December 2008 - Freeradius-Users - lists.freeradius.org

Re: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 16 Dec '08

16 Dec '08

> >Hi, I'm wondering if someone can point me in the right direction. I > want to > >list radius clients with the same IPs (and different shared secrets). > This > >would let me use freeradius among multiple offices, where each could > use the > >same IP addresses for the radius clients. > > And how is routing going to work there? How is radius server suposed to > send the response back to the correct client? This can work only if > carry radius server from office to office so it works a little bit > here, > little bit there. If you connect those clients onto a network they will > all stop working (or, at best, first one you put on the network will > work but others won't). > > Ivan Kalik > Kalik Informatika ISP I'm not exactly sure. How does a RADIUS server work over the Internet? I'm not connecting the radius clients onto the same LAN. If a radius request comes in from the internet, would the server send responses to the Internet IP that it received it from (which I think would work for my case) or would it send to the radius client IP? Here's what I'm trying to do: Host a radius server on the Internet...for PEAP 802.1X (WPA-enterprise). Each AP at the different offices would be set with the Internet IP address of where the radius server is running, along with a shared secret. There would likely be APs set to the same IP address, that's why I'm asking about all this. > > Hi, I'm wondering if someone can point me in the right direction. I > want to > > list radius clients with the same IPs (and different shared secrets). > This > > would let me use freeradius among multiple offices, where each could > use the > > same IP addresses for the radius clients. I need something very > dynamic; > > manually creating virtual servers in the config file won't work well. > > RADIUS doesn't work that way. > > Shared secrets are per client IP. Each client IP is used to look up > the shared secret. You can't have multiple shared secrets for one IP. > > > Right now I'm using v1.188.2.4.2.14 > > That's not the server version number. > > Use "radiusd -v" to get the version information. > > Alan DeKOk. I know it traditionally doesn't, just checking to see what people think and if I might find a way to do what I want to do. What got me thinking something like this could work is when using a different server, I thought I could modify the SQL select statement that's used to find the shared secret. For example, the default is "select SharedSecret from NASES where ClientIPAddress='$c'" I thought I could just add the following to the end "and where Domain=(function that takes the domain from the username...after the @) I found that server can't register the username attribute during the select statement...so it all didn't work. Opps. I'm using v1.1.7 because at the moment I'm using FreeRadius.net on Windows Thanks for your help guys - Eric

3 2

Duplicate IPs for Radius Clients with different secrets
by Eric Geier 15 Dec '08

15 Dec '08

Hi, I'm wondering if someone can point me in the right direction. I want to list radius clients with the same IPs (and different shared secrets). This would let me use freeradius among multiple offices, where each could use the same IP addresses for the radius clients. I need something very dynamic; manually creating virtual servers in the config file won't work well. Right now I'm using v1.188.2.4.2.14 Thanks! Eric

3 2

FreeRADIUS vs Aradial RADIUS
by Aldo Zavala 15 Dec '08

15 Dec '08

Hello guys, I am a little bit scared how hard can be to deploy the FreeRADIUS, I found this in the internet: (aradial.com) this guys claim to have a very convenient and professional AAA server with a convenient price, does anybody here have experience with that "aradial radius server"? What would be the Pros and Cons of purchase it instead of have the FreeRADIUS one? Thanks again.

