April 2007 - Freeradius-Users - lists.freeradius.org

Segmentation fault on sigHUP
by Milan Holub 13 Apr '07

13 Apr '07

Hi all, somewhere in this list there was already mentioned that current CVS version causes segmentation fault when received HUP signal(kill -HUP pid) - depending on the configuration it may survive 1st HUP and then it dies with 1st radius request/2nd HUP). Reason is also known: wrong freeing of memory. I've looked into the code for some time but I got lost in debugging of internal freeradius data structures. Until Alan comes with clean solution I'm offering following workaround: Here is a patch which just comments out freeing of config memory: Index: src/main/mainconfig.c =================================================================== RCS file: /source/radiusd/src/main/mainconfig.c,v retrieving revision 1.106 diff -u -r1.106 mainconfig.c --- src/main/mainconfig.c 7 Apr 2007 14:25:12 -0000 1.106 +++ src/main/mainconfig.c 11 Apr 2007 12:44:08 -0000 @@ -804,9 +804,9 @@ * Note that where possible, we do atomic switch-overs, * to ensure that the pointers are always valid. */ - oldcs = mainconfig.config; + //oldcs = mainconfig.config; mainconfig.config = cs; - cf_section_free(&oldcs); + //cf_section_free(&oldcs); snprintf(buffer, sizeof(buffer), "%.200s/%.50s", radius_dir, mainconfig.radiusd_conf); @@ -942,7 +942,7 @@ * Clean up the configuration data * structures. */ - cf_section_free(&mainconfig.config); +// cf_section_free(&mainconfig.config); free(mainconfig.radiusd_conf); realms_free(); listen_free(&mainconfig.listen); Of course it leads to memory leakage! With default configuration it will eat around 60k of memory per thread on each reload. With my configuration(rlm_sql, 65 NASes in database, some additional modules loaded) it eats something like 600k per thread/reload. Advantages: - HUP does not cause seqmentation fault. - /etc/init.d/freeradius reload is working(uses HUP) - reload using snmp is working(radiusAuthServConfigReset.0 = 2) Disadvantages: - serious memory leakage - you should definitely schedule freeradius restart(daily?, off-peak) in crontab in order to "free" unused memory - when using rlm_sql(as in my case) with this patch then please note that there will be unused open DB connections left after each reHUP ==> to get rid of these connections consider changing your DB configuration(eg. set "wait_timeout = 600" under [mysqld] section of my.cnf for mysql server; this causes to close unused connections older than 10 minutes) Hope this helps someone. PS: I hope freeing unused memory will be revisited and thus this workaround won't be needed anymore. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

9 25

assigning vlan based on NAS and LDAP field?
by Matt Ashfield 13 Apr '07

13 Apr '07

HI all, We're using FR authenticating against LDAP to implement our wireless solution. Basically, we are looking at the LDAP field of record type and determining if it is a staff or a student, and assigning a vlan based on that. Pretty simple and it works. However, there are two issues with this: 1. We have a sister campus, on a different network, but who are sharing the same FR and LDAP servers for authentication. Obviously their NAS's are different than ours because we're in different physical locations and networks. With our current configuration, it looks like we have to define the exact same vlans id's and the same vlan eligibility rules (ie staff get vlan x and student get vlan y) in order for this to work. I guess I'm hoping there is a way to assign different vlans based on the NAS ip address in addition to the student/staff distinction. 2. This follows into our future wired side implementation of 802.1x. In this case, we don't want our staff/student wired users to be assigned to the same vlans as they would be if they were on wireless. Rather we'd prefer to break them up based on their NAS or something like that. Anyways, I realize this is quite an odd situation, but probably quite similar to what many EDU people are encountering. Any help/advice is greatly appreaciated. Thanks Matt mda(a)unb.ca

