<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Le 13/06/2012 10:55, Alan DeKok a écrit :
<blockquote cite="mid:4FD85592.7090603@deployingradius.com"
type="cite">
<pre wrap="">rs do <b class="moz-txt-star"><span class="moz-txt-tag">*</span>not<span class="moz-txt-tag">*</span></b> have this feature. The
"inner-tunnel" authentication is handled by various special-purpose
magic. That makes the configuration more complex a</pre>
</blockquote>
Thanks a lot for the time you spent on this request.<br>
I will not understand all, but i think (i hope) i can roughly follow
the mechanism. I often try to known what a product do for
configuring it. Maybe it is a mistake...<br>
<br>
Here are the last lines of a successful connexion. It begins with
the last outside tunnel authenticate section, just before entering
inner-tunnel parsing.<br>
I obviously believe you about all what you said, but i can't find an
explicite authenticate section between * ldap authorization and *
entering LDAP.<br>
It's quite possible (likely) that i don't read correctly the output,
please don't be offended about my questions. I only try to
understand.<br>
<br>
...<br>
# Executing group from file /etc/raddb/sites-enabled/default<br>
+- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/ttls<br>
[eap] processing type ttls<br>
[ttls] Authenticate<br>
[ttls] processing EAP-TLS<br>
TLS Length 61<br>
[ttls] Length Included<br>
[ttls] eaptls_verify returned 11<br>
[ttls] eaptls_process returned 7<br>
[ttls] Session established. Proceeding to decode tunneled
attributes.<br>
[ttls] Got tunneled request<br>
User-Name = "user1"<br>
User-Password = "toutou"<br>
FreeRADIUS-Proxied-To = 127.0.0.1<br>
[ttls] Sending tunneled request<br>
User-Name = "user1"<br>
User-Password = "toutou"<br>
FreeRADIUS-Proxied-To = 127.0.0.1<br>
server inner-tunnel
{*************************************************************
entering tunnel ?<br>
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel<br>
+- entering group authorize {...}<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
[suffix] No '@' in User-Name = "user1", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
++[control] returns noop<br>
[eap] No EAP-Message, not doing EAP<br>
++[eap] returns noop<br>
++[files] returns noop<br>
[ldap] performing user authorization for
user1***********************************************************
ldap authorization<br>
[ldap] expand: %{Stripped-User-Name} -><br>
[ldap] ... expanding second conditional<br>
[ldap] expand: %{User-Name} -> user1<br>
[ldap] expand: %{Stripped-User-Name} -><br>
[ldap] ... expanding second conditional<br>
[ldap] expand: %{User-Name} -> user1<br>
[ldap] expand:
(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(mail=%{%{Stripped-User-Name}:-%{User-Name}}))
-> (|(uid=user1)(mail=user1))<br>
[ldap] expand: ou=ac-orleans-tours,ou=education,o=gouv,c=fr ->
ou=ac-orleans-tours,ou=education,o=gouv,c=fr<br>
[ldap] ldap_get_conn: Checking Id: 0<br>
[ldap] ldap_get_conn: Got Id: 0<br>
[ldap] attempting LDAP reconnection<br>
[ldap] (re)connect to replica.in.ac-orleans-tours.fr:389,
authentication 0<br>
[ldap] bind as / to replica.in.ac-orleans-tours.fr:389<br>
[ldap] waiting for bind result ...<br>
[ldap] Bind was successful<br>
[ldap] performing search in
ou=ac-orleans-tours,ou=education,o=gouv,c=fr, with filter
(|(uid=user1)(mail=user1))<br>
[ldap] looking for check items in directory...<br>
[ldap] looking for reply items in directory...<br>
WARNING: No "known good" password was found in LDAP. Are you sure
that the user is configured correctly?<br>
[ldap] Setting Auth-Type =
LDAP***********************************************************************
ldap authorization successful<br>
[ldap] user user1 authorized to use remote access<br>
[ldap] ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>
++[expiration] returns noop<br>
++[logintime] returns noop<br>
++[pap] returns noop<br>
Found Auth-Type = LDAP<br>
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel<br>
+- entering group LDAP
{...}*************************************************************
entering LDAP<br>
[ldap] login attempt by "user1" with password "toutou"<br>
