July 2007 - Freeradius-Users - lists.freeradius.org

Level 2 authentication with RADIUS.
by ashish verma 19 Jul '07

19 Jul '07

Hi all, I am new to the list and for RADIUS too so i might ask some repetitive questions. Here is my question: Can we have level 2 (enable) authentication too with Radius server as we have for level 1(user level)? If yes, can someone provide me some documentation. I tried to search for it but couldnt find any. Thanks in advance, Ashish

2 2

Re: Freeradius-Users Digest, Vol 27, Issue 116
by ashish verma 19 Jul '07

19 Jul '07

Hi all, Thanks for the reply. i was just missing " ". Well another problem here.. i have defined a priv level 7 in the switch. ran the following commands. privilege configure level 7 snmp-server host privilege configure level 7 snmp-server enable privilege configure level 7 snmp-server privilege exec level 7 ping ! But still the user is able to run all the commands. here is my user file conf user Auth-Type :=Local, User-Password == "user" Service-Type = NAS-Prompt-User, Login-Service = ssh, Cisco-avpair = "Shell:priv-lvl=7" On 7/19/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Problem in EAP-TLS Authentication (Govardhana K N) > 2. Re: Quirky question about rewriting usernames (Pshem Kowalczyk) > 3. Support for Cisco (ashish verma) > 4. Re: Support for Cisco (tnt(a)kalik.co.yu) > 5. Re: Support for Cisco (Peter Nixon) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 19 Jul 2007 10:36:28 +0530 > From: "Govardhana K N" <govardhan.nagarajaiah(a)gmail.com> > Subject: Problem in EAP-TLS Authentication > To: FreeRadius <freeradius-users(a)lists.freeradius.org> > Message-ID: > <5f382300707182206k616c02f6ude7fb5e71976dbe9(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > I was trying to configure EAP with TLS/TTlS. After enabling TLS/TTLS in " > eap.conf", I tried sending an Radius Access-Request with EAP-Identitye > response. The Server is crashing becoz of segmentation fault. The debug > lod > from the server is given below. > > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > cheux301:/etc/freeradius# freeradius -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/freeradius/proxy.conf > Config: including file: /etc/freeradius/clients.conf > Config: including file: /etc/freeradius/snmp.conf > Config: including file: /etc/freeradius/eap.conf > Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius:/usr/local/lib" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/freeradius/freeradius.pid" > main: bind_address = 127.0.0.1 IP address [127.0.0.1] > main: user = "freerad" > main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = no > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/lib/freeradius:/usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = yes > mschap: require_strong = yes > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "/etc/passwd" > unix: shadow = "/etc/shadow" > unix: group = "/etc/group" > unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" > tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" > tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/etc/freeradius/certs/dh" > tls: random_file = "/etc/freeradius/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = yes > tls: check_cert_cn = "%{User-Name}" > tls: cipher_list = "DEFAULT" > tls: check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > ttls: default_eap_type = "md5" > ttls: copy_request_to_tunnel = no > ttls: use_tunneled_reply = no > rlm_eap: Loaded and initialized type ttls > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication 127.0.0.1:1812 > Listening on accounting 127.0.0.1:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32823, id=217, > length=95 > User-Name = "jrc" > NAS-Identifier = "jrcnas" > NAS-Port-Type = Ethernet > CUI = "0" > Service-Type = Framed-User > Framed-MTU = 1400 > Calling-Station-Id = "1:1:1:1:1:1" > Message-Authenticator = 0x2568987af6f31763f9199f8067fafee1 > EAP-Message = 0x02d20008016a7263 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > Segmentation fault > cheux301:/etc/freeradius# > > > > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > > -- > Thanks & Regards, > Govardhana K N >

1 0

Support for Cisco
by ashish verma 19 Jul '07

19 Jul '07

Hi all, I am trying to configure "free radius" for some Cisco devices. till now i am able to authenticate using the radius server and i am getting into user level or privilege level depending on the attribute i am defining. Now what i am looking for is authorization. There is something called "Cisco-AV priv" attribute through which one can define privilege level from 1 to 15. But i am not able to define it in "users file". Can anyone tell me how to define this or whether we can define this kind of attribute in freeradius or not? Thanks in advance, Ashish