2 1

Version 2.0 is a lot closer to reality...
by Alan DeKok 13 Apr '07

13 Apr '07

I've just committed massive changes to the server core. The "diff" is about 3k lines, and doesn't include deleted or added files. The good news is that it looks to be nearly 100% backwards compatible with the configurations currently allowed by the CVS head. That is, I've written it to be backwards compatible, and validated it via tests, but I won't claim it's perfect until people test it. The new features include: - full IPv6 support for proxying (finally) - realms have been split into "server pools" and "home servers" (see proxy.conf for details) - deletion of old horrid code that did "Walking the entire request list" - move to event-based core, so that things happen when necessary, rather than accidentally as a side of effect of trial & error. - new Status-Server "ping" capability, so that home servers transitioning from dead -> live are automatically discovered and used. See "proxy.conf" for details of most of the new features. This patch does *not* include a number of other features which are currently sitting in my queue. For those interested in code details, see src/main/event.c, and src/main/realms.c. The code is much simpler than before, and substantially easier to understand. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

8 28

log on device directly in "priviledged mode"
by Molteni Davide 13 Apr '07

13 Apr '07

Finally I successfully managed to log into the cisco switch (thanks to your help) using freeradius. Now I want that the radius users can directly enter into enable mode of the cisco device. I set this in the users file test Auth-Type := Local, User-Password == "test" Cisco-AVPair = "shell:priv-lvl=15" but it doesn't work, the user "test" log into the cisco as unpriviledged. Is there something missing in the config?

3 4

FreeRADIUS 1.1.6 has been released.
by Alan DeKok 13 Apr '07

13 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The only new features in this release are a few dictionaries. All of the other changes are bug fixes, including the double-free's that were in 1.1.5. We also fixed approximately 30 bugs found by Coverity (http://scan.coverity.com) One of the bugs found by Coverity was a memory leak in the EAP-TTLS module. We recommend that everyone using EAP-TTLS upgrade to 1.1.6. See http://freeradius.org for further information, including pointers to the source code, and the security announcement. Alan DeKok. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQCVAwUBRh42R6kul4vkAkl9AQJVmQP/Tvkt2CosUd/DBrt2K+QS0rak54kce6JO qKP5rEzL27xLeoxZgQKAZCI/o8Nu+/wuoNEJQWbuCs2XwtBLt9PvfmRkDoBvSFVS c/CrA9pRLZchlZ2LUfObRzWqOld6a2HslKS8EGvTJhKBfyB+eNU1MXHPi2wU/Asw j0O5YwnMftQ= =QPPf -----END PGP SIGNATURE-----

