April 2006 - Freeradius-Users - lists.freeradius.org

Authentification with: login, password, SSID and Ldap
by ludovic cailleau 25 Apr '06

25 Apr '06

Hello My authentification with login, password, SSID start with the users files of freeradius. But now I would like use Ldap. ----------- My slapd.conf : include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/corba.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/RADIUS-LDAPv3.schema schemacheck on # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "o=crt" rootdn "cn=adminlp,o=crt" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw azerty rootpw {SSHA}vx07rOmgLvv4SSxzWfBbrjQy/B02ZxG3 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap -------- Radius.conf ldap { server = "127.0.0.1" identity = "cn=adminlp,o=crt" password = azerty basedn = "o=crt" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusVSA=%{Symbol-SSID}))" # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" ###access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on itSymbol-SSIDs own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # # edir_account_policy_check=no # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GrSymbol-SSIDoupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } -------------------- Radius X log.radius.txt --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici. --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "127.0.0.1" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=adminlp,o=crt" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "azerty" ldap: basedn = "o=crt" ldap: filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusVSA=%{Symbol-SSID}))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusVSA mapped to RADIUS SSID-Symbol rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x904f1d0 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded attr_filter attr_filter: attrsfile = "/etc/raddb/attrs" rlm_attr_filter: Authorize method will be deprecated. Module: Instantiated attr_filter (attr_filter) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.49.0.200:16001, id=101, length=153 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000f014368726973746f706865 Message-Authenticator = 0x50e7912a4f7aaf7b7f9efe5d1354abcc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=adminlp,o=crt/azerty to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 101 to 10.49.0.200:16001 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1e110f74e6e75c2fde6ad9440c9a0d59 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16002, id=102, length=162 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0x1e110f74e6e75c2fde6ad9440c9a0d59 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 Message-Authenticator = 0x5fdd8ee8e05643405a2449f850d01366 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "attr_filter" returns noop for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 102 to 10.49.0.200:16002 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd02519c6c2d0755361db3a0e0ee3d92 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16003, id=103, length=236 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0xfd02519c6c2d0755361db3a0e0ee3d92 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203005019800000004616030100410100003d0301444e222064da236d3c423c5960ec24a009d5633cfd41b94bc4f4bbc77ad64fdc00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf6318c97017eb4ca36531d34201b867a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 2 modcall[authorize]: module "attr_filter" returns noop for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 103 to 10.49.0.200:16003 EAP-Message = 0x010403ee19c0000006f1160301004a020000460301444e2290940edc3df8d3c83df1254c1bc94d67499c428ef11b9ba47674b8dcfd208f0a156431c2e5008f1f6fea0465ad70bd9d3890cd70d3c26302d13aab5e066900040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e7440 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x53c510b0b164a7e2493b93f58fc62752 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16004, id=104, length=162 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0x53c510b0b164a7e2493b93f58fc62752 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x3928bf68acb932334a3c0f7548b649bd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "attr_filter" returns noop for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 104 to 10.49.0.200:16004 EAP-Message = 0x0105031319006578616d706c652e636f6d301e170d3034303132353133323630375a170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db EAP-Message = 0x1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e80ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d6520436974 EAP-Message = 0x7931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8 EAP-Message = 0xd4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe2523d4bdeb0bf12afb4437a8a3de3f6 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16005, id=105, length=348 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0xe2523d4bdeb0bf12afb4437a8a3de3f6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500c01980000000b6160301008610000082008061eff0aece25e4fff1a2179dea47c0ac83ef86ce4634a32570f0dbe1629efe72ee2a4f26dbadeff2a7b0fb8efcd4ff7cdf64bb953282868d3f346fd5110c4a14168e32b05790bc21e6233fa163a5797b4110e4c4ac02b1b653fcd77e541c7fc30a2a0c7049cb9fba3b0be6f3b73544474c069a45629e8734b18a30bec00d3439140301000101160301002087654a42ae4eebf01b67ab880c43971ac40aadb7544e2ba9d92b1370005648b0 Message-Authenticator = 0x8d2333c4ef3c67d73b31ca391022c1d3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "attr_filter" returns noop for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 105 to 10.49.0.200:16005 EAP-Message = 0x0106003119001403010001011603010020f74167b1846147a5a42cd016adc5f7ab91ac831c7dd2a883c3027799917453f4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x082354f3ce65f8c4a2b9e13b7618416b Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16006, id=106, length=162 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0x082354f3ce65f8c4a2b9e13b7618416b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 Message-Authenticator = 0x3e023e477ce99ca4f98d53896a97fe83 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 5 modcall[authorize]: module "attr_filter" returns noop for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 106 to 10.49.0.200:16006 EAP-Message = 0x0107002019001703010015950f9c43ceb0c0c3088dbb0111f2af782ba0875e6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdd9c199edeef778b26e181e1fe935a30 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16007, id=107, length=194 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0xdd9c199edeef778b26e181e1fe935a30 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700261900170301001b0e49827b5cc3855d603085082c66ec489c5560c11823206250a044 Message-Authenticator = 0x7cf852e5bd79fa33628e526e330e424b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "attr_filter" returns