- Freeradius-Users - lists.freeradius.org

matching entry in users file
by vazoumana fofana 27 Nov '12

27 Nov '12

Dear all, i ve got question about authentication : i want to set in users file, a user who can be authenticated by two ways : EAP-TLS (certificate) and EAP-TTLSP, PAP (login password). For a same and unique login, can i do this ? Or freeradius just check the first entry wich corresponds ? Cheers.

3 3

freeradius management (web management tool)
by Ben 27 Nov '12

27 Nov '12

hi,all daloradius vs ara,which one is easy to use.

1 0

user's default login time
by studyfordo 27 Nov '12

27 Nov '12

Hi, all when I add user to file /etc/freeradius/files in the vpn authentication server. so I want to the folloing things about user. 1. how long will user automatic login off( which file can I check the time) 2.how cant I teminat session by manual 3.when login with wrong password, the user can be locked out and can email to inform user 4.users default actived time the above funtion need user mysq module? thanks

2 1

rewrite_calling_station_id not working
by aaronrus＠comcast.net 27 Nov '12

27 Nov '12

I've been following the guide at http://wiki.freeradius.org/guide/Mac-Auth I completed the section called Mac-Auth and 802.1x The issue im having is with the rewrite_calling_station_id. If I comment this out and make sure the authorized_macs file has the mac listed just like the access point sends it everything works. The problem is not all access points send the mac in the same format. Some may send it in upper case and some in lower case and with 30 plus access points I need to make sure its formatted correctly Which is what rewrite_calling_station_id should do. In the log below authorized_macs has the mac address in lower case. rewrite_calling_station_id should should solve this but does not. In order to get it working I commented out rewrite_calling_station_id and changed the mac in the authorized_macs file to upper case. I'm using ubuntu 10.4, FreeRADIUS Version 2.1.8 I noticed this WARNING: Unknown module "tolower" in string expansion "%" in the rejected log. I have searched for a tolower program but can not find one to install. What package is tolower part of ? What am I missing? Here is the policy.conf file # Rewrite called station id attribute into a standard format. # rewrite_calling_station_id { if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ update request { Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } } else { noop } } Here is the rejected log FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 5 2010 at 02:49:11 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.1.0.66 { require_message_authenticator = no secret = "testing123" shortname = "AP" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating noop always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Instantiating authorized_macs files authorized_macs { usersfile = "/etc/freeradius/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } Module: Instantiating reject always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.0.66 port 1520, id=0, length=198 Message-Authenticator = 0x8e5270705f13e5bf4d6bf9b89ee8b33b Service-Type = Framed-User User-Name = "aaron" Framed-MTU = 1488 Called-Station-Id = "40-01-C6-DD-CB-40:test-2.4GHz" Calling-Station-Id = "00-14-A4-1E-FF-B6" NAS-Identifier = "Access-Point-22" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a016161726f6e NAS-IP-Address = 10.1.0.66 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++- entering if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} WARNING: Unknown module "tolower" in string expansion "%" ++++[request] returns ok +++- if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok +++ ... skipping else for request 0: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok [authorized_macs] expand: %{Calling-Station-ID} -> ++[authorized_macs] returns noop ++? if (!ok) ? Evaluating !(ok) -> TRUE ++? if (!ok) -> TRUE ++- entering if (!ok) {...} +++[reject] returns reject ++- if (!ok) returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aaron attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 10.1.0.66 port 1520 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.0.66 port 1522, id=0, length=198 Message-Authenticator = 0x770f506840dc4d2173ef986496b52844 Service-Type = Framed-User User-Name = "aaron" Framed-MTU = 1488 Called-Station-Id = "40-01-C6-DD-CB-40:test-2.4GHz" Calling-Station-Id = "00-14-A4-1E-FF-B6" NAS-Identifier = "Access-Point-22" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a016161726f6e NAS-IP-Address = 10.1.0.66 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++- entering if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} WARNING: Unknown module "tolower" in string expansion "%" ++++[request] returns ok +++- if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok +++ ... skipping else for request 1: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok [authorized_macs] expand: %{Calling-Station-ID} -> ++[authorized_macs] returns noop ++? if (!ok) ? Evaluating !(ok) -> TRUE ++? if (!ok) -> TRUE ++- entering if (!ok) {...} +++[reject] returns reject ++- if (!ok) returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aaron attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 0 to 10.1.0.66 port 1522 Waking up in 3.5 seconds. Cleaning up request 0 ID 0 with timestamp +16 Waking up in 1.4 seconds. Cleaning up request 1 ID 0 with timestamp +17 Ready to process requests.

