May 2006 - Freeradius-Users - lists.freeradius.org

Connecting two freeradius server ?
by Frank Bonnet 24 May '06

24 May '06

Hello I use freeradius to authenticate Chillispot users using an Openldap backend , everything works like a charm :-) Another (friendly) site has quite the same configuration they do use freeradius too to authenticate their wi-fi users. Both sites have a permanent Internet access. Now is it possible for "my" daemon to "communicate" with another freeradius daemon which is running in another distant site to let all of our users ( my site + distant site ) authenticate transparently with their own site logins/passwds on the two sites ? Thank you. -- Frank Bonnet

2 2

specific accounting attributes
by JVUVANT Yahoo 24 May '06

24 May '06

Hi all I'm using redback SE800 and I would like to collect some specific attributes returned by the NAS with freeradius. someone can help me how to ? Thanks Jacques vuvant

2 1

Getting the signaling IP address
by vignesh 24 May '06

24 May '06

Hello all I am using cisco TCL IVR 2.0 and Free Radius 1.1. I am trying to send signalling ip as an extra attribute to radius from the NAS in the accounting request packet using h323-ivr-out. The problem is I am not able to retrive the signaling ip of the out bound leg( I even tried the same for the inbound leg but still no luck). I am retriving the signaling ip using the info tag infotag get leg_remote_signaling_ip_address leg_outgoing. But I am getting a empty string This is my code where I retrive the signaling ip proc act_Cleanup { } { set signalip [infotag get leg_remote_signaling_ip_address leg_outgoing] set avsend(h323-ivr-out,0) "billingid:$signalip" aaa accounting update leg_outgoing -a avsend call close } This is the procedure that's get called when the call ends. I even tried using this code snippet when the call is established but I am still unable to read the signaling ip. I am accounting at stop only. In the accounting request there is one attribute h323-remote-address which gives me the signaling ip but how do I retrive it in my tcl ivr script. Please guys help me out Thanks Vignesh

1 0

dual-master mysql replication - seems promissing
by RobertB 23 May '06

23 May '06

Hi All Does anybody run dual-master replication with freeradius? I have been doing some testing and it seems good. I also use the rlm_sqlippool with it and works very well. I need to do a lot more testing under heavy load and simulate some faults, but seems very promising, at least with NTRadPing. I'm running mysql-5.0.21 with auto_increment_increment and auto_increment_offset options. Cheers, RobertB

1 0

RE: FreeRadius 1.1.1 and run-away CPU
by Aaron Burruss 23 May '06

23 May '06

I have the proxy section commented out in radiusd.conf, occurs both ways... I do see something in the radius.log... when the CPU pegs out (and the server stops handling requests), I see this occur in the radius.log: Tue May 23 16:37:03 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Tue May 23 16:37:03 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Before that, I have some other misc errors, but nothing that I'm too worried about. -A -----Original Message----- From: freeradius-users-bounces+aburruss=networkinsight.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+aburruss=networkinsight.com@lists.freer adius.org] On Behalf Of Alan DeKok Sent: Tuesday, May 23, 2006 10:49 AM To: FreeRadius users mailing list Subject: Re: FreeRadius 1.1.1 and run-away CPU "Aaron Burruss" <aburruss(a)networkinsight.com> wrote: > I'm running freeraduius 1.1.1 on a FreeBSD 5.4 server. I'm using the > mysql module (mysql 4.0.24), and everything seems to be working fine... > but at random times, the CPU becomes pegged by the radiusd process, and > it will stop accepting requests from my clients. This does not (seem > to) occur when I run in debug (-X), but I obviously don't want to run it > in that mode for the long term. I've looked around, and can't seem to > find anything that might be causing this to happen. Are you proxying requests? If so, try the patch from bug #331. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius-Users Digest, Vol 13, Issue 106
by Kartthik Raghunathan 23 May '06

