November 2007 - Freeradius-Users - lists.freeradius.org

Re: Expiration attribute
by Marinko Tarlac 23 Nov '07

23 Nov '07

Thanks Ivan Best regards Message: 3 Date: Thu, 22 Nov 2007 07:51:41 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Expire attribute To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <sRvpveEi.1195714301.7796390.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 Attribute name is Expiration. It is a check item so it does go into radcheck. I use is == as operator, but := should work as well. Format that works for me is: November 28 2007 20:26:43 Ivan Kalik Kalik Informatika ISP

1 0

Exec-Program-Wait
by Felipe Ceglia - PY1NB 23 Nov '07

23 Nov '07

Hello, I am trying to setup a "prepaid" style system on my freeradius. All I want is to check user name against a perl script that will let user get in or not. I put this on users file, but the script is not being run: DEFAULT Called-Station-Id == "hotspot_shop_tere" #THIS IS LINE 155 Exec-Program-Wait = "/etc/raddb/scripts/hotspot_shop_tere.pl %U", DEFAULT Called-Station-Id == "hotspot_shop_tere", Acct-Status-Type == Stop Exec-Program-Wait = "/etc/raddb/scripts/hotspot_shop_tere.pl %U %{AcctSessionTime}", Thanks in advance, Felipe radiusd -X says: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 10 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "after" main: lower_pass = "after" main: nospace_user = "after" main: nospace_pass = "after" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 2 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/raddb/temp/passwd" unix: shadow = "(null)" unix: group = "/etc/raddb/temp/group" unix: radwtmp = "NULL" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "rootpasswd" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.2:32777, id=40, length=181 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:0B:CD:EC:63:50" Called-Station-Id = "hotspot_shop_tere" NAS-Port-Id = "hotspot" User-Name = "joe" NAS-Port = 2150629415 Acct-Session-Id = "80300027" Framed-IP-Address = 10.5.50.254 Mikrotik-Attr-10 = 0x0a0532fe User-Password = "whatever" Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.254.2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "joe" rlm_realm: Proxying request from user joe to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'joe' rlm_sql (sql): sql_set_user escaped user --> 'joe' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'joe' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User joe not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User joe not found in radgroupcheck rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [joe/whatever] (from client hotspot_shop_tere port 2150629415 cli 00:0B:CD:EC:63:50) rad_lowerpair: Stripped-User-Name now 'joe' rad_lowerpair: User-Password now 'whatever' rad_rmspace_pair: Stripped-User-Name now 'joe' rad_rmspace_pair: User-Password now 'whatever' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'joe' rlm_sql (sql): sql_set_user escaped user --> 'joe' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'joe' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User joe not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User joe not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [joe/whatever] (from client hotspot_shop_tere port 2150629415 cli 00:0B:CD:EC:63:50) Delaying request 0 for 2 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.254.2:32777, id=40, length=181 Sending Access-Reject of id 40 to 192.168.254.2 port 32777 --- Walking the entire request list --- Waking up in 10 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 40 with timestamp 4745d2ae Nothing to do. Sleeping until we see a request.

