March 2006 - Freeradius-Users - lists.freeradius.org

VLAN and SSID
by Antonio Matera 03 Apr '06

03 Apr '06

Hallo, I have a problem with the authentication on different VLAN. I write for you my example: I have two VLAN (VLAN1 and VLAN2) conneccted to two SSID (SSID1 and SSID2) on my Cisco 1200 AP. I have the same authentication on both connection (EAP-TLS). In my users file I have two user: user1 Auth-Type := EAP Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN the authentication works fine but , for example, if I connect the WinXP client on the SSID1 with the certificate user of the VLAN2, I have this situation: The client is connected to the VLAN2 but the SSID of the wireless connection is SSID1. It is possible to prevent the connection to the select SSID if the certificate of the user is incorrect? Thanks, bye

4 12

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 01 Apr '06

01 Apr '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > I was wondering if someone has any idea of how to solve the problem of > special characters(e.g. $) in FreeRadius 1.1.0. Have you tried FreeRADIUS 1.1. which was released last week? According to the ChangeLog the bug #261 has been fixed and it was the "attributes retreived from ldap are truncated at first space" bug, which sounded very similar to our problem: http://bugs.freeradius.org/show_bug.cgi?id=261 -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 7

RE: Version 1.1.1 stops responding
by King, Michael 31 Mar '06

31 Mar '06

I'm running it in debug mode (and piping it to a file) Freeradius -X -A >crash.log After a few hours this is what I got. On the command line. rad2:/home/mking# /usr/sbin/freeradius -X -A >crash.log Killed rad2:/home/mking# The last few lines from the log file are rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello And that's it? Unfortunatly, I deleted the log file by mistake. (I really should drink my coffee before typing) I'm attempting to recreate it now. It shouldn't be long, (I hope)

4 4

Radrelay and detail file permissions
by Ben Plimpton 31 Mar '06

31 Mar '06

I have setup radius to log detail files for radrelay to use. I think that I followed the documentation exactly except for the name of the detail file. detail detail-combined { detailfile = ${radacctdir}/detail-combined detailperm = 0600 dirperm = 0755 locking = yes } accounting { detail detail-combined } FreeRadius logs to this file properly if I don't startup radrelay and the permissions remain as I would expect they should: -rw------- 1 radiusd radiusd 1166 Mar 31 12:02 detail-combined But when I start radrelay the permissions change: [root@ns1-new radacct]# radrelay -a /var/log/radius/radacct \ -d /etc/raddb -n ns2-new detail-combined [root@ns1-new radacct]# ls -la total 44 drwx------ 9 radiusd radiusd 4096 Mar 31 12:08 . drwx------ 3 radiusd radiusd 4096 Mar 31 12:02 .. drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 11:42 127.0.0.1 drwxr-xr-x 2 radiusd radiusd 4096 Mar 17 16:17 216.17.128.39 drwxr-xr-x 2 radiusd radiusd 4096 Feb 7 00:30 216.237.65.2 drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 00:00 216.237.67.198 drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 09:34 216.237.67.217 drwxr-xr-x 2 radiusd radiusd 4096 Feb 14 09:49 216.237.72.66 drwxr-xr-x 2 radiusd radiusd 4096 Mar 31 10:39 216.237.77.3 -rw------- 1 root root 0 Mar 31 12:08 detail-combined [root@ns1-new radacct]# I start getting error like this in my radius.log which I would expect with the file permissions the way they are and radiusd cannot log to the detail file properly and as a result, radrelay cannot send the accounting request to the remote server: Fri Mar 31 12:11:13 2006 : Error: rlm_detail: Couldn't open file /var/log/radius/radacct/detail-combined: Permission denied Am I missing something with the way I am starting up radrelay? Or are there permissions that I need to check somewhere else? Should radrelay be run as user radiusd? If so, how would I do that? Also. My system is running Fedora Core 4 - FreeRadius Ver 1.0.4 Any help is greatly appreciated. Thanks -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

