freeradius on ubuntu 8.04
All: I have recently built a new freeradius server. I built an old one a few years ago that has served me very well. I am not sure of the freeradius version on my new server, as i installed it using the apt-get process. The server is working great for the most part, but i am having a weird problem. I am using freeradius to do a radius to ldap conversion. We have Novell Edir 8.7.3 running ldap servers. My old freeradius box is running suse 7.2 and freeradius .0.9.3. It is attaching to the same ldap server and i have no issues with it. My issue is the first ldap connection works great. The first time. I then see a message on the server saying: "Nothing to do. Sleeping until we see a request." If i happen to make a login attempt within 15 seconds of that coming up, i see: "---Walking the entire request list--- Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... " When i try again, it works. Any ideas what this could be? If you need more info as to my version of freeradius, i will be more then happy to supply the info, if you tell me how to retrieve it :) Thanks for your help! John
My issue is the first ldap connection works great. The first time. I then see a message on the server saying:
"Nothing to do. Sleeping until we see a request."
If i happen to make a login attempt within 15 seconds of that coming up, i see:
"---Walking the entire request list--- Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... "
When i try again, it works.
There should be an Access-Request before it sends an Access-Reject. Is that somewhere in the debug? Ivan Kalik Kalik Informatika ISP
yes, the request happens first before i see the "walking the entire request" part. Also, the waking up in 1 second piece is repeated 3 times before i get the access reject.
On 12/31/2008 at 10:18 AM, in message <kzKd3NlK.1230736709.3551350.tnt@kalik.net>, <tnt@kalik.net> wrote: My issue is the first ldap connection works great. The first time. I then see a message on the server saying:
"Nothing to do. Sleeping until we see a request."
If i happen to make a login attempt within 15 seconds of that coming up, i see:
"---Walking the entire request list--- Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... "
When i try again, it works.
There should be an Access-Request before it sends an Access-Reject. Is that somewhere in the debug? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Run server as radiusd -X and post the debug in full. Server is doing something and the debug should show what. Ivan Kalik Kalik Informatika ISP Dana 31/12/2008, "John Hottel" <hottel@nwf.org> piše:
yes, the request happens first before i see the "walking the entire request" part. Also, the waking up in 1 second piece is repeated 3 times before i get the access reject.
On 12/31/2008 at 10:18 AM, in message <kzKd3NlK.1230736709.3551350.tnt@kalik.net>, <tnt@kalik.net> wrote: My issue is the first ldap connection works great. The first time. I then see a message on the server saying:
"Nothing to do. Sleeping until we see a request."
If i happen to make a login attempt within 15 seconds of that coming up, i see:
"---Walking the entire request list--- Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... "
When i try again, it works.
There should be an Access-Request before it sends an Access-Reject. Is that somewhere in the debug?
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
John Hottel wrote:
If i happen to make a login attempt within 15 seconds of that coming up, i see:
"---Walking the entire request list---
You are running 1.1.7 (or later). Upgrade to 2.1.3.
Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... "
When i try again, it works.
Any ideas what this could be? If you need more info as to my version of freeradius, i will be more then happy to supply the info, if you tell me how to retrieve it :)
$ man radiusd radiusd -v Alan DeKok.
radius version is 1.1.7 root@colo-radius:/usr/sbin# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/www" main: libdir = "/usr/lib" main: radacctdir = "/var/www/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/www/radius.txt" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded Counter counter: filename = "/etc/freeradius/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1230746513 [2008-12-31 13:01:53], Next reset 1230786000 [2009-01-01 00:00:00] Module: Instantiated counter (daily) Module: Loaded LDAP ldap: server = "172.16.8.141" ldap: port = 389 ldap: net_timeout = 10 ldap: timeout = 5 ldap: timelimit = 5 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "o=nwf,c=us" ldap: filter = "(&(CN=%{User-Name})(objectClass=person))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 10 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0xb93ecd88 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=105, length=58 User-Name = "hottel" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for hottel radius_xlat: '(&(CN=hottel)(objectClass=person))' radius_xlat: 'o=nwf,c=us' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.16.8.141:389, authentication 0 rlm_ldap: bind as / to 172.16.8.141:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=hottel)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user hottel authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "hottel" with password "" rlm_ldap: user DN: cn=Hottel,ou=Users,ou=HQ,o=NWF,c=US rlm_ldap: (re)connect to 172.16.8.141:389, authentication 1 rlm_ldap: bind as cn=Hottel,ou=Users,ou=HQ,o=NWF,c=US/ to 172.16.8.141:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user hottel authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Login