July 2006 - Freeradius-Users - lists.freeradius.org

Handling request from OpenSer in Freeradius - I need help
by GlobeInPhotos 12 Jul '06

12 Jul '06

Hi I have problem to properly handle OpenSer request in Freeradius. When I switch on debug mode in freeradius I've got LISTING 1 (below). In the first part of log we can see that INVITE message was received and authorize_check (defined by _check_query ) SQL statement was called and I've got proper result. After that message was parsed and values from Digest-Attributes was moved to named Digest- attributes e.g Digest-Method In my radius solution I have to return to OpenSer few attributes when I detect that Digest-Method is equal to INVITE. But I cannot return attributes by authorize_check because when authotize_check db procedure is called Digest-Method is not set (only I can see Digest-Attributes). After call to authorize_check, freeradius parse request and I have complete set of values: Digest-User-Name = "test001" Digest-Realm = "server1.test.pl" Digest-Nonce = "44b414bb1e6165386992a6c367a1ce2b1682ba32" Digest-URI = "sip:+4800001@server1.test.pl" Digest-Method = "INVITE" But after this part only one DB procedure is called: test.postauth() (defined by postauth_query in postgres.sql) but this procedure cannot return attributes - It can returns only one string. I have questions: - how to return list attributes when message is parsed ? Is it possible to configure that radius will call sql statement after parsing a message - how to access all Digest-Attrbute from unparsed message when I put '%{Digest-Attributes}' in query I can see only first attribute - Is possible to control order of parsing in my example orders is: - receive of 'raw' request - execution authorize check - parsing of raw message (message "mod_digest: Converting Digest-Attributes to something sane") But in post http://lists.freeradius.org/mailman/htdig/freeradius-users/2004-September/03 6519.html order is following - receive of 'raw' request - parsing of raw message (message "mod_digest: Converting Digest-Attributes to something sane") - execution authorize check Do you know how to achieve last order ? Should I change something in conf. files? Part of my postgres.conf file: authorize_check_query = "SELECT * FROM test.authorize_check('%{SQL-User-Name}', '%{Digest-URI}', '%{Service-Type}')" postauth_query = "SELECT test.postauth('%{Digest-Method}', '%{Digest-Attributes:-0}', '%{Digest-Attributes:-3}')" LISTING 1 --------- rad_recv: Access-Request packet from host 153.19.130.250:34032, id=245, length=237 User-Name = "test001(a)server1.test.pl" Digest-Attributes = "\n\ttest001" Digest-Attributes = "\001\026server1.test.pl" Digest-Attributes = "\002*44b414bb1e6165386992a6c367a1ce2b1682ba32" Digest-Attributes = "\004#sip:+4800001@server1.test.pl" Digest-Attributes = "\003\010INVITE" Digest-Response = "1475e3bd94becc734d77893ddcd70046" Service-Type = IAPP-Register Sip-URI-User = "test001" NAS-Port = 5060 NAS-IP-Address = 153.19.130.250 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 3 rlm_realm: Looking up realm "server1.test.pl" for User-Name = "test001(a)server1.test.pl" rlm_realm: No such realm "server1.test.pl" modcall[authorize]: module "suffix" returns noop for request 3 users: Matched entry DEFAULT at line 5 users: Matched entry DEFAULT at line 42 modcall[authorize]: module "files" returns ok for request 3 radius_xlat: 'test001(a)server1.test.pl' rlm_sql (sql): sql_set_user escaped user --> 'test001(a)server1.test.pl' radius_xlat: 'SELECT * FROM test.authorize_check('test001(a)server1.test.pl', '', '')' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT * FROM test.authorize_check('test001(a)server1.test.pl', '', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: '' radius_xlat: '' radius_xlat: '' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "test001" Digest-Realm = "server1.test.pl" Digest-Nonce = "44b414bb1e6165386992a6c367a1ce2b1682ba32" Digest-URI = "sip:+4800001@server1.test.pl" Digest-Method = "INVITE" A1 = test001:server1.test.pl:gdfi A2 = INVITE:sip:+4800001@server1.test.pl H(A1) = 1307e5525ca6a7907307ad0af15dbb42 H(A2) = 5bfbcc6c93b4debf70853f609176ff45 KD = 1307e5525ca6a7907307ad0af15dbb42:44b414bb1e6165386992a6c367a1ce2b1682ba32:5b fbcc6c93b4debf70853f609176ff45 EXPECTED 1475e3bd94becc734d77893ddcd70046 RECEIVED 1475e3bd94becc734d77893ddcd70046 modcall[authenticate]: module "digest" returns ok for request 3 modcall: leaving group authenticate (returns ok) for request 3 Login OK: [test001(a)server1.test.pl/<no User-Password attribute>] (from client server1 port 5060) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test001(a)server1.test.pl' rlm_sql (sql): sql_set_user escaped user --> 'test001(a)server1.test.pl' radius_xlat: 'SELECT test.postauth('=5Cn=5Cttest001', '=5Cn=5Cttest001', '=5Cn=5Cttest001')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is SELECT test.postauth('', '=5Cn=5Cttest001', '=5Cn=5Cttest001') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT test.postauth('', '=5Cn=5Cttest001', '=5Cn=5Cttest001') Regards Michal Szymanski -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.9.10/384 - Release Date: 2006-07-10