5 4

trouble with encrypted password
by vazoumana fofana 26 Nov '12

26 Nov '12

hello everybody, i ve got trouble with encrypted password. I want to manage users with password wich are more longer than 8 caracters. When i use radcrypt (based on crypt), it doesn't work. It's normal due to limitation of crypt. I must cut password to 8 caracters for make running. When i use radcrypt with MD5 encryption , it doesn't run : indeed the encrypted string generated by MD5 radcrypt is more than 16 caracters. How can i use encrypted password without limited password to 8 caracters ? Cheers

2 2

EAP-TLS constant disconnects
by Uros Kolar 26 Nov '12

26 Nov '12

Hi all! We've been using freeradius 2.1.12 with EAP-TLS authentication. The problem we experience is constant disconnects of the clients. After an some time (it seems like the intervals are random) of usage the connection drops. I don't have a debug output, since the server is in production allready and because of the valid traffic it's hard to efficiently debug it that way. A similar problem was allready reported some years ago (without an answer - at least not in that thread): http://bit.ly/10o9xkG Any ideas (what may the cause be, how to debug it efficiently etc.) are welcome! Regards!

3 6

Re: files Authentication problem
by Matthew Newton 26 Nov '12

26 Nov '12

On Mon, Nov 26, 2012 at 12:13:06PM +0100, alexdhelmet(a)free.fr wrote: > Thanks, it's working now. That's good. > I will try with PAP as soon as I have more time. There's nothing to try - your debug log shows that PAP is already being called (it's in be default), so all you need to to is remove the auth-type := local from your config. It will work exactly as it does now. Setting Auth-Type like this has been deprecated for *years*, and is only likely to cause you problems some time in the future. There are very few situations where it should be set manually. Matthew > >On Mon, Nov 26, 2012 at 08:17:21AM +0100, alexdhelmet(a)free.fr wrote: > >>Thanks for your answer. > >I've just re-read what you're doing - you're looking up the > >lowercase password in the users file instead of the username (e.g. > >you're ignoring the username), but then your password check > >is between User-Password and Cleartext-Password, as usual. > > > >Try something like this in your sites-enabled/default, after > >preprocess: > > > > update request { > > User-Password := "%{tolower:%{User-Password}}" > > } > > > >>But, at the moment, we must keep this Auth-Type, to be compatible > >>wirth an old version of freeradius, we couldn't update at the > >>moment. > >No, you still don't need it. The PAP module will do it for you - > >read the debug output. > > > >Matthew > > > >(waiting for 3.x so that Auth-Type := Local will actually break > >things at last). > > > > > > > >>>On Wed, Nov 21, 2012 at 09:01:22AM +0100, alexdhelmet(a)free.fr wrote: > >>>>"00c51180d29c" Auth-Type := Local, Cleartext-Password := "00c51180d29c" > >>>> Alcatel-Lucent-Auth-Group = 4 > >>>As the debug log says, Remove "Auth-Type := Local" from the above. > >>> > >>>Matthew > >>> > >>> > >>- > >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0

files Authentication problem
by alexdhelmet＠free.fr 26 Nov '12

26 Nov '12

Hello, I have a problem of authentication with the files method. I am using freeradius: FreeRADIUS Version 2.1.10 I try to configure freeradius to have authentication with non-sensitive password and user. I am using ntradping to test my radius server. In both case, ++[files] returns ok , so it seems to be ok. But the client receive on ok, and one bad. See the output of freeradius -X NON-WORKING : the last C is in capital letter. ============= rad_recv: Access-Request packet from host 100.100.16.3 port 44994, id=1, length=57 User-Name = "00c51180d29c" User-Password = "00c51180d29C" Vendor-Specific = 0x383030 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [files] expand: %{User-Password} -> 00c51180d29C [files] expand: %{tolower:%{User-Password}} -> 00c51180d29c [files] users: Matched entry 00c51180d29c at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. Login incorrect: [00c51180d29c/00c51180d29C] (from client pc1461 port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00c51180d29c attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds WORKING ========= rad_recv: Access-Request packet from host 100.100.16.3 port 45055, id=3, length=57 User-Name = "00c51180d29c" User-Password = "00c51180d29c" Vendor-Specific = 0x383030 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [files] expand: %{User-Password} -> 00c51180d29c [files] expand: %{tolower:%{User-Password}} -> 00c51180d29c [files] users: Matched entry 00c51180d29c at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. Login OK: [00c51180d29c/00c51180d29c] (from client pcXX port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 3 to 100.100.16.3 port 45055 Alcatel-Lucent-Auth-Group = 4 Finished request 3. Config of the files modules ==================== files { # The default key attribute to use for matches. The content # of this attribute is used to match the "name" of the # entry. #key = "%{Stripped-User-Name:-%{User-Name}}" usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users key = "%{tolower:%{User-Password}}" case_sensitive = no # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } Users file (all in lower letters) ======== "00c51180d29c" Auth-Type := Local, Cleartext-Password := "00c51180d29c" Alcatel-Lucent-Auth-Group = 4 Thanks for the help. Alexandre

