August 2006 - Freeradius-Users - lists.freeradius.org

limiting user access
by simon＠434canada.com 02 Aug '06

02 Aug '06

Hi, Ok, I think I am getting closer. I have defined a new passwd module like so: passwd nas_group { filename = ${raddbdir}/nas_group format = "*NAS-IP-Address:,User-Name" } I have also added a call to nas_group in the authorize section, directly after preprocess: nas_group { notfound = reject } In my nas_group file, i have the following: 255.255.255.255:test_user When I test this out with radtest, I get success no matter what, with whatever user(s) are listed behind the NAS-IP-Address being "added to config_items". What I want though, is to make sure that the user name coming in is listed in the nas_group file after the NAS-IP-Address entry. If it is there, then the password should just be checked against the username, but if the user name is not associated with this NAS-IP-Address, then the attempt should be rejected. So how do I get the rlm_passwd module to check the list of user names against the user name in the incoming request? Thanks, Simon

2 1

EAP-TTLS MD5 hashed Passwords in MySQL Database for WPA-802.1x auth
by Christian Poessinger 02 Aug '06

02 Aug '06

Hello, I'm trying to setup a System to authenticate WLAN users via EAP-TTLS with md5 crypted passwords, stored in a sql database. I'm using MySQL as the Backend and it works great when the passwords are stored in cleartext or UNIX crypt. When i convert the password from crypt to md5 and change pap encryption_scheme to md5 it doen't work anymore. As I have to use the SQL attribute field with 'Crypt-Password' in it, it seems that it wants to use crypt passwords and not md5. I tried to change it to 'md5-password' but well ... that wasn't the answer. Here is the error: --------- modcall: entering group PAP for request 4 rlm_pap: login attempt by "foo" with password bar rlm_pap: Crypt-Password attribute but encryption scheme is not set to CRYPT modcall[authenticate]: module "pap" returns fail for request 4 modcall: leaving group PAP (returns fail) for request 4 auth: Failed to validate the user. TTLS: Got tunneled reply RADIUS code 3 TTLS: Got tunneled Access-Reject --------- Anyone has an Idea how to use the MD5 hashed Passwords in the Database with EAP-TTLS for authentication? I appended my radius configuration. Thanks. ----------- CONFIG ------------ eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no leap { } tls { private_key_file = /etc/ssl/rad.pem certificate_file = /etc/ssl/rad.pem CA_file = /etc/ssl/ca.pem dh_file = /etc/ssl/rad.dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } modules { pap { encryption_scheme = md5 } } authorize { preprocess suffix eap files sql } authenticate { Auth-Type PAP { pap } eap } users-file DEFAULT Auth-Type = PAP Fall-Through = 0 -------- END OF CONFIG -------------

3 10

Cisco's split tunneling policy attribute not returned?
by Geoff Silver 02 Aug '06