23 May '06

Hi Alan, Thanks for your response. Have installed openssl-devel-0.9.7a-33.17 package, do you still think i need some other package to be installed. If so, can i know the package name. Thanks, Kartthik > ------------------------------ > > Message: 6 > Date: Mon, 22 May 2006 14:09:35 -0400 > From: "Alan DeKok" <aland(a)nitros9.org> > Subject: Re: make error message - please help ! > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060522180935.6E9DD16CC1(a)mail.nitros9.org> > > "Kartthik Raghunathan" <kartthikr(a)lycos.com> wrote: > > In file included from eap_peap.h:25, > > from rlm_eap_peap.c:24: > > ../../libeap/eap_tls.h:138: syntax error before "SSL" > > ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union > > You don't have the OpenSSL header files installed. > > Alan DeKok. -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

authentication problems
by simon＠434canada.com 23 May '06

23 May '06

Hi, I am trying to get freeRadius working with PEAP, and am having some issues. When I test the server using NTRadPing (a free utility at http://www.novell.com/coolsolutions/tools/14377.html) I can get properly authenticated, using either of two user accounts I set up in the users file. However, when I try to actually connect (using a laptop running WinXp SP2 with a Intel PRO/Wireless 2915ABG wireless card) I never get fully authenticated. I used the tutorial found at http://tldp.org/HOWTO/html_single/8021X-HOWTO/ to set up all the configuration files. Below is the output from running radiusd in debug mode, including the start up information, and then the results of attempting to connect. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.1:1862, id=0, length=131 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000e01746573742d75736572 Message-Authenticator = 0xaea691f462c399eebe0ccea5abdd016b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.10.1.1 port 1862 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf590bbb204a16a614cf61d3c73c04467 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.1:1864, id=0, length=215 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 State = 0xf590bbb204a16a614cf61d3c73c04467 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d0301447369eb92ff2c63e203ef45db95b3a0fdcc5af1ccb4b6a28e9dd88e40a3d78300001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x4ac8301cffc55179342d8b744c786817 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 10.10.1.1 port 1864 EAP-Message = 0x0102040a19c0000006f1160301004a02000046030144736a0490bb7192c45745a721b32c5b68fcc8733f626a18038ae2a93b27c2f2208a76ac974384f6bf8c3dbdae0b2e6ea2371340c4b0a4353a5af39d36f7eeb21c00040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb312fc37dc40bf679a588a4b66d2e59 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.1:1866, id=0, length=141 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 State = 0xcb312fc37dc40bf679a588a4b66d2e59 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0x70d6c4332f6449bde6b64dec328f7c14 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 10.10.1.1 port 1866 EAP-Message = 0x010302f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xff0dc76f44ccfd825058d18d81d57758 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.1:1868, id=0, length=141 User-Name = "test-user" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 State = 0xff0dc76f44ccfd825058d18d81d57758 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x0345a065f9e26b50b6c8fd34d949efba Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "test-user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry test-user at line 98 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 10.10.1.1 port 1868 EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f35e0c331009d44dcad4684f4f9261a Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 44736a04 Cleaning up request 1 ID 0 with timestamp 44736a04 Cleaning up request 2 ID 0 with timestamp 44736a04 Cleaning up request 3 ID 0 with timestamp 44736a04 Nothing to do. Sleeping until we see a request. This just continues over and over. Any help here would be greatly appreciated. Thanks, Simon

