- Freeradius-Devel - lists.freeradius.org

Checking TLS-Cert-* and and accept/reject based on them
by Matthew Newton 10 Feb '12

10 Feb '12

Hi, An question came up recently on freeradius-users whether it was possible to reject a request based on the TLS-Client-Cert-* type attributes. The reply being that it would be quite hard to allow these checks to happen in the authorize section of the code. I had a look at doing that, but it does seem pretty nasty, as it would involve doing EAP-TLS things at a different place from, say PEAP or TTLS. At least, from what I could tell. However, I looked at and implemented a different solution, which seems to work really well. Taking ideas from inner-tunnels and the SoH check method, I added a virtual_server option to the tls configuration. The rlm_eap_tls code then, just before returning success, runs through this virtual server (if given) allowing it to check the TLS-Cert* vps, and reject if it wants to based on them. It turns out to be a pretty small patch, and the code path isn't touched at all if the virtual_server option is not set. I've tested with EAP-TLS and PEAP/EAP-TLS, and both work well. I think the next step would be to move the client certificate validation, ocsp and other checks as 'modules' in this virtual server, but that looks a bit harder as they are done in a openssl callback function (cbtls_verify IIRC) - but may not be past the realms of possibility. Patch below, and also pushed to github: https://github.com/mcnewton/freeradius-server/commit/fbee1e9b4ce93c15d0f074… Comments? Cheers, Matthew >From fbee1e9b4ce93c15d0f074ad3fdfb71ba095a4ed Mon Sep 17 00:00:00 2001 From: Matthew Newton <mcn4(a)leicester.ac.uk> Date: Thu, 2 Feb 2012 16:00:37 +0000 Subject: [PATCH] Add virtual-server option for EAP-TLS to allow certificate field checks Normally attributes such as TLS-Client-Cert-Common-Name can be seen in Post-Auth only, which is too late to act if the return to the client should be changed. This code adds a virtual-server option to EAP-TLS to allow these values to be examined, and the return status updated accordingly. --- raddb/eap.conf | 8 ++ raddb/sites-available/check-eap-tls | 54 +++++++++++++++ .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 69 +++++++++++++++++++- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h | 2 + 4 files changed, 132 insertions(+), 1 deletions(-) create mode 100644 raddb/sites-available/check-eap-tls diff --git a/raddb/eap.conf b/raddb/eap.conf index 087f7f7..81d9074 100644 --- a/raddb/eap.conf +++ b/raddb/eap.conf @@ -291,6 +291,14 @@ ecdh_curve = "prime256v1" # + # As part of checking a client certificate, the EAP-TLS + # sets some attributes such as TLS-Client-Cert-CN. This + # virtual server has access to these attributes, and can + # be used to accept or reject the request. + # + # virtual_server = check-eap-tls + + # # Session resumption / fast reauthentication # cache. # diff --git a/raddb/sites-available/check-eap-tls b/raddb/sites-available/check-eap-tls new file mode 100644 index 0000000..15dc628 --- /dev/null +++ b/raddb/sites-available/check-eap-tls @@ -0,0 +1,54 @@ +# This virtual server allows EAP-TLS to reject access requests +# based on some certificate attributes. + +# Value-pairs that are available for checking include: +# +# TLS-Client-Cert-Subject +# TLS-Client-Cert-Issuer +# TLS-Client-Cert-Common-Name +# TLS-Client-Cert-Subject-Alt-Name-Email +# +# To see a full list of attributes, run the server in debug mode +# with this virtual server configured, and look at the attributes +# passed in to this virtual server. + +server check-eap-tls { + + +# Authorize - this is the only section required. +# +# To accept the access request, set Auth-Type = Accept, otherwise +# set it to Reject. + +authorize { + if ("%{TLS-Client-Cert-Common-Name}" == "client.example.com") { + update config { + Auth-Type = Accept + } + } + else { + update config { + Auth-Type = Reject + } + update reply { + Reply-Message = "Your certificate is not valid." + } + } + +# if ("host/%{TLS-Client-Cert-Common-Name}" == "%{User-Name}") { +# update config { +# Auth-Type = Accept +# } +# } +# else { +# update config { +# Auth-Type = Reject +# } +# } + +} + + + +} + diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c index cbe61ad..2ffd6eb 100644 --- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c +++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c @@ -130,6 +130,8 @@ static CONF_PARSER module_config[] = { offsetof(EAP_TLS_CONF, check_cert_issuer), NULL, NULL}, { "make_cert_command", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, make_cert_command), NULL, NULL}, + { "virtual_server", PW_TYPE_STRING_PTR, + offsetof(EAP_TLS_CONF, virtual_server), NULL, NULL}, #if OPENSSL_VERSION_NUMBER >= 0x0090800fL #ifndef OPENSSL_NO_ECDH @@ -1611,6 +1613,7 @@ static int eaptls_authenticate(void *arg, EAP_HANDLER *handler) tls_session_t *tls_session = (tls_session_t *) handler->opaque; REQUEST *request = handler->request; eap_tls_t *inst = (eap_tls_t *) arg; + EAP_TLS_CONF *conf = inst->conf; RDEBUG2("Authenticate"); @@ -1619,9 +1622,73 @@ static int eaptls_authenticate(void *arg, EAP_HANDLER *handler) switch (status) { /* * EAP-TLS handshake was successful, return an - * EAP-TLS-Success packet here. + * EAP-TLS-Success packet here. If a virtual-server + * is configured, check that is happy, first. */ case EAPTLS_SUCCESS: + if (conf->virtual_server) { + VALUE_PAIR *vp; + VALUE_PAIR *copy; + REQUEST *fake; + + /* create a fake request, and copy current request vps in */ + fake = request_alloc_fake(request); + rad_assert(fake->packet->vps == NULL); + + vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ); + if (vp) { + pairadd(&fake->packet->vps, vp); + } + + for (vp = request->packet->vps; vp != NULL; vp = vp->next) { + if (pairfind(fake->packet->vps, vp->attribute)) { + continue; + } + copy = paircopy2(vp, vp->attribute); + pairadd(&fake->packet->vps, copy); + } + + /* copy the TLS verification vps in to the request */ + for (vp = handler->certs; vp != NULL; vp = vp->next) { + if (pairfind(fake->packet->vps, vp->attribute)) { + continue; + } + copy = paircopy2(vp, vp->attribute); + pairadd(&fake->packet->vps, copy); + } + + /* set the virtual server to use */ + if ((vp = pairfind(request->config_items, PW_VIRTUAL_SERVER)) != NULL) { + fake->server = vp->vp_strvalue; + } else { + fake->server = conf->virtual_server; + } + + RDEBUG("Processing EAP-TLS check:"); + debug_pair_list(fake->packet->vps); + + RDEBUG("server %s {", fake->server); + + rad_authenticate(fake); + + RDEBUG("} # server %s", fake->server); + + /* copy the reply vps back to our reply */ + pairadd(&request->reply->vps, fake->reply->vps); + fake->reply->vps = NULL; + + /* reject if virtual server didn't return accept */ + if (fake->reply->code != PW_AUTHENTICATION_ACK) { + RDEBUG2("EAP-TLS rejected by virtual server"); + request_free(&fake); + eaptls_fail(handler, 0); + return 0; + } + + request_free(&fake); + /* success */ + } + break; /* diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h index 34c917f..6840714 100644 --- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h +++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h @@ -71,6 +71,8 @@ typedef struct eap_tls_conf { char *verify_tmp_dir; char *verify_client_cert_cmd; + char *virtual_server; + #ifdef HAVE_OPENSSL_OCSP_H /* * OCSP Configuration -- 1.7.2.5 -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 10

