October 2008 - Freeradius-Users - lists.freeradius.org

Freeradius error: "Discarding conflicting packet"
by jelle-e 27 Nov '08

27 Nov '08

Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 21

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8

sqlcounter returning wrong value?
by liran tal 13 Nov '08

13 Nov '08

Hey, I'm experimenting with some sqlcounter directives in radiusd.conf and chilli as the NAS. I've defined the following sqlcounter stanza for a daily traffic limit: sqlcounter defined in radiusd.conf: (the query was corrected as suggested by tnt on a previous thread on the list, correct me if I got it wrong please) sqlcounter counterChilliSpotMaxDailyOctets { counter-name = ChilliSpot-Max-Daily-Octets check-name = ChilliSpot-Max-Daily-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily error-msg = "Sorry, your maximum traffic usage (download and upload) has exceed the provided limit" query = "SELECT (SUM(AcctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } In the authorization phase, I'm seeing the following in debug log: rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='%{User-Name}'' radius_xlat: 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'' sqlcounter_expand: '%{sql:SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'' rlm_sql (sql): - sql_xlat radius_xlat: 'tester1' rlm_sql (sql): sql_set_user escaped user --> 'tester1' radius_xlat: 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 2 radius_xlat: '24004370' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user tester1, check_item=26214400, counter=24004370 rlm_sqlcounter: Sent Reply-Item for user tester1, Type=ChilliSpot-Max-Total-Octets, value=26239950 modcall[authorize]: module "counterChilliSpotMaxDailyOctets" returns ok for request 0 The entry in radcheck is as follows: | 346 | tester1 | ChilliSpot-Max-Daily-Octets | := | 26214400 | What happens is that it seems the counter doesn't work as expected. When a user logs in, performs some traffic usage, logs out and logs in again, the replied back attribute for chilli doesn't contain a value which is the remainder of the traffic usage, but something else. According to the radius debug above, if check_item=26214400 and counter=24004370, how come value=26239950? So I'm guessing I'm missing something but I'm too obsessed with the sqlcounter to notice it. (is the subtractation not a normal decimal action?) The FreeRADIUS version used is 1.1.7 Regards, Liran.

6 23

VMPS - Initial project ideas
by Hairy51 12 Nov '08

12 Nov '08

Hi all, I am just about to start a project to remove the VMPS system from an aging catalyst switch and i would like to investigate the possibilty of using FreeRadius for this. We currently have about 1500 hosts that rely on VMPS for dynamic assignment and an ideal solution would be to move the VMPS service onto a server (Or multiple servers) with as little interuptions to users as possible. Also, for simplicities sake it would be great if we could re-use the current Static VMPS file that the catalyst switch uses. I have looked into FreeNAC as a solution, but want to investigate other ways of acheiving this. We do not really need to do anything other than assign (or block) VLANs, so the extra functionality of FreeNAC is not needed at this point. Considering i am coming from a limited Linux background, how hard would it be for me to acheive this using FreeRADIUS? Does it sound feasible? I am really looking for a bit of advice from those with experience of the FreeRADIUS application and who know of the potential pit-falls and complications that we may face! Many thanks - any comments or idea's much appreciated... Cheers Jonathan -- View this message in context: http://www.nabble.com/VMPS---Initial-project-ideas-tp20264221p20264221.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

freeradius 2.1.1 with ubuntu server 8.04
by piston 05 Nov '08

05 Nov '08

Hi All I'm trying to building package, so how i got error during the process. I have no problem to build freeradius 2.1.0 package at this pc. Please assist. Below are the logs dpkg-buildpackage -b -uc dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set LDFLAGS to default value: -Wl,-Bsymbolic-functions dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.1-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture i386 debian/rules clean dpatch deapply-all 02-dialupadmin-help not applied to ./ . attempting to revert failed patch 01-radiusd-to-freeradius from ./: md5sums match, proceeding ... done (neither success nor failure guaranteed) rm -rf patch-stamp patch-stampT debian/patched dh_testdir dh_clean rm -f build-arch-stamp build-indep-stamp libltdl/stamp-h1 rm -f install-arch-stamp install-indep-stamp configure-stamp [ -f Make.inc ] && make distclean || true # The make clean forgets to remove this build directory [ -d src/modules/lib ] && rm -fr src/modules/lib || true # Put the original autotools files back in place [ -f config.sub.dist ] && rm config.sub && mv config.sub.dist config.sub || true [ -f config.guess.dist ] && rm config.guess && mv config.guess.dist config.guess || true debian/rules build test -d debian/patched || install -d debian/patched dpatch apply-all applying patch 01-radiusd-to-freeradius to ./ ... failed. make: *** [patch-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 Thank you.

