June 2006 - Freeradius-Users - lists.freeradius.org

Eap/TLS Problem !!
by Emerson 21 Jun '06

21 Jun '06

Dear Freeradius user's, a cuple days i have a problem with my radius server, i can not authenticate clients. Freeradius 1.1.1 with Eap/TLS + MYSQL running in slack 10.1 My radius client is a wl5460-AP and i use a pci wireless to auth in ap linked in my radius. But now, my pci wireless link in AP, but nothing passes trought, "ping" not work for any local. I try to execute freeradius in debug mode (radiusd -X), it only show this messages in loop. I can not understand this errors..... Anyone Can Help-me, i need this Radius Server Working.....Thak's to all...... Emerson ***************************************************** rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 75 modcall: leaving group authenticate (returns handled) for request 75 Sending Access-Challenge of id 174 to 10.254.0.254 port 2053 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 EAP-Message = 0x014c00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbdef72a1d8e3188e972218ab20f569f1 Finished request 75 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 74 ID 173 with timestamp 4497f091 Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.254:2053, id=175, length=191 User-Name = "usuario1" NAS-IP-Address = 10.254.0.254 NAS-Port = 0 Called-Station-Id = "004f62087474" Calling-Station-Id = "0014a53c478d" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x024c000d017573756172696f31 State = 0xbdef72a1d8e3188e972218ab20f569f1 Message-Authenticator = 0x75c255ea144b5d1a2864236a85e01e83 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 76 modcall[authorize]: module "preprocess" returns ok for request 76 rlm_eap: EAP packet type response id 76 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 76 radius_xlat: 'usuario1' rlm_sql (sql): sql_set_user escaped user --> 'usuario1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'usuario1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'usuario1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'usuario1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'usuario1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 76 modcall: leaving group authorize (returns updated) for request 76 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 76 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 76 modcall: leaving group authenticate (returns handled) for request 76 Sending Access-Challenge of id 175 to 10.254.0.254 port 2053 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 EAP-Message = 0x014d00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8576b5091495b6b611506711da5f4530 Finished request 76 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 75 ID 174 with timestamp 4497f096 Waking up in 5 seconds...

3 2

Segmentation fault
by pinakee 21 Jun '06

21 Jun '06

Hi, Whenever I try to run radeapclient as the following: radeapclient -x localhost auth testing123 <req.txt I get a segmentation fault. Following is req.txt: User-Name = "bob" EAP-MD5-Password = "hello" NAS-IP-Address = 192.168.150.33 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "bob" Message-Authenticator = 0x00 NAS-Port=0 Can someone let me know the reason and how to fix this? Thanks, Pinakee Biswas Chief Solution Architect XIUS (A Megasoft LTD division) Ph: 9949495958 (M)

1 0

Fwd: Filter attributes when proxying
by Martin Zuziak 20 Jun '06

20 Jun '06

Hello all I didn't get any response the first time I sent this so I'm trying again. Any chance of having such a feature implemented? Sincerely, Martin Zuziak <zuziak(a)math.ku.dk> PS: Don't worry, if I don't get any answer this time, I'll shut up :) ----- Forwarded message from Martin Zuziak <zuziak(a)math.ku.dk> ----- Date: Thu, 1 Jun 2006 10:34:19 +0200 From: Martin Zuziak <zuziak(a)math.ku.dk> To: freeradius-users(a)lists.freeradius.org Subject: Filter attributes when proxying Hello all Is it possible to (easily) remove single attributes sent or received when proxying? I know it can be done with attr_filter but if you only want to remove a single attribute while leaving the rest untouched, you need pass rules for every other attribute. It doesn't look like attr_rewrite can remove attributes. Am I wrong? Otherwise I think this would be a nice feature to implement. The attr_filter module can easily (I think) be changed to include a variable to control whether or not passing rules are needed to allow an attribute. Currently attributes are only allowed if they don't fail any rules in attrs and pass at least one rule: if (fail == 0 && pass > 0) This could be changed to something like if (fail == 0 && (pass > 0 || allow_no_match)) where a variable in the attrs file could control if passing rules are required. Sincerely, Martin Zuziak <zuziak(a)math.ku.dk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----- End forwarded message -----