2 1

We need help
by Sam Sein Muan Tie 31 Mar '06

31 Mar '06

dear all, we, well shoudnt say we, i got stucked to this project of building a radius server for stopping some user NFS mount from MAC/IP spoofing on linux . We are hoping for wired dot1.x for radius server. [root@radius-server raddb]# rpm -qa |grep freeradius freeradius-mysql-1.0.4-1.FC4.1 freeradius-1.0.4-1.FC4.1 freeradius-postgresql-1.0.4-1.FC4.1 freeradius-unixODBC-1.0.4-1.FC4.1 we have a cisco 2950 switch running linux's freeradius, the clients will be linux box and windows box i actually got it to work before on Redhat Linux Enterprise 3 but then it doenst work anymore .. i m using a certificate to authenticate to radius server, eap/ttls Got it to work before then copy the config to different server, it doenst work anymore. I m using pk12 for windows keys, i also got the pk12 to work on linux's xsupplicant. [root@radius-server raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/raddb" main: libdir = "/usr/local/lib" main: radacctdir = "/etc/raddb" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = yes main: log_stripped_names = yes main: log_file = "/var/log/raddb/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/raddb/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/etc/raddb/certs" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/masterkeys/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/masterkeys/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/masterkeys/cacert.pem" tls: private_key_password = "******" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/etc/raddb/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 130.95.x.25:1812, id=6, length=147 NAS-IP-Address = 130.95.x.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE Client" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501686f73742f4353534520436c69656e74 Message-Authenticator = 0xe66215ebe693583af7e7a74ffef7d4cb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: EAP packet type response id 0 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 6 to 130.95.x.25:1812 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x468e8ff532b828abe82e074e9954e6fc Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.95.x.25:1812, id=7, length=224 NAS-IP-Address = 130.95.x.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE Client" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 State = 0x468e8ff532b828abe82e074e9954e6fc EAP-Message = 0x020100500d800000004616030100410100003d0301442c9afc9dea1262e7e0a4de122b8f69 c8a00c354a7c7b670e3991cbb65396c500001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x63a3a87e538a38b1ef9782fd0f6cb826 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02cb], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a9], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 7 to 130.95.x.25:1812 EAP-Message = 0x010203d70d80000003cd160301004a020000460301442c9accea2351dd63f780655aaa8056 5a0f88362ecfadcc5fb500a4a21c70212042be4fa4618018294a134f8019f92b218025b2e45c eeae8604cff81ad1312ea100040016030102cb0b0002c70002c40002c1308202bd30820226a0 03020102020101300d06092a864886f70d0101040500308197310b3009060355040613024155 310b3009060355040813025741310e300c060355040713055045525448310c300a060355040a 1303555741310d300b060355040b130443535345312630240603550403131d7261646975732d 7365727665722e637373652e7577612e6564752e617531263024 EAP-Message = 0x06092a864886f70d0109011617737570706f727440637373652e7577612e6564752e617530 1e170d3036303333303037353832385a170d3037303333303037353832385a308197310b3009 060355040613024155310b3009060355040813025741310e300c060355040713055045525448 310c300a060355040a1303555741310d300b060355040b130443535345312630240603550403 131d7261646975732d7365727665722e637373652e7577612e6564752e61753126302406092a 864886f70d0109011617737570706f727440637373652e7577612e6564752e617530819f300d 06092a864886f70d010101050003818d00308189028181009eed EAP-Message = 0x0d14ac1f27a76de23f02b065887b6e10f8122a3516a023db9bf070de3782f2979c674ce799 6ffa4a49c8d0dbd29a49a1e534da62ba535b8d245262e18852192fbb376464776f8e3f3afe23 c2e8d432bd00f73281b296293da081080d58901a9d3daacac45ec8e83be3485044054d8b1444 5751cf5c497523c0f322d14b7f0203010001a317301530130603551d25040c300a06082b0601 0505070301300d06092a864886f70d010104050003818100d5d6082cabbbe853812b0395b4f0 b589ff7e7bd6e2be72f7d5684027a4fb9354a293c3a2963f77689b1bb55c7d39c8d6d85f18d5 fba53bb6f47299c5d4c3cca09d2bf5ac7b1d6c23469f4b586829 EAP-Message = 0xbe08cd401b76724fb6c95da6ea38d1207711de4241c30db480d766dbea06c9549bccb10e77 c9841f4249e021c71b23ac21ff16030100a90d0000a1020102009c009a308197310b30090603 55040613024155310b3009060355040813025741310e300c060355040713055045525448310c 300a060355040a1303555741310d300b060355040b130443535345312630240603550403131d 7261646975732d7365727665722e637373652e7577612e6564752e61753126302406092a8648 86f70d0109011617737570706f727440637373652e7577612e6564752e61750e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbea1a78423928831b0f8befbe6e01f2b Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 130.95.x.25:1812, id=8, length=150 NAS-IP-Address = 130.95.x.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE Client" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 State = 0xbea1a78423928831b0f8befbe6e01f2b EAP-Message = 0x020200060d00 Message-Authenticator = 0x9c6a5c72722c135212a282ae89f03a58 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 8 to 130.95.x.25:1812 EAP-Message = 0x0103000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29148f4232b7bd94658abe9cb6bd0933 Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 6 with timestamp 442c9acc Cleaning up request 1 ID 7 with timestamp 442c9acc Cleaning up request 2 ID 8 with timestamp 442c9acc Nothing to do. Sleeping until we see a request. Many thanks in advance Sam Tie