2 2

users file auth failing
by Anthony Chavez 31 Oct '08

31 Oct '08

Dear freeradius-users, I've succeeded in getting LDAP authz/authn working with MSCHAPv2 and have been using it successfully for a few months now. I would like to add a very simple user with only a Cleartext-Password to the users file (this is strictly a FreeRADIUS user and in the interest of security shouldn't be in LDAP). I would like both the users file and LDAP to be queried for users, with a query falling through to the next source if a particular user is not found. In other words, I would like to be able to use *both* a users file *and* LDAP for auth. I've added the following at the top of the users file, which has not been modified otherwise from the sample that ships with 2.0.3. someuser Cleartext-Password := "somepassword" The authorize section of my default config (sans comments) looks like this. authorize { preprocess chap mschap suffix eap { ok = return } files ldap expiration logintime pap } As you can see, "files" is there, so it would seem that (based on my admittedly limited understanding of how FreeRADIUS is supposed to work) the users file should be queried. Nevertheless, authentication is failing and nothing is being logged apart from the following. Login incorrect (rlm_ldap: User not found) What could I be doing wrong? -- Anthony Chavez http://hexadecagram.org/ mailto:acc@hexadecagram.org xmpp:acc@hexadecagram.org

5 7

Logical Or in check items?
by Martin Pauly 31 Oct '08

31 Oct '08

Hi all, I have a question about the users file. Several check items are always treated as an AND condition. I would like to implement the OR case. I.e. I have 2 groups of NASes: Group 1 is recognized by their NAS-IP-Address: pauly Auth-Type := System, NAS-IP-Adress = <IP of NAS1> Reply-Message = "Matched local user entry %{User-Name}, recognized by NAS-IP-Address" Group 2 is only accessed from a certain Calling-Station-Id, but their IP addresses are arbitrary. So I do pauly Auth-Type := System, Calling-Station-Id = <My-special-ID> Reply-Message = "Matched local user entry %{User-Name}, recognized by Calling-Station-Id" Could I combine this into a single entry somehow? Thanks for any help Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 1