3 4

Re: Support for WiMAX VSA
by Nitin Naveen 19 Jul '07

19 Jul '07

Hi Walter, We fixed the freeradius so that the WiMAX VSA may be downloaded to the ASNGW after EAP completion. We have not enhanced freeradius to be AAA server in a WiMAX network. We download the MSK from freeradius to our ASNGW. Based on the downloaded MSK our ASNGW generates the AK context and hence the required keys. Freeradius only provides the key material, generation is part of our ASNGW. Hope this explanation helps. We can work towards making freeradius a complete AAA server for the WiMAX network. Regards Nitin freeradius-users-request(a)lists.freeradius.org Sent by: freeradius-users-bounces+nitin.naveen=hsc.com(a)lists.freeradius.org 07/19/2007 09:27 AM Please respond to freeradius-users(a)lists.freeradius.org To freeradius-users(a)lists.freeradius.org cc Subject Freeradius-Users Digest, Vol 27, Issue 114 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Mikrotik Accounting ON/OFF (Hugh Messenger) 2. Re: 1.1.7 sqlippool %{SQL-User-Name} (Peter Nixon) 3. Testing WAD via ntlm_auth (ken) 4. Re: Testing WAD via ntlm_auth (A.L.M.Buxey(a)lboro.ac.uk) 5. RE: Mikrotik Accounting ON/OFF (tnt(a)kalik.co.yu) 6. Re: Testing WAD via ntlm_auth (tnt(a)kalik.co.yu) 7. RE: Mikrotik Accounting ON/OFF (Hugh Messenger) 8. Support for WiMAX VSA (Nitin Naveen) 9.Support for WiMAX VSA(Walter Goulet) ---------------------------------------------------------------------- Message: 1 Date: Wed, 18 Jul 2007 14:47:22 -0500 From: "Hugh Messenger" <hugh(a)alaweb.com> Subject: RE: Mikrotik Accounting ON/OFF To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <00d301c7c974$76445ed0$010210ac@DELLBOY> Content-Type: text/plain; charset="us-ascii" tnt(a)kalik.co.yu said: > >, but if anyone on this list has a Beta 3 setup :-D > > Good old SETUP - missing or bug: > http://forum.mikrotik.com/viewtopic.php?f=1&t=16963 OK, I'll rephrase that ... "if anyone on this list has a 3.0beta10 install they can test with". :) > Ivan Kalik > Kalik Informatika ISP -- hugh ------------------------------ Message: 2 Date: Wed, 18 Jul 2007 23:03:46 +0300 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: 1.1.7 sqlippool %{SQL-User-Name} To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200707182303.46430.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-1" On Wed 18 Jul 2007, Hugh Messenger wrote: > Peter Nixon quoth: > > On Tue 17 Jul 2007, Hugh Messenger wrote: > > > Can we add sqlippool to the ./modules/stable list? > > > > It is in the stable list for 2.0 but its up to Alan whether we put it in > > for 1.1.7 > > It's been pretty darn stable for me in 1.1.6. And now we've gotten the > MySQL stuff whipped into shape and fixed a few other issues for 1.1.7, I'd > say it's ready for Prime Time. OK. Thats good enough for me. I have added it :-) -- Peter Nixon http://peternixon.net/ ------------------------------ Message: 3 Date: Wed, 18 Jul 2007 21:41:10 +0100 From: ken <k.brown(a)bbk.ac.uk> Subject: Testing WAD via ntlm_auth To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <469E7AE6.8060505(a)bbk.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Does anyone have actual examples of radclient (or other command-line tools) being used to test Freeradius using Windows Active Directory authentication via samba/ntlm_auth? I'd like to be able to test Radius authentication for various different categories of user on our Active Directory. Presumably this involves PEAP/MSCHAPv2 I can't work out how to do it without using a Windows client and a wireless infrastructure we don't have yet. (or even if it is doable) I can use radclient to test PAP and "straight" CHAP against locally defined users with cleartext passwords. Time to go one step further. ------------------------------ Message: 4 Date: Wed, 18 Jul 2007 21:55:08 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Testing WAD via ntlm_auth To: k.brown(a)bbk.ac.uk, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20070718205508.GA21505(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Presumably this involves PEAP/MSCHAPv2 I can't work out how to > do it without using a Windows client and a wireless > infrastructure we don't have yet. (or even if it is doable) you dont need wireless to do such testing - there are plenty of ethernet switches out there that do 802.1x and can throw the EAP authentication to your RADIUS box... ....with this in mind, you could use wpa_supplicant on linux - yes it does wired 802.1x nicely... eg have this in the config eap=PEAP identity="domain\username" password="secret_password" ca_cert="/etc/cert/ca.pem" phase1="peaplabel=0" phase2="auth=MSCHAPV2" or..since you're playing with wpa_supplicant..use its handy tool eapol_test - very useful. of course, with wired 802.1x you can also play with the windows client and get used to its quirks and foibles. alan ------------------------------ Message: 5 Date: Wed, 18 Jul 2007 22:05:01 +0100 From: <tnt(a)kalik.co.yu> Subject: RE: Mikrotik Accounting ON/OFF To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <b03pBwWK.1184792701.4799830.