still about how to return some attributes only in Access-Accept packet
Yesterday, I post a question here: weiwei fang wrote:
Hello, all!
I want some attributes only sent back to users in Access-Accept packet, but won't appear in Access-Challenge packet?
How could I do? Now I just add the attribute in MySQL database, however, it is also contained in Access-Challenge packet.
Read raddb/sites-available/default, and look for "challenge"
Alan DeKok.
I uncommented the following lines in raddb/sites-available/default: # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } Now I use the EAPMD5 simple example to test it. I add "Framed-MTU = 1500" in the req.txt and then run: radeapclient -x localhost auth testing123 <req.txt As in RFC2865, this attribute "Framed-MTU = 1500" should not returned in the access-challenge packet. however, I can still get it in the access-challenge packet. I don't know why? If I should add something in the raddb/sites-available/attrs.access_challenge file? Thanks a lot for your answer.
weiwei fang wrote:
As in RFC2865, this attribute "Framed-MTU = 1500" should not returned in the access-challenge packet.
however, I can still get it in the access-challenge packet. I don't know why?
So... what does debug mode say?
If I should add something in the raddb/sites-available/attrs.access_challenge file?
No. Alan DeKok.
Sorry I use another account for this reply. root@ubuntu:/usr/local/etc/raddb# radeapclient -x localhost auth testing123 </home/fang/freeradius-server-2.1.9/src/tests/eapmd5-01/req.txt +++> About to send encoded packet: User-Name = "test" Cleartext-Password = "test" NAS-IP-Address = 209.87.252.247 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "test" Message-Authenticator = 0x00 NAS-Port = 0 <+++ EAP decoded packet: (notice this is the accept-challenge packet and Framed-MTU = 1500 is there) Reply-Message = "Hello, test" Framed-MTU = 1500 EAP-Message = 0x01d3001604108bb813bc0db605897f7ecea4036ca422 Message-Authenticator = 0x62cb659c92b12b930fda931c6ba04af7 State = 0xbbd9622dbb0a661e27e315270e22da7a EAP-Id = 211 EAP-Code = Request EAP-Type-MD5 = 0x108bb813bc0db605897f7ecea4036ca422 +++> About to send encoded packet: User-Name = "test" Cleartext-Password = "test" NAS-IP-Address = 209.87.252.247 EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Type-MD5 = 0x1092ee897591f29bbfde36e49152e39501 State = 0xbbd9622dbb0a661e27e315270e22da7a <+++ EAP decoded packet: Reply-Message = "Hello, test" Framed-MTU = 1500 EAP-Message = 0x03d30004 Message-Authenticator = 0xa7de7cd1e3a2025447c8a0bc17ec4c24 User-Name = "test" EAP-Id = 211 EAP-Code = Success I use radiusd -xxX to open debug, and to verify the attr_filter module running process, I add the printf("***** %s\n", __FUNC__); in every function of rlm_attr_filter.c so you can notice something like: ****** attr_filter_instantiate ****** getattrsfile I think if the filter is trying to filter something, the function attr_filter_common should be executed, but not actually. I don't know why? Since I am a new user and there is no relevant examples online, can you give me more hints, but not just a few words? Although I know your time may be very limitted. root@ubuntu:/home/fang/freeradius-server-2.1.9/src/modules/rlm_attr_filter# radiusd -xxX Tue May 25 22:05:03 2010 : Info: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on May 25 2010 at 18:16:56 Tue May 25 22:05:03 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue May 25 22:05:03 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue May 25 22:05:03 2010 : Info: PARTICULAR PURPOSE. Tue May 25 22:05:03 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue May 25 22:05:03 2010 : Info: GNU General Public License v2. Tue May 25 22:05:03 2010 : Info: Starting - reading configuration files ... Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Tue May 25 22:05:03 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Tue May 25 22:05:03 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Tue May 25 22:05:03 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Tue May 25 22:05:03 2010 : Debug: main { Tue May 25 22:05:03 2010 : Debug: allow_core_dumps = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Tue May 25 22:05:03 2010 : Debug: main { Tue May 25 22:05:03 2010 : Debug: prefix = "/usr/local" Tue May 25 22:05:03 2010 : Debug: localstatedir = "/usr/local/var" Tue May 25 22:05:03 2010 : Debug: logdir = "/usr/local/var/log/radius" Tue May 25 22:05:03 2010 : Debug: libdir = "/usr/local/lib" Tue May 25 22:05:03 2010 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Tue May 25 22:05:03 2010 : Debug: hostname_lookups = no Tue May 25 22:05:03 2010 : Debug: max_request_time = 30 Tue May 25 22:05:03 2010 : Debug: cleanup_delay = 5 Tue May 25 22:05:03 2010 : Debug: max_requests = 1024 Tue May 25 22:05:03 2010 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Tue May 25 22:05:03 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Tue May 25 22:05:03 2010 : Debug: debug_level = 0 Tue May 25 22:05:03 2010 : Debug: proxy_requests = yes Tue May 25 22:05:03 2010 : Debug: log { Tue May 25 22:05:03 2010 : Debug: stripped_names = no Tue May 25 22:05:03 2010 : Debug: auth = no Tue May 25 22:05:03 2010 : Debug: auth_badpass = no Tue May 25 22:05:03 2010 : Debug: auth_goodpass = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: security { Tue May 25 22:05:03 2010 : Debug: max_attributes = 200 Tue May 25 22:05:03 2010 : Debug: reject_delay = 1 Tue May 25 22:05:03 2010 : Debug: status_server = yes Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue May 25 22:05:03 2010 : Debug: proxy server { Tue May 25 22:05:03 2010 : Debug: retry_delay = 5 Tue May 25 22:05:03 2010 : Debug: retry_count = 3 Tue May 25 22:05:03 2010 : Debug: default_fallback = no Tue May 25 22:05:03 2010 : Debug: dead_time = 120 Tue May 25 22:05:03 2010 : Debug: wake_all_if_all_dead = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: home_server localhost { Tue May 25 22:05:03 2010 : Debug: ipaddr = 127.0.0.1 Tue May 25 22:05:03 2010 : Debug: port = 1812 Tue May 25 22:05:03 2010 : Debug: type = "auth" Tue May 25 22:05:03 2010 : Debug: secret = "testing123" Tue May 25 22:05:03 2010 : Debug: response_window = 20 Tue May 25 22:05:03 2010 : Debug: max_outstanding = 65536 Tue May 25 22:05:03 2010 : Debug: require_message_authenticator = no Tue May 25 22:05:03 2010 : Debug: zombie_period = 40 Tue May 25 22:05:03 2010 : Debug: status_check = "status-server" Tue May 25 22:05:03 2010 : Debug: ping_interval = 30 Tue May 25 22:05:03 2010 : Debug: check_interval = 30 Tue May 25 22:05:03 2010 : Debug: num_answers_to_alive = 3 Tue May 25 22:05:03 2010 : Debug: num_pings_to_alive = 3 Tue May 25 22:05:03 2010 : Debug: revive_interval = 120 Tue May 25 22:05:03 2010 : Debug: status_check_timeout = 4 Tue May 25 22:05:03 2010 : Debug: irt = 2 Tue May 25 22:05:03 2010 : Debug: mrt = 16 Tue May 25 22:05:03 2010 : Debug: mrc = 5 Tue May 25 22:05:03 2010 : Debug: mrd = 30 Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: home_server_pool my_auth_failover { Tue May 25 22:05:03 2010 : Debug: type = fail-over Tue May 25 22:05:03 2010 : Debug: home_server = localhost Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: realm example.com { Tue May 25 22:05:03 2010 : Debug: auth_pool = my_auth_failover Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: realm LOCAL { Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: radiusd: #### Loading Clients #### Tue May 25 22:05:03 2010 : Debug: client localhost { Tue May 25 22:05:03 2010 : Debug: ipaddr = 127.0.0.1 Tue May 25 22:05:03 2010 : Debug: require_message_authenticator = no Tue May 25 22:05:03 2010 : Debug: secret = "testing123" Tue May 25 22:05:03 2010 : Debug: nastype = "other" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: radiusd: #### Instantiating modules #### Tue May 25 22:05:03 2010 : Debug: instantiate { Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_exec Tue May 25 22:05:03 2010 : Debug: Module: Instantiating exec Tue May 