2 1

Freeradius doesn't work with ldap
by Eduardo Lima 23 Nov '07

23 Nov '07

Hi, I've been using Freeradius 1.1.3 with PEAP/MSCHAPv2 authentication with no problem. But now, I need to use it with LDAP too and it doesn't work at all. The client is windows xp without a domain. The LDAP is for the email directory. The user should type your user name (email) and password stored in LDAP. Probably, the error is in: Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for ducavalcanti with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 The full log is listed below Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "ldap.recife.pe.gov.br" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/raddb/certs/demoCA/cacert.pem" ldap: tls_cacertdir = "/etc/raddb/certs/demoCA" ldap: tls_certfile = "/etc/raddb/certs/cert-srv.pem" ldap: tls_keyfile = "/etc/raddb/certs/cert-srv.pem" ldap: tls_randfile = "/etc/raddb/certs/random" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "dc=recife" ldap: filter = "(uid=%u))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x85ac160 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" [/etc/raddb/users]:10 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "cidadao". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:21 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "ds". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:32 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "onibus1". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:41 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "onibus2". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:50 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "onibus3". ?This attribute MUST go on the first line with the other check items [/etc/raddb/users]:74 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/detail" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.45:1397, id=0, length=215 Message-Authenticator = 0x97a84f20d4434232cd49ca6d658945d3 Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000011016475636176616c63616e7469 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6e92a11c2e2eb8b0f5a3ef121130cdbe Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=1, length=296 Message-Authenticator = 0x6f9a9ac031506c58b6c6e44ca2406e45 Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0x6e92a11c2e2eb8b0f5a3ef121130cdbe Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014739af68a8f0d6ff21bcf3d70631bff8fd284444e2b706a9bf448ec99da68d9000001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0613], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x0102040a19c000000670160301004a0200004603014739b155fbba378d8caad6bf3cf2fcd445f60f72624d63cae1e97a280be0f1f620cfffe3e5b1d4493d5a781cdf4f43bed0de241d70bb915648fcd4285ef7b4f58400040016030106130b00060f00060c0002a6308202a23082020ba00302010202090091c3a0bfdd719e76300d06092a864886f70d0101050500307d310b3009060355040613024252311330110603550408130a5065726e616d6275636f310f300d060355040a1306454d5052454c310f300d060355040b1306454d5052454c3110300e060355040313077375706f7274653125302306092a864886f70d01090116167375706f72 EAP-Message = 0x746540617270736973742e636f6d2e6272301e170d3037313031383132313931315a170d3038313031373132313931315a30818f310b3009060355040613024252311330110603550408130a5065726e616d6275636f3110300e060355040714075c526563696665310f300d060355040a1306454d5052454c310f300d060355040b1306454d5052454c3110300e060355040313077375706f7274653125302306092a864886f70d01090116167375706f72746540617270736973742e636f6d2e627230819f300d06092a864886f70d010101050003818d0030818902818100c493f9d65023f11b86d83e3443a39aa9439dc496752284b2de7376bb59 EAP-Message = 0xf0dd3d3ceaad3870d7d393f619afc5a82e04bbe00131aa116737fd6e6fe0f591b95e83475cb5c5256978242191e5cdf41c66299a4aae6de5a2af98b01ed54257e35a4bb5d22e776f6e9228ca8f3e6657ce1126be95caa7e53724beae1be3ce6327527d0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181007294fff28c80a0b0fc13279969ee9deff9027df4826d2303bda176920df162c6e163db22b5de11cce2f04aa83174d20bc611aabd9c6ff0c14d85a3b86a5f114760163ea6f34015825c49180850cfb7f5e94beb0c698ace6c6787f74f0bff5e73750177013be7da604a EAP-Message = 0xe7574dcd6964f26f37744d77b1709c6fb6c9cf25a07bee0003603082035c308202c5a00302010202090091c3a0bfdd719e74300d06092a864886f70d0101050500307d310b3009060355040613024252311330110603550408130a5065726e616d6275636f310f300d060355040a1306454d5052454c310f300d060355040b1306454d5052454c3110300e060355040313077375706f7274653125302306092a864886f70d01090116167375706f72746540617270736973742e636f6d2e6272301e170d3037313031383132303734355a170d3130313031373132303734355a307d310b3009060355040613024252311330110603550408130a506572 EAP-Message = 0x6e616d6275636f310f300d060355040a1306454d5052 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd0beac7b89b40eefff915efd4d9d96a Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=2, length=222 Message-Authenticator = 0x17dee25fd4e402e0bce5c2e7c4e06575 Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0xfd0beac7b89b40eefff915efd4d9d96a Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010302761900454c310f300d060355040b1306454d5052454c3110300e060355040313077375706f7274653125302306092a864886f70d01090116167375706f72746540617270736973742e636f6d2e627230819f300d06092a864886f70d010101050003818d0030818902818100a874f87336485c332625fec54ed9362480378288099013dca4f82709de7b981491150f4bd5b66b74ea7580e17c99eccf9eb2e0e2df128dcde28a8b6df8b1b29e7cea11325a07c1928e3a1e3f6a7e78c1625b3934ffb14dc88b7b2a5c4579d4fd4ff8d168f6738e1ad7da52ac7b43abebe498e40ee3090e4f8c78cbc068cd9d650203010001a381e33081e0301d06 EAP-Message = 0x03551d0e041604142b91d9d0c793e7444e1797f22bc1e570b72225343081b00603551d230481a83081a580142b91d9d0c793e7444e1797f22bc1e570b7222534a18181a47f307d310b3009060355040613024252311330110603550408130a5065726e616d6275636f310f300d060355040a1306454d5052454c310f300d060355040b1306454d5052454c3110300e060355040313077375706f7274653125302306092a864886f70d01090116167375706f72746540617270736973742e636f6d2e627282090091c3a0bfdd719e74300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002ce9db31047ea23cf5c461c252 EAP-Message = 0x017d696503c0542fc2e50360b955027d8cc61908d938a3f351302317774c9840d291fa3e3967b893bdd2c0952e93921be784f66795d6395abc58e10a921a138bc90b252b373ca7ca597bd4838d7f45e7741a5502d91c2ed79df141931fd6816c83978d2c09fca2eae6932ed4e538973e75127f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d984a07595e9ac3aa78f16d85c558c6 