02 Aug '06

Running FreeRadius 1.1.0, and I'm wondering if I'm doing something wrong here. We have some users who have a split tunneling policy configured on their account for various historical reasons. The entries look like so: myuser Huntgroup-Name=="Office", Hint==Port-1812, Auth-Type:=Accept CVPN3000-IPSEC-Split-Tunneling-Policy = 1, CVPN3000-IPSEC-Split-Tunnel-List = "SPCCOLO_ST", Class = "OU=AOL-TW", Filter-Id = "SPCCOLO_O" Unfortunately, the split tunneling attributes aren't being returned by radiusd to the client (neither the NAS nor radclient). In testing with radclient, I get: # echo 'User-Name = "myuser", User-Password = "", NAS-IP-Address = 127.0.0.1, NAS-Port = 1' | /opt/bin/radclient -d /opt/share/dictionary/ -x 127.0.0.1:1812 auth foobar Sending Access-Request of id 63 to 127.0.0.1 port 1812 User-Name = "myuser" User-Password = "" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=63, length=42 Class = 0x4f553d414f4c2d5457 Filter-Id = "SPCCOLO_O" Our prior GNU radius setup (which I hate) did this just fine, returning: Sending Access-Request of id 224 to 172.18.165.36 port 1645 User-Name = "myuser" User-Password = "" NAS-IP-Address = 172.18.209.18 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.18.165.36:1645, id=224, length=72 Class = 0x4f553d414f4c2d5457 Filter-Id = "SPCCOLO_O" Vendor-3076-Attr-55 = 0x00000001 Vendor-3076-Attr-27 = 0x535043434f4c4f5f5354 Is there something special I need to do to ensure that the Split-Tunneling attributes are returned upon successful authentication? Running radiusd in debug mode doesn't reveal anything obvious to me: # /opt/reverb/sbin/radiusd -AX Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/reverb/etc/clients.conf Config: including file: /opt/reverb/etc/proxy.conf main: prefix = "/opt/reverb" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/opt/reverb/lib" main: radacctdir = "/var/log/radius" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "reverb" main: group = "reverb" main: usercollide = no main: lower_user = "yes" main: lower_pass = "no" main: nospace_user = "before" main: nospace_pass = "no" main: checkrad = "/opt/reverb/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 1 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 300 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1645 listen: type = "auth" listen: port = 1646 listen: type = "acct" listen: port = 1812 listen: type = "auth" listen: port = 1813 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /opt/reverb/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "none" exec: packet_type = "(null)" Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded preprocess preprocess: huntgroups = "/opt/reverb/etc/huntgroups" preprocess: hints = "/opt/reverb/etc/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes Module: Instantiated preprocess (preprocess) Module: Loaded syslog syslog: hidepasswd = "yes" syslog: logextra = "(null)" syslog: logfacility = "local3" syslog: loglevel = "info" syslog: logname = "radiusd-auth" Module: Instantiated syslog (auth_log) Module: Loaded files files: usersfile = "/opt/reverb/etc/users" files: acctusersfile = "/opt/reverb/etc/acct_users" files: preproxy_usersfile = "/opt/reverb/etc/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) syslog: hidepasswd = "yes" syslog: logextra = "(null)" syslog: logfacility = "local3" syslog: loglevel = "info" syslog: logname = "radiusd-acct" Module: Instantiated syslog (acct_log) syslog: hidepasswd = "yes" syslog: logextra = "User-Name = %{User-Name},Client-IP-Address = %{Client-IP-Address},NAS-IP-Address = %{NAS-IP-Address},NAS-Port = %{NAS-Port}" syslog: logfacility = "local3" syslog: loglevel = "info" syslog: logname = "radiusd-auth" Module: Instantiated syslog (reply_log) Listening on authentication *:1645 Listening on accounting *:1646 Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:36126, id=68, length=64 User-Name = "myuser" User-Password = "" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_rmspace_pair: User-Name now 'myuser' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 radius_xlat: 'Port-1812' modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "auth_log" returns ok for request 0 users: Matched entry myuser at line 28547 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [myuser] (from client localhost port 1) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: 'User-Name = myuser,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,NAS-Port = 1' rlm_syslog: User-Name = %{User-Name},Client-IP-Address = %{Client-IP-Address},NAS-IP-Address = %{NAS-IP-Address},NAS-Port = %{NAS-Port} expands to User-Name = myuser,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,NAS-Port = 1 modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 68 to 127.0.0.1 port 36126 Class = 0x4f553d414f4c2d5457 Filter-Id = "SPCCOLO_O" Finished request 0 Going to the next request

2 2

limiting user access
by simon＠434canada.com 02 Aug '06

02 Aug '06

>> I am setting up a single server to handle various access points at >> various locations. Is there a mechanism to limit access to a >> particular access point based on the username? > There are generic mechanisms to configure the server to do what you >want. I suggest putting the users into a group (see man rlm_passwd), >and then keying off of the NAS IP address to ensure that people not in >that group are denied access. See the FAQ. > > Alan DeKok. Will this mechanism work if I am using MySQL as a backend to store user information? I have looked over the man pages and the FAQ for rlm_passwd, and am still not sure how it all fits together. Are there other sources I could look at for more information? How does the module know which file to read when it initializes? And since this does not support dynamic updates of the files, would it still be a good option if the file will be changed in a dynamic fashion? Thanks again, Simon

1 0

huntgroups and mysql
by simon＠434canada.com 02 Aug '06

02 Aug '06

Hi, I want to restrict access for particular access points based on a user name. So a particular user can be authenticated on several access points (through a single freeRadius server) but should be denied access on others. I have been reading around, and I think that the way to approach this is through the use of huntgroups. I am not sure what changes need to be incorporated to make this work properly. I am running freeRadius 1.1.2, and am using mySQL 5 as a backend. Here is what I have started with. I set up an entry in the huntgroups file something like this: groupname1 NAS-IP-Address == 192.168.2.3 Group = firstgroup Then, in my database, I would need the following entries in the following tables: -- radcheck -- id UserName Attribute Value Op 1 test Password testp == 2 test Huntgroup-Name groupname1 == -- usergroup -- id UserName GroupName 1 test firstgroup Is this all that needs to be done? The goal here is to allow user "test" to be authenticated when he tries to connect from the NAS with IP address 192.168.2.3. If he tries to be authenticated through another NAS, then it should be rejected. My other question is if I want user "test" to know be allowed to authenticate through another NAS (in addition to the previous one), what needs to be done? I would think that I would need to make another entry for the second NAS in the huntgroups file (giving a Group = secondgroup key-value pair), and then make another entry in the usergroup table with UserName "test" and GroupName "secondgroup". If I am way off, other suggestions would also be greatly appreciated. Thanks, Simon