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 I have an idle routerboard waiting for a replacement wifi mini-pci. It has routeros 2.9 but somehow I am not tempted to try the upgrade: upgrade to 3beta & failed logins: http://forum.mikrotik.com/viewtopic.php?f=3&t=17128 On liked topic things go from bad to worse - it seems that the wireless package is working as well as setup command in beta: RB133c and 3.10b: http://forum.mikrotik.com/viewtopic.php?f=1&t=16502&p=80766 And since routerboard has flash memory and not HDD for storing OS I am not so sure what would happen to the licence after the upgrade/downgrade. Not particularly keen to find out :-( Ivan Kalik Kalik Informatika ISP Dana 18/7/2007, "Hugh Messenger" <hugh(a)alaweb.com> pi?e: >tnt(a)kalik.co.yu said: >> >, but if anyone on this list has a Beta 3 setup :-D >> >> Good old SETUP - missing or bug: >> http://forum.mikrotik.com/viewtopic.php?f=1&t=16963 > >OK, I'll rephrase that ... "if anyone on this list has a 3.0beta10 install >they can test with". :) > >> Ivan Kalik >> Kalik Informatika ISP > > -- hugh > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ Message: 6 Date: Wed, 18 Jul 2007 23:38:12 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Testing WAD via ntlm_auth To: freeradius-users(a)lists.freeradius.org Message-ID: <20aUZbvV.1184798292.9840090.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 http://www.nabble.com/MSCHAP-test-client--tf4069370.html You don't need to do PEAP to test ntlm_auth, just MSCHAP. Ivan Kalik Kalik Informatika ISP Dana 18/7/2007, "ken" <k.brown(a)bbk.ac.uk> pi?e: >Does anyone have actual examples of radclient (or other >command-line tools) being used to test Freeradius using Windows >Active Directory authentication via samba/ntlm_auth? > >I'd like to be able to test Radius authentication for various >different categories of user on our Active Directory. > >Presumably this involves PEAP/MSCHAPv2 I can't work out how to >do it without using a Windows client and a wireless >infrastructure we don't have yet. (or even if it is doable) > >I can use radclient to test PAP and "straight" CHAP against >locally defined users with cleartext passwords. Time to go one >step further. > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ Message: 7 Date: Wed, 18 Jul 2007 17:58:06 -0500 From: "Hugh Messenger" <hugh(a)alaweb.com> Subject: RE: Mikrotik Accounting ON/OFF To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <00e401c7c98f$1b3a2450$010210ac@DELLBOY> Content-Type: text/plain; charset="us-ascii" I finally thought to look in the changelog http://www.mikrotik.com/download/CHANGELOG_beta > What's new in 3.0beta10: [blah blah] > *) added radius client to send Accounting-On packet on startup; [blah] -- hugh ------------------------------ Message: 8 Date: Thu, 19 Jul 2007 09:11:26 +0530 From: Nitin Naveen <Nitin.Naveen(a)hsc.com> Subject: Support for WiMAX VSA To: freeradius-users(a)lists.freeradius.org Cc: freeradius-users-bounces+nitin.naveen=hsc.com(a)lists.freeradius.org, freeradius-users(a)lists.freeradius.org Message-ID: <OF4AEE7966.C6FE6E61-ON6525731D.00137FC1-6525731D.00149CEF(a)hsc.com> Content-Type: text/plain; charset="us-ascii" Hello All, Hi I am Nitin Naveen working with HUGHES SYSTIQUE. We have been working to enhance freeradius to support WiMAX VSA (as per WiMAX NWG forum). WiMAX VSA are not the typical type-length-value rather they have type-length-controlinfo-value. We have enhanced the dictionary but we were not able to generate the attributes as per the WiMAX NWG format. For now we have developed our own rlm_hsc_wimax module. We like to contribute to freeradius so that the WiMAX VSA are supported as part of the standard distribution. To this end we can share our code. But before that we would like to follow the correct procedure for releasing the code. Your inputs and suggestion are awaited. Regards Nitin Naveen Principal Engineer HUGHES SYSTIQUE D-8, Infocity-11 Sector-33, Gugaon Haryana, India tel: +91-124-3045400 fax: +91-124-4039301 nitin.naveen(a)hsc.com www.hsc.com *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