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=3, length=408 Message-Authenticator = 0xba582ade90838a38b10004924ed5e5e7 Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0x2d984a07595e9ac3aa78f16d85c558c6 Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300c01980000000b616030100861000008200804d52a6ab167309225ce9a411b4eabf4aa96925f14b8da9bfbc6e89e5410bada5be32d4d918fd13a2c54f0d9bcf03c26280bc3225e5fe83cecec1d6994ba448b5ff1be3cc778d8173d0fb2b9619e586dd2d9603b0128470ad57e0d48ab9ebb91dfa87389335b6ffe3767046a3747f1f53f5bfcc8dc29bbb76679c83c81f46df8914030100010116030100205829fbdf78858311c77221d58efa0a2714ea74c5eb841a7848dbb4256cc344a8 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010400311900140301000101160301002044268c376c10a7426ec28ac1f70560496dd01442fc1871d4309a231de0cf2fd2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xeb89542136d6968cc340734f68c628c6 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=4, length=222 Message-Authenticator = 0xbe9ec00cfe2576161f6376e77baa9bde Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0xeb89542136d6968cc340734f68c628c6 Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 4 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010500201900170301001500822197cc3a4d4115a1707866e50911ccd5fd7153 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3eb2c3e8d1e2d49910601e06aad46db Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=5, length=256 Message-Authenticator = 0xd469b7f0dc9bceb846ac92b41967a0bd Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0xe3eb2c3e8d1e2d49910601e06aad46db Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020500281900170301001d10537c5025635ceb31f1789dd73ace4a29aca849cc784caf663ca8bad7 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 40 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ducavalcanti rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02050011016475636176616c63616e7469 PEAP: Got tunneled identity of ducavalcanti PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ducavalcanti PEAP: Sending tunneled request EAP-Message = 0x02050011016475636176616c63616e7469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ducavalcanti" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled reply RADIUS code 11 Simultaneous-Use = 1 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010600261a010600211081f8c12bb5d6b67acd534094d559a0c16475636176616c63616e7469 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3e601b3722625ab79f99c119a369261 PEAP: Processing from tunneled session code 0x85c4500 11 Simultaneous-Use = 1 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010600261a010600211081f8c12bb5d6b67acd534094d559a0c16475636176616c63616e7469 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3e601b3722625ab79f99c119a369261 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 5 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x0106003d190017030100324053f25612454fd272b962c7131679228164337ddc83ca7f617c0ffb77ec9f6a01b77e338e1878a50ed7740fd57eeec946c7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc72085ef2bc63e62f47a3fe126211ebe Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=6, length=310 Message-Authenticator = 0x29eaa29601a8e416c9d18bac862e94c0 Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0xc72085ef2bc63e62f47a3fe126211ebe Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206005e1900170301005368c49f7d568b3493615bb4786eb9cbe9add92efec32e3690cbb373dc7230e7cc3b95945d2e9a8305a3197dc9485223992b1e2c7574ebe1a06d7349e036cc82f50c0cb78613bf938941fc7c79df7ef5ad703b4e NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 94 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020600471a0206004231c09d2e726a412f912f80c6c2c24a01cf0000000000000000f03d9d7d5bd85c82c5f72d39aa28929b49b63bf52ecff5cb006475636176616c63616e7469 PEAP: Setting User-Name to ducavalcanti PEAP: Adding old state with f3 e6 PEAP: Sending tunneled request EAP-Message = 0x020600471a0206004231c09d2e726a412f912f80c6c2c24a01cf0000000000000000f03d9d7d5bd85c82c5f72d39aa28929b49b63bf52ecff5cb006475636176616c63616e7469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ducavalcanti" State = 0xf3e601b3722625ab79f99c119a369261 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 71 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for ducavalcanti with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 Simultaneous-Use = 1 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x85e80e8 3 Simultaneous-Use = 1 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 6 to 10.0.0.45 port 1397 Idle-Timeout = 1200 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-MTU = 1500 EAP-Message = 0x010700261900170301001b4a225c725a01e1ae8ee997fa96c6065c6c2688941f65cb21b089bd Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb91f907fbd983f95c34961b9e8b8c182 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=7, length=254 Message-Authenticator = 0xf4a4b6cf3eda5ad189a531100a4ab76a Service-Type = Framed-User User-Name = "ducavalcanti" Framed-MTU = 1488 State = 0xb91f907fbd983f95c34961b9e8b8c182 Called-Station-Id = "00-18-6E-8F-7F-C6:Teste_Radius" Calling-Station-Id = "00-16-CF-5D-AB-87" NAS-Identifier = "3Com Access Point 7760" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020700261900170301001beb99d02b18f142827e3a1a0590988723cff7c84b868b96f2c5d2b3 NAS-IP-Address = 10.0.0.45 NAS-Port = 3 NAS-Port-Id = "STA port # 3" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "ducavalcanti", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 74 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.45:1397, id=7, length=254 Sending Access-Reject of id 7 to 10.0.0.45 port 1397 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4739b155 Cleaning up request 1 ID 1 with timestamp 4739b155 Cleaning up request 2 ID 2 with timestamp 4739b155 Cleaning up request 3 ID 3 with timestamp 4739b155 Cleaning up request 4 ID 4 with timestamp 4739b155 Cleaning up request 5 ID 5 with timestamp 4739b155 Cleaning up request 6 ID 6 with timestamp 4739b155 Cleaning up request 7 ID 7 with timestamp 4739b155 Nothing to do. Sleeping until we see a request. PLEASE HELP!! --------------------------------- Abra sua conta no Yahoo! Mail, o único sem limite de espaço para armazenamento!