problems with authorization PEAP - EAP-MSCHAPv2 clients
by Lukas Lisa 31 Oct '08

31 Oct '08

Hello, I would like to authorize windows clients access to 3com Baseline Switch 2948 SFP against FreeRADIUS server 2.0.5. Windows are cofigured to use PEAP - EAP-MSCHAPv2. Server certificate was created with bootstrap script (xpextensions are included). I tried windows xp sp3 and linux (wpa_supplicant) client and both cause the same server output and authorization can't pass. Testing tools eapol_test, radeapclient and jRadiusSimulator can pass all tests fine. EAP - MD5 Challenge works fine. Attaching radiusd.conf and radius -X output. Thanks for help. -- Lukas Lisa prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} log_auth = yes run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes ##### proxy ##### # $INCLUDE proxy.conf realm NULL { type = radius authhost = LOCAL accthost = LOCAL secret = ss } ###### clients ###### # $INCLUDE clients.conf client 127.0.0.1 { secret = ss shortname = localhost nastype = other } client 10.1.11.0{ netmask = 24 secret = ss shortname = LAN_clients nastype = other } snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { # $INCLUDE ${confdir}/modules/ #### acct_unique #### acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } ### detail #### detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" } #### files #### files { usersfile = ${confdir}/users #acctusersfile = ${confdir}/acct_users #preproxy_usersfile = ${confdir}/preproxy_users compat = no } #### mschap #### mschap { authtype = MS-CHAP } #### pap #### pap { auto_header = no } #### preprocess #### preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } #### realm #### realm suffix { format = suffix delimiter = "@" } ######## eap ####### eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" #make_cert_command = "${certdir}/bootstrap" fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 #copy_request_to_tunnel = no #use_tunneled_reply = no use_tunneled_reply = yes #virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = yes #copy_request_to_tunnel = no #use_tunneled_reply = no use_tunneled_reply = yes #virtual_server = "inner-tunnel" } mschapv2 { } } # $INCLUDE sql.conf # $INCLUDE sql/mysql/counter.conf } # instantiate { # exec # expr # expiration # logintime # } # # $INCLUDE policy.conf #### sites enabled #### # $INCLUDE sites-enabled/ authorize { preprocess mschap suffix eap #chap #eap { # ok = return #} #unix files #expiration #logintime #pap } authenticate { Auth-Type PAP { pap } #Auth-Type CHAP { # chap #} Auth-Type MS-CHAP { mschap } #unix eap } preacct { preprocess acct_unique #suffix files } accounting { detail #unix #radutmp #attr_filter.accounting_response } #session { # radutmp #} #post-auth { # exec # Post-Auth-Type REJECT { # attr_filter.access_reject # } #} #pre-proxy { #} #post-proxy { # eap #} FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Jul 29 2008 at 14:10:17 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/snmp.conf including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } log_auth = yes } client 127.0.0.1 { require_message_authenticator = no secret = "ss" shortname = "localhost" nastype = "other" } client 10.1.11.0 { netmask = 24 require_message_authenticator = no secret = "ss" shortname = "LAN_clients" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### realm NULL { authhost = LOCAL accthost = LOCAL } radiusd: #### Instantiating modules #### radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.11.254 port 1678, id=86, length=92 NAS-IP-Address = 10.1.11.254 NAS-Port = 13 NAS-Port-Type = Ethernet Calling-Station-Id = "00-1E-C9-5D-12-E8" User-Name = "pepa" EAP-Message = 0x020100090170657061 Message-Authenticator = 0x6966eee3e16f3dbca48d1d0940ee8092 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pepa", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pepa" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry pepa at line 63 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 86 to 10.1.11.254 port 1678 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Tunnel-Type:0 = VLAN EAP-Message = 0x01020016041039cd7461637ef88b1917e73e9f7454c0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc12a17dec12813be64a3903fd78b27a2 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.11.254 port 1678, id=87, length=107 NAS-IP-Address = 10.1.11.254 NAS-Port = 13 NAS-Port-Type = Ethernet Calling-Station-Id = "00-1E-C9-5D-12-E8" User-Name = "pepa" EAP-Message = 0x020200060319 State = 0xc12a17dec12813be64a3903fd78b27a2 Message-Authenticator = 0xa707c2539eb95c1920974e7a99366818 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pepa", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pepa" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry pepa at line 63 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 87 to 10.1.11.254 port 1678 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Tunnel-Type:0 = VLAN EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc12a17dec0290ebe64a3903fd78b27a2 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.11.254 port 1678, id=88, length=213 NAS-IP-Address = 10.1.11.254 NAS-Port = 13 NAS-Port-Type = Ethernet Calling-Station-Id = "00-1E-C9-5D-12-E8" User-Name = "pepa" EAP-Message = 0x0203007019800000006616030100610100005d03014905f33e53294d50e965048da5c85d5a54078b2ca1eca3ede7dd82bebb20cd2e203ab15972a43e9953c3140d9f8068bc75e2eff3a94af4b2a7bbf43fde181f93ce001600040005000a000900640062000300060013001200630100 State = 0xc12a17dec0290ebe64a3903fd78b27a2 Message-Authenticator = 0xa80ad48264377d85ed6cca3d48beb8a8 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pepa", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pepa" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 3 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry pepa at line 63 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 88 to 10.1.11.254 port 1678 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Tunnel-Type:0 = VLAN EAP-Message = 0x0104040019c0000008bb160301004a0200004603014905f340ca71458a4f8eef21bef0a72853f3d1431af934867c4c847bab632ca920ed2b962c1a418d7eeb9a84e10a8291d32e29821fc64642d9787a9b7bfa0a041d000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038313031333136313335375a170d3039313031333136313335375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b89c61b7b2480f72d2438a52212f4ebb8ab8bf94fe0b25bc3de955b7175f EAP-Message = 