1 0

Ignoring unconnected handle 4..
by Abul Monsur Mannan 11 Jul '06

11 Jul '06

Hello FR users Can anyone here to light on me.My problem is -- [root@localhost ~]# radtest rumen rumen1 localhost 1812 testing123 Sending Access-Request of id 66 to 127.0.0.1 port 1812 User-Name = "rumen" User-Password = "rumen1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 66 to 127.0.0.1 port 1812 User-Name = "rumen" User-Password = "rumen1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 ------------------------------------------------------ In radiusd -x command promp-- rad_recv: Access-Request packet from host 127.0.0.1:32769, id=66, length=57 User-Name = "rumen" User-Password = "rumen1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 23 modcall[authorize]: module "preprocess" returns ok for request 23 modcall[authorize]: module "chap" returns noop for request 23 modcall[authorize]: module "mschap" returns noop for request 23 rlm_realm: No '@' in User-Name = "rumen", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 23 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 23 radius_xlat: 'rumen' rlm_sql (sql): sql_set_user escaped user --> 'rumen' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rumen' ORDER BY id' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 23 modcall: leaving group authorize (returns fail) for request 23 Finished request 23 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 23 ID 66 with timestamp 44b33d38 Nothing to do. Sleeping until we see a request. By the way ,I have username - rumen with password rumen1 in "radcheck" table in my mysql DB. Thank You in advance.

2 2

Username in MySQL with regexp
by christian meutes 11 Jul '06

11 Jul '06

Hello list, iam using FreeRADIUS-1.0.5 with MySQL-Backend. Now i want a username check with an regexp operator (=~), so that i can match usernames (+1234567(0-9)) against a regexp of "^\+^1234567" and dont have the need of creating 10 users which have all the same reply attributes. The Auth-Type of these usernames is always "Accept". How can i accomplish this? The username itself in the MySQL table doesnt has a check row.. Thanks for any help! Christian Meutes systems engineer -- claranet gmbh internet service provider tel +49 (0) 69 - 40 80 18 - 300 email: christian.meutes(a)de.clara.net http://www.claranet.de/

3 6

FreeRadius Autostart
by Wasif 11 Jul '06

11 Jul '06

Hi all, I am rephrasing my question. I installed FreeRadius without rpm package on CentOS 4. I want FreeRadius to start automatically in background when System boots up. Thanks Wazb