2 3

RE: freeradius-mysql rpm
by Jin Fan 20 Jun '06

20 Jun '06

Please read below. -----Original Message----- From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jfan=cwlab.com@lists.freeradius.org] On Behalf Of Abul Monsur Mannan Sent: Monday, June 19, 2006 10:29 AM To: FreeRadius users mailing list Subject: Re: freeradius-mysql rpm First of all Thank U Jin Fan very much for the detail email. Can U clarify something more ! 1. Where(path) u unzip the rpm file ? You can unzip the rpm anywhere you want. I unzipped it in WINDOW using 7-zip, then scp. Lol. 2. Would u please tell me about ur advice" Then load the first file " - load means what ? copy or move ? Yes, you COPY the file to /usr/lib/ directory. Please light on me . On 6/19/06, Jin Fan <jfan(a)cwlab.com> wrote: > I am using an older version of freeradius 1.0.2 and Fedora 4. > > My way to solve the missing rlm_sql_mysql.so problem is the following. > > 1. I download the freeradius-mysql rpm package from this website. > http://rpmfind.net/linux/RPM/fedora/updates/1/i386/freeradius-mysql-0. > 9. > 3-1.1.i386.html > > 2. Then I used 7-Zip to extract rlm_sql_mysql.so from the rpm. There > are two files in the rpm, rlm_sql_mysql-1.0.2.so and rlm_sql_mysql.so. > The second file is the link file to the first file. > > 3. Then load the first file into /use/lib/ folder, which contains all > the link library files. Make a link to the file and name it > rlm_sql_mysql.so. You also need to use chmod command to change the > file permission. > > 4. Restart freeradius server and it might run. > > You might need to find the correct rpm package for your system. > > Jin Fan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

mpd+freeradius+AD
by Егоров Сергей 20 Jun '06

20 Jun '06

Hi all! I have completed setup of mpd+freeradius+AD 2003. Now my users authenticating from Active Directory, if they are members of specific group. But I still have some questions: 1. How to make a different timeouts for different groups in AD 2. How to appoint special IP for special users 3. How to restrict users to access only to defined IP in my network

1 0

RPM build problems on RedHat AS4
by B Thompson 20 Jun '06

20 Jun '06

Hi Following previous posts on this mailing list I patched my freeradius.spec as shown at the end of this email. I ran rpmbuild -bb and got the lib_eap packaging problems and during the build many messages like this :- (cd /usr/src/redhat/BUILD/freeradius-1.1.2/src/modules/rlm_eap; /bin/sh /usr/src/redhat/BUILD/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -modul\e -export-dynamic -o rlm_eap.la -rpath /usr/lib rlm_eap.lo eap.lo mem.lo state.lo rlm_eap.c eap.c mem.c state.c /usr/src/redhat/BUILD/freeradius-1.1.2/src/lib\/libradius.la libeap/libeap.la -lltdl -lnsl -lresolv -lpthread) gcc -shared rlm_eap.lo eap.lo mem.lo state.lo -L/usr/src/redhat/BUILD/freeradius-1.1.2/src/lib/.libs -L/usr/lib -lradius -leap -lltdl -lnsl -lresolv -lpthre\ad -Wl,-soname -Wl,rlm_eap-1.1.2.so -o .libs/rlm_eap-1.1.2.so /usr/bin/ld: cannot find -leap collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap.la' with the above command before installing it libtool: install: warning: remember to run `libtool --finish /usr/lib' gmake[6]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1.2/src/modules/rlm_eap' I then ran rpmbuild again and although I don't remember changing anything it worked fine and built me an rpm. However when I came to install, I still have the following dependency problem :- error: Failed dependencies: /usr/local/bin/perl is needed by freeradius-1.1.2-0.i386 The output of "whereis perl" :- perl: /usr/bin/perl /usr/local/bin/perl /usr/share/man/man1/perl.1.gz # ls -l /usr/local/bin/perl lrwxrwxrwx 1 root root 13 Jun 21 2004 /usr/local/bin/perl -> /usr/bin/perl Could anyone suggest why I am gettting the failed dependendcy? Thanks Ben Thompson Here is the patch :- --- freeradius.spec.orig 2006-05-21 18:32:53.000000000 +0100 +++ freeradius.spec 2006-06-20 11:40:59.000000000 +0100 @@ -38,6 +38,9 @@ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make +sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile + + %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT @@ -111,6 +114,18 @@ %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd + +%doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX +%doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema +%doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend +%doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover +%doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas +%doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file +%doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ +%doc doc/rlm* doc/supervise-radiusd.txt +%doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL + + %changelog * Thu Dec 15 2004 Alan DeKok - update for 1.1.0

1 0

Re[2]: rlm_detail bug when "locking = yes"
by Michael Chernyakhovsky 20 Jun '06

20 Jun '06

Nicolas wrote: >> we need close outfd right before "return RLM_MODULE_FAIL;" at line 236. > .... or get the fixes from CVS head which solve many other problems > in rlm_detail. (for example file renamed or unlinked by another > program) > Everyone will save a considerable amount of time if you could backport > the changes from CVS to 1.1.2, run tests to check the new code, and > send unified diff to the list. > http://freeradius.org/radiusd/doc/DIFFS i try to examine snapshot-20060616 btw, there are old bug in rlm_detail.c. 279: if ((outfd = open(buffer, O_WRONLY | O_APPEND | O_CREAT, 280: inst->detailperm)) < 0) { 281: radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", 282: buffer, strerror(errno)); 283: return RLM_MODULE_FAIL; 284: } 286: /* 287: * If we fail to aquire the filelock in 80 tries 288: * (approximately two seconds) we bail out. 289: */ 290: if (inst->locking) { 291: lseek(outfd, 0L, SEEK_SET); 292: if (rad_lockfd_nonblock(outfd, 0) < 0) { 293: close(outfd); 294: tv.tv_sec = 0; 295: tv.tv_usec = 25000; 296: select(0, NULL, NULL, NULL, &tv); 297: lock_count++; 298: continue; 299: } open() executed once. but while we failed to get lock at first try, close(outfd) executed and all the subsequent attempts to lock file fails i comment line 293 out. After this i havn't got any messages like "Error: rlm_detail: Failed to aquire filelock for /var/log/radius/radacct/detail, giving up" in log! so now rlm_detail with "lock=yes" and radrelay all works fine. Mike.