noop for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - Christophe rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0207000f014368726973746f706865 PEAP: Got tunneled identity of Christophe PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to Christophe PEAP: Sending tunneled request EAP-Message = 0x0207000f014368726973746f706865 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "attr_filter" returns noop for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800241a0108001f1069c505b68bbda5c6cb7dec91122125ac4368726973746f706865 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1a2b822cb8949cfef13f42bd73599e5 PEAP: Processing from tunneled session code 0x90c1348 11 EAP-Message = 0x010800241a0108001f1069c505b68bbda5c6cb7dec91122125ac4368726973746f706865 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1a2b822cb8949cfef13f42bd73599e5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 107 to 10.49.0.200:16007 EAP-Message = 0x0108003b1900170301003088cf5ae36c298137881d67baf36f99977aa7d84ccad83803335e45e13caf1b70bc45b90051c97c23559115974a67b99d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9302b3853670d2fb56c0c53cc1b0ed7f Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16008, id=108, length=248 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0x9302b3853670d2fb56c0c53cc1b0ed7f NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208005c19001703010051cd1efab34520bc489077f6b670b8b91e260a8e4a041d4ca98fcca09bc53707b5cc21af2c23cdfb6d902d93df5d5bb7b87c5f196d476558674800ae8d47925eda132963ea67609e80cbb34da9bdcb9f9b44 Message-Authenticator = 0x4b9243e22b21717bdb2c768ad0ba8f60 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 7 modcall[authorize]: module "attr_filter" returns noop for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 92 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800451a0208004031b09aa099218090e72ad9444d7527db4800000000000000003cd31ca86d9ba2cfabdc9194097967ea97d849c7fa2eed1d004368726973746f706865 PEAP: Setting User-Name to Christophe PEAP: Adding old state with f1 a2 PEAP: Sending tunneled request EAP-Message = 0x020800451a0208004031b09aa099218090e72ad9444d7527db4800000000000000003cd31ca86d9ba2cfabdc9194097967ea97d849c7fa2eed1d004368726973746f706865 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Christophe" State = 0xf1a2b822cb8949cfef13f42bd73599e5 NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 7 modcall[authorize]: module "attr_filter" returns noop for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 69 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for Christophe with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. Login incorrect: [Christophe/<no User-Password attribute>] (from client localhost port 29 cli 00:11:F5:3A:DC:37) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x90ec860 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 108 to 10.49.0.200:16008 EAP-Message = 0x010900261900170301001b86e39909913f0f228573a189f8feedb718303a5454635502f59f48 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa93a7a6785d939382c20702f22d3ae66 Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16009, id=109, length=194 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0xa93a7a6785d939382c20702f22d3ae66 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020900261900170301001b847e4d09c430ea2a26fc6756a184bc31d31ead7a10747ac5f09366 Message-Authenticator = 0x76a2cb42efb338266e8d2c56c42b26c1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 8 modcall[authorize]: module "attr_filter" returns noop for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Login incorrect: [Christophe/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16010, id=109, length=194 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0xa93a7a6785d939382c20702f22d3ae66 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020900261900170301001b847e4d09c430ea2a26fc6756a184bc31d31ead7a10747ac5f09366 Message-Authenticator = 0x76a2cb42efb338266e8d2c56c42b26c1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 9 modcall[authorize]: module "attr_filter" returns noop for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Login incorrect: [Christophe/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Delaying request 9 for 1 seconds Finished request 9 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 109 to 10.49.0.200:16009 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 109 to 10.49.0.200:16010 Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.49.0.200:16011, id=109, length=194 User-Name = "Christophe" NAS-IP-Address = 10.49.0.200 Called-Station-Id = "00:A0:F8:BC:C3:9E" Calling-Station-Id = "00:11:F5:3A:DC:37" NAS-Identifier = "WS5000" Symbol-SSID = "CRTguest" NAS-Port = 29 Framed-MTU = 1000 State = 0xa93a7a6785d939382c20702f22d3ae66 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020900261900170301001b847e4d09c430ea2a26fc6756a184bc31d31ead7a10747ac5f09366 Message-Authenticator = 0x76a2cb42efb338266e8d2c56c42b26c1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 radius_xlat: '/var/log/radius/radacct/10.49.0.200/auth-detail-20060425' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.49.0.200/auth-detail-20060425 modcall[authorize]: module "auth_log" returns ok for request 10 modcall[authorize]: module "attr_filter" returns noop for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "Christophe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for Christophe radius_xlat: '(&(uid=Christophe)(radiusVSA=CRTguest))' radius_xlat: 'o=crt' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=crt, with filter (&(uid=Christophe)(radiusVSA=CRTguest)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusVSA as SSID-Symbol, value CRTguest & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user Christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 10 modcall: group authorize returns updated for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 10 modcall: group authenticate returns invalid for request 10 auth: Failed to validate the user. Login incorrect: [Christophe/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Delaying request 10 for 1 seconds Finished request 10 Going to the next request Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 101 with timestamp 444e2290 Cleaning up request 1 ID 102 with timestamp 444e2290 Cleaning up request 2 ID 103 with timestamp 444e2290 Cleaning up request 3 ID 104 with timestamp 444e2290 Cleaning up request 4 ID 105 with timestamp 444e2290 Cleaning up request 5 ID 106 with timestamp 444e2290 Cleaning up request 6 ID 107 with timestamp 444e2290 Cleaning up request 7 ID 108 with timestamp 444e2290 Cleaning up request 8 ID 109 with timestamp 444e2290 Sending Access-Reject of id 109 to 10.49.0.200:16011 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 9 ID 109 with timestamp 444e2292 Waking up in 2 seconds...