5 4

Freeradius and UUNet dial up
by Brenckle, Nicholas 11 Jul '06

11 Jul '06

Im having trouble configuring freeradius. Im going to give the full story, which might be too much detail but here goes... I have a radius server (freeradius v 0.7) working on an old box. I want to upgrade this to a new box with RHEL4 and Freeradius 1.0.1, that comes with RHEL4 now. The old configuration files would not just copy over, starting free radius gives errors with the dictionary files. Since I don't quite understand them, I thought better try to reconfigure the new version then just copy over configuration files. Now I have the new version running/authenticating. The problem is Im missing some data, I think. When I authenticate (using NTRadPing) off the old server, I get Sending authentication request to server 111.111.111.111:1812 Transmitting packet, code =1 id=4 length=67 received response from the server in 10 miliseconds reply packet code=2 id=4 length=174 response: Access-Accept -----------------------------------attribute dump ---------------------------------------------- Service-Type=Framed Framed-Protocol=PPP Ascend-Data-Filter=\0x01\0x01\0x00\0x00\0x00\0x00\0x00\0x00\0x00 (repeated lines) Ascent-Assign-IP-Pool=0 When I try against the new one, I get only the lines to "--attribute dump--", but I do get a correct auth. I know that part works because if I change the uname/password to wrong, it doesnt work. So it is correctly checking against LDAP. But I get none of the lower lines. I know the process is not quite right as If I add the lines to my hints file (which exists on the old server) DEFAULT Suffix == "@dial.dsl.net", Strip-User-Name = Yes Hint = "UUNetDial" then I get nothing working. If I comment out those lines, I can authenticate, but with no extra info. (Which I assume is part of the problem.) If I comment the hints lines out, I get this in the output of radiusd rlm_ldap: Bind was successful rlm_ldap: performing search in dc=dsl,dc=net, with filter (&(objectClass=dslnDialupUser)(uid=radius%dsl.net)) rlm_ldap: checking if remote access for radius%dsl.net is allowed by dslnRadiusProfile rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user radius%dsl.net authorized to use remote access if I leave those lines in the hints, it loses the uid, as shown below... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=dsl,dc=net, with filter (&(objectClass=dslnDialupUser)(uid=_)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed So, what I need to know is, why does the hint lines make the uid get stripped? Im guessing the system somewhere else is also doing a strip, and so the double means no UID gets there? Is there any "radius for dummies"? I think Im getting lost as to which process happens when during the process,ie: when does the hints vs clients vs users files come into play. Thanks for any help! Nick

1 0

Log Accountig users......
by Emerson 11 Jul '06

11 Jul '06

Hi, people, i mounted a freeradius and a NAS running linux with hostapd + wpa_supliccant and DHCP. My users authing with wifi 802.1X, always it work. But i need to know if the radius log the IP of user in accounting.....and save this on a table mysql ? Anyone make this work ? Thanks..... Emerson

2 1

Authenticating user with FDS
by Hariharan R 11 Jul '06

11 Jul '06

Hi all, I am using FreeRADIUS1.1.1 with Fedora Directory server as a backend data store. Let us consider the scenario.. I have two servers, one is a mail server and another one is a proxy server. Both servers are configured to use RADIUS+FDS for user authentication. In FDS i have two organizational unit under root domain. For Ex; ou=mailusers,dc=example,dc=com ou=proxyusers,dc=example,dc=com In the 'raddb/radiusd.conf' file i specified the base domain as (In LDAP module) basedn = "dc=example,dc=com" So whenever a client request comes to the RADIUS server it will look for the username in FDS. The problem is, how the RADIUS will identify that whether the request is comes from the 'mail server' or from the 'proxy server'. Because for mailserver users i have to look in the "ou=mailusers,dc=example,dc=com" and for proxy users i have to look in the "ou=proxyusers,dc=example,dc=com". How i can change the LDAP basedn according to the request. Any one pls help me to solve this problem. If u have some other method to achieve my objective pls let me know. --- Regards, Hariharan.R

2 1

show logged in users
by Fretz Marco 10 Jul '06

10 Jul '06

hello anohter question: whats the best way to see which users are logged in? - reading out the pppoe router with snmp for active sessions - search for session ids with start but no stop event i want do the first one. becuase our routers are in isolated management network and i want access the router from our webinterface or some admin hosts.... can i be 100% sure that a user is logged in if there is no stop event? thanks and kind regards marco fretz