1 0

Mikrotik Accounting ON/OFF
by Hugh Messenger 18 Jul '07

18 Jul '07

I got a response from Mikrotik on this thread: http://forum.mikrotik.com/viewtopic.php?f=1&t=17171 . saying that "I think that following attribute is added at 3.0beta10." Unfortunately I don't have a spare Mtik at the moment I can test the v3 Beta OS on. I have a new one on order, so I should be able to test this myself in a week or so, but if anyone on this list has a Beta 3 setup they can test this with, maybe you could take a few minutes and give it a whirl. -- hugh

2 4

Freeradius 1.1.6 and Cisco 2000 Wirelss Controller
by Brian Ertel 18 Jul '07

18 Jul '07

Hi, I've gotten a bit further but am still getting stuck. I have the Cisco Wireless Controller configured to hit Freeradius for MAC Address Authentication. Freeradius sees the request from the controller and sends back the configure attributes from the users file but the controller doesn't seem to see it correctly (the desired VLAN tag) and I end up in the default VLAN as configured on the controller. Below is my users, clients.conf, and radiusd verbose data output. Any thoughts? Ready to process requests. rad_recv: Access-Request packet from host 148.85.34.82:32768, id=35, length=174 User-Name = "00:0e:35:1c:e0:52" Called-Station-Id = "00-1a-6d-6b-f0-80:2000test" Calling-Station-Id = "00-0e-35-1c-e0-52" NAS-Port = 1 NAS-IP-Address = 148.85.34.82 NAS-Identifier = "WLC-34-82" Airespace-Wlan-Id = 1 User-Password = "testing" Service-Type = Call-Check Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "159" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00:0e:35:1c:e0:52", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00:0e:35:1c:e0:52 at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 35 to 148.85.34.82 port 32768 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "157" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 35 with timestamp 4697de6a Nothing to do. Sleeping until we see a request. ____________________________________________________________ 00:0e:35:1c:e0:52 Auth-Type := Local, User-Password == "testing" Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "157", ______________________________________________________________ client 148.85.34.82 { # # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # # The secret can be any string, up to 31 characters in length. # secret = xxxxxxx # # The short name is used as an alias for the fully qualified # domain name, or the IP address. # shortname = controller # # the following three fields are optional, but may be used by # checkrad.pl for simultaneous use checks # # # The nastype tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use. # # Permitted NAS types are: # # cisco # computone # livingston # max40xx # multitech # netserver # pathras # patton # portslave # tc # usrhiper # other # for all other types # nastype = other # localhost isn't usually a NAS... _____________________ Brian Ertel Network Administrator Amherst College 413-542-8320 bsertel(a)amherst.edu _____________________

