : Info: Loaded virtual server inner-tunnel Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Nov 18 19:13:33 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 18 19:13:33 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sun Nov 18 19:13:33 2012 : Info: Loaded virtual server <default> Sun Nov 18 19:13:33 2012 : Info: Ready to process requests. *Sun Nov 25 06:46:34 2012 : Info: Received HUP signal.* Sun Nov 25 06:46:34 2012 : Info: HUP - Re-reading configuration files Sun Nov 25 06:46:34 2012 : Info: HUP - loading modules Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "files" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "pap" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "detail" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "sql_log" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "auth_log" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "suffix" Sun Nov 25 06:46:34 2012 : Info: Module: Reloaded module "radutmp" Sun Nov 25 06:46:34 2012 : Info: Loaded virtual server inner-tunnel Sun Nov 25 06:46:34 2012 : Info: Loaded virtual server <default> Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #2 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #1 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #0 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Nov 25 18:23:51 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 25 18:23:51 2012 : Info: rlm_sql (sql): Connected new DB handle, #4 Sun Nov 25 18:24:16 2012 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Nov 25 18:24:16 2012 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 25 18:24:16 2012 : Info: rlm_sql (sql): Connected new DB handle, #3 *Sun Dec 2 06:38:05 2012 : Info: Received HUP signal.* Sun Dec 2 06:38:05 2012 : Info: HUP - Re-reading configuration files Why FreeRADIUS receives that HUP signal? Can I disable it , or should I update FreeRADIUS software? Thanks !

3 4

Re: preproxy_users
by Alan Buxey 06 Dec '12

06 Dec '12

Sounds like your old server had a local dictionary entry that your new server doesn't have alan

3 4

Python access to attribute lists
by Duarte Fonseca 05 Dec '12

05 Dec '12

Hi, Just wondering if someone can confirm something for me. The python module only passes the the request attribute list (not the reply, proxy-reply, control lists) to the python script, is that correct? Would it be possible to modify the module to pass the remaining lists to the python code? Thanks in advance, Duarte

4 3