August 2006 - Freeradius-Users - lists.freeradius.org

ippool auth-type error
by Sascha Djuric 31 Aug '06

31 Aug '06

SORRY NOW WITH PROPER SUBJECT :D hello all im new to radius, but i got freeradius configured with mysql. radtest is working fine for my test user. now i configured an ippool, which get successfully loaded on startup. again radtest works fine, only new thing is the following trace: rlm_ippool: enter postauth rlm_ippool: Could not find Pool-Name attribute. the enter postauth trace was added by me. now i added the Pool-Name to radcheck for my user. after that what happens is: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> rad_recv: Access-Request packet from host 127.0.0.1:34065, id=125, length=55 User-Name = "SVD" User-Password = "secret" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "SVD", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 radius_xlat: 'SVD' rlm_sql (sql): sql_set_user escaped user --> 'SVD' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'SVD' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'SVD' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'SVD' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'SVD' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [SVD] modcall[authorize]: module "sql" returns notfound for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [SVD/secret] (from client localhost port 0) <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<, funny thing is, i dont even see the ippool trace again. i can post more details, but maybe this is a common error. thx in advance for your help

1 0

(no subject)
by Sascha Djuric 31 Aug '06

31 Aug '06

hello all im new to radius, but i got freeradius configured with mysql. radtest is working fine for my test user. now i configured an ippool, which get successfully loaded on startup. again radtest works fine, only new thing is the following trace: rlm_ippool: enter postauth rlm_ippool: Could not find Pool-Name attribute. the enter postauth trace was added by me. now i added the Pool-Name to radcheck for my user. after that what happens is: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> rad_recv: Access-Request packet from host 127.0.0.1:34065, id=125, length=55 User-Name = "SVD" User-Password = "secret" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "SVD", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 radius_xlat: 'SVD' rlm_sql (sql): sql_set_user escaped user --> 'SVD' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'SVD' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'SVD' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'SVD' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'SVD' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [SVD] modcall[authorize]: module "sql" returns notfound for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [SVD/secret] (from client localhost port 0) <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<, funny thing is, i dont even see the ippool trace again. i can post more details, but maybe this is a common error. thx in advance for your help

1 0

FreeRADIUS crashes after EAP/PEAP authentication
by Nick Larsen 30 Aug '06

30 Aug '06

Hi I sent an email to the list with the subject "EAP PEAP, unable to load certificate", but as the subject has changed slightly, I've decided to create a new thread. Has anyone had any issues at all when setting up PEAP? My FreeRADIUS installation, which is used for ADSL/Dial Up AAA (and if I can get it working Wireless AAA), crashes as a wireless client tries to authenticate, but is fine for DSL/Dial Up. I'm running FreeRADIUS 1.1.1 (OpenSSL 0.9.7e-p1 25 Oct 2004). Running on: FreeBSD radius02.01.net.nz 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Wed Nov 2 22:33:15 UTC 2005 root@s-dallas.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC sparc64 FreeRADIUS confuration line: ./configure --sysconfdir=/etc --localstatedir=/var --disable-ltdl-install --with-ltdl-include=/usr/local/include --with-ltdl-lib=/usr/local/lib --with-large-files --with-rlm_sql_unixodbc --without-rlm_krb5 --without-rlm_sql_postgresql --without-rlm_ldap --enable-strict-dependencies --disable-shared --with-openssl-includes=/usr/local/include/openssl --with-openssl-libraries=/usr/local/lib Here is the radiusd -XA output when a wireless user tries to authenticate: Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.199:1812, id=5, length=73 User-Name = "nick" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02010009016e69636b NAS-IP-Address = 10.10.1.199 Message-Authenticator = 0x44a4bae6e408185535e54b666e440793 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'nick' rlm_sql (sql): sql_set_user escaped user --> 'nick' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'nick' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'nick' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'nick' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'nick' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 5 to 10.10.1.199 port 1812 Framed-IP-Address := 10.10.1.197 Service-Type := Framed-User Framed-Protocol := PPP Acct-Interim-Interval := 600 Framed-IP-Netmask := 255.255.255.0 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x441787b224b2cade909f815da10d28a2 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.1.199:1812, id=6, length=156 User-Name = "nick" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202004a198000000040160301003b010000370301d47428dbffab776a5aa27dd1f3ae43b58ba88be83f19c437a92b5e416c87ecf600001000040005000a000900640062000300060100 State = 0x441787b224b2cade909f815da10d28a2 NAS-IP-Address = 10.10.1.199 Message-Authenticator = 0xd35a0b343af33d868016f1faa2c401ca Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "nick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 radius_xlat: 'nick' rlm_sql (sql): sql_set_user escaped user --> 'nick' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'nick' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'nick' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'nick' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'nick' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization Segmentation fault: 11 (core dumped) root@radius02 [/etc/raddb]# Any help at all would be much appreciated, as I have spent hours (and days even) on researching the causes and have found nothing. I know FreeRADIUS is quite capable of doing PEAP, so it must somehow be my configuration. Let me know if there's any info I've left out. -- Regards, Nick Larsen Wellington NEW ZEALAND