25 22:05:03 2010 : Debug: exec { Tue May 25 22:05:03 2010 : Debug: wait = no Tue May 25 22:05:03 2010 : Debug: input_pairs = "request" Tue May 25 22:05:03 2010 : Debug: shell_escape = yes Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_expr Tue May 25 22:05:03 2010 : Debug: Module: Instantiating expr Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_expiration Tue May 25 22:05:03 2010 : Debug: Module: Instantiating expiration Tue May 25 22:05:03 2010 : Debug: expiration { Tue May 25 22:05:03 2010 : Debug: reply-message = "Password Has Expired " Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_logintime Tue May 25 22:05:03 2010 : Debug: Module: Instantiating logintime Tue May 25 22:05:03 2010 : Debug: logintime { Tue May 25 22:05:03 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Tue May 25 22:05:03 2010 : Debug: minimum-timeout = 60 Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: radiusd: #### Loading Virtual Servers #### Tue May 25 22:05:03 2010 : Debug: server inner-tunnel { Tue May 25 22:05:03 2010 : Debug: modules { Tue May 25 22:05:03 2010 : Debug: Module: Checking authenticate {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_pap Tue May 25 22:05:03 2010 : Debug: Module: Instantiating pap Tue May 25 22:05:03 2010 : Debug: pap { Tue May 25 22:05:03 2010 : Debug: encryption_scheme = "auto" Tue May 25 22:05:03 2010 : Debug: auto_header = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_chap Tue May 25 22:05:03 2010 : Debug: Module: Instantiating chap Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_mschap Tue May 25 22:05:03 2010 : Debug: Module: Instantiating mschap Tue May 25 22:05:03 2010 : Debug: mschap { Tue May 25 22:05:03 2010 : Debug: use_mppe = yes Tue May 25 22:05:03 2010 : Debug: require_encryption = no Tue May 25 22:05:03 2010 : Debug: require_strong = no Tue May 25 22:05:03 2010 : Debug: with_ntdomain_hack = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_unix Tue May 25 22:05:03 2010 : Debug: Module: Instantiating unix Tue May 25 22:05:03 2010 : Debug: unix { Tue May 25 22:05:03 2010 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_eap Tue May 25 22:05:03 2010 : Debug: Module: Instantiating eap Tue May 25 22:05:03 2010 : Debug: eap { Tue May 25 22:05:03 2010 : Debug: default_eap_type = "md5" Tue May 25 22:05:03 2010 : Debug: timer_expire = 60 Tue May 25 22:05:03 2010 : Debug: ignore_unknown_eap_types = no Tue May 25 22:05:03 2010 : Debug: cisco_accounting_username_bug = no Tue May 25 22:05:03 2010 : Debug: max_sessions = 4096 Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Tue May 25 22:05:03 2010 : Debug: Module: Instantiating eap-md5 Tue May 25 22:05:03 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Tue May 25 22:05:03 2010 : Debug: Module: Instantiating eap-leap Tue May 25 22:05:03 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Tue May 25 22:05:03 2010 : Debug: Module: Instantiating eap-gtc Tue May 25 22:05:03 2010 : Debug: gtc { Tue May 25 22:05:03 2010 : Debug: challenge = "Password: " Tue May 25 22:05:03 2010 : Debug: auth_type = "PAP" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Ignoring EAP-Type/tls because we do not have OpenSSL support. Tue May 25 22:05:03 2010 : Debug: Ignoring EAP-Type/ttls because we do not have OpenSSL support. Tue May 25 22:05:03 2010 : Debug: Ignoring EAP-Type/peap because we do not have OpenSSL support. Tue May 25 22:05:03 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Tue May 25 22:05:03 2010 : Debug: Module: Instantiating eap-mschapv2 Tue May 25 22:05:03 2010 : Debug: mschapv2 { Tue May 25 22:05:03 2010 : Debug: with_ntdomain_hack = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Checking authorize {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_realm Tue May 25 22:05:03 2010 : Debug: Module: Instantiating suffix Tue May 25 22:05:03 2010 : Debug: realm suffix { Tue May 25 22:05:03 2010 : Debug: format = "suffix" Tue May 25 22:05:03 2010 : Debug: delimiter = "@" Tue May 25 22:05:03 2010 : Debug: ignore_default = no Tue May 25 22:05:03 2010 : Debug: ignore_null = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_files, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_files Tue May 25 22:05:03 2010 : Debug: Module: Instantiating files Tue May 25 22:05:03 2010 : Debug: files { Tue May 25 22:05:03 2010 : Debug: usersfile = "/usr/local/etc/raddb/users" Tue May 25 22:05:03 2010 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Tue May 25 22:05:03 2010 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Tue May 25 22:05:03 2010 : Debug: compat = "no" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Checking session {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_radutmp Tue May 25 22:05:03 2010 : Debug: Module: Instantiating radutmp Tue May 25 22:05:03 2010 : Debug: radutmp { Tue May 25 22:05:03 2010 : Debug: filename = "/usr/local/var/log/radius/radutmp" Tue May 25 22:05:03 2010 : Debug: username = "%{User-Name}" Tue May 25 22:05:03 2010 : Debug: case_sensitive = yes Tue May 25 22:05:03 2010 : Debug: check_with_nas = yes Tue May 25 22:05:03 2010 : Debug: perm = 384 Tue May 25 22:05:03 2010 : Debug: callerid = yes Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: Module: Checking post-auth {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_attr_filter Tue May 25 22:05:03 2010 : Debug: Module: Instantiating attr_filter.access_reject Tue May 25 22:05:03 2010 : Debug: ****** attr_filter_instantiate Tue May 25 22:05:03 2010 : Debug: attr_filter attr_filter.access_reject { Tue May 25 22:05:03 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Tue May 25 22:05:03 2010 : Debug: key = "%{User-Name}" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: ****** getattrsfile Tue May 25 22:05:03 2010 : Debug: } # modules Tue May 25 22:05:03 2010 : Debug: } # server Tue May 25 22:05:03 2010 : Debug: server { Tue May 25 22:05:03 2010 : Debug: modules { Tue May 25 22:05:03 2010 : Debug: Module: Checking authenticate {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: Module: Instantiating attr_filter.access_challenge Tue May 25 22:05:03 2010 : Debug: ****** attr_filter_instantiate Tue May 25 22:05:03 2010 : Debug: attr_filter attr_filter.access_challenge { Tue May 25 22:05:03 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" Tue May 25 22:05:03 2010 : Debug: key = "%{User-Name}" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: ****** getattrsfile Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_always, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_always Tue May 25 22:05:03 2010 : Debug: Module: Instantiating handled Tue May 25 22:05:03 2010 : Debug: always handled { Tue May 25 22:05:03 2010 : Debug: rcode = "handled" Tue May 25 22:05:03 2010 : Debug: simulcount = 0 Tue May 25 22:05:03 2010 : Debug: mpp = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Checking authorize {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_preprocess Tue May 25 22:05:03 2010 : Debug: Module: Instantiating preprocess Tue May 25 22:05:03 2010 : Debug: preprocess { Tue May 25 22:05:03 2010 : Debug: huntgroups = "/usr/local/etc/raddb/huntgroups" Tue May 25 22:05:03 2010 : Debug: hints = "/usr/local/etc/raddb/hints" Tue May 25 22:05:03 2010 : Debug: with_ascend_hack = no Tue May 25 22:05:03 2010 : Debug: ascend_channels_per_line = 23 Tue May 25 22:05:03 2010 : Debug: with_ntdomain_hack = no Tue May 25 22:05:03 2010 : Debug: with_specialix_jetstream_hack = no Tue May 25 22:05:03 2010 : Debug: with_cisco_vsa_hack = no Tue May 25 22:05:03 2010 : Debug: with_alvarion_vsa_hack = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Checking preacct {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_acct_unique Tue May 25 22:05:03 2010 : Debug: Module: Instantiating acct_unique Tue May 25 22:05:03 2010 : Debug: acct_unique { Tue May 25 22:05:03 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Checking accounting {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Tue May 25 22:05:03 2010 : Debug: Module: Linked to module rlm_detail Tue May 25 22:05:03 2010 : Debug: Module: Instantiating detail Tue May 25 22:05:03 2010 : Debug: detail { Tue May 25 22:05:03 2010 : Debug: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Tue May 25 22:05:03 2010 : Debug: header = "%t" Tue May 25 22:05:03 2010 : Debug: detailperm = 384 Tue May 25 22:05:03 2010 : Debug: dirperm = 493 Tue May 25 22:05:03 2010 : Debug: locking = no Tue May 25 22:05:03 2010 : Debug: log_packet_header = no Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Module: Instantiating attr_filter.accounting_response Tue May 25 22:05:03 2010 : Debug: ****** attr_filter_instantiate Tue May 25 22:05:03 2010 : Debug: attr_filter attr_filter.accounting_response { Tue May 25 22:05:03 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" Tue May 25 22:05:03 2010 : Debug: key = "%{User-Name}" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: ****** getattrsfile Tue May 25 22:05:03 2010 : Debug: Module: Checking session {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: Module: Checking post-auth {...