1 0

Proxy RADIUS problem
by Santiago Balaguer García 25 Apr '06

25 Apr '06

Hi people, I have a LINUX machine with freeradius 1.1.10. I do proxy RADIUS correctly with one remote server, but if I add in my proxy.conf file a redundant one because the primary RADIUS fails, it doesn't work correctly. I want to do roaming with two remote RADIUS servers to the domain1 since my RADIUS. However, I get only do roaming with the first one, because withe the first fails, my RADIUS doesn't ask to the second remote RADIUS server. Could you tell me where is the configuration bug? I attached my proxy.conf file: ******************************************* proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = yes } realm domain1 { type = radius authhost = 123.123.123.123:11812 accthost = 123.123.123.123:11813 secret = secret nostrip } realm domain1 { type = radius authhost = 123.123.123.124:11812 accthost = 123.123.123.124:11813 secret = secret nostrip } **************************************** _________________________________________________________________ Descarga gratis la Barra de Herramientas de MSN http://www.msn.es/usuario/busqueda/barra?XAPID=2031&DI=1055&SU=http%3A//www…

3 3

(no subject)
by Bruno B. Farcas dos Santos 24 Apr '06

24 Apr '06

Hi, I´m a new menber of the list, below there are some informations that are logging on the radius log. I´m using Freeradius 1.1.1 + Oracle 9i Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 2572446) for request 352 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1359956) for request 362 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 409626) for request 351 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1523806) for request 361 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 2556061) for request 347 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 2277516) for request 358 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 606246) for request 369 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1900661) for request 363 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1032256) for request 355 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 2392211) for request 366 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1605731) for request 365 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1654886) for request 367 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 2523291) for request 360 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 1949816) for request 357 Mon Apr 24 19:13:41 2006 : Error: WARNING: Unresponsive child (id 2506906) for request 364 Mon Apr 24 19:13:41 2006 : Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Mon Apr 24 19:13:41 2006 : Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Mon Apr 24 19:13:41 2006 : Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Mon Apr 24 19:13:41 2006 : Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Mon Apr 24 19:13:41 2006 : Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Anyone could give some help about how to sovle this problem? Sometimes when I restart the radiusd or oracle services aparentely the problem is solved but in a small time it starts again. Thanks, -- Bruno Barreira Farcas dos Santos Suporte Técnico

2 1

FreeRadius Howto + PPPoE
by Rani Ahmed 24 Apr '06

24 Apr '06

hi all. i want to know how to use free radius with pppoe-server and using plain text files. not using mysql or others cos i dont have ppl well computer literate. please dont tell me to read the files.. i have read them about 100 times but could not figure out how to really use them. ie. why should i put this value or that... and i really need a howto that explains the usage of Freeradius in all of its aspects and features without missing a thing, that of Smaba's Users Guide.