6 8

1.1.6 crashes on fedora 6
by Jacob Jarick 13 Apr '07

13 Apr '07

Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** ./sbin/radiusd: double free or corruption (fasttop): 0x09f91ca8 *** ======= Backtrace: ========= /lib/libc.so.6[0xcbfefd] /lib/libc.so.6(cfree+0x90)[0xcc3550] /usr/local/lib/libltdl.so.3[0x3d55db] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xbe)[0x3d5f6e] ./sbin/radiusd(find_module_instance+0x317)[0x8bcc67] ./sbin/radiusd(setup_modules+0x1e8)[0x8bd108] ./sbin/radiusd(main+0x42c)[0x8c090c] /lib/libc.so.6(__libc_start_main+0xdc)[0xc6ff2c] ./sbin/radiusd[0x8b46b1] ======= Memory map: ======== 00110000-00124000 r-xp 00000000 fd:00 7745049 /usr/local/lib/libradius-1.1.6.so 00124000-00125000 rwxp 00014000 fd:00 7745049 /usr/local/lib/libradius-1.1.6.so 00125000-00126000 rwxp 00125000 00:00 0 00126000-0012f000 r-xp 00000000 fd:00 458793 /lib/libnss_files-2.5.so 0012f000-00130000 r-xp 00008000 fd:00 458793 /lib/libnss_files-2.5.so 00130000-00131000 rwxp 00009000 fd:00 458793 /lib/libnss_files-2.5.so 001e0000-001eb000 r-xp 00000000 fd:00 461338 /lib/libgcc_s-4.1.1-20061011.so.1 001eb000-001ec000 rwxp 0000a000 fd:00 461338 /lib/libgcc_s-4.1.1-20061011.so.1 00218000-0022a000 r-xp 00000000 fd:00 461341 /lib/libnsl-2.5.so 0022a000-0022b000 r-xp 00012000 fd:00 461341 /lib/libnsl-2.5.so 0022b000-0022c000 rwxp 00013000 fd:00 461341 /lib/libnsl-2.5.so 0022c000-0022e000 rwxp 0022c000 00:00 0 0022e000-00230000 r-xp 00000000 fd:00 461330 /lib/libdl-2.5.so 00230000-00231000 r-xp 00001000 fd:00 461330 /lib/libdl-2.5.so 00231000-00232000 rwxp 00002000 fd:00 461330 /lib/libdl-2.5.so 002eb000-002fe000 r-xp 00000000 fd:00 461331 /lib/libpthread-2.5.so 002fe000-002ff000 r-xp 00012000 fd:00 461331 /lib/libpthread-2.5.so 002ff000-00300000 rwxp 00013000 fd:00 461331 /lib/libpthread-2.5.so 00300000-00302000 rwxp 00300000 00:00 0 003d2000-003d7000 r-xp 00000000 fd:00 7763046 /usr/local/lib/libltdl.so.3.1.4 003d7000-003d8000 rwxp 00004000 fd:00 7763046 /usr/local/lib/libltdl.so.3.1.4 00637000-00650000 r-xp 00000000 fd:00 461328 /lib/ld-2.5.so 00650000-00651000 r-xp 00018000 fd:00 461328 /lib/ld-2.5.so 00651000-00652000 rwxp 00019000 fd:00 461328 /lib/ld-2.5.so 0071e000-00723000 r-xp 00000000 fd:00 458841 /lib/libcrypt-2.5.so 00723000-00724000 r-xp 00004000 fd:00 458841 /lib/libcrypt-2.5.so 00724000-00725000 rwxp 00005000 fd:00 458841 /lib/libcrypt-2.5.so 00725000-0074c000 rwxp 00725000 00:00 0 007fa000-007fc000 r-xp 00000000 fd:00 7759006 /usr/local/lib/rlm_exec-1.1.6.so 007fc000-007fd000 rwxp 00001000 fd:00 7759006 /usr/local/lib/rlm_exec-1.1.6.so 008b0000-008ce000 r-xp 00000000 fd:00 7763256 /usr/local/sbin/radiusd 008ce000-008cf000 rwxp 0001e000 fd:00 7763256 /usr/local/sbin/radiusd 008cf000-008d0000 rwxp 008cf000 00:00 0 00c5a000-00d91000 r-xp 00000000 fd:00 461329 /lib/libc-2.5.so 00d91000-00d93000 r-xp 00137000 fd:00 461329 /lib/libc-2.5.so 00d93000-00d94000 rwxp 00139000 fd:00 461329 /lib/libc-2.5.so 00d94000-00d97000 rwxp 00d94000 00:00 0 00e7c000-00e8b000 r-xp 00000000 fd:00 461343 /lib/libresolv-2.5.so 00e8b000-00e8c000 r-xp 0000e000 fd:00 461343 /lib/libresolv-2.5.so 00e8c000-00e8d000 rwxp 0000f000 fd:00 461343 /lib/libresolv-2.5.so 00e8d000-00e8f000 rwxp 00e8d000 00:00 0 00ea7000-00ea8000 r-xp 00ea7000 00:00 0 [vdso] 09eb6000-09f9d000 rw-p 09eb6000 00:00 0 b7e00000-b7e21000 rw-p b7e00000 00:00 0 b7e21000-b7f00000 ---p b7e21000 00:00 0 b7f2f000-b7f32000 rw-p b7f2f000 00:00 0 b7f49000-b7f4b000 rw-p b7f49000 00:00 0 bf82f000-bf862000 rw-p bf82f000 00:00 0 [stack] Aborted [root@fedora local]# Its pretty much the same issue I had with 1.1.5 on fedora 6