4 10

Configuring LEAP for freeradius
by Gaurav Bandekar 23 Nov '07

23 Nov '07

Hi, I wanted to know how to configure EAP-LEAP on FreeRadius Server. The following are the configuration settings done. 1. clients.conf - added the client AP. 2. radiusd.conf - modules { . . $INCLUDE ${confdir}/eap.conf } authenticate { . . eap } authorize { . . eap } 3. eap.conf:- Have set default_eap_type = LEAP. And the LEAP section is empty. leap { } What do I have to set over here in the leap section? Also is there any other file that needs to be modified. Thanks & Regards Gaurav

2 1

How to reset weekly counter every Sunday midnight?
by Lee Sing Chyun 22 Nov '07

22 Nov '07

Hi, I'm trying unsuccessfully to configure a sqlcounter that is reset every Sunday 0:00AM. Here's what i configured in radiusd.conf: sqlcounter weeklycounter { counter-name = Weekly-Session-Time check-name = Max-Weekly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = weekly # For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } After that, I did a radtest. From the resulting SQL trace, I notice "%b" is expanded as 7 days earlier than today. For instance, when running radtest on 20 Nov 2007 1:16AM (a Tuesday), "%b" gets expanded to 13 Nov 2007 0:00AM (a Tuesday too), which is not my desired outcome. How do I configure a sqlcounter that is reset every Sunday midnight? Thanks in advance, and sorry if there're any obvious mistakes that I have overlooked. -- sc