3 2

Free Radius 1.1.2, Fedora 5 & "invalid ELF header"
by Bill 02 Aug '06

02 Aug '06

Hi, I am replacing a server that is currently running RedHat 9 and FreeRadius 0.9.3 to a newer server with Fedora 5 and FreeRadius 1.1.2. While using my old FreeRadius notes I've come across this error message on startup that I can't seem to beat. I've tried configuring FreeRadius with "--disable-shared" and "--with-gnu-ld" seperately and neither of these worked. My older of FreeRadius (0.9.3) won't even make on Fedora 5. I normally configure it using: ./configure --with-radacctdir=/var/log --with-raddbdir=/etc/raddb --with-log dir=/var/log/radacct This is the error from /var/log/radacct/radius.log Error: radiusd.conf[1565] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header Some of the errors had the rlm_exec.a path as these. You can see the "usr" in the path was "busted". Pb<ED>?/local/lib/rlm_exec.a P2<D2>?/local/lib/rlm_exec.a <F8><e?/local/lib/rlm_exec.a h<C2>??/local/lib/rlm_exec.a Thanks, Bill

3 2

rlm_perl CORE DUMPED(part 3)
by KES 02 Aug '06

02 Aug '06

Здравствуйте, freeradius-users. # perl -v This is perl, v5.8.7 built for i386-freebsd-64int sorry for many posts... -- С уважением, KES mailto:kes-kes@yandex.ru

2 1

freeradius-1.1.1 + mschap + ldap with encrypted password
by wekz 02 Aug '06

02 Aug '06

Hi all, I've configured freeradius-1.1.1 to do eap-tls and peap to authenticate windows wireless users against an ldap. The problem now is that I have to authenticate doing peap against an ldap which has userpassword encrypted ( and is a point that I can't change unless it is impossible to do ). I know that when I'm using peap what I finally use is mschapv2 and that this protocol makes a challenge ( with username, password and somestuff ) that the user must response. As my ldap-user-passwords are encrypted and microsoft clients make the response with a clear-test password, it couldn't work. At least that's what I've understood ( and my knowledge about this is very limited, so correct me if I'm wrong ). My question is if there is anyway to make it work configuring ntlm_auth ? Thanks in advance.

2 2

Error with libmysqlclient_r.so.14
by Bruno Machado 02 Aug '06

02 Aug '06

Hi all Im trying to use Radius, but Im receiving this error: rlm_sql (sql): Could not link driver rlm_sql_mysql: libmysqlclient_r.so.14: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1825] Unknown module "sql". radiusd.conf[1754] Failed to parse authorize section. The server already have MySQL 5.0.22 installed. Anybody knows what is happening? Thanks --------------------------------- Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora!