2 2

Freeradius with Win2K Active Directory
by Naveen 19 Jun '06

19 Jun '06

Hi Experts, I am new to freeradius. Can some one point me how to do the Authenticate users in Windows 2000 Active Directory with Freeradius. Is there any how to / step by step document available? Thanks for your Help Regards Naveen

1 0

Re: Auth Problems 2 !!
by Emerson 19 Jun '06

19 Jun '06

Hi Alan, in mysql table, i remove this options ":= Local", and now others errors appear: Thank's a Lot Alan..... Emerson rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 7791:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 7791:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 3 modcall: leaving group authenticate (returns reject) for request 3 auth: Failed to validate the user. Login incorrect: [usuario1/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Delaying request 3 for 1 seconds Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 65 with timestamp 4496e659 Cleaning up request 1 ID 66 with timestamp 4496e659 Cleaning up request 2 ID 67 with timestamp 4496e659 Sending Access-Reject of id 68 to 10.254.0.254 port 2053 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 3 ID 68 with timestamp 4496e659 Nothing to do. Sleeping until we see a request.

2 1

peap cisco edirectory & windows xp
by Marc-Andre Vallee 19 Jun '06

19 Jun '06

Hi, I'm trying to make windows xp (sp2) work with cisco Aironet 1130AG series Access Point with 802.1x authentification on a freeradius server. I'm using freeradius 1.0.5 from SLES9 SP3. The eDirectory (LDAP) authentification seems to be working, ntradping works fine in chap, and logs shows success. Looks like it's the PEAP that is not working. After some research, I've even installed KB 885453 from MS, also KB893357 without any help... Is someone able to tell me where the problem is ? cisco ? freeradius ? windows ? I've seen a similar setup agains a 3com access point, that worked. Basicly, it's the same cfg file, adapted..... Thanks a lot Marc Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "CN=radius_admin,O=GES" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/raddb/certs/rootder.b64" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypassword" ldap: basedn = "O=GES" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8113028 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "mysecret" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 User-Name = "complys" Framed-MTU = 1400 Called-Station-Id = "0014.f1ae.0210" Calling-Station-Id = "0013.ce6e.6cf3" Service-Type = Login-User Message-Authenticator = 0x41f142dff44964dfc0d97cb331892429 EAP-Message = 0x0202000c01636f6d706c7973 NAS-Port-Type = Wireless-802.11 NAS-Port = 326 NAS-IP-Address = 10.60.255.5 NAS-Identifier = "2300-2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "complys", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for complys radius_xlat: '(cn=complys)' radius_xlat: 'O=GES' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as CN=radius_admin,O=GES/mypassword to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in O=GES, with filter (cn=complys) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user complys authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 50 to 10.60.255.5:1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf0fc7e3df1b791cb726358765b041b83 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 Sending duplicate reply to client wifi:1645 - ID: 50 Re-sending Access-Challenge of id 50 to 10.60.255.5:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 50 with timestamp 4496f5b0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 User-Name = "complys" Framed-MTU = 1400 Called-Station-Id = "0014.f1ae.0210" Calling-Station-Id = "0013.ce6e.6cf3" Service-Type = Login-User Message-Authenticator = 0x41f142dff44964dfc0d97cb331892429 EAP-Message = 0x0202000c01636f6d706c7973 NAS-Port-Type = Wireless-802.11 NAS-Port = 326 NAS-IP-Address = 10.60.255.5 NAS-Identifier = "2300-2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "complys", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for complys radius_xlat: '(cn=complys)' radius_xlat: 'O=GES' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in O=GES, with filter (cn=complys) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user complys authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 50 to 10.60.255.5:1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdc004b86ccc1febf7e0fb8fc813caf00 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 Sending duplicate reply to client wifi:1645 - ID: 50 Re-sending Access-Challenge of id 50 to 10.60.255.5:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 50 with timestamp 4496f5ba Nothing to do. Sleeping until we see a request. Marc-Andre Vallee, CLE9, CLE, CLP, CNA Conseiller, Integration et technologies Complys technologies inc. Solutions informatiques sur mesure pour votre entreprise. Montreal : (514) 645-2875 Quebec : (418) 648-9270 http://www.complys.com AVIS DE CONFIDENTIALITE: L' information transmise avec ce courrier electronique est de nature privilegie et confidentielle. Elle est destinee l'usage exclusif de son destinataire. Si vous n'etes pas le destinataire vise, vous etes par la presente avise qu'il est strictement interdit d'utiliser cette information, de la copier, la distribuer ou la diffuser. Veuillez s'il vous plait contacter l'expediteur initial du courrier electronique et le detruire de votre ordinateur.

1 0