0x45766a706a40b5170baf82cfc8622479a835169b94891b5e435c45b942a9ca833bbe1509f09831cd7e17d71110ee5a050221ca79216e9a09a537f2696a3126a3c4684a2b8f641abede9eb178859679ac7c16ece760ad637d31c0b0ce2b49f70f74b9d5168bc40d96a5c6b2e59c139fdaf5e06d71064cf8a28af40e1749a6c97441513fb1b1e5cb1d7db8d1b31217b5c5bc29622d75ce017da3a12227587946bb3345d6fe14af05d16b476782315851ecd00e070c17f8938985f8e0e64c2f49ec0b70495745447c7f8d94d58949b358214a0fc085dbe2acde64fb164cb57e902481a70203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101002d7a145511474c09898d85ec8157862965467bcb83ebc6af106c06584f73b42e9dfcff6d8e2c85dad3e8bc710db690ba6a465ea6a36dbc35ed5a968a2a5deeb6f61ccf3a5d9c5b3a655f97596fd49114dba554e5cf4e7320b1507688e82b4206017050dfbb4860a1a827e027141625f91bb9db31bdf479c107fb72fcf30fd284d35677e1df77d283992e0af591db69620ee16168031d61f449853f2561a06c7467b5e87bc9c9af007e0b994059218f8a574269471b0bbf65048523c1d33d82512b61f38d6042f6b9ec083e83ab8d68b1404af602cc8dd5004448d6b28e6fe00b5973b4a0d67d EAP-Message = 0xf5cc5ef0da4ee34196020d2d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc12a17dec32e0ebe64a3903fd78b27a2 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.11.254 port 1678, id=89, length=107 NAS-IP-Address = 10.1.11.254 NAS-Port = 13 NAS-Port-Type = Ethernet Calling-Station-Id = "00-1E-C9-5D-12-E8" User-Name = "pepa" EAP-Message = 0x020400061900 State = 0xc12a17dec32e0ebe64a3903fd78b27a2 Message-Authenticator = 0xab4f01388e23132589dadf9f65db9679 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pepa", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pepa" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry pepa at line 63 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 89 to 10.1.11.254 port 1678 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Tunnel-Type:0 = VLAN EAP-Message = 0x010503fc194030dd35e7732524f5bee6b4c97d820004ab308204a73082038fa003020102020900d78413b623ba23d7300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038313031333136313335365a170d3038313131323136313335365a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d5c7e3aa2abb3f430ac169b53b66e9a22718e126dba0470333185c8b96365de4d7c54bee4451027b619c27169275f0eba07c2de1f8548abd6fbb7170d59a1897fa47d868769403f60ff2d368db47f8 EAP-Message = 0xd37f6eca5998f6ffea4c956948b9ea9527d2e052da8c186bffc415d4e57cfa758f66802777defc4503850d21c42ee6a0ac0babb38cd65bb4f1355a81632c92c71ffeb0037949dd944dfc5569cb81403987cda1c95378f709c00ef31b5076097db8959481ed465a1014615013ad809e00028a58f2d852fb975720dbcb0ce32f0d6c56a4231e5297b92ab698914750a2b4571b7bee836c400ed21dceeb7dec88bb170d0b9bdc04d641e498cf64278b1374d90203010001a381fb3081f8301d0603551d0e04160414727a098357bfd22b4680cfb84356363747a750483081c80603551d230481c03081bd8014727a098357bfd22b4680cfb84356363747a7 EAP-Message = 0x5048a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900d78413b623ba23d7300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007bc90ed54235fc8c171f1876f27b34541a67b82ace8367522ce93522a6fb72f32d7cb470fa649dc44a5aa5c1e1c7947235b3 EAP-Message = 0xe494691a8395c6a4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc12a17dec22f0ebe64a3903fd78b27a2 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.11.254 port 1678, id=90, length=107 NAS-IP-Address = 10.1.11.254 NAS-Port = 13 NAS-Port-Type = Ethernet Calling-Station-Id = "00-1E-C9-5D-12-E8" User-Name = "pepa" EAP-Message = 0x020500061900 State = 0xc12a17dec22f0ebe64a3903fd78b27a2 Message-Authenticator = 0x7dcfbca510f5d2afadbcb2d4022e9fac +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pepa", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pepa" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry pepa at line 63 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 90 to 10.1.11.254 port 1678 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Tunnel-Type:0 = VLAN EAP-Message = 0x010600d51900b7cdda23960c130380f9fd68693b47ea5a21a0f40c232669cd2bceb27a0b050b728fac4d99abcfa01c89c25fb3bfa0126752307379f601d9a397917fc4d3028e76786a30fe41c6b7a56caa8dcef2e11d11b68c946050f859ade7048e7b7f24d1a0457bd59203f675643e45356023ef33a54a2479086258bb16bf47f06843f999d1c1d01fb7c776b1f46ea8b5ba2971871573f8732f62320df5ac4e5c114fe52ec0090dd9ab84451c6eb8a5c9ce1fe683c12a2a6ede934e245c78a07318af10b5cafa7995b1fa16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc12a17dec52c0ebe64a3903fd78b27a2 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.11.254 port 1678, id=91, length=423 NAS-IP-Address = 10.1.11.254 NAS-Port = 13 NAS-Port-Type = Ethernet Calling-Station-Id = "00-1E-C9-5D-12-E8" User-Name = "pepa" EAP-Message = 0x0206014019800000013616030101061000010201003bca0f75f1f302a91302341697a459f3f961bead4d54bf79199b56dea8f01d88ef5ef77c7ecdb2b4d18fbfb7b397181be165926b963737ac0c7f7051221ae0b8ff6f36bff1348c349f1b9f1b076d3cec038d72c0f4665815d6fec1830db190f9ba42b9d74190dba1807b40a1974dcfc6ea6cb9f04bde43b7a7086019ede4f760de013f8bfef8f5353e72ea42be2bf013771f6ca320c97c2ab7063c6917d8035848adb11d59a8adf020f1cd38eaad6df5e8b044551d3246fb8d28860904c4a1e85658cfc2ac3274c15e2c242f4ff7aa9e2c2bf39bc6e727ce638c551e07d71558127926c9787f9116 EAP-Message = 0x29b89554fcb8b5f83c86729c02f7372fc289e3387f984dbe1403010001011603010020cfb473a793569c59b602e68442c0e06084d4bebed0231fd225b852aa2905ae47 State = 0xc12a17dec52c0ebe64a3903fd78b27a2 Message-Authenticator = 0x206d99bfc01aa0eb76cf7d74f9ebea80 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "pepa", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pepa" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 6 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok users: Matched entry pepa at line 63 ++[files] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 91 to 10.1.11.254 port 1678 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Tunnel-Type:0 = VLAN EAP-Message = 0x0107003119001403010001011603010020ff7e97bac4dc133a2c7f1372d480d9069a8ef3cc9c305ec508719bde15f64e0b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc12a17dec42d0ebe64a3903fd78b27a2 Finished request 5. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 86 with timestamp +22 Cleaning up request 1 ID 87 with timestamp +22 Cleaning up request 2 ID 88 with timestamp +22 Cleaning up request 3 ID 89 with timestamp +22 Cleaning up request 4 ID 90 with timestamp +22 Cleaning up request 5 ID 91 with timestamp +22 Ready to process requests. pepa Cleartext-Password := "zdepa" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 1, Tunnel-Type = VLAN, DEFAULT Auth-Type = Local Fall-Through = 1