2 1

"Open" WPA system
by Mark D. Montgomery II 23 May '06

23 May '06

I posted a while ago about our school trying to setup essentially an open wpa system (anyone can connect with WPA with little or no changes to windows settings). The actual user auth is done later via a hotspot server of some sort. Anyhow, I currently have freeradius set to Auth-Type:=Accept so it should accept any connection. This works fine using radtest, but breaks when trying to do a peap connection. Attached is the log output from a peap attempt. Any suggestions on how to fix the error? Thanks. Mark II mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.109.195:1061, id=0, length=252 Message-Authenticator = 0x41eb703e9f3512dd95d5baa8c95398af Service-Type = Framed-User User-Name = "MONTGOMERY-MARK\\markmontgomery" Framed-MTU = 1488 Called-Station-Id = "00-11-95-BF-EF-1C:DBCWIFI" Calling-Station-Id = "00-14-A5-7C-1A-46" NAS-Identifier = "D-Link Access Point with POE" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000023014d4f4e54474f4d4552592d4d41524b5c6d61726b6d6f6e74676f6d657279 NAS-IP-Address = 192.168.109.195 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 81 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '@' in User-Name = "MONTGOMERY-MARK\markmontgomery", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Looking up realm "MONTGOMERY-MARK" for User-Name = "MONTGOMERY-MARK\markmontgomery" rlm_realm: No such realm "MONTGOMERY-MARK" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type ACCEPT rad_check_password: Auth-Type = Accept, accepting the user Login OK: [MONTGOMERY-MARK\\markmontgomery] (from client internal-network port 1 cli 00-14-A5-7C-1A-46) Sending Access-Accept of id 0 to 192.168.109.195:1061 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.109.195:1061, id=0, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client internal-network:1061 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 446b74d8 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.109.195:1062, id=0, length=252 Message-Authenticator = 0xcc2effc2183aeadc6a7562d425a30878 Service-Type = Framed-User User-Name = "MONTGOMERY-MARK\\markmontgomery" Framed-MTU = 1488 Called-Station-Id = "00-11-95-BF-EF-1C:DBCWIFI" Calling-Station-Id = "00-14-A5-7C-1A-46" NAS-Identifier = "D-Link Access Point with POE" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000023014d4f4e54474f4d4552592d4d41524b5c6d61726b6d6f6e74676f6d657279 NAS-IP-Address = 192.168.109.195 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 81 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "digest" returns noop for request 1 rlm_realm: No '@' in User-Name = "MONTGOMERY-MARK\markmontgomery", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: Looking up realm "MONTGOMERY-MARK" for User-Name = "MONTGOMERY-MARK\markmontgomery" rlm_realm: No such realm "MONTGOMERY-MARK" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: EAP packet type response id 0 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type ACCEPT rad_check_password: Auth-Type = Accept, accepting the user Login OK: [MONTGOMERY-MARK\\markmontgomery] (from client internal-network port 1 cli 00-14-A5-7C-1A-46) Sending Access-Accept of id 0 to 192.168.109.195:1062 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.109.195:1062, id=0, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client internal-network:1062 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 446b74e2 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.109.195:1063, id=0, length=252 Message-Authenticator = 0x7b4d94434e62a332c52855fc18400629 Service-Type = Framed-User User-Name = "MONTGOMERY-MARK\\markmontgomery" Framed-MTU = 1488 Called-Station-Id = "00-11-95-BF-EF-1C:DBCWIFI" Calling-Station-Id = "00-14-A5-7C-1A-46" NAS-Identifier = "D-Link Access Point with POE" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000023014d4f4e54474f4d4552592d4d41524b5c6d61726b6d6f6e74676f6d657279 NAS-IP-Address = 192.168.109.195 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 hints: Matched DEFAULT at 81 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 rlm_realm: No '@' in User-Name = "MONTGOMERY-MARK\markmontgomery", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: Looking up realm "MONTGOMERY-MARK" for User-Name = "MONTGOMERY-MARK\markmontgomery" rlm_realm: No such realm "MONTGOMERY-MARK" modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_eap: EAP packet type response id 0 length 35 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 160 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type ACCEPT rad_check_password: Auth-Type = Accept, accepting the user Login OK: [MONTGOMERY-MARK\\markmontgomery] (from client internal-network port 1 cli 00-14-A5-7C-1A-46) Sending Access-Accept of id 0 to 192.168.109.195:1063 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.109.195:1063, id=0, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client internal-network:1063 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 0 with timestamp 446b74eb Nothing to do. Sleeping until we see a request.