2 1

Freeradius log
by fvt3 31 Mar '06

31 Mar '06

Hi, I'm getting this error in my log, Error: rlm_sql: The 'op' field for attribute 'password = ' is NULL, or non-existent. Wed Mar 29 11:43:34 2006 : Error: rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect. Wed Mar 29 11:43:39 2006 : Error: Invalid operator for item Password: reverting to '==' Anyone know what it is and how to resolve it ? I'm still able to authenticate while the log is giving me this error message ... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3

openssl/des.h error
by Christoforos Ntantogian 31 Mar '06

31 Mar '06

Hello, I was trying to install freeradius 1.0.1 but i failed. The x99.h file contains the line : include<openssl/des.h> and unfortunately there is no such a file and the compilation stops with error. I have suse linux 7.2 and it has openssl.exe but i cant find anywhere the des.h file. Note that the new freeradius 1.1.0 and 1.1.1 doesnt include the x99.h file neither its folder that contains it (rlm_x99_token) and i managed to install these newer versions. However, i have to install the older version. Any suggestions... Thank you chris

2 1

Problem with FreeRadius EAP/TLS and 3com OfficeConnect Wireless AP
by Eugenio Pasquariello 31 Mar '06

31 Mar '06

Hi, we have installed freeradius in conjunction with a 3com OfficeConnect Wireless AP, with WPA encryption. Our system is a Slackware Linux with kernel ver. 2.4.28. The 3Com OfficeConnect Wireless 11g Access Point model is 3CRWE454G72. We've installed the version 1.1.1 of Freeradius, and we used openssl to create the certificates for the server and the clients. We tried different configuration, read faq, discussion groups etc., but the system fails. The client start the EAP transaction, start TLS and receive the server certifcate, we have used WinXp as client and then WIN requests to the user the client certificate. After the choice of the certificate, the client remain blocked. Here we have posted the radius debug output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.254:3544, id=142, length=93 User-Name = "Roberto" NAS-IP-Address = 192.168.1.254 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x028e000c01526f626572746f Message-Authenticator = 0xb55a7cf8add654a3a2f627a983584a26 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Roberto", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 142 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry Roberto at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 142 to 192.168.1.254 port 3544 EAP-Message = 0x018f00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd31f2f5f5f870497aa396155166ca8fa Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.254:3545, id=143, length=179 User-Name = "Roberto" NAS-IP-Address = 192.168.1.254 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0xd31f2f5f5f870497aa396155166ca8fa EAP-Message = 0x028f00500d800000004616030100410100003d0301442baf2655b72d4ab025b2d05ef8360e73f8ab6bf8fae204c1d19927387adafc00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xe91e302630229d5e42eab44b6622c911 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "Roberto", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 143 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry Roberto at line 216 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 027f], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 007f], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 143 to 192.168.1.254 port 3545 EAP-Message = 0x019003610d8000000357160301004a020000460301442b8e5b6233434e31e800ab8a715ae577fa51d24f619d7ae5319bda5caa03c220ad755d37d34c5c822ea79225b05c557391c03a273ebc10acaaab6c0dfa976b0b000400160301027f0b00027b00027800027530820271308201daa003020102020900aa4ba0044b60a2cb300d06092a864886f70d0101040500306e310b3009060355040613024954310c300a060355040813036d6974310c300a060355040713036d6974310c300a060355040a13036d6974310c300a060355040b13036d6974310c300a060355040313036d69743119301706092a864886f70d010901160a6d6974406d69742e