Re: EAP-AKA patch not working on freeradius-1.1.4.Can any one give me the dictionary file to be used for EAP-AKA?
by Ming-Ching Tiew 10 Feb '12

10 Feb '12

--- On Thu, 2/9/12, mikeyiconoclast <shiva.tyson(a)gmail.com> wrote: > From: mikeyiconoclast <shiva.tyson(a)gmail.com> > Subject: Re: EAP-AKA patch not working on freeradius-1.1.4.Can > any one give me the dictionary file to be used for EAP-AKA? > To: "FreeRadius developers mailing list" <freeradius devel(a)lists.freeradius.org> > Date: Thursday, February 9, 2012, 5:47 PM > I have used the latest patch on 2.1.10.EAP-AKA patch is applied > successfully on freeradius 2.1.10. The patch does not work even if it applies cleanly. Somehow it simply says ACCESS-ACCEPT even without the full AKA exchange.

3 2

rlm_sql_log - directory creation
by Brian Candler 10 Feb '12

10 Feb '12

Attached is a small patch we use to rlm_sql_log to create (one level of) directories automatically. This is because we use sql_log { path = "${radacctdir}/%{%{NAS-IP-Address}:-0.0.0.1}/sql_%Y%m%d.acc" ... } and we don't want to have to remember to create new subdirectories whenever a new NAS comes online. Is this something which might be considered for a future version? Perhaps more generally, any module which writes files could have a flag which enables 'mkdir -p' type functionality? Regards, Brian.

2 2

EAP-AKA patch not working on freeradius-1.1.4.Can any one give me the dictionary file to be used for EAP-AKA?
by mikeyiconoclast 09 Feb '12

09 Feb '12

Hi All, This is with reference to the EAP-AKA patch on freeradius-1.1.4. (http://freeradius.1045715.n5.nabble.com/EAP-AKA-support-for-Freeradius-1-1-…) Modified eap.conf adding aka and sim. While starting the radiusd server,I got the following error message. /usr/local/etc/raddb/users[92]: Parse error (check) for entry akauser(a)domain.com: Unknown value AKA for attribute EAP-Type Regards shiva

2 2

TLS-*-Cert-Common-Name if no certificate subject - patch
by Matthew Newton 09 Feb '12

09 Feb '12

The client certificate on the device I'm testing with here has no Subject, and has a subjectAltName instead. This seems allowed (mandated? - the text is unclear to me) by RFC3280 s4.1.2.6. Correctly, the TLS-Client-Cert-Subject vp is _not_ added. Incorrectly, TLS-Client-Cert-Common-Name IS added, with the value of the common name from the issuer certificate. Below mini-patch only tries to add the common-name vp if it previously found a subject. Cheers, Matthew >From 921bd453c11697830b0d4871aa7aac51601a0ee5 Mon Sep 17 00:00:00 2001 From: Matthew Newton <mcn4(a)leicester.ac.uk> Date: Fri, 3 Feb 2012 13:33:26 +0000 Subject: [PATCH] rlm_eap_tls.c - only add TLS-*-Cert-Common-Name if there was a subject --- .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c index e548961..0132ae0 100644 --- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c +++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c @@ -636,12 +636,12 @@ static int cbtls_verify(int ok, X509_STORE_CTX *ctx) } /* - * Get the Common Name + * Get the Common Name, if there is a subject */ X509_NAME_get_text_by_NID(X509_get_subject_name(client_cert), NID_commonName, common_name, sizeof(common_name)); common_name[sizeof(common_name) - 1] = '\0'; - if ((lookup <= 1) && common_name[0] && (strlen(common_name) < MAX_STRING_LEN)) { + if ((lookup <= 1) && common_name[0] && subject[0] && (strlen(common_name) < MAX_STRING_LEN)) { pairadd(&handler->certs, pairmake(cert_attr_names[EAPTLS_CN][lookup], common_name, T_OP_SET)); } -- 1.7.2.5 -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

Need help on installing FR with postgresql.
by artaxerxe 02 Feb '12

02 Feb '12

Hello! I installed FR in my CentOS 6.2 from source. Doing a radtest on it, works good with files authentication. I try to change the authentication to sql mode, and I get the following error when I start FR: Thu Feb 2 11:30:36 2012 : Error: Could not link driver rlm_sql_postgresql: rlm_sql_postgresql.so: cannot open shared object file: No such file or directory Thu Feb 2 11:30:36 2012 : Error: Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Thu Feb 2 11:30:36 2012 : Error: /netnfork/radius-server//etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Thu Feb 2 11:30:36 2012 : Error: /netnfork/radius-server//etc/raddb/sites-enabled/default[177]: Failed to load module "sql". Thu Feb 2 11:30:36 2012 : Error: /netnfork/radius-server//etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. When I installed the FR, I put a --prefix=/my/path to the ./configure command. The resulted warnings, that are related to my problem, are: ... configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. ... I want to use FR with postgresql, and I have postgresql installed on my system, and also the FR database is already well done. (I know that because I have a FR installation under the default location. I installed it via yum, and it works good). So, can anybody explain me how to resolve my issue? I tried to install libpq-fe.h, but I didn't find it. I also tried to run the following: # ./configure --prefix=/my/path/ --with-postgresql-include-dir=/usr/pgsql-9.1/lib/ | grep -i WARNING but with the same WARNING. Can anybody help me on this? Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-on-installing-FR-with-pos… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 7