1 0

User-accounts do not expire in time...
by Evert 22 Nov '07

22 Nov '07

Hi all! I have users in my system who are supposed to be able to logon as much as they want, in a period of 24 hours starting from their 1st logon. This requires 2 entries in radgroupcheck, right? Based on http://wiki.freeradius.org/Rlm_sqlcounter I think both Max-All-Session & Max-Daily-Session need to be 86400 if I'm not mistaken? I have in radgroupcheck: 24hours Max-Daily-Session := 86400 24hours Max-All-Session := 86400 however, a user who is a member of the 24hours group is able to log on longer than the 24hours period: Mon Nov 19 13:15:35 2007 : Auth: Login OK: [ofjyc5] (from client stline port 2151678956 cli 30:13:02:31:68:B9) Mon Nov 19 13:28:00 2007 : Auth: Login OK: [ofjyc5] (from client stline port 2151678959 cli 30:13:02:31:68:B9) Tue Nov 20 09:11:04 2007 : Auth: Login OK: [ofjyc5] (from client stline port 2151678995 cli 00:19:D2:29:F9:D5) Tue Nov 20 15:04:31 2007 : Auth: Login OK: [ofjyc5] (from client stline port 2151679001 cli 00:19:D2:29:F9:D5) Wed Nov 21 07:21:19 2007 : Auth: Login OK: [ofjyc5] (from client stline port 2151679009 cli 00:19:D2:29:F9:D5) /etc/raddb/sqlcounter.conf is a copy from http://wiki.freeradius.org/Rlm_sqlcounter What am I doing wrong here...? Regards, Evert

4 12

Expire attribute
by Marinko Tarlac 22 Nov '07

22 Nov '07

Hi I need more info about Expire attribute. Where I can find them (for example where do I need to put it when I'm using mysql database, syntax, operators etc)... I suppose radcheck table buy I don't know about attribute format...

5 4

SLES 10 + Oracle
by Stefan Kohler 21 Nov '07

21 Nov '07

Hi users, I have a problem compiling a RPM-package for SLES10 and I followed the instructions on the WIKI-sites. All dependecies are installed and I also installed the Oracle rpms (oracle-instantclient-basic and oracle-instantclient-devel), so all headers and stuff should be installed. Now I am trying to build the RPM (as mentioned above all dependencies are installed) and I get the following message: "RPM build errors: File not found by glob: /var/tmp/freeradius-1.1.7-build/usr/lib/ freeradius/rlm_sql_oracle*.so*" What am I missing? I downloaded the tar.bz2 file and put it in the SOURCE-folder and extracted the specs file and enabled the oracle- line there. Maybe on of you could help me? Thank you very much for all comments. Kind regards - Stefan -- stef [at] internetchefs [dot] de

4 10

WPA HOWTO
by build 21 Nov '07

21 Nov '07

G'day All, Using Debian etch. I've started again with the WPA HOWTO at http://wiki.freeradius.org/WPA_HOWTO It's a bit confusing with the eap.conf file separate to the radiusd.conf but I thought I had got it right. I was wrong. :/# freeradius -X -A Starting - reading configuration files ... <snip> rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1940] Unknown module "eap". radiusd.conf[1887] Failed to parse authenticate section. cheval:/# find -name rlm_eap_tls.so cheval:/# Can anyone give me a hint before my PC goes through a closed window? Thanking you in anticipation, build