EAP-Message = 0x6974301e170d3036303332383038313430375a170d3037303332383038313430375a306e310b3009060355040613024954310c300a060355040813036d6974310c300a060355040713036d6974310c300a060355040a13036d6974310c300a060355040b13036d6974310c300a060355040313036d69743119301706092a864886f70d010901160a6d6974406d69742e697430819f300d06092a864886f70d010101050003818d0030818902818100d0b8d6c7706f408c87fe35a34030d908520460b43cd34fdfde0566b9e75602f45f65b30846e8a7d5ca2ff3237fc916c2c40b726de40ca004ea68bf6d3d1f106ed4584ea7f5d80fcbca7379059323 EAP-Message = 0x9a1a72a34b33d5b0cec0624543558c46e2b216e16ce47770465d55dcd9500cf70eb59f4ba70c7da4d2a7dea55419e700aa0d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810046fb8261e93111d30d2b1f794ef922d114f67a16eaef27c054589d013b37de7508ddcc26580852bcdfdd688ebf664f4e5fa04d2e45686268e1585556c57d70bbb17255d7d0dee55e8cdf20dd86850c9cc8b3c08ace49e46728e13c71641b78e1e8ab24b88401d1e04e574a07b272692f8ae0290e9178c8507f65296f03418435160301007f0d00007702010200720070306e310b300906035504 EAP-Message = 0x0613024954310c300a060355040813036d6974310c300a060355040713036d6974310c300a060355040a13036d6974310c300a060355040b13036d6974310c300a060355040313036d69743119301706092a864886f70d010901160a6d6974406d69742e69740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc317b1f0947b3868a6ce76d9107a6308 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.254:3546, id=144, length=105 User-Name = "Roberto" NAS-IP-Address = 192.168.1.254 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0xc317b1f0947b3868a6ce76d9107a6308 EAP-Message = 0x029000060d00 Message-Authenticator = 0x80e0d9154111b75e2f24f084b9bd4d6a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "Roberto", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 144 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry Roberto at line 216 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 144 to 192.168.1.254 port 3546 EAP-Message = 0x0191000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x75ac3a428d93b0ba22431963a01bd5fd Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 142 with timestamp 442b8e5b Cleaning up request 1 ID 143 with timestamp 442b8e5b Cleaning up request 2 ID 144 with timestamp 442b8e5b Nothing to do. Sleeping until we see a request. Have you some idea on how can we solve the problem? thanks for any support

2 2

multiple attribute instaces and radius variables (xlat)
by Andriy Gapon 31 Mar '06

31 Mar '06

FreeRAIUS documentation in 1.1.1 mentions a possibility of referencing specific AVPs in case of multiple instances of an attribute (%{Attr-Name[N]}). This is quite useful (and a nice addition!), but it doesn't seem to cover some situations (especially related to logging/accounting) where number of attribute instances is not known in advance. Is it possible to add something like %{Attr-Name[*]} that would expand to all values of an attribute and something like %{Attr-Name[#]} that would expand to number of attribute instances ? The toughest part of the above suggestion is which delimiter to use in case of [*] and if it is possible to make that delimiter configurable. -- Andriy Gapon

2 2

frontend for freeradius???
by Olaf Schäfer 31 Mar '06

31 Mar '06

@Guy Fraser Hi, I read that you've been working 'on some PHP functions to manage FreeRadius'. I'm goning to do some efforts in the same direction: extending dialup admin with managing abilities for ip-pools, simultaneous-use, rlm_counter etc. Especially I'm interested in your functions to acquire information from configuration files. best regards, Olaf

1 0