2 3

Problem with freeradius + openldap for AP authentication
by Nicolas Lathiere 26 Nov '12

26 Nov '12

Hiya I need some help to configure freeradius with openldap. I have a ldap database which stores password in SSHA format, so i choose PAP for authentication. I want to use freeradius to authenticate on a netgear Wifi access point. (http://deployingradius.com/documents/protocols/compatibility.html) I've set up the AP in client freeradius in clients.conf, with a secret and shortname like in documentation. Next i've put auto_header = yes in pap.conf And uncomment the line ldap to activate module in /site-enable/default When i start server in debug mode, authorization works fine but server have problems to authentication step and i don't understand why Here is the debug comments : rad_recv: Access-Request packet from host 192.168.0.201 port 32774, id=85, length=169 User-Name = "cyril" NAS-IP-Address = 192.168.0.201 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "4C-60-DE-D2-22-61:easyBridge2" Calling-Station-Id = "7C-C5-37-14-16-C9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0200000e016e6c61746869657265 Message-Authenticator = 0x2bf3ec3446adc97ea15c4c160ee8b0bbThu Nov 22 15:04:36 2012 : Wed Nov 21 18:39:17 2012 : Info: [ldap] looking for reply items in directory... Wed Nov 21 18:39:17 2012 : Info: [ldap] user cyril authorized to use remote access Wed Nov 21 18:39:17 2012 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Nov 21 18:39:17 2012 : Info: ++[ldap] returns ok Wed Nov 21 18:39:17 2012 : Info: ++[expiration] returns noop Wed Nov 21 18:39:17 2012 : Info: ++[logintime] returns noop Wed Nov 21 18:39:17 2012 : Info: [pap] Normalizing NT-Password from hex encoding Wed Nov 21 18:39:17 2012 : Info: [pap] Normalizing SSHA1-Password from base64 encoding Wed Nov 21 18:39:17 2012 : Info: [pap] Found existing Auth-Type, not changing it. Wed Nov 21 18:39:17 2012 : Info: ++[pap] returns noop Wed Nov 21 18:39:17 2012 : Info: Found Auth-Type = PAP Wed Nov 21 18:39:17 2012 : Info: +- entering group PAP {...} Auth: [pap] Attribute "Password" is required for authentication. Thu Nov 22 15:04:36 2012 : Info: ++[pap] returns invalid Thu Nov 22 15:04:36 2012 : Info: Failed to authenticate the user. Thu Nov 22 15:04:36 2012 : Auth: Login incorrect: [cyril/<via Auth-Type = PAP>] (from client WNAP320 port 0 cli 44-A7-CF-CD-C5-C7) Thu Nov 22 15:04:36 2012 : Info: Using Post-Auth-Type Reject Thu Nov 22 15:04:36 2012 : Info: +- entering group REJECT {...} Thu Nov 22 15:04:36 2012 : Debug: expand: %{User-Name} -> cyril Thu Nov 22 15:04:36 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 22 15:04:36 2012 : Info: ++[attr_filter.access_reject] returns updated Thu Nov 22 15:04:36 2012 : Info: Delaying reject of request 5 for 1 seconds Thu Nov 22 15:04:36 2012 : Debug: Going to the next request Thu Nov 22 15:04:36 2012 : Debug: Waking up in 0.9 seconds. Thu Nov 22 15:04:37 2012 : Info: Sending delayed reject for request 5

2 1

How to perform certain actions on Access Accept
by Shravan S G 26 Nov '12

26 Nov '12

Hi, I have configured FreeRadius to authenticate users based on entries in a Database. On successful authentication, an Access-Accept is returned. Now I want to send a message with some random content to another machine connected to the FreeRadius server, as soon as the user is authenticated. How can I configure some completely unrelated action like this, or say a file transfer to be performed on successful authentication of a user? Thanks in advance, Shravan

2 1