4 10

3COM sw4500 802.1x Problem
by Aydin KOÇAK 18 Jul '07

18 Jul '07

Hello; I implemented 802.1x on 3com 4500 switch but i receive an error on my FreeRadius server: rlm_ldap: - authorize rlm_ldap: performing user authorization for aydin radius_xlat: '(uid=aydin)' radius_xlat: 'ou=Kullanicilar,dc=kocak,dc=org,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Kullanicilar,dc=kocak,dc=org,dc=tr, with filter (uid=aydin) --- Walking the entire request list --- Waking up in 5 seconds... Threads: total/active/spare threads = 5/1/4 rlm_ldap: checking if remote access for aydin is allowed by uid rlm_ldap: Added password 61714164102 in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusHint as User-Password, value 1111 & op=21 rlm_ldap: Adding radiusAuthType as Auth-Type, value Local & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 802 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user aydin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ auth: Failed to validate the user. My proablem is "No User-Password or CHAP-Password attribute in the request" message it is clear but my supplicant (XP and SecureW2) don't sent User-Password as is seen : [1 User-name ] [7 ] [aydin] *0.24948670 4500 RDS/8/DEBUG:- 1 - [79 EAP-Message ] [12] [0201000A01617964696E] [80 Message-Autheticator ] [18] [00000000000000000000000000000000] [4 NAS-IP-Address ] [6 ] [192.168.0.77] [32 NAS-Identifier ] [6 ] [4500] [5 NAS-Port ] [6 ] [268443649] [61 NAS-Port-Type ] [6 ] [15] *0.24949119 4500 RDS/8/DEBUG:- 1 - [6 Service-Type ] [6 ] [2] [7 Framed-Protocol ] [6 ] [1] [31 Caller-ID ] [16] [303030382D306435332D33623336] User-Password not in request. How am i sent User-Password ? I tried WinXP 802.1x (EAP-MD5) and SecureW2(EAP-MD5). My /etc/users file is following : --------------------------------- DEFAULT Auth-Type = LDAP Fall-Through = 1 --------------------------------- Thanks your relation. Aydin Kocak.