3 3

HELP: radtest fails local test
by Jacob Jarick 13 Apr '07

13 Apr '07

Freeradius 1.1.3 smb.conf http://pastebin.ca/437671 radius.conf http://pastebin.ca/437670 clients.conf http://pastebin.ca/437668 eap.conf http://pastebin.ca/437667 krb5.conf http://pastebin.ca/437666 A local test using radtest fails but I am unsure why. It looks like its trying to authenticate against the unix passwd file, I only need FR to auth against our w2k3 AD server. Any help is appreciated. [root@fedora ~]# radtest Administrator pass 127.0.0.1:1812 10 testing123 Sending Access-Request of id 166 to 127.0.0.1 port 1812 User-Name = "Administrator" User-Password = "tfxsol" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=166, length=20 radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32770, id=166, length=65 User-Name = "Administrator" User-Password = "tfxsol" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [Administrator]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 166 to 127.0.0.1 port 32770 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 166 with timestamp 461f1204 Nothing to do. Sleeping until we see a request.

3 6

Freeradius + AD2003 Authentication ERROR - Help please !
by Jacob Jarick 13 Apr '07

13 Apr '07

Me again guys, I have adjusted my config files etc (see links betow), but now Im stuck on this new error and it has me a bit baffled. Freeradius 1.1.3 smb.conf http://pastebin.ca/437671 radius.conf http://pastebin.ca/437670 clients.conf http://pastebin.ca/437668 eap.conf http://pastebin.ca/437667 krb5.conf http://pastebin.ca/437666 I start the wireless connection on XP, enter in user and password, freeradius runs the ntlm_auth command but then it spits out this huuuuge message. Its so big the terminals buffer isnt big enough, but I have copied and pasted everything I can. Error highlights (stuff that I think may be causing issues). SSL ERROR: (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Failure to validate user: Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain= --username=Administrator --challenge=bb4c397988ae6ebc --nt-response=4a7cd9abdfc2f92680c182845a937f4beb6646c4cddd7de1 Exec-Program output: No such user (0xc0000064) Exec-Program-Wait: plaintext: No such user (0xc0000064) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP Failure: PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE [root@fedora ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -----------------------------------------snip----------------------------------------------------------- read_config_files: reading dictionary Message-Authenticator = 0x11c04a4cd7b37155c0cfb0a458f157f2 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 683 [root@fedora ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 State = 0x2c48e30296c956862631dbaea6c6ed4b NAS-IP-Address = 10.1.1.110 NAS-Identifier = "ap-test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 207 to 10.1.1.110 port 1645 EAP-Message = 0x010502f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e3c05429a7db3fb59e0e5d5447c7ed1 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.110:1645, id=208, length=336 User-Name = "Administrator" Framed-MTU = 1400 Called-Station-Id = "001a.6c5f.5100" Calling-Station-Id = "0040.96a1.8a54" Service-Type = Login-User Message-Authenticator = 0x029353c67ab0eac37f9d70d2ef5f95df EAP-Message = 0x020500c01980000000b6160301008610000082008065ea7894aafd6fc4e4214bd9467d645f4f41003afc7e486366640507f16376197206a40fb433d80b4af9be3dbd439494f5f37eef232c541bef5725215a6ed4f17a69080ec4836f4a7e60ca400b907cbd33df9c554479770cc1f386bd9296557b5c4fe2b0baa5aa09b55475fa01e791b87d5165e6c6fa5a4ba0b7dd9f2da2c46f14030100010116030100201911f4857c16cce45a0dc84e791aa2b951ac3d9298aa6eb44ce7f3ff5249c745 NAS-Port-Type = Wireless-802.11 NAS-Port = 683 State = 0x2e3c05429a7db3fb59e0e5d5447c7ed1 NAS-IP-Address = 10.1.1.110 NAS-Identifier = "ap-test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 208 to 10.1.1.110 port 1645 EAP-Message = 0x01060031190014030100010116030100203814f45afe407392e87efb6983a8870981a942c2f81ed324195f71a524de0089 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd17667e503f66ca288c2db35cb34e6c2 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.110:1645, id=209, length=150 User-Name = "Administrator" Framed-MTU = 1400 Called-Station-Id = "001a.6c5f.5100" Calling-Station-Id = "0040.96a1.8a54" Service-Type = Login-User Message-Authenticator = 0x0627ca644456709d58ed18a2ce57831b EAP-Message = 0x020600061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 683 State = 0xd17667e503f66ca288c2db35cb34e6c2 NAS-IP-Address = 10.1.1.110 NAS-Identifier = "ap-test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 209 to 10.1.1.110 port 1645 EAP-Message = 0x01070020190017030100158a69836250fab5a87e8dd70c7200f0fbf64a042f7b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2b41d7e3a2939636a6f894a7a671d2bb Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.110:1645, id=210, length=185 User-Name = "Administrator" Framed-MTU = 1400 Called-Station-Id = "001a.6c5f.5100" Calling-Station-Id = "0040.96a1.8a54" Service-Type = Login-User Message-Authenticator = 0x391651fddd34e113abc34ad2ad91aeea EAP-Message = 0x020700291900170301001e12f79f555717d8b2209a14f5d23824e4d072bc00cca4d91573805ac59bdb NAS-Port-Type = Wireless-802.11 NAS-Port = 683 State = 0x2b41d7e3a2939636a6f894a7a671d2bb NAS-IP-Address = 10.1.1.110 NAS-Identifier = "ap-test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - Administrator rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700120141646d696e6973747261746f72 PEAP: Got tunneled identity of Administrator PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to Administrator PEAP: Sending tunneled request EAP-Message = 0x020700120141646d696e6973747261746f72 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Administrator" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800271a01080022106bff528cee3735f159e2e423b9a1b58741646d696e6973747261746f72 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf537d300d4e8efd604854f40dc640251 PEAP: Processing from tunneled session code 0x8d67e68 11 EAP-Message = 0x010800271a01080022106bff528cee3735f159e2e423b9a1b58741646d696e6973747261746f72 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf537d300d4e8efd604854f40dc640251 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 210 to 10.1.1.110 port 1645 EAP-Message = 0x0108003e19001703010033f2767694f2b314c765de3196f34fcfd2224b87519edec105cc14aa8774d2464c881507edd375a80b4bed4418f9f0534af45d53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a58316d09a226fca75a2395385a60a1 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.110:1645, id=211, length=239 User-Name = "Administrator" Framed-MTU = 1400 Called-Station-Id = "001a.6c5f.5100" Calling-Station-Id = "0040.96a1.8a54" Service-Type = Login-User Message-Authenticator = 0x1dba61d8c8627129899a9a3203e6e37b EAP-Message = 0x0208005f19001703010054757bdab4a9263e10c6d8a9691c16e0f9cafc9e8a266dbd56a6706817802c616bd9e8132774fa54331a15f447baa3a5e0bf1afe52716c41b5a5d6d5fd87067dc6bb545b2c76c2a58ef5b045b2e2f67d57b1a99c95 NAS-Port-Type = Wireless-802.11 NAS-Port = 683 State = 0x4a58316d09a226fca75a2395385a60a1 NAS-IP-Address = 10.1.1.110 NAS-Identifier = "ap-test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 95 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800481a0208004331bbc709898ccd4b9b3e8de0e0257783e100000000000000004a7cd9abdfc2f92680c182845a937f4beb6646c4cddd7de10041646d696e6973747261746f72 PEAP: Setting User-Name to Administrator PEAP: Adding old state with f5 37 PEAP: Sending tunneled request EAP-Message = 0x020800481a0208004331bbc709898ccd4b9b3e8de0e0257783e100000000000000004a7cd9abdfc2f92680c182845a937f4beb6646c4cddd7de10041646d696e6973747261746f72 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Administrator" State = 0xf537d300d4e8efd604854f40dc640251 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 72 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for Administrator with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' rlm_mschap: No NT-Domain was found in the User-Name. radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 6b radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --domain= --username=Administrator --challenge=bb4c397988ae6ebc --nt-response=4a7cd9abdfc2f92680c182845a937f4beb6646c4cddd7de1' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain= --username=Administrator --challenge=bb4c397988ae6ebc --nt-response=4a7cd9abdfc2f92680c182845a937f4beb6646c4cddd7de1 Exec-Program output: No such user (0xc0000064) Exec-Program-Wait: plaintext: No such user (0xc0000064) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8d67708 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 211 to 10.1.1.110 port 1645 EAP-Message = 0x010900261900170301001b2466fb337d6515701d17bf6ba992a265c5358d028de8eb11f9c8c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaadc7bbf54e267f09efe8524cd195aa2 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.110:1645, id=212, length=182 User-Name = "Administrator" Framed-MTU = 1400 Called-Station-Id = "001a.6c5f.5100" Calling-Station-Id = "0040.96a1.8a54" Service-Type = Login-User Message-Authenticator = 0xe97b3122d0fb931a13954986b7b43152 EAP-Message = 0x020900261900170301001b9589405a87362f7b801540c2b914ad3b2b2ee05b0e12c5055c7f05 NAS-Port-Type = Wireless-802.11 NAS-Port = 683 State = 0xaadc7bbf54e267f09efe8524cd195aa2 NAS-IP-Address = 10.1.1.110 NAS-Identifier = "ap-test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.1.110:1645, id=212, length=182 Sending Access-Reject of id 212 to 10.1.1.110 port 1645 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Cleaning up request 0 ID 205 with timestamp 461f09c0 Cleaning up request 1 ID 206 with timestamp 461f09c0 Cleaning up request 2 ID 207 with timestamp 461f09c0 Cleaning up request 3 ID 208 with timestamp 461f09c0 Cleaning up request 4 ID 209 with timestamp 461f09c0 Cleaning up request 5 ID 210 with timestamp 461f09c0 Cleaning up request 6 ID 211 with timestamp 461f09c0 Cleaning up request 7 ID 212 with timestamp 461f09c0 Nothing to do. Sleeping until we see a request.