3 5

Freeradius crashed on me
by Lisa Casey 30 Aug '06

30 Aug '06

Hi, I have a FreeBSD 5.3 box running freeradius. This box also runs sendmail and does e-mail for a small amount (~50) users. For the past two days I have been trying to rebuild sendmail on this box so it would support SMTP Auth. I have not got that working, but that would be truly off-topic for this list. I'm only mentioning this because it MAY have played a role in what happened with Freeradius. As part of trying to get SMTP Auth working, I installed Cyrus-SASL v2. Again, I have no idea if this has any bearing on what happened with radius or not. I'm working on sendmail, haven't messed with radius at all, radius has been working fine, then I get a call from a customer about 2:00 - he can't get connected. So I took a look at the radius.log and saw this: Wed Aug 30 14:01:37 2006 : Error: radiusd.conf[1299] Failed to link to module 'rlm_counter': Shared object "lib gdbm.so.3" not found, required by "rlm_counter-1.0.1.so" So I paniced. At this point radius wasn't working and none of our customers can get connected. I started trying to "fix" things on an emergency basis. I edited /usr/local/etc/raddb/radiusd.conf and commevnted out my rlm_counter monthly stuff. Then I attempted to restart the radius server. I next got this in radius.log: Wed Aug 30 14:19:28 2006 : Error: ERROR: Cannot find a configuration entry for module "exec". So I edited radiusd.conf again and commented out exec in the Instantiate section. I restarted radius and got this in radius.log: Wed Aug 30 15:07:12 2006 : Error: ERROR: Cannot find a configuration entry for module "expr". So I edited radiusd.conf again and commented out expr in the Instantiate section. I restarted radius and got this in radius.log: I restarted radius and got this in radius.log: Wed Aug 30 15:08:31 2006 : Error: /usr/local/etc/raddb/users[1]: Unexpected trailing comma in check item list f or entry DEFAULT Wed Aug 30 15:08:31 2006 : Error: Errors reading /usr/local/etc/raddb/users Wed Aug 30 15:08:31 2006 : Error: radiusd.conf[1020]: files: Module instantiation failed. So I edited my users file and removed the DEFAULT entry I had at the top for monthly time limits. I then restarted radius and now it works. My question is: What the hell happened? I honestly don't know. I haven't been working on radius or changed anything. What I was doing was installing Cyrus SASL and attempting to rebuild Sendmail. The only thing I can figure is that while I was messing around with SASL and sendmail I did something with shared libraries? I don't have a clue if this is what happened, but if it is I don't know where to go look to see what's wrong with libraries (if anything). Help, please? Anyone? Thanks, Lisa Casey