} for more modules to load Tue May 25 22:05:03 2010 : Debug: } # modules Tue May 25 22:05:03 2010 : Debug: } # server Tue May 25 22:05:03 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue May 25 22:05:03 2010 : Debug: listen { Tue May 25 22:05:03 2010 : Debug: type = "auth" Tue May 25 22:05:03 2010 : Debug: ipaddr = * Tue May 25 22:05:03 2010 : Debug: port = 0 Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: listen { Tue May 25 22:05:03 2010 : Debug: type = "acct" Tue May 25 22:05:03 2010 : Debug: ipaddr = * Tue May 25 22:05:03 2010 : Debug: port = 0 Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: listen { Tue May 25 22:05:03 2010 : Debug: type = "control" Tue May 25 22:05:03 2010 : Debug: listen { Tue May 25 22:05:03 2010 : Debug: socket = "/usr/local/var/run/radiusd/radiusd.sock" Tue May 25 22:05:03 2010 : Debug: mode = "rw" Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: } Tue May 25 22:05:03 2010 : Debug: Listening on authentication address * port 1812 Tue May 25 22:05:03 2010 : Debug: Listening on accounting address * port 1813 Tue May 25 22:05:03 2010 : Debug: Listening on command file /usr/local/var/run/radiusd/radiusd.sock Tue May 25 22:05:03 2010 : Debug: Listening on proxy address * port 1814 Tue May 25 22:05:03 2010 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 51554, id=236, length=67 User-Name = "test" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xc52fa993a307e116ff5680322dada9f4 NAS-Port = 0 EAP-Message = 0x02d200090174657374 Tue May 25 22:05:27 2010 : Info: +- entering group authorize {...} Tue May 25 22:05:27 2010 : Info: ++[preprocess] returns ok Tue May 25 22:05:27 2010 : Info: ++[chap] returns noop Tue May 25 22:05:27 2010 : Info: ++[mschap] returns noop Tue May 25 22:05:27 2010 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Tue May 25 22:05:27 2010 : Info: [suffix] No such realm "NULL" Tue May 25 22:05:27 2010 : Info: ++[suffix] returns noop Tue May 25 22:05:27 2010 : Info: [eap] EAP packet type response id 210 length 9 Tue May 25 22:05:27 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue May 25 22:05:27 2010 : Info: ++[eap] returns updated Tue May 25 22:05:27 2010 : Info: ++[unix] returns notfound Tue May 25 22:05:27 2010 : Info: [files] users: Matched entry test at line 90 Tue May 25 22:05:27 2010 : Info: [files] expand: Hello, %{User-Name} -> Hello, test Tue May 25 22:05:27 2010 : Info: ++[files] returns ok Tue May 25 22:05:27 2010 : Info: ++[expiration] returns noop Tue May 25 22:05:27 2010 : Info: ++[logintime] returns noop Tue May 25 22:05:27 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue May 25 22:05:27 2010 : Info: ++[pap] returns noop Tue May 25 22:05:27 2010 : Info: Found Auth-Type = EAP Tue May 25 22:05:27 2010 : Info: +- entering group authenticate {...} Tue May 25 22:05:27 2010 : Info: [eap] EAP Identity Tue May 25 22:05:27 2010 : Info: [eap] processing type md5 Tue May 25 22:05:27 2010 : Debug: rlm_eap_md5: Issuing Challenge Tue May 25 22:05:27 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 236 to 127.0.0.1 port 51554 Reply-Message = "Hello, test" Framed-MTU = 1500 EAP-Message = 0x01d3001604108bb813bc0db605897f7ecea4036ca422 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbbd9622dbb0a661e27e315270e22da7a Tue May 25 22:05:27 2010 : Info: Finished request 0. Tue May 25 22:05:27 2010 : Debug: Going to the next request Tue May 25 22:05:27 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 51554, id=237, length=98 User-Name = "test" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0xb553a994f93e5448f6a1b92aab6b2781 NAS-Port = 0 State = 0xbbd9622dbb0a661e27e315270e22da7a EAP-Message = 0x02d30016041092ee897591f29bbfde36e49152e39501 Tue May 25 22:05:27 2010 : Info: +- entering group authorize {...} Tue May 25 22:05:27 2010 : Info: ++[preprocess] returns ok Tue May 25 22:05:27 2010 : Info: ++[chap] returns noop Tue May 25 22:05:27 2010 : Info: ++[mschap] returns noop Tue May 25 22:05:27 2010 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Tue May 25 22:05:27 2010 : Info: [suffix] No such realm "NULL" Tue May 25 22:05:27 2010 : Info: ++[suffix] returns noop Tue May 25 22:05:27 2010 : Info: [eap] EAP packet type response id 211 length 22 Tue May 25 22:05:27 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue May 25 22:05:27 2010 : Info: ++[eap] returns updated Tue May 25 22:05:27 2010 : Info: ++[unix] returns notfound Tue May 25 22:05:27 2010 : Info: [files] users: Matched entry test at line 90 Tue May 25 22:05:27 2010 : Info: [files] expand: Hello, %{User-Name} -> Hello, test Tue May 25 22:05:27 2010 : Info: ++[files] returns ok Tue May 25 22:05:27 2010 : Info: ++[expiration] returns noop Tue May 25 22:05:27 2010 : Info: ++[logintime] returns noop Tue May 25 22:05:27 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue May 25 22:05:27 2010 : Info: ++[pap] returns noop Tue May 25 22:05:27 2010 : Info: Found Auth-Type = EAP Tue May 25 22:05:27 2010 : Info: +- entering group authenticate {...} Tue May 25 22:05:27 2010 : Info: [eap] Request found, released from the list Tue May 25 22:05:27 2010 : Info: [eap] EAP/md5 Tue May 25 22:05:27 2010 : Info: [eap] processing type md5 Tue May 25 22:05:27 2010 : Info: [eap] Freeing handler Tue May 25 22:05:27 2010 : Info: ++[eap] returns ok Tue May 25 22:05:27 2010 : Info: +- entering group post-auth {...} Tue May 25 22:05:27 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 237 to 127.0.0.1 port 51554 Reply-Message = "Hello, test" Framed-MTU = 1500 EAP-Message = 0x03d30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Tue May 25 22:05:27 2010 : Info: Finished request 1. Tue May 25 22:05:27 2010 : Debug: Going to the next request Tue May 25 22:05:27 2010 : Debug: Waking up in 4.9 seconds. Tue May 25 22:05:32 2010 : Info: Cleaning up request 0 ID 236 with timestamp +24 Tue May 25 22:05:32 2010 : Info: Cleaning up request 1 ID 237 with timestamp +24 Tue May 25 22:05:32 2010 : Info: Ready to process requests. 在2010-05-26 12:53:11，"Alan DeKok" <aland@deployingradius.com> 写道：
weiwei fang wrote:
As in RFC2865, this attribute "Framed-MTU = 1500" should not returned in the access-challenge packet.
however, I can still get it in the access-challenge packet. I don't know why?
So... what does debug mode say?
If I should add something in the raddb/sites-available/attrs.access_challenge file?
No.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
方维维 wrote:
Sorry I use another account for this reply. ... Tue May 25 22:05:27 2010 : Info: Found Auth-Type = EAP Tue May 25 22:05:27 2010 : Info: +- entering group authenticate {...} Tue May 25 22:05:27 2010 : Info: [eap] EAP Identity Tue May 25 22:05:27 2010 : Info: [eap] processing type md5 Tue May 25 22:05:27 2010 : Debug: rlm_eap_md5: Issuing Challenge Tue May 25 22:05:27 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 236 to 127.0.0.1 port 51554
You didn't edit the file that the server is reading. Alan DeKok.