2 2

Triple Play Service Accouting Suggestion
by ram 13 Apr '07

13 Apr '07

Hi all iam planning to deploy DSL Services along with Triple play service I would like to use FreeRadius for my test application/ and performance well going to live environment could some suggest me. is this Free Radius can be used for this kind of application if this supports, can some one guide me to URL where i can integrate all Services thanks ram

1 0

1.1.3 authenticating via radtest fails, debug output included.
by Jacob Jarick 12 Apr '07

12 Apr '07

Im having trouble getting rad test and my wireless clients to authenticate. I have followed "FreeRADIUS Tutorial for AD intergration" step by step. Im using freeradius 1.1.3 to authenticate against a windows 2003 server. I would use a later version but they all (including 1.1.6) segfault on fedora 6. files: clients.conf http://pastebin.ca/437594 eap.conf http://pastebin.ca/437596 radiusd.conf http://pastebin.ca/437597 proxy.conf http://pastebin.ca/437598 radtest output: [root@fedora ~]# /usr/bin/radtest Administrator tfxsol 127.0.0.1:1812 10 testing123 Sending Access-Request of id 44 to 127.0.0.1 port 1812 User-Name = "Administrator" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=44, length=20 radius -X output: [root@fedora raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key--domain=%{mschap:NT-Domain}--username=%{mschap:User-Name}--challenge=%{mschap:Challenge:-00}--nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32771, id=44, length=65 User-Name = "Administrator" User-Password = "tfxsol" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [Administrator]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 44 to 127.0.0.1 port 32771 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 44 with timestamp 461ef431 Nothing to do. Sleeping until we see a request.

1 0