May 2007 - Freeradius-Users - lists.freeradius.org

timeouts through a firewall?
by Matt Ashfield 09 May '07

09 May '07

Hi All We are seeing the following error: Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Our radius server talks to our LDAP server through a firewall. I'm wondering if this has to do with the session lifetime setting on the firewall? If there are no authentications taking place (we're in testing mode, and it was at least 2-3 hours between client authentications), then I guess this connection/session could be timed out by the firewall? I just want to know if that makes sense before approaching the firewall guys and asking to increase the timeout. Thanks Matt mda(a)unb.ca

4 3

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 08 May '07

08 May '07

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" identity = "cn=Directory Manager" password = 1223 basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

Machine-Authentication against SaMBa account in LDAP Directory
by Christian Hohmann 08 May '07

08 May '07

Hi members, I have a problem with the name of hosts. Here is the situation: I have an LDAP Directory which is filled by samba-Deamon, for example with hosts that are added to my domain. Samba signs every host-account with a "$" at the end. If my laptop would be named christian, the entry created by SaMBa in LDAP is "christian$" Now I configured host authentication of windows Machines with freeradius. Windows machines are configured to answer with their host account and password. The windows machine christian answeres with the string "host/christian" als Username. I configured realm with proxy to cut away host/. So the current Username is "christian". The username in LDAP is "christian$" and so I added a $ sign in the following line of the radiusd.conf Change the line from : filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" to: filter = "(uid=%{Stripped-User-Name:-%{User-Name}}$)" This adds a $ sign to every User ID at the end. I can do authentication for all Hosts authenticate with their host account. The problem is, that I have no possibility to authenticate with a username that has no $ as last character. This is the case for all users exept host accounts. Do you have a hint for me, how I could add the $ sign at the end of hostnames, but not for "normal users"? Best regards Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

4 3

Re: dyndns.org domain in Clients.conf
by AS Alex 08 May '07

08 May '07

Yes i have enabled hostname_lookups but nothing. For VPN...can be an idea but without vpn it's possibile to realize what i need?? ----- Original Message ----- From: "Milan Holub" <holub(a)thenet.ch> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Friday, May 04, 2007 11:29 AM Subject: Re: dyndns.org domain in Clients.conf > Hi, > > just a guess: > > Ensure that you have following line radiusd.conf: > hostname_lookups = yes > > Milan Holub > holub (at) thenet (dot) ch > > -------------------------------------- > TheNet-Internet Services AG, > im Bernertechnopark, Morgenstr. 129 > CH-3018, Bern, Switzerland > 031 998 4333, Fax 031 998 4330 > http://www.thenet.ch > http://wlan.thenet.ch > -------------------------------------- > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 6

Proxy.conf regex
by Joseph 08 May '07

08 May '07

Is it possible to use wild card domains in proxy.conf? Or does regex support have to be enabled somewhere or can it be enabled? regards, Joseph

7 13

Biometria
by Fábio Roberto da Silva 08 May '07

08 May '07

Good Morning I am verifying the possibility to use freeradius with authentication server being used biometria, using data base Mysql, would like to know as to implement this type of authentication Fábio Roberto da Silva __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0

Re: dyndns.org domain in Clients.conf
by AS Alex 08 May '07

08 May '07

How i can use nas identifier attribute?? client.conf needs an ip however ?? i'm very confused. ----- Original Message ----- *From:* YvesDM <ydmlog(a)gmail.com> *To:* FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> *Sent:* Friday, May 04, 2007 1:21 PM *Subject:* Re: dyndns.org domain in Clients.conf On 5/4/07, AS Alex <asblackdevils(a)gmail.com> wrote: > > Yes i have enabled hostname_lookups but nothing. > > Hostname lookups are only done at FR startup, so as soon as the ip changes you have a problem :-) Use the Nas identifier attribute. Kind regards, Yves ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: eap-tls authentication with free radius 1.1.5 (Alan DeKok)
by anoop_c＠sifycorp.com 08 May '07