2 2

help
by c k 02 Aug '06

02 Aug '06

Hi friends, I want to deploy freeradius authentication in my wireless lan. I m using EAP-TLS with Windows XP SP2 inbuilt supplicant. Everything works fine till the freeradius server and hostapd is initialized.But then i think authentication fails.It shows a list of "REAUTH_TIMER entering state INITIALIZE" message.For more details i m pasting he hostapd output.Plz help. hostapd -dd hostapd.conf Configuration file: hostapd.conf ctrl_interface_group=0 madwifi_set_iface_flags: dev_up=0 Using interface ath0 with hwaddr 00:15:6d:50:02:53 and ssid 'Havanet-EDS' ath0: RADIUS Authentication server 192.168.2.224:1812 ath0: RADIUS Accounting server 192.168.2.224:1813 madwifi_set_ieee8021x: enabled=1 madwifi_configure_wpa: group key cipher=1 madwifi_configure_wpa: pairwise key ciphers=0xa madwifi_configure_wpa: key management algorithms=0x1 madwifi_configure_wpa: rsn capabilities=0x0 madwifi_configure_wpa: enable WPA= 0x1 madwifi_set_iface_flags: dev_up=1 WPA: group state machine entering state GTK_INIT GMK - hexdump(len=32): [REMOVED] GTK - hexdump(len=32): [REMOVED] WPA: group state machine entering state SETKEYSDONE madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1 madwifi_set_privacy: enabled=1 ath0: RADIUS Sending RADIUS message to accounting server ath0: RADIUS Next RADIUS client retransmit in 3 seconds SIOCGIWRANGE: WE(compiled)=19 WE(source)=13 enc_capa=0xf Flushing old station entries madwifi_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3 Deauthenticate all stations l2_packet_receive - recvfrom: Network is down Wireless event: cmd=0x8c03 len=20 ath0: STA 00:16:b6:99:81:13 IEEE 802.11: associated New STA ath0: STA 00:16:b6:99:81:13 WPA: event 1 notification madwifi_del_key: addr=00:16:b6:99:81:13 key_idx=0 ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: start authentication IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_KEY_TX entering state NO_KEY_TRANSMIT IEEE 802.1X: 00:16:b6:99:81:13 KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:16:b6:99:81:13 CTRL_DIR entering state IN_OR_BOTH IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state IDLE IEEE 802.1X: 00:16:b6:99:81:13 KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:16:b6:99:81:13 CTRL_DIR entering state FORCE_BOTH IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 KEY_RX entering state NO_KEY_RECEIVE ath0: STA 00:16:b6:99:81:13 WPA: start authentication WPA: 00:16:b6:99:81:13 WPA_PTK entering state INITIALIZE madwifi_del_key: addr=00:16:b6:99:81:13 key_idx=0 WPA: 00:16:b6:99:81:13 WPA_PTK_GROUP entering state IDLE WPA: 00:16:b6:99:81:13 WPA_PTK entering state AUTHENTICATION WPA: 00:16:b6:99:81:13 WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state DISCONNECTED ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: unauthorizing port madwifi_set_sta_authorized: addr=00:16:b6:99:81:13 authorized=0 IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state RESTART IEEE 802.1X: station 00:16:b6:99:81:13 - new auth session, clearing State IEEE 802.1X: Generated EAP Request-Identity for 00:16:b6:99:81:13 (identifier 0, timeout 30) IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:16:b6:99:81:13 (identifier 0) TX EAPOL - hexdump(len=42): 00 16 b6 99 81 13 00 15 6d 50 02 53 88 8e 01 00 00 18 01 00 00 18 01 57 65 6c 63 6f 6d 65 54 6f 48 61 76 61 6e 65 74 57 44 53 IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=0 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAP packet (code=2 id=0 len=11) from STA: EAP Response-Identity (1) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: STA identity 'client' IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet ath0: RADIUS Sending RADIUS message to authentication server ath0: RADIUS Next RADIUS client retransmit in 0 seconds IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 5 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:16:b6:99:81:13 WPA: event 5 notification WPA: 00:16:b6:99:81:13 WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state ABORTING IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state INITIALIZE ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: aborting authentication IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state RESTART IEEE 802.1X: station 00:16:b6:99:81:13 - new auth session, clearing State IEEE 802.1X: Generated EAP Request-Identity for 00:16:b6:99:81:13 (identifier 1, timeout 30) IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state IDLE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:16:b6:99:81:13 (identifier 1) TX EAPOL - hexdump(len=42): 00 16 b6 99 81 13 00 15 6d 50 02 53 88 8e 01 00 00 18 01 01 00 18 01 57 65 6c 63 6f 6d 65 54 6f 48 61 76 61 6e 65 74 57 44 53 IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=1 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAP packet (code=2 id=1 len=11) from STA: EAP Response-Identity (1) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: STA identity 'client' IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet ath0: RADIUS Sending RADIUS message to authentication server ath0: RADIUS Next RADIUS client retransmit in 0 seconds IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=0 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=1 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAP packet (code=2 id=1 len=11) from STA: EAP Response-Identity (1) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: STA identity 'client' IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE ath0: STA 00:00:00:00:00:00 RADIUS: Resending RADIUS message (id=0) ath0: RADIUS Next RADIUS client retransmit in 3 seconds IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE ath0: STA 00:16:b6:99:81:13 RADIUS: Resending RADIUS message (id=2) ath0: STA 00:16:b6:99:81:13 RADIUS: Resending RADIUS message (id=1) ath0: RADIUS Next RADIUS client retransmit in 3 seconds. The authentication does not get successful and the wireless network notification icon on the windows XP side shows "validating" status for hours. Plzzz help. --------------------------------- How low will we go? Check out Yahoo! Messengers low PC-to-Phone call rates.

2 1