[ldap] user DN: uid=user1,ou=personnels
EN,ou=ac-orleans-tours,ou=education,o=gouv,c=fr<br>
[ldap] (re)connect to replica.in.ac-orleans-tours.fr:389,
authentication 1<br>
[ldap] bind as uid=user1,ou=personnels
EN,ou=ac-orleans-tours,ou=education,o=gouv,c=fr/toutou to
replica.in.ac-orleans-tours.fr:389<br>
[ldap] waiting for bind result ...<br>
[ldap] Bind was successful<br>
[ldap] user user1 authenticated succesfully<br>
++[ldap] returns ok<br>
WARNING: Empty post-auth section. Using default return values.<br>
# Executing section post-auth from file
/etc/raddb/sites-enabled/inner-tunnel<br>
} # server inner-tunnel<br>
[ttls] Got tunneled reply code 2<br>
[ttls] Got tunneled Access-Accept<br>
[eap] Freeing handler<br>
++[eap] returns ok<br>
# Executing section post-auth from file
/etc/raddb/sites-enabled/default<br>
+- entering group post-auth {...}<br>
++[exec] returns noop<br>
<br>
Sending Access-Accept of id 230 to 172.30.145.70 port 32769<br>
MS-MPPE-Recv-Key =
0xffc75d74e5bf1ac3d87ad519d6717eb47335013ecdf9d90b911054432b3a14f9<br>
MS-MPPE-Send-Key =
0xc56881775c6929ffb64a59e4f9cbac06d99eb03ab5925f182555d2ec3af2b91e<br>
EAP-Message = 0x03080004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
User-Name = "user1"<br>
Finished request 6.<br>
Going to the next request<br>
Waking up in 4.6 seconds.<br>
rad_recv: Accounting-Request packet from host 172.30.145.70 port
32769, id=249, length=192<br>
User-Name = "user1"<br>
NAS-Port = 2<br>
NAS-IP-Address = 172.30.145.70<br>
NAS-Identifier = "wifi-admin"<br>
Airespace-Wlan-Id = 1<br>
Acct-Session-Id = "4fd83d9f/00:1d:e0:21:7b:31/94"<br>
Acct-Authentic = RADIUS<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "164"<br>
Acct-Status-Type = Interim-Update<br>
Acct-Input-Octets = 16133<br>
Acct-Output-Octets = 21904<br>
Acct-Input-Packets = 458<br>
Acct-Output-Packets = 238<br>
Acct-Session-Time = 47<br>
Acct-Delay-Time = 0<br>
Calling-Station-Id = "192.168.234.10"<br>
Called-Station-Id = "172.30.145.70"<br>
# Executing section preacct from file
/etc/raddb/sites-enabled/default<br>
+- entering group preacct {...}<br>
++[preprocess] returns ok<br>
[acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address =
172.30.145.70,NAS-IP-Address = 172.30.145.70,Acct-Session-Id =
"4fd83d9f/00:1d:e0:21:7b:31/94",User-Name = "user1"'<br>
[acct_unique] Acct-Unique-Session-ID = "9fcc14215b25e276".<br>
++[acct_unique] returns ok<br>
[suffix] No '@' in User-Name = "user1", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
++[files] returns noop<br>
# Executing section accounting from file
/etc/raddb/sites-enabled/default<br>
+- entering group accounting {...}<br>
[detail] expand:
/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d ->
/var/log/radius/radacct/172.30.145.70/detail-20120613<br>
[detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d
expands to /var/log/radius/radacct/172.30.145.70/detail-20120613<br>
[detail] expand: %t -> Wed Jun 13 09:14:29 2012<br>
++[detail] returns ok<br>
++[unix] returns noop<br>
[radutmp] expand: /var/log/radius/radutmp ->
/var/log/radius/radutmp<br>
[radutmp] expand: %{User-Name} -> user1<br>
++[radutmp] returns ok<br>
++[exec] returns noop<br>
[attr_filter.accounting_response] expand: %{User-Name} ->
user1<br>
attr_filter: Matched entry DEFAULT at line 12<br>
++[attr_filter.accounting_response] returns updated<br>
Sending Accounting-Response of id 249 to 172.30.145.70 port 32769<br>
Finished request 7.<br>
Cleaning up request 7 ID 249 with timestamp +40<br>
Going to the next request<br>
Waking up in 4.6 seconds.<br>
Cleaning up request 0 ID 224 with timestamp +39<br>
Cleaning up request 1 ID 225 with timestamp +39<br>
Cleaning up request 2 ID 226 with timestamp +39<br>
Cleaning up request 3 ID 227 with timestamp +39<br>
Cleaning up request 4 ID 228 with timestamp +39<br>
Waking up in 0.3 seconds.<br>
Cleaning up request 5 ID 229 with timestamp +40<br>
Cleaning up request 6 ID 230 with timestamp +40<br>
Ready to process requests.<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Emmanuel BILLOT
CATEL - Dpt. Système et Réseaux
Rectorat - Académie d'Orléans-Tours
10, rue Molière - 45000 Orléans
Tél : 02 38 79 45 57
</pre>
</body>
</html>