Well, all my configure file is put by default in: /usr/local/etc/raddb I also edited the radiusd.conf here for the "log" section to test some log function. The "sites-enabled" sub-folder is also here. So why the server reads the radiusd.conf here but not the "default" file in the "sites-enabled" sub-folder? 在2010-05-26 14:24:22，"Alan DeKok" <aland@deployingradius.com> 写道：
方维维 wrote:
Sorry I use another account for this reply. ... Tue May 25 22:05:27 2010 : Info: Found Auth-Type = EAP Tue May 25 22:05:27 2010 : Info: +- entering group authenticate {...} Tue May 25 22:05:27 2010 : Info: [eap] EAP Identity Tue May 25 22:05:27 2010 : Info: [eap] processing type md5 Tue May 25 22:05:27 2010 : Debug: rlm_eap_md5: Issuing Challenge Tue May 25 22:05:27 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 236 to 127.0.0.1 port 51554
You didn't edit the file that the server is reading.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Another thing is: when I uncommented # handled # override the "updated" code from attr_filter then the radiusd reported error. Then I know it should be : handled # override the "updated" code from attr_filter (since the #line should starts a new line) why the radiusd reported error when it didn't read the default configuration file? Strange!!! 在2010-05-26 14:24:22，"Alan DeKok" <aland@deployingradius.com> 写道：
方维维 wrote:
Sorry I use another account for this reply. ... Tue May 25 22:05:27 2010 : Info: Found Auth-Type = EAP Tue May 25 22:05:27 2010 : Info: +- entering group authenticate {...} Tue May 25 22:05:27 2010 : Info: [eap] EAP Identity Tue May 25 22:05:27 2010 : Info: [eap] processing type md5 Tue May 25 22:05:27 2010 : Debug: rlm_eap_md5: Issuing Challenge Tue May 25 22:05:27 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 236 to 127.0.0.1 port 51554
You didn't edit the file that the server is reading.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Anyone who knows this problem can help to check about the problem? Thanks! 在2010-05-26 14:34:01，WWF <weiweif@126.com> 写道： Another thing is: when I uncommented # handled # override the "updated" code from attr_filter then the radiusd reported error. Then I know it should be : handled # override the "updated" code from attr_filter (since the #line should starts a new line) why the radiusd reported error when it didn't read the default configuration file? Strange!!! 在2010-05-26 14:24:22，"Alan DeKok" <aland@deployingradius.com> 写道：
方维维 wrote:
Sorry I use another account for this reply. ... Tue May 25 22:05:27 2010 : Info: Found Auth-Type = EAP Tue May 25 22:05:27 2010 : Info: +- entering group authenticate {...} Tue May 25 22:05:27 2010 : Info: [eap] EAP Identity Tue May 25 22:05:27 2010 : Info: [eap] processing type md5 Tue May 25 22:05:27 2010 : Debug: rlm_eap_md5: Issuing Challenge Tue May 25 22:05:27 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 236 to 127.0.0.1 port 51554
You didn't edit the file that the server is reading.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
网易为中小企业免费提供企业邮箱（自主域名）
Hi,
Anyone who knows this problem can help to check about the problem? Thanks!
your server hasnt been built with full EAP support - the debug says so (read the lines about PEAP/TTLS etc - installed the openssl-devel stuff and rebuild. you should have a file called attrs.access_challenge in your $RADDB directory. this gets used. ensure the call within your handler part calls that file and not something else. alan
在2010-05-26 16:50:15，"Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> 写道： >Hi, >> Anyone who knows this problem can help to check about the problem? >> Thanks! > >your server hasnt been built with full EAP support - the debug says so (read the >lines about PEAP/TTLS etc - installed the openssl-devel stuff and rebuild. however, I installed it under my ubuntu. Why the debug says that? I think it is because I use EAPMD5 here to test. root@ubuntu:/home/fang/Desktop# !385 apt-get install libssl-dev Reading package lists... Done Building dependency tree Reading state information... Done libssl-dev is already the newest version. 0 upgraded, 0 newly installed, 0 to remove and 1025 not upgraded. besides, I installed the openssl. I use the command: ./configure --with-experimental-module to generate the Makefile. If libssl-dev is missing, then this step can't be done.
you should have a file called attrs.access_challenge in your $RADDB directory. this gets used. ensure the call within your handler part calls that file and not something else.
please notice this link:http://lists.freeradius.org/pipermail/freeradius-users/2010-May/msg00588.htm... weiwei fang wrote:
As in RFC2865, this attribute "Framed-MTU = 1500" should not returned in the access-challenge packet.
however, I can still get it in the access-challenge packet. I don't know why?
So... what does debug mode say?
If I should add something in the raddb/sites-available/attrs.access_challenge file?
No. Alan DeKok. As a new user, I left the attrs.access_challenge file as it is: # # Configuration file for the rlm_attr_filter module. # Please see rlm_attr_filter(5) manpage for more information. # # $Id$ # # This configuration file is used to remove almost all of the # attributes From an Access-Challenge message. The RFC's say # that an Access-Challenge packet can contain only a few # attributes. We enforce that here. # DEFAULT EAP-Message =* ANY, State =* ANY, Message-Authenticator =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Session-Timeout =* ANY, Idle-Timeout =* ANY
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
在2010-05-26 16:50:15，"Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> 写道： >Hi, >> Anyone who knows this problem can help to check about the problem? >> Thanks! > >your server hasnt been built with full EAP support - the debug says so (read the >lines about PEAP/TTLS etc - installed the openssl-devel stuff and rebuild.
however, I installed it under my ubuntu. Why the debug says that? I think it is because I use EAPMD5 here to test.
because debian-based systems are very fussy about OpenSSL and licencing/building - check the mailing list archives for literally HUNDREDS of similar cases. the debug doesnt lie. if it says it doesnt have EAP support, then it doesnt. you need to use a proper EAP method to activate the tunnel functions - EAP-MD5 really isnt upt o much at all. just use eg eapol_test (part of wpa_supplicant) to do a proper PEAP or EAP-TTLS test! alan
So Can I ask a question: what is the link between the attributes filter in Access-Challenge packets and the EAP type? You mean I can't do it in EAP-MD5 but only in other EAP types? 在2010-05-26 17:08:54，"Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> 写道：
Hi,
在2010-05-26 16:50:15，"Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> 写道： >Hi, >> Anyone who knows this problem can help to check about the problem? >> Thanks! > >your server hasnt been built with full EAP support - the debug says so (read the >lines about PEAP/TTLS etc - installed the openssl-devel stuff and rebuild.
however, I installed it under my ubuntu. Why the debug says that? I think it is because I use EAPMD5 here to test.
because debian-based systems are very fussy about OpenSSL and licencing/building - check the mailing list archives for literally HUNDREDS of similar cases. the debug doesnt lie. if it says it doesnt have EAP support, then it doesnt. you need to use a proper EAP method to activate the tunnel functions - EAP-MD5 really isnt upt o much at all.
just use eg eapol_test (part of wpa_supplicant) to do a proper PEAP or EAP-TTLS test!
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
So Can I ask a question: what is the link between the attributes filter in Access-Challenge packets and the EAP type?
read the logic in the config file - see how you are activating the filter and where it is being activated.
You mean I can't do it in EAP-MD5 but only in other EAP types?
dont know. I havent looked at it closely myself but EAP-MD5 really isnt EAP per se. its badly named imho. but look at your debug...do you see that bit of unlang logic being hit? i dont . alan
在2010-05-26 17:41:15，"Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> 写道：
Hi,
So Can I ask a question: what is the link between the attributes filter in Access-Challenge packets and the EAP type?
read the logic in the config file - see how you are activating the filter and where it is being activated.
I have know what's wrong now for your guess. Now I get rid of the warning about it since I make clean the whole system and re make it and make install it. Yes, I read the config file. But I don't know what is the meaning and the usage. As you may know, there are so few examples and tutorials online. I really want to solve my problems and I don't want all things done by people here. I will try my best first. However, everytime I only got some small hints here, like "yes/no/read...". I am not the author of this software, my knowledge is limited in it although I want to try my best. For example, the access-challenge filter feature is added from 2.1.7. But no examples are available. If just uncomment the lines in raddb/sites-enable/default is enough? If I should not use EAP-MD5? The users don't know how, maybe only authors know. The only reason I guess is that the "free" users can only get small hints, as what I got for this question.
You mean I can't do it in EAP-MD5 but only in other EAP types?
dont know. I havent looked at it closely myself but EAP-MD5 really isnt EAP per se. its badly named imho. but look at your debug...do you see that bit of unlang logic being hit? i dont .
I think you just give me a hint, let me try for it. However, I just think the above is your guess. And the authors did not tell us EAP-MD5 can't do it (filter Access-Challenge).
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
WWF wrote:
The only reason I guess is that the "free" users can only get small hints, as what I got for this question.
You were told what the problem was, and how to fix it. There is no magic involved. The debug output *clearly* shows that the "attr_filter.access_challenge" module is not being run. You did not enable it. Go enable it, and stop complaining about the lack of support. Alan DeKok.
在2010-05-26 21:58:27，"Alan DeKok" <aland@deployingradius.com> 写道：
WWF wrote:
The only reason I guess is that the "free" users can only get small hints, as what I got for this question.
You were told what the problem was, and how to fix it. There is no magic involved.
Sorry, I don't know which one? If it is the
The debug output *clearly* shows that the "attr_filter.access_challenge" module is not being run. You did not enable it.
Sorry, which will be the *right* output after I enable it?I can't see clearly it is not being run. Maybe the question is stupid. Please forgive me as a new user.
Go enable it, and stop complaining about the lack of support.