3 12

EAP-TLS does not send an access OK.
by Patrice Oliver 21 Nov '07

21 Nov '07

Hello, Hello, I work on a WIFI authentication project, dealing with EAP/TLS on Freeradius. I allready read a lots of docs on the net The certificats are created with xpextensions and installed. I use freeradius. My config files are joined. Client : windows XP pro sp2. Here is the freeradius log when I try to connect : rad_recv: Access-Request packet from host 172.17.5.100:32778 <http://172.17.5.100:32778>, id=168, length=150 User-Name = "mobile" NAS-IP-Address = 172.17.5.100 <http://172.17.5.100> NAS-Identifier = "172.17.5.100 <http://172.17.5.100>" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000F20957BB7" Called-Station-Id = "000B8641C660" Framed-MTU = 1100 EAP-Message = 0x0201000b016d6f62696c65 Aruba-Essid-Name = "eole" Aruba-Location-Id = "2.1.1" Message-Authenticator = 0x4b5ee61553ec73cc454c403ec873ad24 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Sending Access-Challenge of id 168 to 172.17.5.100 <http://172.17.5.100> port 32778 Aruba-User-Vlan = 200 Aruba-User-Role = "eole" EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1d8d2c72aac139bb25089361b94918e rad_recv: Access-Request packet from host 172.17.5.100:32778 <http://172.17.5.100:32778>, id=169, length=269 User-Name = "mobile" NAS-IP-Address = 172.17.5.100 <http://172.17.5.100> NAS-Identifier = "172.17.5.100 <http://172.17.5.100>" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000F20957BB7" Called-Station-Id = "000B8641C660" Framed-MTU = 1100 EAP-Message = 0x020200700d800000006616030100610100005d0301473c2a4b426528392f0efd1946172b375ed92f04360eb7068b276ad02f65df942002bc6aa8929e3855237d44cfed0de9e0eef6830330686250346b2a2141ff2f66001600040005000a000900640062000300060013001200630100 State = 0xf1d8d2c72aac139bb25089361b94918e Aruba-Essid-Name = "eole" Aruba-Location-Id = "2.1.1" Message-Authenticator = 0xd4944b76a67263b3c6431530b33522d1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Sending Access-Challenge of id 169 to 172.17.5.100 <http://172.17.5.100> port 32778 Aruba-User-Vlan = 200 Aruba-User-Role = "eole" EAP-Message = 0x0103040a0dc000000411160301004a020000460301473c2a46804b2c3888c0fcb80af8456213cc201aedf4dbc513dcc2f8dc0d7a2520c39aea56359ef81ae4da7be8959b0abee59ccc86f23934883ad976089ed8db2700040016030102fa0b0002f60002f30002f0308202ec30820255a003020102020101300d06092a864886f70d01010405003081ab310b30090603550406130246523112301006035504081309426f7572676f676e65310f300d06035504071306426561756e6531153013060355040a130c63682d626561756e652e6672311b3019060355040b131273696e666f2e63682d626561756e652e667231193017060355040313104348 EAP-Message = 0x2d424541554e4520544c532043413128302606092a864886f70d010901161961646d696e2e7265736561754063682d626561756e652e6672301e170d3037313030343036303635395a170d3137313030313036303635395a3081b2310b30090603550406130246523112301006035504081309426f7572676f676e65310f300d06035504071306426561756e6531153013060355040a130c63682d626561756e652e6672311b3019060355040b131273696e666f2e63682d626561756e652e66723120301e06035504031317667265657261646975732e63682d626561756e652e66723128302606092a864886f70d010901161961646d696e2e726573 EAP-Message = 0x6561754063682d626561756e652e667230819f300d06092a864886f70d010101050003818d0030818902818100b0dbd8779b2d0041264551b5a97c4860c2fdec4c953a8d6f00839eadfccced93c100d3d832cb2e7432ebf8800008ccae4183baa244042116d38a5f31f31e475bfa0ada5047795d30b4b14b79585dc719f95eb361efecb1efef87b1c832dbf69380a46375e46f3eb88df40ab35ebed329e35978ab394989e7114ca11c1444ae1f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810053a216c3ab1d7895dd006da7dbc281c4fd6159869c212aa97e72cf29c5b109 EAP-Message = 