08 May '07

Hi i didn\'t get the exact problem. I have gone through eap.conf. Pls make little bit clear abt the problem Anoop freeradius-users-request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body \'help\' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than \"Re: Contents of Freeradius-Users digest...\" > > > Today\'s Topics: > > 1. Re: MySQL and postauth_query (George Embrey) > 2. Re: FreeRadius crash (A.L.M.Buxey(a)lboro.ac.uk) > 3. Re: MySQL and postauth_query (Peter Nixon) > 4. Re: rlm_sqlippool in freeradius 1.1.6 (Peter Nixon) > 5. Re: IP billing with freeradius (satish patel) > 6. Re: IP billing with freeradius (Peter Nixon) > 7. Re: eap-tls authentication with free radius 1.1.5 (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 08 May 2007 14:38:39 +1000 > From: George Embrey <george(a)vmail.net.au> > Subject: Re: MySQL and postauth_query > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <463FFECF.7080101(a)vmail.net.au> > Content-Type: text/plain; charset=\"us-ascii\" > > Hugh Messenger wrote: > > >George Embrey <george(a)vmail.net.au> says: > > > > > >>Queries to Windows MySQL servers from Linux Systems often fail unless > >>the lower_case_table_names parameter is set to 0 in the my.ini file > in > >>the MySQL directory. > >> > >> > > > >I\'m familiar with that issue, and I checked all the table case-ness. > The > >problem seems to be with providing an empty string (\'\') as the value > for an > >auto-incrementing integer primary index. > > > > > Yes that is true \'\' or empty strings are not nulls or integers... I > suggest replacing the \'\' with the word null, this will sort out the > issue based on the query you specified. > > >The problem with setting lower_case_table_names to 0 is that I could > end up > >blowing away my MyISAM tables elsewhere in that server, as per the > warning > >the service control gives, if I moof a query on those and use the > \"wrong\" > >case: > > > > > > > I would rename the MyISAM tables using phpmyadmin or using SQL and sort > out the Database to run case sensitive in the first place like the ANSI > standard. > > Or much better still mysqldump the entire MySQL server into a file > \"textfilename.sql\", sort out the table names etc... using a good text > editor, place a drop table if exists before each create table entry, > save the file then run mysql -uroot -p < \"textfilename.sql\" to recreate > all of the databases including data with tablenames in the correct > case... > > Maybe I am just too fussy... > > >\"You have forced lower_case_table_names to 0 through a command-line > option, > >even though your file system \'E:MySQLData\' is case insensitive. > This > >means that you can corrupt a MyISAM table by accessing it with > different > >cases. You should consider changing lower_case_table_names to 1 or 2\" > > > > > > > Only if you live in an all windows world... \"Compatability is a bitch > it > demands the use of standards, the little things which M$ don\'t adhere > to > very well\" ;-) > > >It\'s working fine with my modifie query, so I\'m just going to put this > down > >to \"a 5.x thing\" and live with my change. Compared to the wholesale > hack > >and slash job I\'ve had to do on the sqlippool queries to get them to > work, > >it\'s no Big Whoop, LOL! > > > >But thanks for the suggestion, I appreciate your time. > > > > -- hugh > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > George Embrey > CEO / Senior Systems Architect. > Vmail Internet Services Pty Ltd. > 318 Shoal Point Road > Shoal Point QLD 4750 > Australia >

1 0

IP billing with freeradius
by satish patel 08 May '07

08 May '07

Dear Sir I am working in data center so i need ip base billing means which ip address useing how much bandwidth means i give 10 GB data transfer to my one customer and 10GB data transfer reached then i got mesge or i can block the port of server what ever this is example so it is possible can i accouting of data transfer through my core switch ?? Reghards Satish Patel $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Office firewalls, cyber cafes, college labs, don't allow you to download CHAT? Here's a solution!

