<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If it's "sometimes", then it would be wise to compare the debug log of<br>
when the client succeeds and when it does not. Also, IIRC RHEL5 has<br>
2.1.12 already, so you should upgrade just in case this is a fixed<br>
bug.<br><br></blockquote><div><br></div><div>just updated my testserver to 2.1.12.</div><div>I test now with rad_eap_test utility to eliminate a client failure. the behaviour gets more stranger. the test utility also fails sometimes, but the radius server seams to be ok now?</div>
<div><br></div><div><br></div><div><div>[root@wlan-radius rad_eap_test-0.23]# ./rad_eap_test -H 172.21.15.1 -P 1812 -S testtest -u nagios -p xxxx -m WPA-EAP -e PEAP -2 MSCHAPV2</div><div>access-accept; 0</div><div>[root@wlan-radius rad_eap_test-0.23]# ./rad_eap_test -H 172.21.15.1 -P 1812 -S testtest -u nagios -p xxxx -m WPA-EAP -e PEAP -2 MSCHAPV2</div>
<div>access-accept; 0</div><div>[root@wlan-radius rad_eap_test-0.23]# ./rad_eap_test -H 172.21.15.1 -P 1812 -S testtest -u nagios -p xxxx -m WPA-EAP -e PEAP -2 MSCHAPV2</div><div>access-accept; 0</div><div>[root@wlan-radius rad_eap_test-0.23]# ./rad_eap_test -H 172.21.15.1 -P 1812 -S testtest -u nagios -p xxxx -m WPA-EAP -e PEAP -2 MSCHAPV2</div>
<div>access-accept; 0</div><div>[root@wlan-radius rad_eap_test-0.23]# ./rad_eap_test -H 172.21.15.1 -P 1812 -S testtest -u nagios -p xxxx -m WPA-EAP -e PEAP -2 MSCHAPV2</div><div>access-accept; 1</div><div>[root@wlan-radius rad_eap_test-0.23]#</div>
</div><div><br></div><div><div>} # server inner-tunnel</div><div>[peap] Got tunneled reply code 2</div><div> MS-MPPE-Encryption-Policy = 0x00000001</div><div> MS-MPPE-Encryption-Types = 0x00000006</div><div>
MS-MPPE-Send-Key = 0x5b1d5157a6d94d87d527c9aab7234a85</div><div> MS-MPPE-Recv-Key = 0x942bf481ca97760d330305771e0d2e09</div><div> EAP-Message = 0x03090004</div><div> Message-Authenticator = 0x00000000000000000000000000000000</div>
<div> User-Name = "nagios"</div><div>[peap] Got tunneled reply RADIUS code 2</div><div> MS-MPPE-Encryption-Policy = 0x00000001</div><div> MS-MPPE-Encryption-Types = 0x00000006</div><div> MS-MPPE-Send-Key = 0x5b1d5157a6d94d87d527c9aab7234a85</div>
<div> MS-MPPE-Recv-Key = 0x942bf481ca97760d330305771e0d2e09</div><div> EAP-Message = 0x03090004</div><div> Message-Authenticator = 0x00000000000000000000000000000000</div><div> User-Name = "nagios"</div>
<div>[peap] Tunneled authentication was successful.</div><div>[peap] SUCCESS</div><div>++[eap] returns handled</div><div>Sending Access-Challenge of id 9 to 172.21.15.1 port 59848</div><div> EAP-Message = 0x010a003b19001703010030a46c09beb178741efc835036735026e09d8b1b1b44a88b55fce72fc28133dbf7e6edca8c0a65a6a2a85fd98eeeef2f6e</div>
<div> Message-Authenticator = 0x00000000000000000000000000000000</div><div> State = 0xc9f5fd31c0ffe486f9e2896c0b298eff</div><div>Finished request 779.</div><div>Going to the next request</div><div>Waking up in 0.1 seconds.</div>
<div>rad_recv: Access-Request packet from host 172.21.15.1 port 59848, id=10, length=226</div><div> User-Name = "nagios"</div><div> NAS-IP-Address = 127.0.0.1</div><div> Calling-Station-Id = "70-6F-6C-69-73-68"</div>