2 1

Proxy Question
by Reynold McGuire 24 Apr '06

24 Apr '06

How's everyone doing? I have a proxy question / problem. I am attempting to get freeRadius to basically proxy via realm. This one radius server is going to be the proxy to all other radius servers... I am able to proxy correctly using the following in proxy.conf ---CUT--- Realm ad.domain.com { type = radius authhose = ias.server.ad.domain.com:1812 accthost = ias.server.ad.domain.com:1813 secret = testing123 nostrip } ---CUT--- This works great for the apps that need / allow "username(a)domian.com" style authentication. My problem is when using programs like MS PEAP authentication that wants to pass the info as "domain.com\username" I have read thru proxy.conf and radius.conf and looked at the ntdomain realm and I can not seem to get it to see the "domain.com\username". I am using IAS on an AD member server for authentication for another project and it wants to authenticate users via "username(a)domain.com" as it is sitting in the root of the AD (no users there) so you have to give it the FQDN. Long story short, How can I get freeRadius to see "domain.com\username" and convert that to "username(a)domain.com" and proxy that off? Thanks in advance. - Reynold

3 7

TTLS/PEAP seg faults
by João Mamede 24 Apr '06

24 Apr '06

can I do something about this? I'm using ldap in authorize{}(just uncommented it and not using in it in authenticate{}(I don't need it for EAP-TTLS right?) Do I need to add the auth-type ldap in users? I'm around this for a week now :( rad_recv: Access-Request packet from host 192.168.5.1:2048, id=0, length=247 User-Name = "forevertheuni" NAS-IP-Address = 192.168.5.1 Called-Station-Id = "000ea65b5239" Calling-Station-Id = "0011f547e038" NAS-Identifier = "000ea65b5239" NAS-Port = 31 Framed-MTU = 1400 State = 0x729d931bc6bfa59612707c69d4ac0269 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201006c150016030100610100005d0301444ac484048c1ded0c6a1a0ff213c2e6a1632cd26d6c89501a7f6d10461f815300003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 Message-Authenticator = 0xbaf1f6903393341b2e2cddff9dc928d4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "forevertheuni", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 1 length 108 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall[authorize]: module "files" returns notfound for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for forevertheuni radius_xlat: '(uid=forevertheuni)' radius_xlat: 'ou=Users,dc=cartoons,dc=buh' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Users,dc=cartoons,dc=buh, with filter (uid=forevertheuni) rlm_ldap: checking if remote access for forevertheuni is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user forevertheuni authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization Segmentation fault: 11 (core dumped) [root@T4 /home/forevertheuni]#

2 1

connection problems
by Pelusa Vali 24 Apr '06

24 Apr '06

hi list, well i use debian etch, kernel 2.6.15.6, madwifi-ng-r1475, freeradius 1.1.0, hostapd 0.5.2 and a linksys wmp55ag as wireless adaptor. i can put it as access point, but have a big problem. if only set access point without security or using wep, clients disconnect after 2-8 minutes and cann't reconnect, only if ap is reseted. so i used hostapd to set WPA-PSK and link was very stable for hours. now set WPA-EAP and using freeradius configured PEAP. it worked very well for 8 days. stable, only connection delay was too large, but it worked. after 8 days, clients deauthenticate and reauthenticate each 3-5 minutes. i think it's related to madwifi, because of first problem i described. any body has same behavior?? if so, how could it be solved?? it's an annoying, clients are working and suddenly they lost connection and must wait until it was re-established, it takes from 1 to 10 minutes to complete, if so. do you have any idea?? thanks for your help _______________________________________________________________ Halloween Trivia: What is 'Samhainophobia' a fear of? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=118