Maybe I think this is a good and only way to get some hints after my msg in http://lists.freeradius.org/pipermail/freeradius-users/2010-May/msg00596.htm.... It seems a long wait. I am not trying to complain but really want to use the software correctly. Thanks for your kindly help. Best regards
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
WWF wrote:
You were told what the problem was, and how to fix it. There is no magic involved.
Sorry, I don't know which one? If it is the
You said you edited a file. The debug output showed that the file was not edited.
Maybe I think this is a good and only way to get some hints after my msg in http://lists.freeradius.org/pipermail/freeradius-users/2010-May/msg00596.htm.... It seems a long wait. I am not trying to complain but really want to use the software correctly.
Make sure you are editing the file that the server is reading. There really aren't many ways of saying that. It is *impossible* to help you until you edit the file that the server is reading. Alan DeKok.
Thanks for your kindly reply. Now I edited the default file in /usr/local/etc/raddb/sites-enabled, notice that "handled # override the "updated" code from attr_filter" (it will cause an error for my Radiusd): # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } The radiusd debug output is as follows: root@ubuntu:/usr/local/var/log/radius# radiusd -Xxxxx Wed May 26 20:30:20 2010 : Info: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on May 26 2010 at 02:10:20 Wed May 26 20:30:20 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Wed May 26 20:30:20 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed May 26 20:30:20 2010 : Info: PARTICULAR PURPOSE. Wed May 26 20:30:20 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed May 26 20:30:20 2010 : Info: GNU General Public License v2. Wed May 26 20:30:20 2010 : Info: Starting - reading configuration files ... Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Wed May 26 20:30:20 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Wed May 26 20:30:20 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/status Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Wed May 26 20:30:20 2010 : Debug: main { Wed May 26 20:30:20 2010 : Debug: allow_core_dumps = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Wed May 26 20:30:20 2010 : Debug: main { Wed May 26 20:30:20 2010 : Debug: prefix = "/usr/local" Wed May 26 20:30:20 2010 : Debug: localstatedir = "/usr/local/var" Wed May 26 20:30:20 2010 : Debug: logdir = "/usr/local/var/log/radius" Wed May 26 20:30:20 2010 : Debug: libdir = "/usr/local/lib" Wed May 26 20:30:20 2010 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Wed May 26 20:30:20 2010 : Debug: hostname_lookups = no Wed May 26 20:30:20 2010 : Debug: max_request_time = 30 Wed May 26 20:30:20 2010 : Debug: cleanup_delay = 5 Wed May 26 20:30:20 2010 : Debug: max_requests = 1024 Wed May 26 20:30:20 2010 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Wed May 26 20:30:20 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Wed May 26 20:30:20 2010 : Debug: debug_level = 0 Wed May 26 20:30:20 2010 : Debug: proxy_requests = yes Wed May 26 20:30:20 2010 : Debug: log { Wed May 26 20:30:20 2010 : Debug: stripped_names = yes Wed May 26 20:30:20 2010 : Debug: auth = yes Wed May 26 20:30:20 2010 : Debug: auth_badpass = yes Wed May 26 20:30:20 2010 : Debug: auth_goodpass = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: security { Wed May 26 20:30:20 2010 : Debug: max_attributes = 200 Wed May 26 20:30:20 2010 : Debug: reject_delay = 1 Wed May 26 20:30:20 2010 : Debug: status_server = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed May 26 20:30:20 2010 : Debug: proxy server { Wed May 26 20:30:20 2010 : Debug: retry_delay = 5 Wed May 26 20:30:20 2010 : Debug: retry_count = 3 Wed May 26 20:30:20 2010 : Debug: default_fallback = no Wed May 26 20:30:20 2010 : Debug: dead_time = 120 Wed May 26 20:30:20 2010 : Debug: wake_all_if_all_dead = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: home_server localhost { Wed May 26 20:30:20 2010 : Debug: ipaddr = 127.0.0.1 Wed May 26 20:30:20 2010 : Debug: port = 1812 Wed May 26 20:30:20 2010 : Debug: type = "auth" Wed May 26 20:30:20 2010 : Debug: secret = "testing123" Wed May 26 20:30:20 2010 : Debug: response_window = 20 Wed May 26 20:30:20 2010 : Debug: max_outstanding = 65536 Wed May 26 20:30:20 2010 : Debug: require_message_authenticator = no Wed May 26 20:30:20 2010 : Debug: zombie_period = 40 Wed May 26 20:30:20 2010 : Debug: status_check = "status-server" Wed May 26 20:30:20 2010 : Debug: ping_interval = 30 Wed May 26 20:30:20 2010 : Debug: check_interval = 30 Wed May 26 20:30:20 2010 : Debug: num_answers_to_alive = 3 Wed May 26 20:30:20 2010 : Debug: num_pings_to_alive = 3 Wed May 26 20:30:20 2010 : Debug: revive_interval = 120 Wed May 26 20:30:20 2010 : Debug: status_check_timeout = 4 Wed May 26 20:30:20 2010 : Debug: irt = 2 Wed May 26 20:30:20 2010 : Debug: mrt = 16 Wed May 26 20:30:20 2010 : Debug: mrc = 5 Wed May 26 20:30:20 2010 : Debug: mrd = 30 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: home_server_pool my_auth_failover { Wed May 26 20:30:20 2010 : Debug: type = fail-over Wed May 26 20:30:20 2010 : Debug: home_server = localhost Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: realm example.com { Wed May 26 20:30:20 2010 : Debug: auth_pool = my_auth_failover Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: realm LOCAL { Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Loading Clients #### Wed May 26 20:30:20 2010 : Debug: client localhost { Wed May 26 20:30:20 2010 : Debug: ipaddr = 127.0.0.1 Wed May 26 20:30:20 2010 : Debug: require_message_authenticator = no Wed May 26 20:30:20 2010 : Debug: secret = "testing123" Wed May 26 20:30:20 2010 : Debug: nastype = "other" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Instantiating modules #### Wed May 26 20:30:20 2010 : Debug: instantiate { Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_exec Wed May 26 20:30:20 2010 : Debug: Module: Instantiating exec Wed May 26 20:30:20 2010 : Debug: exec { Wed May 26 20:30:20 2010 : Debug: wait = no Wed May 26 20:30:20 2010 : Debug: input_pairs = "request" Wed May 26 20:30:20 2010 : Debug: shell_escape = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_expr Wed May 26 20:30:20 2010 : Debug: Module: Instantiating expr Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_expiration Wed May 26 20:30:20 2010 : Debug: Module: Instantiating expiration Wed May 26 20:30:20 2010 : Debug: expiration { Wed May 26 20:30:20 2010 : Debug: reply-message = "Password Has Expired " Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_logintime Wed May 26 20:30:20 2010 : Debug: Module: Instantiating logintime Wed May 26 20:30:20 2010 : Debug: logintime { Wed May 26 20:30:20 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Wed May 26 20:30:20 2010 : Debug: minimum-timeout = 60 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Loading Virtual Servers #### Wed May 26 20:30:20 2010 : Debug: server inner-tunnel { Wed May 26 20:30:20 2010 : Debug: modules { Wed May 26 20:30:20 2010 : Debug: Module: Checking authenticate {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_pap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating pap Wed May 26 20:30:20 2010 : Debug: pap { Wed May 26 20:30:20 2010 : Debug: encryption_scheme = "auto" Wed May 26 20:30:20 2010 : Debug: auto_header = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_chap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating chap Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_mschap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating mschap Wed May 26 20:30:20 2010 : Debug: mschap { Wed May 26 20:30:20 2010 : Debug: use_mppe = yes Wed May 26 20:30:20 2010 : Debug: require_encryption = no Wed May 26 20:30:20 2010 : Debug: require_strong = no Wed May 26 20:30:20 2010 : Debug: with_ntdomain_hack = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_unix Wed May 26 20:30:20 2010 : Debug: Module: Instantiating unix Wed May 26 20:30:20 2010 : Debug: unix { Wed May 26 20:30:20 2010 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_eap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap Wed May 26 20:30:20 2010 : Debug: eap { Wed May 26 20:30:20 2010 : Debug: default_eap_type = "md5" Wed May 26 20:30:20 2010 : Debug: timer_expire = 60 Wed May 26 20:30:20 2010 : Debug: ignore_unknown_eap_types = no Wed May 26 20:30:20 2010 : Debug: cisco_accounting_username_bug = no Wed May 26 20:30:20 2010 : Debug: max_sessions = 4096 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-md5 Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-leap Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-gtc Wed May 26 20:30:20 2010 : Debug: gtc { Wed May 26 20:30:20 2010 : Debug: challenge = "Password: " Wed May 26 20:30:20 2010 : Debug: auth_type = "PAP" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-tls Wed May 26 20:30:20 2010 : Debug: tls { Wed May 26 20:30:20 2010 : Debug: rsa_key_exchange = no Wed May 26 20:30:20 2010 : Debug: dh_key_exchange = yes Wed May 26 20:30:20 2010 : Debug: rsa_key_length = 512 Wed May 26 20:30:20 2010 : Debug: dh_key_length = 512 Wed May 26 20:30:20 2010 : Debug: verify_depth = 0 Wed May 26 20:30:20 2010 : Debug: pem_file_type = yes Wed May 26 20:30:20 2010 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Wed May 26 20:30:20 2010 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Wed May 26 20:30:20 2010 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Wed May 26 20:30:20 2010 : Debug: private_key_password = "whatever" Wed May 26 20:30:20 2010 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Wed May 26 20:30:20 2010 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Wed May 26 20:30:20 2010 : Debug: fragment_size = 1024 Wed May 26 20:30:20 2010 : Debug: include_length = yes Wed May 26 20:30:20 2010 : Debug: check_crl = no Wed May 26 20:30:20 2010 : Debug: cipher_list = "DEFAULT" Wed May 26 20:30:20 2010 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Wed May 26 20:30:20 2010 : Debug: cache { Wed May 26 20:30:20 2010 : Debug: enable = no Wed May 26 20:30:20 2010 : Debug: lifetime = 24 Wed May 26 20:30:20 2010 : Debug: max_entries = 255 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-ttls Wed May 26 20:30:20 2010 : Debug: ttls { Wed May 26 20:30:20 2010 : Debug: default_eap_type = "md5" Wed May 26 20:30:20 2010 : Debug: copy_request_to_tunnel = no Wed May 26 20:30:20 2010 : Debug: use_tunneled_reply = no Wed May 26 20:30:20 2010 : Debug: virtual_server = "inner-tunnel" Wed May 26 20:30:20 2010 : Debug: include_length = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-peap Wed May 26 20:30:20 2010 : Debug: peap { Wed May 26 20:30:20 2010 : Debug: default_eap_type = "mschapv2" Wed May 26 20:30:20 2010 : Debug: copy_request_to_tunnel = no Wed May 26 20:30:20 2010 : Debug: use_tunneled_reply = no Wed May 26 20:30:20 2010 : Debug: proxy_tunneled_request_as_eap = yes Wed May 26 20:30:20 2010 : Debug: virtual_server = "inner-tunnel" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-mschapv2 Wed May 26 20:30:20 2010 : Debug: mschapv2 { Wed May 26 20:30:20 2010 : Debug: with_ntdomain_hack = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Checking authorize {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_realm Wed May 26 20:30:20 2010 : Debug: Module: Instantiating suffix Wed May 26 20:30:20 2010 : Debug: realm suffix { Wed May 26 20:30:20 2010 : Debug: format = "suffix" Wed May 26 20:30:20 2010 : Debug: delimiter = "@" Wed May 26 20:30:20 2010 : Debug: ignore_default = no Wed May 26 20:30:20 2010 : Debug: ignore_null = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_files, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_files Wed May 26 20:30:20 2010 : Debug: Module: Instantiating files Wed May 26 20:30:20 2010 : Debug: files { Wed May 26 20:30:20 2010 : Debug: usersfile = "/usr/local/etc/raddb/users" Wed May 26 20:30:20 2010 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Wed May 26 20:30:20 2010 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Wed May 26 20:30:20 2010 : Debug: compat = "no" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Checking session {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_radutmp Wed May 26 20:30:20 2010 : Debug: Module: Instantiating radutmp Wed May 26 20:30:20 2010 : Debug: radutmp { Wed May 26 20:30:20 2010 : Debug: filename = "/usr/local/var/log/radius/radutmp" Wed May 26 20:30:20 2010 : Debug: username = "%{User-Name}" Wed May 26 20:30:20 2010 : Debug: case_sensitive = yes Wed May 26 20:30:20 2010 : Debug: check_with_nas = yes Wed May 26 20:30:20 2010 : Debug: perm = 384 Wed May 26 20:30:20 2010 : Debug: callerid = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: Module: Checking post-auth {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_attr_filter Wed May 26 20:30:20 2010 : Debug: Module: Instantiating attr_filter.access_reject Wed May 26 20:30:20 2010 : Debug: ****** attr_filter_instantiate Wed May 26 20:30:20 2010 : Debug: attr_filter attr_filter.access_reject { Wed May 26 20:30:20 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Wed May 26 20:30:20 2010 : Debug: key = "%{User-Name}" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: ****** getattrsfile Wed May 26 20:30:20 2010 : Debug: } # modules Wed May 26 20:30:20 2010 : Debug: } # server Wed May 26 20:30:20 2010 : Debug: server status { Wed May 26 20:30:20 2010 : Debug: modules { Wed May 26 20:30:20 2010 : Debug: Module: Checking authorize {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_always, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_always Wed May 26 20:30:20 2010 : Debug: Module: Instantiating ok Wed May 26 20:30:20 2010 : Debug: always ok { Wed May 26 20:30:20 2010 : Debug: rcode = "ok" Wed May 26 20:30:20 2010 : Debug: simulcount = 0 Wed May 26 20:30:20 2010 : Debug: mpp = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } # modules Wed May 26 20:30:20 2010 : Debug: } # server Wed May 26 20:30:20 2010 : Debug: server { Wed May 26 20:30:20 2010 : Debug: modules { Wed May 26 20:30:20 2010 : Debug: Module: Checking authenticate {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: Module: Instantiating attr_filter.access_challenge Wed May 26 20:30:20 2010 : Debug: ****** attr_filter_instantiate Wed May 26 20:30:20 2010 : Debug: attr_filter attr_filter.access_challenge { Wed May 26 20:30:20 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" Wed May 26 20:30:20 2010 : Debug: key = "%{User-Name}" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: ****** getattrsfile Wed May 26 20:30:20 2010 : Error: /usr/local/etc/raddb/sites-enabled/default[301]: Unknown action 'override'. Wed May 26 20:30:20 2010 : Error: /usr/local/etc/raddb/sites-enabled/default[299]: Failed to parse "if" subsection. root@ubuntu:/usr/local/var/log/radius# Therefore, I don't understand why this default file is not the one my server is reading. 在2010-05-26 23:10:42，"Alan DeKok" <aland@deployingradius.com> 写道：
WWF wrote:
You were told what the problem was, and how to fix it. There is no magic involved.
Sorry, I don't know which one? If it is the
You said you edited a file. The debug output showed that the file was not edited.
Maybe I think this is a good and only way to get some hints after my msg in http://lists.freeradius.org/pipermail/freeradius-users/2010-May/msg00596.htm.... It seems a long wait. I am not trying to complain but really want to use the software correctly.
Make sure you are editing the file that the server is reading. There really aren't many ways of saying that. It is *impossible* to help you until you edit the file that the server is reading.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
hi In my last reply, I have shown that I edited the default file, and it has been really read by the radiusd. Actually, If I fix the error by : Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter (<-- notice this line) } } } And the radiusd will work normally. And I can see debug output like the following: Thu May 27 00:09:59 2010 : Debug: server { Thu May 27 00:09:59 2010 : Debug: modules { Thu May 27 00:09:59 2010 : Debug: Module: Checking authenticate {...} for more modules to load Thu May 27 00:09:59 2010 : Debug: Module: Instantiating attr_filter.access_challenge Thu May 27 00:09:59 2010 : Debug: ****** attr_filter_instantiate Thu May 27 00:09:59 2010 : Debug: attr_filter attr_filter.access_challenge { Thu May 27 00:09:59 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" Thu May 27 00:09:59 2010 : Debug: key = "%{User-Name}" Thu May 27 00:09:59 2010 : Debug: } Thu May 27 00:09:59 2010 : Debug: ****** getattrsfile Thu May 27 00:09:59 2010 : Debug: Module: Instantiating handled Thu May 27 00:09:59 2010 : Debug: always handled { Thu May 27 00:09:59 2010 : Debug: rcode = "handled" Thu May 27 00:09:59 2010 : Debug: simulcount = 0 Thu May 27 00:09:59 2010 : Debug: mpp = no Thu May 27 00:09:59 2010 : Debug: } Thu May 27 00:09:59 2010 : Debug: Module: Checking authorize {...} for more modules to load Thu May 27 00:09:59 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Thu May 27 00:09:59 2010 : Debug: Module: Linked to module rlm_preprocess I think it just shows the attr_filter attr_filter.access_challenge is now loaded by server.(I don't know if it is, since I don't know what will be the *right* output.) However, the filter does not work. Can anyone tell me what the problem is? Best Regards 2010-05-27 ----- Original Message ----- From: WWF To: FreeRadius users mailing list Sent: 2010-05-27, 11:35:40 Subject: Re:Re: still about how to return some attributes only inAccess-Accept packet Thanks for your kindly reply. Now I edited the default file in /usr/local/etc/raddb/sites-enabled, notice that "handled # override the "updated" code from attr_filter" (it will cause an error for my Radiusd): # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # Auth-Type eap { eap { handled = 1 } if (handled && (Response-Packet-Type == Access-Challenge)) { attr_filter.access_challenge.post-auth handled # override the "updated" code from attr_filter } } } The radiusd debug output is as follows: root@ubuntu:/usr/local/var/log/radius# radiusd -Xxxxx Wed May 26 20:30:20 2010 : Info: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on May 26 2010 at 02:10:20 Wed May 26 20:30:20 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Wed May 26 20:30:20 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed May 26 20:30:20 2010 : Info: PARTICULAR PURPOSE. Wed May 26 20:30:20 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed May 26 20:30:20 2010 : Info: GNU General Public License v2. Wed May 26 20:30:20 2010 : Info: Starting - reading configuration files ... Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Wed May 26 20:30:20 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Wed May 26 20:30:20 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/status Wed May 26 20:30:20 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Wed May 26 20:30:20 2010 : Debug: main { Wed May 26 20:30:20 2010 : Debug: allow_core_dumps = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Wed May 26 20:30:20 2010 : Debug: main { Wed May 26 20:30:20 2010 : Debug: prefix = "/usr/local" Wed May 26 20:30:20 2010 : Debug: localstatedir = "/usr/local/var" Wed May 26 20:30:20 2010 : Debug: logdir = "/usr/local/var/log/radius" Wed May 26 20:30:20 2010 : Debug: libdir = "/usr/local/lib" Wed May 26 20:30:20 2010 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Wed May 26 20:30:20 2010 : Debug: hostname_lookups = no Wed May 26 20:30:20 2010 : Debug: max_request_time = 30 Wed May 26 20:30:20 2010 : Debug: cleanup_delay = 5 Wed May 26 20:30:20 2010 : Debug: max_requests = 1024 Wed May 26 20:30:20 2010 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Wed May 26 20:30:20 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Wed May 26 20:30:20 2010 : Debug: debug_level = 0 Wed May 26 20:30:20 2010 : Debug: proxy_requests = yes Wed May 26 20:30:20 2010 : Debug: log { Wed May 26 20:30:20 2010 : Debug: stripped_names = yes Wed May 26 20:30:20 2010 : Debug: auth = yes Wed May 26 20:30:20 2010 : Debug: auth_badpass = yes Wed May 26 20:30:20 2010 : Debug: auth_goodpass = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: security { Wed May 26 20:30:20 2010 : Debug: max_attributes = 200 Wed May 26 20:30:20 2010 : Debug: reject_delay = 1 Wed May 26 20:30:20 2010 : Debug: status_server = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed May 26 20:30:20 2010 : Debug: proxy server { Wed May 26 20:30:20 2010 : Debug: retry_delay = 5 Wed May 26 20:30:20 2010 : Debug: retry_count = 3 Wed May 26 20:30:20 2010 : Debug: default_fallback = no Wed May 26 20:30:20 2010 : Debug: dead_time = 120 Wed May 26 20:30:20 2010 : Debug: wake_all_if_all_dead = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: home_server localhost { Wed May 26 20:30:20 2010 : Debug: ipaddr = 127.0.0.1 Wed May 26 20:30:20 2010 : Debug: port = 1812 Wed May 26 20:30:20 2010 : Debug: type = "auth" Wed May 26 20:30:20 2010 : Debug: secret = "testing123" Wed May 26 20:30:20 2010 : Debug: response_window = 20 Wed May 26 20:30:20 2010 : Debug: max_outstanding = 65536 Wed May 26 20:30:20 2010 : Debug: require_message_authenticator = no Wed May 26 20:30:20 2010 : Debug: zombie_period = 40 Wed May 26 20:30:20 2010 : Debug: status_check = "status-server" Wed May 26 20:30:20 2010 : Debug: ping_interval = 30 Wed May 26 20:30:20 2010 : Debug: check_interval = 30 Wed May 26 20:30:20 2010 : Debug: num_answers_to_alive = 3 Wed May 26 20:30:20 2010 : Debug: num_pings_to_alive = 3 Wed May 26 20:30:20 2010 : Debug: revive_interval = 120 Wed May 26 20:30:20 2010 : Debug: status_check_timeout = 4 Wed May 26 20:30:20 2010 : Debug: irt = 2 Wed May 26 20:30:20 2010 : Debug: mrt = 16 Wed May 26 20:30:20 2010 : Debug: mrc = 5 Wed May 26 20:30:20 2010 : Debug: mrd = 30 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: home_server_pool my_auth_failover { Wed May 26 20:30:20 2010 : Debug: type = fail-over Wed May 26 20:30:20 2010 : Debug: home_server = localhost Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: realm example.com { Wed May 26 20:30:20 2010 : Debug: auth_pool = my_auth_failover Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: realm LOCAL { Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Loading Clients #### Wed May 26 20:30:20 2010 : Debug: client localhost { Wed May 26 20:30:20 2010 : Debug: ipaddr = 127.0.0.1 Wed May 26 20:30:20 2010 : Debug: require_message_authenticator = no Wed May 26 20:30:20 2010 : Debug: secret = "testing123" Wed May 26 20:30:20 2010 : Debug: nastype = "other" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Instantiating modules #### Wed May 26 20:30:20 2010 : Debug: instantiate { Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_exec Wed May 26 20:30:20 2010 : Debug: Module: Instantiating exec Wed May 26 20:30:20 2010 : Debug: exec { Wed May 26 20:30:20 2010 : Debug: wait = no Wed May 26 20:30:20 2010 : Debug: input_pairs = "request" Wed May 26 20:30:20 2010 : Debug: shell_escape = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_expr Wed May 26 20:30:20 2010 : Debug: Module: Instantiating expr Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_expiration Wed May 26 20:30:20 2010 : Debug: Module: Instantiating expiration Wed May 26 20:30:20 2010 : Debug: expiration { Wed May 26 20:30:20 2010 : Debug: reply-message = "Password Has Expired " Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_logintime Wed May 26 20:30:20 2010 : Debug: Module: Instantiating logintime Wed May 26 20:30:20 2010 : Debug: logintime { Wed May 26 20:30:20 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Wed May 26 20:30:20 2010 : Debug: minimum-timeout = 60 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: radiusd: #### Loading Virtual Servers #### Wed May 26 20:30:20 2010 : Debug: server inner-tunnel { Wed May 26 20:30:20 2010 : Debug: modules { Wed May 26 20:30:20 2010 : Debug: Module: Checking authenticate {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_pap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating pap Wed May 26 20:30:20 2010 : Debug: pap { Wed May 26 20:30:20 2010 : Debug: encryption_scheme = "auto" Wed May 26 20:30:20 2010 : Debug: auto_header = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_chap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating chap Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_mschap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating mschap Wed May 26 20:30:20 2010 : Debug: mschap { Wed May 26 20:30:20 2010 : Debug: use_mppe = yes Wed May 26 20:30:20 2010 : Debug: require_encryption = no Wed May 26 20:30:20 2010 : Debug: require_strong = no Wed May 26 20:30:20 2010 : Debug: with_ntdomain_hack = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_unix Wed May 26 20:30:20 2010 : Debug: Module: Instantiating unix Wed May 26 20:30:20 2010 : Debug: unix { Wed May 26 20:30:20 2010 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_eap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap Wed May 26 20:30:20 