2 1

Segmentation Fault
by Matteo Lazzarini 23 May '06

23 May '06

help me please.... The cause could be my AP D-Link DWL-900AP+? In the several one tried to you once they are connected to me A single time is successful to connect to me The demands from client Win XP leave corrected with certify to you previously install to you in the client .... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/1x/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/1x/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/1x/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/1x/dh" tls: random_file = "/usr/local/radius/etc/1x/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.5:1206, id=19, length=133 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000b016d617474656f Message-Authenticator = 0x967f88da472270a5df15034140e2040c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 19 to 192.168.1.5 port 1206 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5a270abdfa6e2a77ddfe453ad6fc4d54 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1206, id=20, length=220 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200500d800000004616030100410100003d030144734f2af0e9b4731fd9c2d0b4e504ca9ecd1d42ac11c913e9e2774b4179862b00001600040005000a000900640062000300060013001200630100 State = 0x5a270abdfa6e2a77ddfe453ad6fc4d54 Message-Authenticator = 0xffd12a5c648cfc7773dbbd30fd0c3f0a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 1 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04eb], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0051], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 20 to 192.168.1.5 port 1206 EAP-Message = 0x0103040a0dc000000595160301004a0200004603014473330a686dcaad963dba557b286c130ae8a2d9b77b43505615b517a28015cb206097502b68ed30dcc00fa7d886e1a545ac9836c60dad6e34ee5f29b12c64b34e00040016030104eb0b0004e70004e4000239308202353082019ea003020102020105300d06092a864886f70d01010505003040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b3009060355040313024341301e170d3036303532333039303932345a170d3037303532333039303932345a3068310b30090603550406130249543110300e06 EAP-Message = 0x03550408130742657267616d6f31123010060355040a130947727570706f696d69310f300d060355040313067261646975733122302006092a864886f70d01090116137261646975734067727570706f696d692e697430819f300d06092a864886f70d010101050003818d0030818902818100b9ae0ef1716002d6b034f588e8b8b74bd312a355433aec355c9fe01dba647be21a421e811a37a0ec2a9bb214510f02362db1f19b33d0d6cf5f609379ae6dfe962d34bcc76d71f9d2e8ed0bf6f3000f8eaf3d6f9eaacc9f0930f96c86a7cb4ba8cd8c966984ffda1a822207f7c652e63ce05b14f16081e899960095d4efac221d0203010001a317301530 EAP-Message = 0x130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100aa75b2e1c672de7111c6a480c7e63fb0dd6e2763b581e3926abb51775254de94d1f42f3e9c4e73b35f5e6f6d11b76ab024062eb050d433da7249051388c80d0e2622f5d264b1a1da7e4c60a24fceb2310509cff9e61b0583173d79322c834ade2b99f68b4488c56ba88b27e42820306a74fdb6dbf07020c4c2ae90e9ae7da5890002a5308202a13082020aa003020102020900f65e6a6e4582e65e300d06092a864886f70d01010505003040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a1309 EAP-Message = 0x47727570706f696d69310b3009060355040313024341301e170d3036303532333039303133305a170d3038303532323039303133305a3040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b300906035504031302434130819f300d06092a864886f70d010101050003818d0030818902818100b536489b6093a1ee191c95e2ac498564095e182c86e59a82a276a10a1fe1d60d4a4774370e3a31b6d33c18c64c046877fa8d61a1b08644e891e53c1e38ef28ae219919bb7ba7d4d68e3daded7b81c25ae99c6697fb6dcf0d81238390ba28ad73133dd0f3120cff4c EAP-Message = 0x8782368fd48dd03b12a6847de5340d9035aa1ce1c96f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3889b8bcaefc660f73c84ed14247d0d3 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1206, id=21, length=146 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 State = 0x3889b8bcaefc660f73c84ed14247d0d3 Message-Authenticator = 0xd1c04f41b010cf03e62335e3d7009b1d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 2 