2 1

Windows XP keeps "verifying identity"
by Klaas De Craemer 10 Jul '06

10 Jul '06

Hello, I have been trying to set up an Access Point on a soekris-board for some days now, but I keep getting stuck. The certificates are all in place, Freeradius starts up nicely, hostapd seems to work... But the trouble starts in Windows XP SP2: When I try to associate with the AP, it keeps sitting in a "Attempting Verification"-loop. In my freeradius-window, the authentication messages keep scrolling by, but it seems like the Windows-client doesn't "listen" to them.... I am using freeradius 1.0.2 built from source on kernel 2.6.15 Below is some of the Radius-output ("radiusd -X -A") and some of that from hostapd: =================Freeradius====================== rad_recv: Access-Request packet from host 127.0.0.1:1026, id=74, length=245 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x026800500d800000004616030100410100003d030144afac86153ed083623ea17e4a82459787262b54cdb6eb6b33603567da79e78600001600040005000a000900640062000300060013001200630100 State = 0xe1ca3273104420e8f3fa797348da4fbf Message-Authenticator = 0xb662295a5ab68423baa41ed3e1976b0f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 74 modcall[authorize]: module "preprocess" returns ok for request 74 modcall[authorize]: module "chap" returns noop for request 74 modcall[authorize]: module "mschap" returns noop for request 74 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 74 rlm_eap: EAP packet type response id 104 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 74 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 74 modcall: group authorize returns updated for request 74 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 74 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 057b], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 006d], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 74 modcall: group authenticate returns handled for request 74 Sending Access-Challenge of id 74 to 127.0.0.1:1026 EAP-Message = 0x0169040a0dc000000641160301004a02000046030144afaba4db9800c241c6097bfa7eb313e6b163c2c1db2a249c781b6c7e2648f3206bb401df913de39db66c828301156e1d7429bfd2b70632a98e371577d7a57871000400160301057b0b00057700057400025930820255308201bea003020102020101300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039313133395a170d3037303730 EAP-Message = 0x383039313133395a306c310b3009060355040613024245310c300a0603550408130357564c310e300c060355040713055469656c74310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100af6bd5feb703ca2b30d6cecb02524a0fcb8bc364a2c2bc39400561629844d18a24c448656f1cf6964c9a064c82cc3616264e2419e073093ab7289e8688c656f652f8e4e63a9a54dd1492a5757df04bc0ecd4441868f158da2fdadcb4bd31a07243fe8bce413f7fbf85f0 EAP-Message = 0xd006ecbcd62019e26e8c58290e1fe1ccd2189e2c53450203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810052b4fd21f12d8d14ffd712d100fb12a3daa5e681a44b0e2dda3762829611171cfd8d5828a6f1db3216cce98190a1f6a110a66848e8b2846a2da6254a5a42ad21731004b858723fbf9651bdae4915d167ce8b8be8c9167ee7c78b1de730334035d321ceb8196873e73d8ae15c5e6d974d2cca62bff234a117561c16408e25bde9000315308203113082027aa003020102020100300d06092a864886f70d0101040500305c310b3009060355040613024245310c300a06 EAP-Message = 0x03550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d301e170d3036303730383039303733345a170d3039303730373039303733345a305c310b3009060355040613024245310c300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d0a45b7a7abbdc0330bec488c4e5e2fd56eb84f7066d6ce7 EAP-Message = 0xe6ef10a6f757b59a15da4694dc47dde72da145998c53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d981da6b6526a9fc3fe589ab7276e7a Finished request 74 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=75, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x026900060d00 State = 0x7d981da6b6526a9fc3fe589ab7276e7a Message-Authenticator = 0x212c160c65f716be783b7b5466fc4725 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 75 modcall[authorize]: module "preprocess" returns ok for request 75 modcall[authorize]: module "chap" returns noop for request 75 modcall[authorize]: module "mschap" returns noop for request 75 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 75 rlm_eap: EAP packet type response id 105 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 75 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 75 modcall: group authorize returns updated for request 75 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 75 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 75 modcall: group authenticate returns handled for request 