<div> Framed-MTU = 1400</div><div> NAS-Port-Type = Wireless-802.11</div><div> Connect-Info = "rad_eap_test + eapol_test"</div><div> EAP-Message = 0x020a006019001703010020fcc074273699ca1e907af0200b96b3eaa01064887cff1a26b692f38602c3a48817030100309381801c8d424b14a2d053af534f137d1f632c69aa0572f0720bec578a1d6a61df79dc279e86b9f81d68dc6c81191e8f</div>
<div> State = 0xc9f5fd31c0ffe486f9e2896c0b298eff</div><div> Message-Authenticator = 0xb3249ed0ca17319a8d00741f734c974b</div><div># Executing section authorize from file /etc/raddb/sites-enabled/default</div>
<div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>++[mschap] returns noop</div><div>++[digest] returns noop</div><div>[suffix] No '@' in User-Name = "nagios", looking up realm NULL</div>
<div>[suffix] No such realm "NULL"</div><div>++[suffix] returns noop</div><div>[eap] EAP packet type response id 10 length 96</div><div>[eap] Continuing tunnel setup.</div><div>++[eap] returns ok</div><div>Found Auth-Type = EAP</div>
<div># Executing group from file /etc/raddb/sites-enabled/default</div><div>+- entering group authenticate {...}</div><div>[eap] Request found, released from the list</div><div>[eap] EAP/peap</div><div>[eap] processing type peap</div>
<div>[peap] processing EAP-TLS</div><div>[peap] eaptls_verify returned 7 </div><div>[peap] Done initial handshake</div><div>[peap] eaptls_process returned 7 </div><div>[peap] EAPTLS_OK</div><div>[peap] Session established. Decoding tunneled attributes.</div>
<div>[peap] Peap state send tlv success</div><div>[peap] Received EAP-TLV response.</div><div>[peap] Success</div><div>[eap] Freeing handler</div><div>++[eap] returns ok</div><div>Login OK: [nagios/<via Auth-Type = EAP>] (from client 172.21.15.1 port 0 cli 70-6F-6C-69-73-68)</div>
<div># Executing section post-auth from file /etc/raddb/sites-enabled/default</div><div>+- entering group post-auth {...}</div><div>[sql] expand: %{User-Name} -> nagios</div><div>[sql] sql_set_user escaped user --> 'nagios'</div>
<div>[sql] expand: %{User-Password} -> </div><div>[sql] ... expanding second conditional</div><div>[sql] expand: %{Chap-Password} -> </div><div>[sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'nagios', '', 'Access-Accept', '2012-08-08 10:42:37')</div>
<div>rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'nagios', '', 'Access-Accept', '2012-08-08 10:42:37')</div>
<div>rlm_sql (sql): Reserving sql socket id: 2</div><div>rlm_sql (sql): Released sql socket id: 2</div><div>++[sql] returns ok</div><div>++[exec] returns noop</div><div>Sending Access-Accept of id 10 to 172.21.15.1 port 59848</div>
<div> MS-MPPE-Recv-Key = 0x3a1be0edbc8566fc1b291ff8d09a4892ad61da4dc4a33927088e7c700d478e12</div><div> MS-MPPE-Send-Key = 0x39a7512be1ea532b88619cf74533da41e180aeb57c6077287a98c82597f8cfa5</div><div> EAP-Message = 0x030a0004</div>
<div> Message-Authenticator = 0x00000000000000000000000000000000</div><div> User-Name = "nagios"</div><div>Finished request 780.</div><div>Going to the next request</div><div>Waking up in 0.1 seconds.</div>
</div><div> </div></div>-- <br>kind regards,<div>Stefan</div><div><div>_______________________</div></div><div><a href="http://www.epb.at" target="_blank">www.epb.at</a> - Your IT Partner in East Austria</div><br>