2 1

(no subject)
by Kartthik 30 Aug '06

30 Aug '06

2 1

Problem using EAP-TTLS
by luigi natalino 30 Aug '06

30 Aug '06

Hello,i've installed freeradius 1.1.2 and I've configured eap-ttls in eap.conf tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } I've not made other changes to this file. I've launched chillispot with --eapolenable option -> chilli --eapolenable I've installed and configured SecureW2 client on WinXP. The problem is that EAP-TTLS are not used as shown in this log: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=valug,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypass" ldap: basedn = "ou=homewifi,dc=valug,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139948 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1041, id=0, length=219 User-Name = "utente" CHAP-Challenge = 0xb8e461988db3fcb15283eae64c342d1b CHAP-Password = 0x0090a807a589b4864d7900bee913da1710 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "XX-XX-XX-XX-XX-XX" Called-Station-Id = "YY-YY-YY-YY-YY-YY" NAS-Identifier = "localhost" Acct-Session-Id = "44f1bf3c00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x81223a8de1013cb55976c322793533a2 WISPr-Logoff-URL = "http://192.168.182.5:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "utente", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 But "Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=valug,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypass" ldap: basedn = "ou=homewifi,dc=valug,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139948 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:1041, id=0, length=219 User-Name = "utente" CHAP-Challenge = 0xb8e461988db3fcb15283eae64c342d1b CHAP-Password = 0x0090a807a589b4864d7900bee913da1710 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "XX-XX-XX-XX-XX-XX" Called-Station-Id = "YY-YY-YY-YY-YY-YY" NAS-Identifier = "localhost" Acct-Session-Id = "44f1bf3c00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x81223a8de1013cb55976c322793533a2 WISPr-Logoff-URL = "http://192.168.182.5:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "utente", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 The authentication seems not to take place through EAP-TTLS. Have I done any mistake in the Freeradius configuration or it depends on SecureW2? Since I use LDAP what Authentication Method i must set insecureW2 (i think PAP) ? What other information I must set? Excuse me for my bad english. Many Thanks, Luigi _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

2 1

Dialupadmin in dedicated server
by Guilherme Franco 30 Aug '06

30 Aug '06

Hello, I need to use Dialup Admin that is installed alone in a dedicated server. In the dialupadmin admin.config, it states thats it needs the /etc/local/radius in the same machine. What can I do? (considering that the freeradius in installed in another server) Thank you.

2 2

1.1.3 on Solaris 10 (sparc)
by Lin Richardson 30 Aug '06

30 Aug '06

I am quite pleased to report I have, with minimal discomfort, version 1.1.3running on Solaris 10. The source actually compiles perfectly once OS dependencies etc. are met. I will share a few tips here for any who may be attempting the same. My main goal was LDAP functionality. Other bells and whistles might require additional steps. Please forgive the Solaris info here, it is dangerously close to being off-topic... except that you need it to install freeradius. ------------------------------- Solaris System Headers Solaris 10 will likely require you to fix the system headers. http://sunfreeware.com/indexsparc10.html. Commands as root: *cd /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/install-tools/ vi mkheaders.conf* - Then put the line "SHELL=/bin/sh" on the first line of the mkheaders.conf file. - It should look something like the following: SHELL=/bin/sh SYSTEM_HEADER_DIR="/usr/include" OTHER_FIXINCLUDES_DIRS="" FIXPROTO_DEFINES="" STMP_FIXPROTO="stmp-fixproto" STMP_FIXINC="stmp-fixinc" Then you run the following command as root. It may take several minutes to rebuild the headers. *./mkheaders *------------------------------- Solaris Packages Solaris 10 has versions of openssl and openLDAP installed I believe with the system. They do not fulfill the compile requirements for freeradius functionality. you should go to http://sunfreeware.com/ and get the packages there, and also resolve any unmet dependencies. If you have other modules you are concerned with that are not building correctly, don't trust the OS packages. Look for equiv packages and try the build with them installed as well. download package gunzip packagename.gz sudo pkgadd -d packagename ------------------------------- Installing FreeRadius Installing actually went off without a hitch. ./configure, make, sudo make install No problems except I needed the packages so rlm_ldap would compile properly. ------------------------------- RunTime Environment In order for the ldap queries to work, the following needs to be set as an environmental variable, OR if you're handy with compiler flags you can take care of it during the compile with the `-RLIBDIR' linker flag. *export LD_LIBRARY_PATH="/usr/local/lib/;/usr/local/freeradius-1.1.3/lib"* The two locations in the above path are for access to the libgcc_s.so.1 libraries and the rlm_ldap libraries respectively.