OK: [hottel] (from client Sonicwall port 0) Sending Access-Accept of id 105 to 172.16.8.7 port 1543 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 105 with timestamp 495bb3a1 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=106, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for icore radius_xlat: '(&(CN=icore)(objectClass=person))' radius_xlat: 'o=nwf,c=us' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user icore authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "icore" with password "" rlm_ldap: user DN: cn=icore,ou=External,ou=HQ,o=NWF,c=US rlm_ldap: (re)connect to 172.16.8.141:389, authentication 1 rlm_ldap: bind as cn=icore,ou=External,ou=HQ,o=NWF,c=US/ to 172.16.8.141:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user icore authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: leaving group LDAP (returns ok) for request 1 Login OK: [icore] (from client Sonicwall port 0) Sending Access-Accept of id 106 to 172.16.8.7 port 1543 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.16.8.7:1543, id=107, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for icore radius_xlat: '(&(CN=icore)(objectClass=person))' radius_xlat: 'o=nwf,c=us' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user icore authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "icore" with password "" rlm_ldap: user DN: cn=icore,ou=External,ou=HQ,o=NWF,c=US rlm_ldap: (re)connect to 172.16.8.141:389, authentication 1 rlm_ldap: bind as cn=icore,ou=External,ou=HQ,o=NWF,c=US/ to 172.16.8.141:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user icore authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: leaving group LDAP (returns ok) for request 2 Login OK: [icore] (from client Sonicwall port 0) Sending Access-Accept of id 107 to 172.16.8.7 port 1543 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 106 with timestamp 495bb3ae Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 107 with timestamp 495bb3b0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=108, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for icore radius_xlat: '(&(CN=icore)(objectClass=person))' radius_xlat: 'o=nwf,c=us' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user icore authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 3 rlm_ldap: - authenticate rlm_ldap: login attempt by "icore" with password "" rlm_ldap: user DN: cn=icore,ou=External,ou=HQ,o=NWF,c=US rlm_ldap: (re)connect to 172.16.8.141:389, authentication 1 rlm_ldap: bind as cn=icore,ou=External,ou=HQ,o=NWF,c=US/ to 172.16.8.141:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user icore authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 3 modcall: leaving group LDAP (returns ok) for request 3 Login OK: [icore] (from client Sonicwall port 0) Sending Access-Accept of id 108 to 172.16.8.7 port 1543 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 108 with timestamp 495bb3ba Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=109, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for icore radius_xlat: '(&(CN=icore)(objectClass=person))' radius_xlat: 'o=nwf,c=us' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [icore/] (from client Sonicwall port 0) Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 109 to 172.16.8.7 port 1543 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 109 with timestamp 495bb3cf Nothing to do. Sleeping until we see a request.
On 12/31/2008 at 10:46 AM, in message <495B93D8.3020305@deployingradius.com>, Alan DeKok <aland@deployingradius.com> wrote: John Hottel wrote: If i happen to make a login attempt within 15 seconds of that coming up, i see:
"---Walking the entire request list---
You are running 1.1.7 (or later). Upgrade to 2.1.3.
Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... "
When i try again, it works.
Any ideas what this could be? If you need more info as to my version of freeradius, i will be more then happy to supply the info, if you tell me how to retrieve it :)
$ man radiusd radiusd -v Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
rad_recv: Access-Request packet from host 172.16.8.7:1543, id=106, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 .. rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user icore authorized to use remote access .. Login OK: [icore] (from client Sonicwall port 0) Sending Access-Accept of id 106 to 172.16.8.7 port 1543 .. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=107, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 .. rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user icore authorized to use remote access .. Login OK: [icore] (from client Sonicwall port 0) Sending Access-Accept of id 107 to 172.16.8.7 port 1543 .. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=108, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 .. rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user icore authorized to use remote access .. Login OK: [icore] (from client Sonicwall port 0) Sending Access-Accept of id 108 to 172.16.8.7 port 1543 .. rad_recv: Access-Request packet from host 172.16.8.7:1543, id=109, length=57 User-Name = "icore" User-Password = "" NAS-IP-Address = 64.241.16.2 NAS-Port = 0 .. rlm_ldap: performing search in o=nwf,c=us, with filter (&(CN=icore)(objectClass=person)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed .. Sending Access-Reject of id 109 to 172.16.8.7 port 1543
So, nothing to do with freeradius. As long as your ldap works it accepts the user. When ldap fails ... Debug ldap and see why did it fail. Ivan Kalik Kalik Informatika ISP
participants (3)
-
Alan DeKok -
John Hottel -
tnt＠kalik.net