How to install freeradius with postgresql from source?
by artaxerxe 02 Feb '12

02 Feb '12

Hello! I'm trying to install FR under a specific directory (specifying --prefix=/path/to/my/dir option for ./configure command). I want that this FR installation to work with postgresql. Can anybody explain me how to get this working? Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-install-freeradius-with-post… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

How to install freeradius-postgresql and freeradius-utils from source.
by artaxerxe 02 Feb '12

02 Feb '12

Hello! I installed freeradius 2.1.10 on my centos 6.2 from source. But I need to install the freeradius-postgresql and freeradius-utils also from source. Can anybody give me some hints on how to achieve this? Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-install-freeradius-postgresq… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

CHAP in freeradius-client
by giusva 02 Feb '12

02 Feb '12

Hi, I noticed that the case PW_CHAP_PASSWORD is disabled in sendserver.c:rc_pack_list(), any idea what state CHAP support is in (and if/what needs fixing)? Thanks, Giuseppe -- View this message in context: http://freeradius.1045715.n5.nabble.com/CHAP-in-freeradius-client-tp5448550… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

Test failure after I installed successfully freeradius
by artaxerxe 01 Feb '12

01 Feb '12

Hello! I installed FreeRADIUS 2.1.10 on CentOS 6.2 via yum. The problem is that when I try to make a test, I get the following message: # radtest "John Doe" hello 127.0.0.1 0 radiussecret radclient:: Failed to find IP address for artaxerxe radclient: Nothing to send. artaxerxe is my hostname. So, can anybody explain me why it doesn't work? Thanks! N.B. the /etc/raddb/users file: ... "John Doe" Auth-Type := Local, User-Password == "hello" Reply-Message = "Hello, %{User-Name}" ... When I run radius in debug mode: # radiusd -XXX Wed Feb 1 13:58:13 2012 : Info: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jul 19 2011 at 10:16:18 Wed Feb 1 13:58:13 2012 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Wed Feb 1 13:58:13 2012 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Feb 1 13:58:13 2012 : Info: PARTICULAR PURPOSE. Wed Feb 1 13:58:13 2012 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Feb 1 13:58:13 2012 : Info: GNU General Public License v2. Wed Feb 1 13:58:13 2012 : Info: Starting - reading configuration files ... Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/radiusd.conf Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/proxy.conf Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/clients.conf Wed Feb 1 13:58:13 2012 : Debug: including files in directory /etc/raddb/modules/ Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/chap Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/always Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/acct_unique Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/logintime Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/cui Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/perl Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/expiration Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/detail.example.com Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/detail.log Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/realm Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/sql_log Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/pam Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/etc_group Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/sqlcounter_expire_on_login Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/inner-eap Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/detail Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/files Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/echo Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/dynamic_clients Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/attr_filter Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/unix Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/radutmp Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/smsotp Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/policy Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/wimax Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/expr Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/preprocess Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/counter Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/checkval Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/sradutmp Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/digest Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/exec Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/otp Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/mac2ip Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/opendirectory Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/mac2vlan Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/attr_rewrite Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/smbpasswd Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/pap Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/mschap Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/linelog Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/ippool Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/ntlm_auth Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/modules/passwd Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/eap.conf Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/policy.conf Wed Feb 1 13:58:13 2012 : Debug: including files in directory /etc/raddb/sites-enabled/ Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/sites-enabled/inner-tunnel Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/sites-enabled/control-socket Wed Feb 1 13:58:13 2012 : Debug: including configuration file /etc/raddb/sites-enabled/default Wed Feb 1 13:58:13 2012 : Debug: main { Wed Feb 1 13:58:13 2012 : Debug: user = "radiusd" Wed Feb 1 13:58:13 2012 : Debug: group = "radiusd" Wed Feb 1 13:58:13 2012 : Debug: allow_core_dumps = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: including dictionary file /etc/raddb/dictionary Wed Feb 1 13:58:13 2012 : Debug: main { Wed Feb 1 13:58:13 2012 : Debug: prefix = "/usr" Wed Feb 1 13:58:13 2012 : Debug: localstatedir = "/var" Wed Feb 1 13:58:13 2012 : Debug: logdir = "/var/log/radius" Wed Feb 1 13:58:13 2012 : Debug: libdir = "/usr/lib/freeradius" Wed Feb 1 13:58:13 2012 : Debug: radacctdir = "/var/log/radius/radacct" Wed Feb 1 13:58:13 2012 : Debug: hostname_lookups = no Wed Feb 1 13:58:13 2012 : Debug: max_request_time = 30 Wed Feb 1 13:58:13 2012 : Debug: cleanup_delay = 5 Wed Feb 1 13:58:13 2012 : Debug: max_requests = 1024 Wed Feb 1 13:58:13 2012 : Debug: pidfile = "/var/run/radiusd/radiusd.pid" Wed Feb 1 13:58:13 2012 : Debug: checkrad = "/usr/sbin/checkrad" Wed Feb 1 13:58:13 2012 : Debug: debug_level = 0 Wed Feb 1 13:58:13 2012 : Debug: proxy_requests = yes Wed Feb 1 13:58:13 2012 : Debug: log { Wed Feb 1 13:58:13 2012 : Debug: stripped_names = no Wed Feb 1 13:58:13 2012 : Debug: auth = no Wed Feb 1 13:58:13 2012 : Debug: auth_badpass = no Wed Feb 1 13:58:13 2012 : Debug: auth_goodpass = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: security { Wed Feb 1 13:58:13 2012 : Debug: max_attributes = 200 Wed Feb 1 13:58:13 2012 : Debug: reject_delay = 1 Wed Feb 1 13:58:13 2012 : Debug: status_server = yes Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed Feb 1 13:58:13 2012 : Debug: proxy server { Wed Feb 1 13:58:13 2012 : Debug: retry_delay = 5 Wed Feb 1 13:58:13 2012 : Debug: retry_count = 3 Wed Feb 1 13:58:13 2012 : Debug: default_fallback = no Wed Feb 1 13:58:13 2012 : Debug: dead_time = 120 Wed Feb 1 13:58:13 2012 : Debug: wake_all_if_all_dead = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: home_server localhost { Wed Feb 1 13:58:13 2012 : Debug: ipaddr = 127.0.0.1 Wed Feb 1 13:58:13 2012 : Debug: port = 1812 Wed Feb 1 13:58:13 2012 : Debug: type = "auth" Wed Feb 1 13:58:13 2012 : Debug: secret = "testing123" Wed Feb 1 13:58:13 2012 : Debug: response_window = 20 Wed Feb 1 13:58:13 2012 : Debug: max_outstanding = 65536 Wed Feb 1 13:58:13 2012 : Debug: require_message_authenticator = yes Wed Feb 1 13:58:13 2012 : Debug: zombie_period = 40 Wed Feb 1 13:58:13 2012 : Debug: status_check = "status-server" Wed Feb 1 13:58:13 2012 : Debug: ping_interval = 30 Wed Feb 1 13:58:13 2012 : Debug: check_interval = 30 Wed Feb 1 13:58:13 2012 : Debug: num_answers_to_alive = 3 Wed Feb 1 13:58:13 2012 : Debug: num_pings_to_alive = 3 Wed Feb 1 13:58:13 2012 : Debug: revive_interval = 120 Wed Feb 1 13:58:13 2012 : Debug: status_check_timeout = 4 Wed Feb 1 13:58:13 2012 : Debug: irt = 2 Wed Feb 1 13:58:13 2012 : Debug: mrt = 16 Wed Feb 1 13:58:13 2012 : Debug: mrc = 5 Wed Feb 1 13:58:13 2012 : Debug: mrd = 30 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: home_server_pool my_auth_failover { Wed Feb 1 13:58:13 2012 : Debug: type = fail-over Wed Feb 1 13:58:13 2012 : Debug: home_server = localhost Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: realm example.com { Wed Feb 1 13:58:13 2012 : Debug: auth_pool = my_auth_failover Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: realm LOCAL { Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: radiusd: #### Loading Clients #### Wed Feb 1 13:58:13 2012 : Debug: client localhost { Wed Feb 1 13:58:13 2012 : Debug: ipaddr = 127.0.0.1 Wed Feb 1 13:58:13 2012 : Debug: require_message_authenticator = no Wed Feb 1 13:58:13 2012 : Debug: secret = "radiussomething" Wed Feb 1 13:58:13 2012 : Debug: nastype = "other" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: radiusd: #### Instantiating modules #### Wed Feb 1 13:58:13 2012 : Debug: instantiate { Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_exec Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "exec" from file /etc/raddb/modules/exec Wed Feb 1 13:58:13 2012 : Debug: exec { Wed Feb 1 13:58:13 2012 : Debug: wait = no Wed Feb 1 13:58:13 2012 : Debug: input_pairs = "request" Wed Feb 1 13:58:13 2012 : Debug: shell_escape = yes Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_expr, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_expr Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "expr" from file /etc/raddb/modules/expr Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_expiration Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration Wed Feb 1 13:58:13 2012 : Debug: expiration { Wed Feb 1 13:58:13 2012 : Debug: reply-message = "Password Has Expired " Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_logintime Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime Wed Feb 1 13:58:13 2012 : Debug: logintime { Wed Feb 1 13:58:13 2012 : Debug: reply-message = "You are calling outside your allowed timespan " Wed Feb 1 13:58:13 2012 : Debug: minimum-timeout = 60 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: radiusd: #### Loading Virtual Servers #### Wed Feb 1 13:58:13 2012 : Debug: server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel Wed Feb 1 13:58:13 2012 : Debug: modules { Wed Feb 1 13:58:13 2012 : Debug: Module: Checking authenticate {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_pap, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_pap Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "pap" from file /etc/raddb/modules/pap Wed Feb 1 13:58:13 2012 : Debug: pap { Wed Feb 1 13:58:13 2012 : Debug: encryption_scheme = "auto" Wed Feb 1 13:58:13 2012 : Debug: auto_header = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_chap, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_chap Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "chap" from file /etc/raddb/modules/chap Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_mschap Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap Wed Feb 1 13:58:13 2012 : Debug: mschap { Wed Feb 1 13:58:13 2012 : Debug: use_mppe = yes Wed Feb 1 13:58:13 2012 : Debug: require_encryption = no Wed Feb 1 13:58:13 2012 : Debug: require_strong = no Wed Feb 1 13:58:13 2012 : Debug: with_ntdomain_hack = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_unix, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_unix Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "unix" from file /etc/raddb/modules/unix Wed Feb 1 13:58:13 2012 : Debug: unix { Wed Feb 1 13:58:13 2012 : Debug: radwtmp = "/var/log/radius/radwtmp" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_eap, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_eap Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "eap" from file /etc/raddb/eap.conf Wed Feb 1 13:58:13 2012 : Debug: eap { Wed Feb 1 13:58:13 2012 : Debug: default_eap_type = "md5" Wed Feb 1 13:58:13 2012 : Debug: timer_expire = 60 Wed Feb 1 13:58:13 2012 : Debug: ignore_unknown_eap_types = no Wed Feb 1 13:58:13 2012 : Debug: cisco_accounting_username_bug = no Wed Feb 1 13:58:13 2012 : Debug: max_sessions = 4096 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-md5 Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_leap Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-leap Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-gtc Wed Feb 1 13:58:13 2012 : Debug: gtc { Wed Feb 1 13:58:13 2012 : Debug: challenge = "Password: " Wed Feb 1 13:58:13 2012 : Debug: auth_type = "PAP" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_tls Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-tls Wed Feb 1 13:58:13 2012 : Debug: tls { Wed Feb 1 13:58:13 2012 : Debug: rsa_key_exchange = no Wed Feb 1 13:58:13 2012 : Debug: dh_key_exchange = yes Wed Feb 1 13:58:13 2012 : Debug: rsa_key_length = 512 Wed Feb 1 13:58:13 2012 : Debug: dh_key_length = 512 Wed Feb 1 13:58:13 2012 : Debug: verify_depth = 0 Wed Feb 1 13:58:13 2012 : Debug: CA_path = "/etc/raddb/certs" Wed Feb 1 13:58:13 2012 : Debug: pem_file_type = yes Wed Feb 1 13:58:13 2012 : Debug: private_key_file = "/etc/raddb/certs/server.pem" Wed Feb 1 13:58:13 2012 : Debug: certificate_file = "/etc/raddb/certs/server.pem" Wed Feb 1 13:58:13 2012 : Debug: CA_file = "/etc/raddb/certs/ca.pem" Wed Feb 1 13:58:13 2012 : Debug: private_key_password = "whatever" Wed Feb 1 13:58:13 2012 : Debug: dh_file = "/etc/raddb/certs/dh" Wed Feb 1 13:58:13 2012 : Debug: random_file = "/etc/raddb/certs/random" Wed Feb 1 13:58:13 2012 : Debug: fragment_size = 1024 Wed Feb 1 13:58:13 2012 : Debug: include_length = yes Wed Feb 1 13:58:13 2012 : Debug: check_crl = no Wed Feb 1 13:58:13 2012 : Debug: cipher_list = "DEFAULT" Wed Feb 1 13:58:13 2012 : Debug: cache { Wed Feb 1 13:58:13 2012 : Debug: enable = no Wed Feb 1 13:58:13 2012 : Debug: lifetime = 24 Wed Feb 1 13:58:13 2012 : Debug: max_entries = 255 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: verify { Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_ttls Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-ttls Wed Feb 1 13:58:13 2012 : Debug: ttls { Wed Feb 1 13:58:13 2012 : Debug: default_eap_type = "md5" Wed Feb 1 13:58:13 2012 : Debug: copy_request_to_tunnel = no Wed Feb 1 13:58:13 2012 : Debug: use_tunneled_reply = no Wed Feb 1 13:58:13 2012 : Debug: virtual_server = "inner-tunnel" Wed Feb 1 13:58:13 2012 : Debug: include_length = yes Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_peap Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-peap Wed Feb 1 13:58:13 2012 : Debug: peap { Wed Feb 1 13:58:13 2012 : Debug: default_eap_type = "mschapv2" Wed Feb 1 13:58:13 2012 : Debug: copy_request_to_tunnel = no Wed Feb 1 13:58:13 2012 : Debug: use_tunneled_reply = no Wed Feb 1 13:58:13 2012 : Debug: proxy_tunneled_request_as_eap = yes Wed Feb 1 13:58:13 2012 : Debug: virtual_server = "inner-tunnel" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating eap-mschapv2 Wed Feb 1 13:58:13 2012 : Debug: mschapv2 { Wed Feb 1 13:58:13 2012 : Debug: with_ntdomain_hack = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Checking authorize {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_realm, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_realm Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "suffix" from file /etc/raddb/modules/realm Wed Feb 1 13:58:13 2012 : Debug: realm suffix { Wed Feb 1 13:58:13 2012 : Debug: format = "suffix" Wed Feb 1 13:58:13 2012 : Debug: delimiter = "@" Wed Feb 1 13:58:13 2012 : Debug: ignore_default = no Wed Feb 1 13:58:13 2012 : Debug: ignore_null = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_files, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_files Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "files" from file /etc/raddb/modules/files Wed Feb 1 13:58:13 2012 : Debug: files { Wed Feb 1 13:58:13 2012 : Debug: usersfile = "/etc/raddb/users" Wed Feb 1 13:58:13 2012 : Debug: acctusersfile = "/etc/raddb/acct_users" Wed Feb 1 13:58:13 2012 : Debug: preproxy_usersfile = "/etc/raddb/preproxy_users" Wed Feb 1 13:58:13 2012 : Debug: compat = "no" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Checking session {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_radutmp Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp Wed Feb 1 13:58:13 2012 : Debug: radutmp { Wed Feb 1 13:58:13 2012 : Debug: filename = "/var/log/radius/radutmp" Wed Feb 1 13:58:13 2012 : Debug: username = "%{User-Name}" Wed Feb 1 13:58:13 2012 : Debug: case_sensitive = yes Wed Feb 1 13:58:13 2012 : Debug: check_with_nas = yes Wed Feb 1 13:58:13 2012 : Debug: perm = 384 Wed Feb 1 13:58:13 2012 : Debug: callerid = yes Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: Module: Checking post-auth {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_attr_filter Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter Wed Feb 1 13:58:13 2012 : Debug: attr_filter attr_filter.access_reject { Wed Feb 1 13:58:13 2012 : Debug: attrsfile = "/etc/raddb/attrs.access_reject" Wed Feb 1 13:58:13 2012 : Debug: key = "%{User-Name}" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: } # modules Wed Feb 1 13:58:13 2012 : Debug: } # server Wed Feb 1 13:58:13 2012 : Debug: server { # from file /etc/raddb/radiusd.conf Wed Feb 1 13:58:13 2012 : Debug: modules { Wed Feb 1 13:58:13 2012 : Debug: Module: Checking authenticate {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_digest, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_digest Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "digest" from file /etc/raddb/modules/digest Wed Feb 1 13:58:13 2012 : Debug: Module: Checking authorize {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_preprocess, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_preprocess Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess Wed Feb 1 13:58:13 2012 : Debug: preprocess { Wed Feb 1 13:58:13 2012 : Debug: huntgroups = "/etc/raddb/huntgroups" Wed Feb 1 13:58:13 2012 : Debug: hints = "/etc/raddb/hints" Wed Feb 1 13:58:13 2012 : Debug: with_ascend_hack = no Wed Feb 1 13:58:13 2012 : Debug: ascend_channels_per_line = 23 Wed Feb 1 13:58:13 2012 : Debug: with_ntdomain_hack = no Wed Feb 1 13:58:13 2012 : Debug: with_specialix_jetstream_hack = no Wed Feb 1 13:58:13 2012 : Debug: with_cisco_vsa_hack = no Wed Feb 1 13:58:13 2012 : Debug: with_alvarion_vsa_hack = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Checking preacct {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_acct_unique Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique Wed Feb 1 13:58:13 2012 : Debug: acct_unique { Wed Feb 1 13:58:13 2012 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Checking accounting {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: (Loaded rlm_detail, checking if it's valid) Wed Feb 1 13:58:13 2012 : Debug: Module: Linked to module rlm_detail Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "detail" from file /etc/raddb/modules/detail Wed Feb 1 13:58:13 2012 : Debug: detail { Wed Feb 1 13:58:13 2012 : Debug: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Wed Feb 1 13:58:13 2012 : Debug: header = "%t" Wed Feb 1 13:58:13 2012 : Debug: detailperm = 384 Wed Feb 1 13:58:13 2012 : Debug: dirperm = 493 Wed Feb 1 13:58:13 2012 : Debug: locking = no Wed Feb 1 13:58:13 2012 : Debug: log_packet_header = no Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter Wed Feb 1 13:58:13 2012 : Debug: attr_filter attr_filter.accounting_response { Wed Feb 1 13:58:13 2012 : Debug: attrsfile = "/etc/raddb/attrs.accounting_response" Wed Feb 1 13:58:13 2012 : Debug: key = "%{User-Name}" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Module: Checking session {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: Module: Checking post-auth {...} for more modules to load Wed Feb 1 13:58:13 2012 : Debug: } # modules Wed Feb 1 13:58:13 2012 : Debug: } # server Wed Feb 1 13:58:13 2012 : Debug: radiusd: #### Opening IP addresses and Ports #### Wed Feb 1 13:58:13 2012 : Debug: listen { Wed Feb 1 13:58:13 2012 : Debug: type = "auth" Wed Feb 1 13:58:13 2012 : Debug: ipaddr = * Wed Feb 1 13:58:13 2012 : Debug: port = 0 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: listen { Wed Feb 1 13:58:13 2012 : Debug: type = "acct" Wed Feb 1 13:58:13 2012 : Debug: ipaddr = * Wed Feb 1 13:58:13 2012 : Debug: port = 0 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: listen { Wed Feb 1 13:58:13 2012 : Debug: type = "control" Wed Feb 1 13:58:13 2012 : Debug: listen { Wed Feb 1 13:58:13 2012 : Debug: socket = "/var/run/radiusd/radiusd.sock" Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: listen { Wed Feb 1 13:58:13 2012 : Debug: type = "auth" Wed Feb 1 13:58:13 2012 : Debug: ipaddr = 127.0.0.1 Wed Feb 1 13:58:13 2012 : Debug: port = 18120 Wed Feb 1 13:58:13 2012 : Debug: } Wed Feb 1 13:58:13 2012 : Debug: Listening on authentication address * port 1812 Wed Feb 1 13:58:13 2012 : Debug: Listening on accounting address * port 1813 Wed Feb 1 13:58:13 2012 : Debug: Listening on command file /var/run/radiusd/radiusd.sock Wed Feb 1 13:58:13 2012 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Wed Feb 1 13:58:13 2012 : Debug: Listening on proxy address * port 1814 Wed Feb 1 13:58:13 2012 : Info: Ready to process requests. So, can anybody explain me why it doesn't work? Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Test-failure-after-I-installed-succ… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1