75 Sending Access-Challenge of id 75 to 127.0.0.1:1026 EAP-Message = 0x016a024b0d8000000641a423ee3382420f826dd1bfb6cdba0e19a54627841829135284486abb171f2ead064a2b1d3f4261451d82ae9a04dd1b60d6339ec876e7347e33ed82ec712846ccc30bad864cfc8f6784de9ba4f08749a65f290203010001a381e23081df30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041435ac18d86277eb69414cd999bf1b325fa98ea02d3081840603551d23047d307b801435ac18d86277eb69414cd999bf1b325fa98ea02da160a45e305c310b3009060355040613024245310c300a0603550408 EAP-Message = 0x130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d820100300d06092a864886f70d0101040500038181007127f79df3611d53c650b0ed7ee16008f75dc296a0e95db3d97cd80fc7328e1193408c582a40e9dd7b0bafad2dbc335f0be62f1c6e0cb604a686fe7114a8204986a4f93e91213c798add773cb9e2d2265991bef7d13b9c3f614e28a6c94b2f8ac412f1b3fbf5d29a1c771352cb430813a7c084797a1e98fbfb3c127794f38092160301006d0d0000650201020060005e305c310b3009060355040613024245310c EAP-Message = 0x300a0603550408130357564c310b3009060355040a13024e413110300e060355040313074b6c61617344433120301e06092a864886f70d01090116116b6c616173646340676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6e48de8b1b13d264c089c9916447801f Finished request 75 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=76, length=171 User-Name = "KlaasDC" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-02-6F-3C-37-D7:soekris4521" Calling-Station-Id = "00-02-6F-3C-37-D8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x026a00060d00 State = 0x6e48de8b1b13d264c089c9916447801f Message-Authenticator = 0xf29176423b6e75d12aacdfa951f33faf Processing the authorize section of radiusd.conf modcall: entering group authorize for request 76 modcall[authorize]: module "preprocess" returns ok for request 76 modcall[authorize]: module "chap" returns noop for request 76 modcall[authorize]: module "mschap" returns noop for request 76 rlm_realm: No '@' in User-Name = "KlaasDC", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 76 rlm_eap: EAP packet type response id 106 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 76 users: Matched entry KlaasDC at line 97 modcall[authorize]: module "files" returns ok for request 76 modcall: group authorize returns updated for request 76 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 76 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 76 modcall: group authenticate returns handled for request 76 Sending Access-Challenge of id 76 to 127.0.0.1:1026 EAP-Message = 0x016b000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe62d35d365edc5eece99a281849cfdc8 Finished request 76 ===================hostapd======================= IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE DATA (TX callback) ACK IEEE 802.1X: 00:02:6f:3c:37:d8 TX status - version=1 type=0 length=587 - ack=1 DATA IEEE 802.1X: 10 bytes from 00:02:6f:3c:37:d8 IEEE 802.1X: version=1 type=0 length=6 EAP: code=2 identifier=131 length=6 (response) wlan0: STA 00:02:6f:3c:37:d8 IEEE 802.1X: received EAP packet (code=2 id=131 len=6) from STA: EAP Response-TLS (13) IEEE 802.1X: 00:02:6f:3c:37:d8 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute wlan0: RADIUS Sending RADIUS message to authentication server wlan0: RADIUS Next RADIUS client retransmit in 3 seconds IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE wlan0: RADIUS Received 68 bytes from RADIUS server wlan0: RADIUS Received RADIUS message wlan0: STA 00:02:6f:3c:37:d8 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec RADIUS packet matching with station 00:02:6f:3c:37:d8 wlan0: STA 00:02:6f:3c:37:d8 IEEE 802.1X: using EAP timeout of 30 seconds wlan0: STA 00:02:6f:3c:37:d8 IEEE 802.1X: decapsulated EAP packet (code=1 id=132 len=10) from RADIUS server: EAP-Request-TLS (13) IEEE 802.1X: 00:02:6f:3c:37:d8 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:02:6f:3c:37:d8 (identifier 132) IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE DATA (TX callback) ACK IEEE 802.1X: 00:02:6f:3c:37:d8 TX status - version=1 type=0 length=10 - ack=1 IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:02:6f:3c:37:d8 REAUTH_TIMER entering state INITIALIZE ===============================================

3 4

RE: Windows XP keeps "verifying identity"
by Garber, Neal 10 Jul '06

10 Jul '06

> Sending Access-Challenge of id 15 to 127.0.0.1:1027 <snip> > rad_recv: Access-Request packet from host 127.0.0.1:1027, id=0, length=159 <snip> It's receiving the request from a loopback address. Is the client the same machine as the FreeRadius server? Are you really connecting to an Access Point? If so, what is its IP address?

2 1