0x2468002d3c9d510561b12ce489d0bfb8e227fe9d02d96d7c740c57cbeac880d50d39983db03e46e9705ad0b915d2d9dd166fa746a7043e0af9f483213b43276d1822469d97c73074cb5d0225e8d9709a7a04303495279eda4dca1c44284997705216030100be0d0000b60301024000b000ae3081ab310b30090603550406130246523112301006035504081309426f7572676f676e65310f300d06035504071306426561756e6531153013060355040a130c63682d626561756e652e6672311b3019060355040b131273696e666f2e63682d626561756e652e6672311930170603550403131043482d424541554e4520544c532043413128302606092a EAP-Message = 0x864886f70d010901161961646d696e2e726573656175 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3086036a150a272bec4609fc740fdb2d rad_recv: Access-Request packet from host 172.17.5.100:32778 <http://172.17.5.100:32778>, id=170, length=163 User-Name = "mobile" NAS-IP-Address = 172.17.5.100 <http://172.17.5.100> NAS-Identifier = "172.17.5.100 <http://172.17.5.100>" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000F20957BB7" Called-Station-Id = "000B8641C660" Framed-MTU = 1100 EAP-Message = 0x020300060d00 State = 0x3086036a150a272bec4609fc740fdb2d Aruba-Essid-Name = "eole" Aruba-Location-Id = "2.1.1" Message-Authenticator = 0xb21a49657c022a70310f50e9eaaea067 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_eap_tls: No SSL info available. Waiting for more SSL data. Sending Access-Challenge of id 170 to 172.17.5.100 <http://172.17.5.100> port 32778 Aruba-User-Vlan = 200 Aruba-User-Role = "eole" EAP-Message = 0x0104001b0d80000004114063682d626561756e652e66720e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc8d232500b2a33696b274f085732a7ad rad_recv: Access-Request packet from host 172.17.5.100:32778 <http://172.17.5.100:32778>, id=171, length=1236 User-Name = "mobile" NAS-IP-Address = 172.17.5.100 <http://172.17.5.100> NAS-Identifier = "172.17.5.100 <http://172.17.5.100>" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000F20957BB7" Called-Station-Id = "000B8641C660" Framed-MTU = 1100 EAP-Message = 0x0204042f0d800000042516030103f50b0002e50002e20002df308202db30820244a003020102020102300d06092a864886f70d01010405003081ab310b30090603550406130246523112301006035504081309426f7572676f676e65310f300d06035504071306426561756e6531153013060355040a130c63682d626561756e652e6672311b3019060355040b131273696e666f2e63682d626561756e652e6672311930170603550403131043482d424541554e4520544c532043413128302606092a864886f70d010901161961646d696e2e7265736561754063682d626561756e652e6672301e170d3037313030343036303731345a170d31373130 EAP-Message = 0x30313036303731345a3081a1310b30090603550406130246523112301006035504081309426f7572676f676e65310f300d06035504071306426561756e6531153013060355040a130c63682d626561756e652e6672311b3019060355040b131273696e666f2e63682d626561756e652e6672310f300d060355040313066d6f62696c653128302606092a864886f70d010901161961646d696e2e7265736561754063682d626561756e652e667230819f300d06092a864886f70d010101050003818d0030818902818100c7e0561703a82682e303bc32ad8f092d170286ccb20925dfd0b0d2e9f0c58667b142544126c9a74f3a256a82d1e5dda7ecfe5b EAP-Message = 0xb38fa2929f9e97027c7608bca14b30b865defb04d6bc5d4e419202b316fa621176751580a2611946ba54b8af076b8c412ec33db7870001d8fa22d203748a2b2e447c25f323d525cc096ba043bd0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003818100a0cce5db99b4618262044bb8211a71dc074e34bdcacb6d0082966715c2ede22e1278f7cc781c166f9a791b6f657022a91f5d38cee9526f0ae0c2da574b7aef62b6f867bc53a577dca3fcc19519e018a8c11b79471f899446f8b01dd42d0d669eede056e01659b84fe31ecc5e4237a3b2cf8d8e918540fc85bf133596ae2c84 EAP-Message = 0xaf1000008200802aaf3007c9a62cea5127aa63790a76002f40fc8905d02d0e263dbbccdb2828e5e7bf5f29b1e273e522d1034d3101144d21a318a4a3da6b1eb23afcca071a3eaf80a9d8d5689bb9b3167382f7b11ce74858a805dec8b7fe4de89c57a88292ab30c11eb906935cdc3088acc25d51efde2d52383072b173d681628e816541a502980f000082008002d36c0fd4caef08e1df313014ef3f2dec0d384e44ccc3e14270e0a8dbfba995a7a1ca12642a788038452c773f88ed50bb8702774d2602dcd2d2ef250c62b291ec0dcd153fd4aa52b507d67bfb7bdb6bdd125bdceb0faf3f1743236201193e1657752f2954088ee8dc4892579e50294f EAP-Message = 