3 9

PAM radius module and "Prompt" attribute.
by ugengia-reg＠yahoo.it 31 Oct '08

31 Oct '08

Hi All, I'm using the pam_radius_auth 1.3.17 PAM service module and a RSA Authentication Manager 7.1 RADIUS server. All is working well, but I found a problem when the PAM module receives an Access-Challenge. Here is the problem: even if the RADIUS server sends a Prompt="No Echo" attribute, my PAM conversation function receives a PAM_PROMPT_ECHO_ON msg_style instead of a PAM_PROMPT_ECHO_OFF. As far as I know the Prompt attribute is not mandatory for RFC 2865 compliance, in fact this attribute is specified into RFC 2869 - Radius Extensions. The question is: will the Prompt attribute be supported in a future release of the PAM service module? Thanks, Cesare Scopri il blog di Yahoo! Mail: Trucchi, novità e scrivi la tua opinione. http://www.ymailblogit.com/blog

3 5

freeradius help
by Rolando Tejada 31 Oct '08

31 Oct '08

hi, i'm trying to configurate freeradius in ububtu 7.04 and fedora 6. i can't in both. in fedora says: "cannot find a configuration entry for module "sql" ", "unknown module sql", "failed to parse authorize section". in ubuntu says: "rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost :radius", "rlm_sql_mysql: Mysql error 'Access denied for user 'root'@'localhost' (using password: YES)'", "rlm_sql (sql): Failed to connect DB handle #0".

3 2