4 6

eap-tls authentication with free radius 1.1.5
by anoop_c＠sifycorp.com 08 May '07

08 May '07

Hi list I am tryinmg to do EAP_TLS certificate based authentication with free radius 1.1.5.The setup worked well with freeradius-snapshot-20021028.But as Windows vista is not supporting the same.So i am trying to do the authentication with 1.1.5 version Pls find the debug message. ot@anoop raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \"/usr/local/var/log/radius/radius.log\" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: user = \"(null)\" main: group = \"(null)\" main: usercollide = no main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = \"no\" main: nospace_pass = \"no\" main: checkrad = \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = \"(null)\" exec: input_pairs = \"request\" exec: output_pairs = \"(null)\" exec: packet_type = \"(null)\" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = \"crypt\" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = \"(null)\" mschap: ntlm_auth = \"(null)\" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \"(null)\" tls: pem_file_type = yes tls: private_key_file = \"/etc/1x/07xwifi.pem\" tls: certificate_file = \"/etc/1x/07xwifi.pem\" tls: CA_file = \"/etc/1x/root.pem\" tls: private_key_password = \"password\" tls: dh_file = \"/etc/1x/DH\" tls: random_file = \"/etc/1x/random\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = \"suffix\" realm: delimiter = \"@\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = \"/etc/raddb/users\" files: acctusersfile = \"/etc/raddb/acct_users\" files: preproxy_usersfile = \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port\" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1027, id=0, length=197 Message-Authenticator = 0x6e5c5bee98e478bb919a0a4779945e06 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 modcall[authorize]: module \"chap\" returns noop for request 0 modcall[authorize]: module \"mschap\" returns noop for request 0 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 0 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3957d24037304516214893f00a023efe Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1027, id=1, length=299 Message-Authenticator = 0xe5ccf77d7f2a7d5bda0a2665725fae25 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x3957d24037304516214893f00a023efe Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020100600d800000005616030100510100004d0301463f12ed420bc1 a3110cd23ccfe6e0215058e72b53ff50e5459ca7dead7b55ec105817a39fe5ba38d7d5235bd73179 a4a7001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 modcall[authorize]: module \"chap\" returns noop for request 1 modcall[authorize]: module \"mschap\" returns noop for request 1 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 1 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a0dc000000564160301004a020000460301463f12e8d54cc3 719cd6999605c885dc3423a304826384417e2c404a7c15cf8d20358795671f2005a10e6e59ed4499 f218aa670ff33e7f13d2139860164d3b7e7f00040016030104bf0b0004bb0004b800022c30820228 30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a 3060310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72 702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a 47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f 9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7 c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186 ed290203010001a317301530130603551d25040c300a06082b EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847 b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9 ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326 92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e0603550403130730377877696669301e170d EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003 818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08 2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2 c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748 36fcaf105200fcd5df5158e2b387310c4ed90203010001a381 EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8328be193d596d8f0b13c977aaaf5cbc Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1027, id=2, length=209 Message-Authenticator = 0xb1f2bd76ec8b4badf29ea01180d76374 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x8328be193d596d8f0b13c977aaaf5cbc Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 modcall[authorize]: module \"chap\" returns noop for request 2 modcall[authorize]: module \"mschap\" returns noop for request 2 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 2 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355 1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603 5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06 03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d 0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b 8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3 5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1 EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906 035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966 690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdbfcbbd6812a2502176f76dd96d6e645 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1027, id=3, length=209 Message-Authenticator = 0xc2de18c894d86c7bb8dff575c8db658b Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0xdbfcbbd6812a2502176f76dd96d6e645 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020300060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 modcall[authorize]: module \"chap\" returns noop for request 3 modcall[authorize]: module \"mschap\" returns noop for request 3 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 3 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed801abad54d9d77e26d58fe30c791cc Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 463f12e8 Cleaning up request 1 ID 1 with timestamp 463f12e8 Cleaning up request 2 ID 2 with timestamp 463f12e8 Cleaning up request 3 ID 3 with timestamp 463f12e8 Nothing to do. Sleeping until we see a request. Pls suggest Regards Anoop

2 1