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 21 to 192.168.1.5 port 1206 EAP-Message = 0x0104019f0d8000000595e1410203010001a381a230819f301d0603551d0e04160414e3fcd11473961d087743bdfc11c2621c1a49650230700603551d23046930678014e3fcd11473961d087743bdfc11c2621c1a496502a144a4423040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b3009060355040313024341820900f65e6a6e4582e65e300c0603551d13040530030101ff300d06092a864886f70d01010505000381810048be72b06a1043c8891eb2c03156bda58fe068cc6c9e3d0a5cdee92ee5417dc444a241afef677acb4906b9b3bcd22df060f4c040 EAP-Message = 0x79496b09b06ba334af5e487fbddd87bbba5824707f0b1dbf9b68cb1124d2d79f5f0661c727cd2d95756e2172725b529d701e40cc539457567805dc1cd4d0c3cb4f44291b53d3fce1ffac4bc016030100510d000049020102004400423040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b30090603550403130243410e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf018e32e5012deb51093bbbb11bb8f34 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1206, id=22, length=1057 User-Name = "matteo" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-12-F0-64-6D-8A" NAS-Identifier = "DWL-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204038f0d800000038516030103550b00024500024200023f3082023b308201a4a003020102020104300d06092a864886f70d01010505003040310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310b3009060355040313024341301e170d3036303532333039303134395a170d3037303532333039303134395a306e310b30090603550406130249543110300e0603550408130742657267616d6f31123010060355040a130947727570706f696d69310f300d060355040313066d617474656f3128302606092a864886f70d01090116196d6c617a7a6172696e694063 EAP-Message = 0x72656d612e756e696d692e697430819f300d06092a864886f70d010101050003818d0030818902818100c0493661470a3ca6e9b03253e5961122d87865d8eef1decc61fe4ce1b9b1cbbca4068715290d7503719051add28c6f868716deb07dd07d2472c5e2efd8d19a53e028ae9f9811790e65933fb91dbc77d2378d1b427104f041f24bfa71c33015052530ada0bb655b68f0cc8d3fa3ad38e99bb0dff18524b016abf1f3134f8932d50203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d01010505000381810047151d2a53dd7159cc78884e60f6534471cfd93aacea842acd0e15417cfb79f96c56 EAP-Message = 0x41e5e613e4b50e25fcd2ad850a177bf4abfd4fa808a042439a421a7362cd153ebdd033f462a6883bed08ebae428db26ad2535a8483c68d259bb8d435a67e8e04cf5edd6d74a9c8968d0cd9ce36fa4ac1f8f82c46dcd1d6f725be1b1c2169100000820080816e81dd3de4c19c4f0cc65f235960bb4b139d2a1e63fa0ba5fd2aa7ea810def29bace7abd216dc9508b1e9bc6fffbe243827fe2f23d0413d6b18a4e83f6d18d8a3c90c6da9cbb2267585de5c19fb5289136724d377190a3d15efcee29f73930358afab3240341505572be07bdac1b58813658468dce9295d9c7dbd345a4b25c0f0000820080ac4e6b0ca0e5a7129d1caabc67cb6b24b8d76f EAP-Message = 0xae0cfee930105c775db5b351e6d7732b6f7d190524110211ab922fe155da04edf68295a5998212bea5f38688b2aa7ef3156c3383b352222e725ab54508b751dc21aa3d3eceb01e62d2fcee3eea02fa45e741e2265ae0f007f0ef50810f0f4e9c5a3e621c5baceb2bd2026c3aeb14030100010116030100208563ba073afa9603a9511a7a3cfeb68baffe873b38b39075fe211605188b786f State = 0xf018e32e5012deb51093bbbb11bb8f34 Message-Authenticator = 0x6d1cf151301d9c811944568bccec3380 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 radius_xlat: '/usr/local/radius/var/log/radius/radacct//auth-detail-20060523' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct//auth-detail-20060523 modcall[authorize]: module "auth_log" returns ok for request 3 rlm_realm: No '@' in User-Name = "matteo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry matteo at line 216 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0249], Certificate chain-depth=1, error=0 --> User-Name = matteo --> BUF-Name = CA --> subject = /C=IT/ST=Bergamo/O=Gruppoimi/CN=CA --> issuer = /C=IT/ST=Bergamo/O=Gruppoimi/CN=CA --> verify return:1 chain-depth=0, error=0 --> User-Name = matteo --> BUF-Name = matteo --> subject = /C=IT/ST=Bergamo/O=Gruppoimi/CN=matteo/emailAddress=mlazzarini(a)crema.unimi.it --> issuer = /C=IT/ST=Bergamo/O=Gruppoimi/CN=CA --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange ./run-radius: line 9: 7283 Segmentation fault