2 1

About eap-peap/switch/FR/openldap
by Hangjun He 18 Jul '07

18 Jul '07

hi, I am use freeradius1.1.6 . And It can work. But there is a question: why freeradius recieve username=anonymous many time? and than receive real username hwang?? Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.84:1030, id=27, length=162 User-Name = "anonymous" // My username is hwang??? NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x892d753593e189cd36612f7fa07e459f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/openldap/ssl/cacert.pem rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as / to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 27 to 10.155.20.84 port 1030 EAP-Message = 0x01010016041061094fc60ca2cd662178a3d6eea822cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3a5eacc7a46269daed6e2e83bf27092c Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=28, length=172 User-Name = "anonymous" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x3a5eacc7a46269daed6e2e83bf27092c Message-Authenticator = 0x3429d0e18b932a327161388ce7e0bdc4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 28 to 10.155.20.84 port 1030 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78c6b1e762ecc5c348c57839451373fc Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=29, length=308 User-Name = "anonymous" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008e198000000084160301007f0100007b0301469dfab4e8c534467a7efea117a737c912db65b70fd69087e66db970d315915320ccd869a4c60335849db3ab1a6ac62e61453a4b96028a90f4d7003b9354af598f003400390038003300320016001300660035002f00150012000a000500040009006300650060006200610064001400110003000600080100 State = 0x78c6b1e762ecc5c348c57839451373fc Message-Authenticator = 0xd219e2d5ad47c0fac48409f97e811c06 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 142 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 007f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05f5], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 29 to 10.155.20.84 port 1030 EAP-Message = 0x0103040a19c000000764160301004a020000460301469dfab309c80c31b99e98c0a34aca8264f8f297de2c96c8d749bc2f8643ed65203b46728ba323185caf08c85e3a2c79d9f28fd7c95c65f4f1c94f9a20d9abaf1e00390016030105f50b0005f10005ee00028b30820287308201f0a003020102020101300d06092a864886f70d0101040500307c310b300906035504061302434e310b3009060355040813026161310b3009060355040713026161310b3009060355040a13026161310b3009060355040b1302616131193017060355040313107777772e6165726f686976652e636f6d311e301c06092a864886f70d010901160f6161406165726f EAP-Message = 0x686976652e636f6d301e170d3037303632363037323031385a170d3038303632353037323031385a307e310b300906035504061302434e310b3009060355040813026164310c300a06035504071303736466310b3009060355040a13027366310c300a060355040b130361736431193017060355040313107777772e6165726f686976652e636f6d311e301c06092a864886f70d010901160f6464406165726f686976652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100b634f0dd4ca2b2710ceb06a0d511a77b99bfffd41c3287bda963b1fd868b978dccbf7be1e4986cf08af63cbc811a7147b865c3dbdd529749 EAP-Message = 0xe54ebd3528f0bc1e070bef3576e374cda904f61c7fb19c861d52361206b659e74221081cb674521e21172342968b83c2e56606310d4cdb30f5670f53234c2006c89544dca8afa7690203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181004285d778012c69d462728a5cf6c7187151c83b5ec1509ad697bd4e2c55cd886be9097a289c13bdefe578674ce5ce0481c9840bb5dc878a9445465fc61f53205f875f79107dfdb55e15a5a38bbc8f8387f0abec3917629363ef6b0f1a15910dbb516fa80cd63c3d4f99508882c04935170a0750997e724a88284627d5a33390a400035d30 EAP-Message = 0x820359308202c2a0030201020209009f961f4fc34f74f5300d06092a864886f70d0101040500307c310b300906035504061302434e310b3009060355040813026161310b3009060355040713026161310b3009060355040a13026161310b3009060355040b1302616131193017060355040313107777772e6165726f686976652e636f6d311e301c06092a864886f70d010901160f6161406165726f686976652e636f6d301e170d3037303632363037313235365a170d3038303632353037313235365a307c310b300906035504061302434e310b3009060355040813026161310b3009060355040713026161310b3009060355040a13026161310b30 EAP-Message = 0x09060355040b13026161311930170603550403131077 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64f0f8b513f75e5eda3b855da24e0e94 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=30, length=172 User-Name = "anonymous" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x64f0f8b513f75e5eda3b855da24e0e94 Message-Authenticator = 0xeccfd2a31efa5926c1da829b98e7c190 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 30 to 10.155.20.84 port 1030 EAP-Message = 0x0104036a190077772e6165726f686976652e636f6d311e301c06092a864886f70d010901160f6161406165726f686976652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c474b27e94d9079f425dc26ae672f7422f90c0dc3acb64f6fe338cafd8c76abe6168006a0924e69387dafc4fe657a15ca04281abbc2f4e3012c0ec02fc49e4ea7d713ef14b49fec2339e9f4be422b21d468c3ad6f7cb5b111d586ffd642e7d0e030835b364d908b72b4c310a3c0740d3a6501f3f0ff54ad5f90fd8b7c5ff02b70203010001a381e23081df301d0603551d0e04160414050729ac4b9f02efbd89d61f801226f7b19871e730 EAP-Message = 0x81af0603551d230481a73081a48014050729ac4b9f02efbd89d61f801226f7b19871e7a18180a47e307c310b300906035504061302434e310b3009060355040813026161310b3009060355040713026161310b3009060355040a13026161310b3009060355040b1302616131193017060355040313107777772e6165726f686976652e636f6d311e301c06092a864886f70d010901160f6161406165726f686976652e636f6d8209009f961f4fc34f74f5300c0603551d13040530030101ff300d06092a864886f70d0101040500038181002617bba7fbd8d318ba237e03c59763285f5b3d552fb04f8295d6fb972e54a80e1ae55182b1b93fad56eccc