2010 : Debug: eap { Wed May 26 20:30:20 2010 : Debug: default_eap_type = "md5" Wed May 26 20:30:20 2010 : Debug: timer_expire = 60 Wed May 26 20:30:20 2010 : Debug: ignore_unknown_eap_types = no Wed May 26 20:30:20 2010 : Debug: cisco_accounting_username_bug = no Wed May 26 20:30:20 2010 : Debug: max_sessions = 4096 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-md5 Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-leap Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-gtc Wed May 26 20:30:20 2010 : Debug: gtc { Wed May 26 20:30:20 2010 : Debug: challenge = "Password: " Wed May 26 20:30:20 2010 : Debug: auth_type = "PAP" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-tls Wed May 26 20:30:20 2010 : Debug: tls { Wed May 26 20:30:20 2010 : Debug: rsa_key_exchange = no Wed May 26 20:30:20 2010 : Debug: dh_key_exchange = yes Wed May 26 20:30:20 2010 : Debug: rsa_key_length = 512 Wed May 26 20:30:20 2010 : Debug: dh_key_length = 512 Wed May 26 20:30:20 2010 : Debug: verify_depth = 0 Wed May 26 20:30:20 2010 : Debug: pem_file_type = yes Wed May 26 20:30:20 2010 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Wed May 26 20:30:20 2010 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Wed May 26 20:30:20 2010 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Wed May 26 20:30:20 2010 : Debug: private_key_password = "whatever" Wed May 26 20:30:20 2010 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Wed May 26 20:30:20 2010 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Wed May 26 20:30:20 2010 : Debug: fragment_size = 1024 Wed May 26 20:30:20 2010 : Debug: include_length = yes Wed May 26 20:30:20 2010 : Debug: check_crl = no Wed May 26 20:30:20 2010 : Debug: cipher_list = "DEFAULT" Wed May 26 20:30:20 2010 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" Wed May 26 20:30:20 2010 : Debug: cache { Wed May 26 20:30:20 2010 : Debug: enable = no Wed May 26 20:30:20 2010 : Debug: lifetime = 24 Wed May 26 20:30:20 2010 : Debug: max_entries = 255 Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-ttls Wed May 26 20:30:20 2010 : Debug: ttls { Wed May 26 20:30:20 2010 : Debug: default_eap_type = "md5" Wed May 26 20:30:20 2010 : Debug: copy_request_to_tunnel = no Wed May 26 20:30:20 2010 : Debug: use_tunneled_reply = no Wed May 26 20:30:20 2010 : Debug: virtual_server = "inner-tunnel" Wed May 26 20:30:20 2010 : Debug: include_length = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-peap Wed May 26 20:30:20 2010 : Debug: peap { Wed May 26 20:30:20 2010 : Debug: default_eap_type = "mschapv2" Wed May 26 20:30:20 2010 : Debug: copy_request_to_tunnel = no Wed May 26 20:30:20 2010 : Debug: use_tunneled_reply = no Wed May 26 20:30:20 2010 : Debug: proxy_tunneled_request_as_eap = yes Wed May 26 20:30:20 2010 : Debug: virtual_server = "inner-tunnel" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed May 26 20:30:20 2010 : Debug: Module: Instantiating eap-mschapv2 Wed May 26 20:30:20 2010 : Debug: mschapv2 { Wed May 26 20:30:20 2010 : Debug: with_ntdomain_hack = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Checking authorize {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_realm Wed May 26 20:30:20 2010 : Debug: Module: Instantiating suffix Wed May 26 20:30:20 2010 : Debug: realm suffix { Wed May 26 20:30:20 2010 : Debug: format = "suffix" Wed May 26 20:30:20 2010 : Debug: delimiter = "@" Wed May 26 20:30:20 2010 : Debug: ignore_default = no Wed May 26 20:30:20 2010 : Debug: ignore_null = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_files, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_files Wed May 26 20:30:20 2010 : Debug: Module: Instantiating files Wed May 26 20:30:20 2010 : Debug: files { Wed May 26 20:30:20 2010 : Debug: usersfile = "/usr/local/etc/raddb/users" Wed May 26 20:30:20 2010 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Wed May 26 20:30:20 2010 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Wed May 26 20:30:20 2010 : Debug: compat = "no" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Checking session {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_radutmp Wed May 26 20:30:20 2010 : Debug: Module: Instantiating radutmp Wed May 26 20:30:20 2010 : Debug: radutmp { Wed May 26 20:30:20 2010 : Debug: filename = "/usr/local/var/log/radius/radutmp" Wed May 26 20:30:20 2010 : Debug: username = "%{User-Name}" Wed May 26 20:30:20 2010 : Debug: case_sensitive = yes Wed May 26 20:30:20 2010 : Debug: check_with_nas = yes Wed May 26 20:30:20 2010 : Debug: perm = 384 Wed May 26 20:30:20 2010 : Debug: callerid = yes Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: Module: Checking post-auth {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_attr_filter Wed May 26 20:30:20 2010 : Debug: Module: Instantiating attr_filter.access_reject Wed May 26 20:30:20 2010 : Debug: ****** attr_filter_instantiate Wed May 26 20:30:20 2010 : Debug: attr_filter attr_filter.access_reject { Wed May 26 20:30:20 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Wed May 26 20:30:20 2010 : Debug: key = "%{User-Name}" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: ****** getattrsfile Wed May 26 20:30:20 2010 : Debug: } # modules Wed May 26 20:30:20 2010 : Debug: } # server Wed May 26 20:30:20 2010 : Debug: server status { Wed May 26 20:30:20 2010 : Debug: modules { Wed May 26 20:30:20 2010 : Debug: Module: Checking authorize {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: (Loaded rlm_always, checking if it's valid) Wed May 26 20:30:20 2010 : Debug: Module: Linked to module rlm_always Wed May 26 20:30:20 2010 : Debug: Module: Instantiating ok Wed May 26 20:30:20 2010 : Debug: always ok { Wed May 26 20:30:20 2010 : Debug: rcode = "ok" Wed May 26 20:30:20 2010 : Debug: simulcount = 0 Wed May 26 20:30:20 2010 : Debug: mpp = no Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: } # modules Wed May 26 20:30:20 2010 : Debug: } # server Wed May 26 20:30:20 2010 : Debug: server { Wed May 26 20:30:20 2010 : Debug: modules { Wed May 26 20:30:20 2010 : Debug: Module: Checking authenticate {...} for more modules to load Wed May 26 20:30:20 2010 : Debug: Module: Instantiating attr_filter.access_challenge Wed May 26 20:30:20 2010 : Debug: ****** attr_filter_instantiate Wed May 26 20:30:20 2010 : Debug: attr_filter attr_filter.access_challenge { Wed May 26 20:30:20 2010 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" Wed May 26 20:30:20 2010 : Debug: key = "%{User-Name}" Wed May 26 20:30:20 2010 : Debug: } Wed May 26 20:30:20 2010 : Debug: ****** getattrsfile Wed May 26 20:30:20 2010 : Error: /usr/local/etc/raddb/sites-enabled/default[301]: Unknown action 'override'. Wed May 26 20:30:20 2010 : Error: /usr/local/etc/raddb/sites-enabled/default[299]: Failed to parse "if" subsection. root@ubuntu:/usr/local/var/log/radius# Therefore, I don't understand why this default file is not the one my server is reading. 在2010-05-26 23:10:42，"Alan DeKok" <aland@deployingradius.com> 写道：
WWF wrote:
You were told what the problem was, and how to fix it. There is no magic involved.
Sorry, I don't know which one? If it is the
You said you edited a file. The debug output showed that the file was not edited.
Maybe I think this is a good and only way to get some hints after my msg in http://lists.freeradius.org/pipermail/freeradius-users/2010-May/msg00596.htm.... It seems a long wait. I am not trying to complain but really want to use the software correctly.
Make sure you are editing the file that the server is reading. There really aren't many ways of saying that. It is *impossible* to help you until you edit the file that the server is reading.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
网易为中小企业免费提供企业邮箱（自主域名）
Hi,
However, the filter does not work.
Can anyone tell me what the problem is?
do you not read my emails? really, I side with Alan here - why bother replying if you keep asking the wrong questions. yes, that # cannot be on the same line as handled - obviously that config wasnt checked before submission..... but the debug you posted just showed the CONFIG being read correctly...not the code actually being activated. do as I said in my last email - ie comment out the line which says 'eap' about 6 lines up and then that code will be activated alan
hi Thanks a lot for your kindly help!!! It works now! Best Regards 2010-05-27 ----- Original Message ----- From: Alan Buxey To: weiweif@126.com,FreeRadius users mailing list Sent: 2010-05-27, 16:34:08 Subject: Re: Re: still about how to return some attributes onlyinAccess-Accept packet Hi,
However, the filter does not work.
Can anyone tell me what the problem is?
do you not read my emails? really, I side with Alan here - why bother replying if you keep asking the wrong questions. yes, that # cannot be on the same line as handled - obviously that config wasnt checked before submission..... but the debug you posted just showed the CONFIG being read correctly...not the code actually being activated. do as I said in my last email - ie comment out the line which says 'eap' about 6 lines up and then that code will be activated alan
Hi, try the following....try commenting out the 'eap' line above that bit of unlang logic..... you'll see that the code is then activated. not sure why its not dealt with properly - possibly a bug or this unlang is supposed to replace that one line and not be there at the same time. either way, as i said in first answer...the debug didnt show the bit of unlang being hit and therefore you need to find out why. i found out why for you - which is nice - but I'm not paid to be your brain. alan
participants (5)
-
Alan Buxey -
Alan DeKok -
weiwei fang -
WWF -
方维维