1 0

freeradius and mysql fails
by mailing＠sylph.be 23 May '06

23 May '06

hello, i was wondering what sql tables i need to have. Im trying to setup freeradius with mysql and i cant get out. i've got the following tables: radius (12) * Browse badusers * Browse mtotacct * Browse nas * Browse radacct * Browse radcheck * Browse radgroupcheck * Browse radgroupreply * Browse radpostauth * Browse radreply * Browse totacct * Browse usergroup * Browse userinfo but when i try to logon (asa 5510 test connection to freeradius) it doesnt work with sql i can logon with the test account 'steve' and password 'testing' and i can logon to the cisco ascm. but when i add an user to mysql something goes wrong. first steve: radius_xlat: 'steve' rlm_sql (sql): sql_set_user escaped user --> 'steve' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'steve' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User steve not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'steve' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'steve' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User steve not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 21 modcall: leaving group authorize (returns ok) for request 21 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 83 to 192.168.6.1 port 1025 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 21 -------------------sql----------------- rad_recv: Access-Request packet from host 192.168.6.1:1025, id=89, length=110 User-Name = "test1" User-Password = "test1" NAS-IP-Address = 192.168.6.1 NAS-Port-Type = Virtual Calling-Station-Id = "000.000.000.000" Cisco-AVPair = "ip:source-ip=000.000.000.000" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 27 modcall[authorize]: module "preprocess" returns ok for request 27 modcall[authorize]: module "chap" returns noop for request 27 modcall[authorize]: module "mschap" returns noop for request 27 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 27 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 27 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 27 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 27 modcall: leaving group authorize (returns ok) for request 27 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 27 modcall[authenticate]: module "unix" returns notfound for request 27 modcall: leaving group authenticate (returns notfound) for request 27 auth: Failed to validate the user. Delaying request 27 for 1 seconds Finished request 27 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 26 ID 88 with timestamp 4472e7cb Sending Access-Reject of id 89 to 192.168.6.1 port 1025 Cleaning up request 27 ID 89 with timestamp 4472e7cb Nothing to do. Sleeping until we see a request. first its 'local' and with sql its 'system', is this ok? when i test the sql statements i get: ==================== Showing rows 0 - 0 (1 total, Query took 0.0004 sec) SQL query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id LIMIT 0 , 30 id UserName Attribute Value op 3 test1 User-Password $1$BnzqweeZ$EJ66Aqwe0/YANJdc8hBC/ := ==================== MySQL returned an empty result set (i.e. zero rows). (Query took 0.0003 sec) SQL query: SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id LIMIT 0 , 30 ==================== Showing rows 0 - 5 (6 total, Query took 0.0004 sec) SQL query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id LIMIT 0 , 30 1 test1 Framed-Protocol PPP = 2 test1 Framed-IP-Address 172.16.3.33 = 3 test1 Framed-IP-Netmask 255.255.255.0 = 4 test1 Framed-MTU 1500 = 5 test1 Framed-Compression Van-Jacobsen-TCP-IP = 6 test1 Service-Type Framed-User = ==================== MySQL returned an empty result set (i.e. zero rows). (Query took 0.0003 sec) SQL query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.op FROM radgroupreply, usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id LIMIT 0 , 30 ==================== i want to know if those results are good, or did i forget something?! the password is encrypted, maybe this is the problem? when i 'check' the password via dialup admin webinterface, it said 'No its wrong' greetings,

2 1