EAP-Message = 0x008144c830ca22f22b37d28b7ec437ab988a5346105ad15a76f84ea9d1d746b6482241d95f106e8b83dcff277ffb4cfdb4b2c46e5030943c310d01e9e755e2a11bf21d3cf5eb1e50fb4e08e45d20f21cb01d75ef46160301010d0c00010900409fb2566c6daf40fa7213de35550402bb2c30650b0b690c926edfdc870939677dee5bef17f04c611d99c259a9f3c3564ff1b617cc682c42f2551d6061bee4ea6b00010500407c848e1deed61f74a1eae953c93aef3f11592a7ebca3039464d5caf560b157d1b36b1d2fe96779040e50b5b1203d45620b82d97b95128a3802d1c654301e4d35008007b33a97ac3ff6e4524749d01480f93aa974bbdca17c EAP-Message = 0x23edf88fd6106f647719683f43bedbd574348b023b18d55b950dc11e32e407bbf94d751f75df8b950263ddc4d50397b0e40f16fde6ea57d8a537ce16f38ddb4962e5b2546a48e4c9b25f94e8894cc44eba7f55133397855092202ead7e82ccfc59a0309620f73e75496e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aca38b181b8d8f126f6f9d75a95cea1 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=31, length=310 User-Name = "anonymous" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02040090198000000086160301004610000042004023b55a35ee451dc35ed4700cccf7378a2207e0602fc6d015659ebbc130312ca4b42ab2e6bc10b7ea3038f5057c5d2e42b75b074ef2b61cc07da33dad7fdef00314030100010116030100302259954c3a5d5001b973d8db65bfbc80b209196649f453710f17ee22aa0a8b24c37251c79d2617bdfc0db164c5d1f06f State = 0x6aca38b181b8d8f126f6f9d75a95cea1 Message-Authenticator = 0xf0b976660c9afb2bebbd92af021e7f39 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 144 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 31 to 10.155.20.84 port 1030 EAP-Message = 0x010500411900140301000101160301003058e4fa4949dbfc44b6eb52a41e2a278ae305a5e729bc575f83623c66afd6560be127d8c5f212e2925261c4a1334393d3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x24be7ab489df058566683a9ebe9c117e Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=32, length=172 User-Name = "anonymous" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0x24be7ab489df058566683a9ebe9c117e Message-Authenticator = 0xee16952d86d913a0de63ea9ac30686b5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 32 to 10.155.20.84 port 1030 EAP-Message = 0x0106002b190017030100200d55461e9cdb964514a669c9dfe5c13871fdd2169a2e4baaa0c9dfe12e76e04e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f2025da9f0e12d75d1b92245369cae4 Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=33, length=209 User-Name = "anonymous" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0206002b19001703010020cdfc4e1259368e75a31d741ace309219962619f1d83af282f29c39016fdcf570 State = 0x0f2025da9f0e12d75d1b92245369cae4 Message-Authenticator = 0xc3aa3be0f439676efe53acf688e853df Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - hwang rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000a016877616e67 PEAP: Got tunneled identity of hwang PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to hwang PEAP: Sending tunneled request EAP-Message = 0x0206000a016877616e67 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "hwang" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "hwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(cn=hwang)' radius_xlat: 'dc=company,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=company,dc=com, with filter (cn=hwang) rlm_ldap: checking if remote access for hwang is allowed by uid rlm_ldap: Added password hwang123 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user hwang authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0107001f1a0107001a10a2750f27e0c8b270b5791e5e4bd204a06877616e67 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc422a3c47ff3cec088d7cffbe0a09d3 PEAP: Processing from tunneled session code 0x81504d0 11 EAP-Message = 0x0107001f1a0107001a10a2750f27e0c8b270b5791e5e4bd204a06877616e67 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc422a3c47ff3cec088d7cffbe0a09d3 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 33 to 10.155.20.84 port 1030 EAP-Message = 0x0107003b19001703010030e585bc4c07bbbcb1bd451d8aed4f816f199eae6bc7aa0387afe552a14f10124aace813bcd79348bf52e26944fbe0aef8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67537faf447ee16778062badc8ed4ea2 Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.155.20.84:1030, id=34, length=273 --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！

2 1

rlm_perl examples
by FreeRadius-ML 18 Jul '07

18 Jul '07

Hi All, Ok, after battling with OpenSER + FreeRadius digest authentication, I managed to make it work correctly. Now, i've decided to try moving to rlm_perl, and I was wondering if any of you guys may have examples or code/configuration snips of rlm_perl integration. I've managed to work with a simple example, and got the phones registering with rlm_perl, which was fairly cool. Now, I need some examples or how to manipulate the dialplan on OpenSER to do as I please, but more importantly, examples of rlm_perl scripts that may be useful. Thanks in advance. Z2L

1 0

Re: how to drop idle users
by vik 18 Jul '07

18 Jul '07

It's ok now, it works fine thank you all. ----- Original Message ---- From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, July 18, 2007 2:56:58 PM Subject: Re: how to drop idle users *sigh* add it as a row not as a field :\ -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/

1 0