1 0

Authentification with: login, password, SSID
by ludovic cailleau 24 Apr '06

24 Apr '06

Good morning, I wish to realize an authentication 802.11x for a wireless network. I use a switch wireless Symbol, and Freeradius under fedora 5. The authentication will have to verified 3 parameters: the login, the password, and the SSID. The switch Symbol with the Vendor Specific Attribute (Symbol-SSID) transmits the SSID. I have then creates a Freeradius's dictionary for this attribute (Symbol-SSID). # # dictionary.symbol # VENDOR Symbol 388 ATTRIBUTE Symbol-SSID 2 string Symbol \n \n \nI use the users files of Freeradius. \nFor validate the authentication I use the entry: \n \n"vlan4"\n Auth-Type :\u003d eap, User-Password \u003d\u003d "vlan4", Symbol-SSID \u003d\u003d \'CRTguest\' \n Reply-Message \u003d "Hello, %u"\n \n \n \nI start freeradius, and when I want to connect me with a client PC I\'m reject.\n \nLogs indicates me: \n \nFri Apr 21 09:01:34 2006 : Info: Using deprecated naslist file.\n Support for this will go away soon. \nFri Apr 21 09:01:34 2006 : Info: rlm_exec: Wait\u003dyes but no output defined. Did you mean output\u003dnone?\n \nFri Apr 21 09:01:34 2006 : Info: Ready to process requests.\n \n",1] ); //--> I use the users files of Freeradius. For validate the authentication I use the entry: "vlan4" Auth-Type := eap, User-Password == "vlan4", Symbol-SSID == 'CRTguest' Reply-Message = "Hello, %u" I start freeradius, and when I want to connect me with a client PC I'm reject. Logs indicates me: Fri Apr 21 09:01:34 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Apr 21 09:01:34 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Apr 21 09:01:34 2006 : Info: Ready to process requests. Length Included \nFri Apr 21 09:01:49 2006 : Error:\n TLS_accept:error in SSLv3 read client certificate A \nFri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message\n \nFri Apr 21 09:01:49 2006 : Info: rlm_eap_tls:\n Length Included \nFri Apr 21 09:01:49 2006 : Info:\n (other): SSL negotiation finished successfully \nFri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message\n \nFri Apr 21 09:01:50 2006 : Info: rlm_eap_mschapv2: Issuing Challenge\n \nFri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client localhost port 0)\n \nFri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37)\n \nFri Apr 21 09:01:52 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request\n \nFri Apr 21 09:01:52 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37)\n \nFri Apr 21 09:01:54 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request\n",1] ); //--> Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Length Included Fri Apr 21 09:01:49 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Length Included Fri Apr 21 09:01:49 2006 : Info: (other): SSL negotiation finished successfully Fri Apr 21 09:01:49 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Apr 21 09:01:50 2006 : Info: rlm_eap_mschapv2: Issuing Challenge Fri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client localhost port 0) Fri Apr 21 09:01:50 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Fri Apr 21 09:01:52 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Fri Apr 21 09:01:52 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) Fri Apr 21 09:01:54 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request \nFri Apr 21 09:01:54 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37)\n \n \n \nBut if I delete the VSA Symbol-SSID, I can connect me. \n \nThank you for your help. -- ",1] ); D(["mb","Ludovic \n\n ",0] ); //--> Fri Apr 21 09:01:54 2006 : Auth: Login incorrect: [vlan4/<no User-Password attribute>] (from client symbol port 29 cli 00:11:F5:3A:DC:37) But if I delete the VSA Symbol-SSID, I can connect me. Thank you for your help. --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

3 4

rlm_exec does not change already existing attributes
by Dmitry Lyubimkov 24 Apr '06

24 Apr '06

In the rlm_exec module for change of attributes according to result of script it is used if (output_pairs) pairmove(output_pairs, &answer); in function static int exec_dispatch(void *instance, REQUEST *request) But function pairmove in valuepair.c does only the following /* * Move attributes from one list to the other * if not already present. */ void pairmove(VALUE_PAIR **to, VALUE_PAIR **from) I.e. if such attribute does not exist that it will be added, and if already exists, will take place nothing. As result using an external script we can only add new attributes, but we can not change existing attributes! How to change User-Name in Radius request? Is it possible to change existing attributes in the simple way without change of the module rlm_exec code? Dmitry

2 1

Redundant ldap server with freeradius 1.0.5
by sumi thra 24 Apr '06

24 Apr '06

Hey All, I want to configure freeradius server to use redundant ldap servers. My configuration is: authorize { preprocess #etc_passwd #etc_group chap mschap suffix_oblic prefix_oblic suffix_at prefix_at suffix_percent prefix_percent files redundant{ ldap_primary ldap_secondary } eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { redundant { ldap_primary ldap_secondary } } #unix eap } ldap ldap_primary { .... .. } ldap ldap_secondary { .. .. } The free radius server is keep on sending the request to secondary server, even though the primary server is reachable. Could you plz guide me where am i missing the configuration ? Any other attribute needs to be defined inside redundant module ? Awaiting for your earliest reply. Thanks, Sumi

1 0