0x4e7c27d59c78f90d2418a89251f0aca114030100010116030100205aecaefe538a1fd0ec6a1f4207aaed488d4a7753d73c152df6f6cf29c492074e State = 0xc8d232500b2a33696b274f085732a7ad Aruba-Essid-Name = "eole" Aruba-Location-Id = "2.1.1" Message-Authenticator = 0xcc6360144fd21b838bf72feda673bd28 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. chain-depth=1, error=0 --> User-Name = mobile --> BUF-Name = CH-BEAUNE TLS CA --> subject = /C=FR/ST=Bourgogne/L=Beaune/O=ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=CH-BEAUNE <http://ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=CH-BEAUNE> TLS CA/emailAddress=admin.reseau(a)ch-beaune.fr <mailto:admin.reseau@ch-beaune.fr> --> issuer = /C=FR/ST=Bourgogne/L=Beaune/O=ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=CH-BEAUNE <http://ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=CH-BEAUNE> TLS CA/emailAddress=admin.reseau(a)ch-beaune.fr <mailto:admin.reseau@ch-beaune.fr> --> verify return:1 chain-depth=0, error=0 --> User-Name = mobile --> BUF-Name = mobile --> subject = /C=FR/ST=Bourgogne/L=Beaune/O=ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=mobile/emailAddress=admin.reseau(a)ch-beaune.fr <http://ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=mobile/emailAddress=admin.rese…> --> issuer = /C=FR/ST=Bourgogne/L=Beaune/O=ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=CH-BEAUNE <http://ch-beaune.fr/OU=sinfo.ch-beaune.fr/CN=CH-BEAUNE> TLS CA/emailAddress=admin.reseau(a)ch-beaune.fr <mailto:admin.reseau@ch-beaune.fr> --> verify return:1 Sending Access-Challenge of id 171 to 172.17.5.100 <http://172.17.5.100> port 32778 Aruba-User-Vlan = 200 Aruba-User-Role = "eole" EAP-Message = 0x010500350d800000002b1403010001011603010020c42bc430a3603bfb36e8b8fd046b0e9c5f9d27efb22fb1826a0794f8939e72b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x182de49cc578ef73f4090ae54adb586c rad_recv: Access-Request packet from host 172.17.5.100:32778 <http://172.17.5.100:32778>, id=172, length=163 User-Name = "mobile" NAS-IP-Address = 172.17.5.100 <http://172.17.5.100> NAS-Identifier = "172.17.5.100 <http://172.17.5.100>" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "000F20957BB7" Called-Station-Id = "000B8641C660" Framed-MTU = 1100 EAP-Message = 0x020500060d00 State = 0x182de49cc578ef73f4090ae54adb586c Aruba-Essid-Name = "eole" Aruba-Location-Id = "2.1.1" Message-Authenticator = 0xc93dcf66036b55d88e0f8b087237572b rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_eap_tls: No SSL info available. Waiting for more SSL data. Sending Access-Challenge of id 172 to 172.17.5.100 <http://172.17.5.100> port 32778 Aruba-User-Vlan = 200 Aruba-User-Role = "eole" EAP-Message = 0x0106000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7434fc4a00a7c70dde94fc0ede886654 I see no OK, and no 'not OK'. I don't understand why 'rlm_eap_tls: No SSL info available. Waiting for more SSL data.' I don't understand why freeradius sends an access challenge instead of an access ok since the certificates are OK. I have to deploy on next monday. May you help me ? Best regards, -- *Hospices Civils de Beaune* *Patrice OLIVER* /Chef de Projet Ville Hôpital/ /Responsable Réseau & Sécurité/ BP 104 21203 BEAUNE Cedex Tél. 03 80 24 44 09 Fax. 03 80 24 45 90 ------------------------------------------------------------------------ Ce message, y compris les pièces jointes, est établi à l'attention exclusive de son ou ses destinataires et est confidentiel. Toute utilisation non conforme à sa destination, toute diffusion ou publication, totale ou partielle, est interdite sauf autorisation expresse de l'expéditeur. Si vous n'êtes pas le destinataire de ce message, merci d'avertir l'expéditeur de l'erreur de distribution puis de le détruire. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. L'expéditeur décline toute responsabilité dans l'hypothèse où il aurait été modifié ou falsifié.

4 21