5 4

How to return the values from the exec program to free radius?
by Shankar Ganesh C 30 Aug '06

30 Aug '06

Hi All, Could some body help me to know how to return values from the exec program ? I can understand that I need to use the output-pairs or reply list .But do not really know how to use that any sample code or document would really help me. Thanks and regards Shankar ganesh

2 2

wpa auth.xp stuck on login
by Collen Blijenberg 30 Aug '06

30 Aug '06

Good day to you all, I'm kinda stuck with authenticating a windows xp sp2 laptop to a wlan - ap that uses wpa. i followed the 802.1X port based auth howto from tldp.org but no luck. the idea is to use ms-chapv2,eap,tls,peap in the log file i can see the user auth. come by, but no errors or problems showed up. the other day, a friend tried is with his mac i-book, and he did get in!? but now my xp machine doesn't.. dunno where it goes wrong.. starting radiusd -XX gives alot of output, but no error's shown either. here is a small dump.. --------- rad_recv: Access-Request packet from host 10.0.0.20:3072, id=0, length=125 User-Name = "collen" NAS-IP-Address = 10.0.0.20 Called-Station-Id = "0016b69e59c3" Calling-Station-Id = "00166f980e78" NAS-Identifier = "0016b69e59c3" NAS-Port = 46 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000b01636f6c6c656e Message-Authenticator = 0xe97abfadc688db9d412503fc8a0e283f Wed Aug 30 15:53:02 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authorize for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 0 Wed Aug 30 15:53:02 2006 : Debug: radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830' Wed Aug 30 15:53:02 2006 : Debug: rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP packet type response id 0 length 11 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Aug 30 15:53:02 2006 : Debug: users: Matched entry collen at line 217 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authorize (returns updated) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rad_check_password: Found Auth-Type EAP Wed Aug 30 15:53:02 2006 : Debug: auth: type "EAP" Wed Aug 30 15:53:02 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authenticate for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP Identity Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: processing type tls Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Initiate Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Start returned 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.0.0.20 port 3072 Reply-Message = "Go and See your system administrator" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x514be7fc208b2ee1df2cc191b5282f3a Wed Aug 30 15:53:02 2006 : Debug: Finished request 0 Wed Aug 30 15:53:02 2006 : Debug: Going to the next request Wed Aug 30 15:53:02 2006 : Debug: --- Walking the entire request list --- Wed Aug 30 15:53:02 2006 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.20:3072, id=0, length=212 User-Name = "collen" NAS-IP-Address = 10.0.0.20 Called-Station-Id = "0016b69e59c3" Calling-Station-Id = "00166f980e78" NAS-Identifier = "0016b69e59c3" NAS-Port = 46 Framed-MTU = 1400 State = 0x514be7fc208b2ee1df2cc191b5282f3a NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d030144f67859f94017b05e178d502a2f37b42e86f6cb6d6d13bd90a07398bdb3115900001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x0fb306b26777d99c2b78ac78fcbbcf85 Wed Aug 30 15:53:02 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authorize for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 1 Wed Aug 30 15:53:02 2006 : Debug: radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830' Wed Aug 30 15:53:02 2006 : Debug: rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP packet type response id 1 length 80 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Wed Aug 30 15:53:02 2006 : Debug: users: Matched entry collen at line 217 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "files" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authorize (returns updated) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rad_check_password: Found Auth-Type EAP Wed Aug 30 15:53:02 2006 : Debug: auth: type "EAP" Wed Aug 30 15:53:02 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authenticate for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: Request found, released from the list Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP/peap Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: processing type peap Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_peap: Authenticate Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: processing TLS Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Length Included Wed Aug 30 15:53:02 2006 : Debug: eaptls_verify returned 11 Wed Aug 30 15:53:02 2006 : Debug: (other): before/accept initialization Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: before/accept initialization Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 read client hello A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write server hello A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write certificate A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write server done A Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 flush data Wed Aug 30 15:53:02 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Aug 30 15:53:02 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Aug 30 15:53:02 2006 : Debug: In SSL Handshake Phase Wed Aug 30 15:53:02 2006 : Debug: In SSL Accept mode Wed Aug 30 15:53:02 2006 : Debug: eaptls_process returned 13 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 10.0.0.20 port 3072 Reply-Message = "Go and See your system administrator" EAP-Message = 0x0102040a19c0000006f1160301004a02000046030144f5983e2a3f2787f349e2c803691e2bd1dcecb00c4cdf71d8130966b67808e0203c016a91c6fb93cb2a5b767bd564efb362ae8b997c45585ec2c3ff446bda25e800040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x98cb9ce82b22aff87c8ddd218edbc40a Wed Aug 30 15:53:02 2006 : Debug: Finished request 1 Wed Aug 30 15:53:02 2006 : Debug: Going to the next request Wed Aug 30 15:53:02 2006 : Debug: rl_next: returning NULL --------------- Cheers Collen..

1 0