3 2

calling-station-id filtering with checkval
by Justin A. Williams 15 Dec '08

15 Dec '08

I see that the mac address from the calling-station-id but then it will not login with the user. If i delete the row 26 with calling-station-id it will permit that user to login. Please help rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 7 mysql> select * from radcheck; +----+------------+--------------------+----+-------------------+ | id | UserName | Attribute | op | Value | +----+------------+--------------------+----+-------------------+ | 25 | testuser | User-Password | == |testpass| | 26 | testuser | Calling-Station-Id | == |00-21-5c-7b-ff-2d| +----+------------+--------------------+----+-------------------+ 2 rows in set (0.00 sec) rad_recv: Access-Request packet from host 10.254.0.1:6001, id=109, length=142 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000f016a77696c6c6935363436 Message-Authenticator = 0xf2e55d0632d8ecd338a16f7fd5523106 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 109 to 10.254.0.1 port 6001 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d7a74c61baccd06a6da72f6137c2a3b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=110, length=225 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x3d7a74c61baccd06a6da72f6137c2a3b Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202005019800000004616030100410100003d0301494720b6f92efa4a7ea79b54e7adb7c31f53e46513e795facd9056b17b27b6eb00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xa12aca0fd57315e8de5b0a729a73f7b4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 110 to 10.254.0.1 port 6001 EAP-Message = 0x0103040a19c0000006f1160301004a0200004603014945cf54c95df83cb35080a7d88f1beb1399cd475bbd9e1aa746791daa604d0020f2a95cf814197a684a9636498965f7d207497edf9cbf7fcb66d28db1c9ff6a3400040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x04ed47a0de71a08bae722f88d6987218 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=111, length=151 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x04ed47a0de71a08bae722f88d6987218 Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x7cce1dc07ea3c41fcb55ca62aa372bf2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 2 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 111 to 10.254.0.1 port 6001 EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x431dbf66e9563ef6c0b3cdac58fd0e4d Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=112, length=337 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x431dbf66e9563ef6c0b3cdac58fd0e4d Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400c01980000000b61603010086100000820080121e3c6a20b3f0fbfb2036283c70f54c14e73b14430c7c82a24866038a75c69bb91eac0b286b735b8666111e4e40621ac80ee1d0996b9a9ce768875ed5d7c0c45a75dbb004a6a5bcdb7ae44ef3921b11f7acd89fac2a413e4391a163c08fee4667758a748139e6d5b15f829bfe545b640a69948441aa050c7c1152881d0a0b801403010001011603010020e69c55647e4c5a4fd3cf2c7f702684ca9de05460f816f7347c0647821ebdf9c0 Message-Authenticator = 0x4f024f2f7e3377b0a9622f3f859c0f9f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 112 to 10.254.0.1 port 6001 EAP-Message = 0x010500311900140301000101160301002095d66e5ab6a8eab6fadd4298805da0ee9e420234c498b39ce5ae4c3ac8232cc2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ee4a12a1ab84d7435dce6a6935a88a4 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=113, length=151 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x0ee4a12a1ab84d7435dce6a6935a88a4 Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x42d0e07d5e59f8d38baf59d71f5672e2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 4 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 113 to 10.254.0.1 port 6001 EAP-Message = 0x0106002019001703010015cfd1b627c3bf869d33564a058a9a317b0d49e8e682 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde6481a2cbcb86cbfff8dea6911117da Finished request 4 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=114, length=183 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0xde6481a2cbcb86cbfff8dea6911117da Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600261900170301001bcce8d4d055cbc691f1340e46621d5cabe5eddcc855f52cd3a13f88 Message-Authenticator = 0x2b78b4114c8bffcb891aead7cf917457 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 5 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testuser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206000f016a77696c6c6935363436 PEAP: Got tunneled identity of testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testuser PEAP: Sending tunneled request EAP-Message = 0x0206000f016a77696c6c6935363436 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): No matching entry in the database for request from user [testuser] modcall[authorize]: module "sql" returns notfound for request 5 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010700241a0107001f10dcab6769a85cba16a42fb47706453cbe6a77696c6c6935363436 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68e17da0a9a400917769de0451579732 PEAP: Processing from tunneled session code 0x8188f38 11 EAP-Message = 0x010700241a0107001f10dcab6769a85cba16a42fb47706453cbe6a77696c6c6935363436 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x68e17da0a9a400917769de0451579732 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 114 to 10.254.0.1 port 6001 EAP-Message = 0x0107003b19001703010030aee484ac01a5a458cf552cf3c7aaf51cb06314433a871487e3d68c9e6f7dd9b20e50b7d8c4282d7120cec1f48fe0dee6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3c061f046a049d3c6e5a8010ac776fde Finished request 5 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=115, length=237 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0x3c061f046a049d3c6e5a8010ac776fde Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207005c1900170301005181f86830de9489b959ba137783ac12d6d085883fb3dd21699611d12260f55b54402164084b309fe60a087e848b816bf48b8d712eadc6b38c708b58f8230dc0ca1925d44c06ff3b55902e7f3573164e8a2f Message-Authenticator = 0xebb532d259687d2da7be90fa77257950 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 92 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 6 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700451a02070040310fb1ca476eb5dd96914ce816dd8109bb00000000000000004485d3dd2f8f7d100c6f1696fa1149988ced9e732e04d840006a77696c6c6935363436 PEAP: Setting User-Name to testuser PEAP: Adding old state with 68 e1 PEAP: Sending tunneled request EAP-Message = 0x020700451a02070040310fb1ca476eb5dd96914ce816dd8109bb00000000000000004485d3dd2f8f7d100c6f1696fa1149988ced9e732e04d840006a77696c6c6935363436 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" State = 0x68e17da0a9a400917769de0451579732 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 69 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): No matching entry in the database for request from user [testuser] modcall[authorize]: module "sql" returns notfound for request 6 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x81a7668 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 115 to 10.254.0.1 port 6001 EAP-Message = 0x010800261900170301001bf8aa1a94ad4a2b0806614e7bead931ede68f144ac5809bbfaf1375 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd5c14aca3f5548e24c6e1e0a7b6b3cc Finished request 6 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.254.0.1:6001, id=116, length=183 User-Name = "testuser" NAS-IP-Address = 192.168.200.50 Called-Station-Id = "00-20-a6-64-7a-38:test" Calling-Station-Id = "00-21-5c-7b-ff-2d" NAS-Identifier = "testap" State = 0xfd5c14aca3f5548e24c6e1e0a7b6b3cc Framed-MTU = 1400 NAS-Port = 2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001bf6abd7a3bb6544d85a447f7ad16a9b7357761515db20de1cece78e Message-Authenticator = 0xdc013599dfdec1515ec553dd0afcfe88 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'testuser';' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 7 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d rlm_checkval: Value Name: Calling-Station-Id, Value: 00-21-5c-7b-ff-2d modcall[authorize]: module "checkval" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client testwireless port 2 cli 00-21-5c-7b-ff-2d) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 5 seconds... -- Justin A Williams

3 4

Two servers using virtualization
by Nataniel Klug 15 Dec '08

15 Dec '08

Hello all, Am using freeradius as my network AAA. For now it is working fine but now I get into a need that I could not solve. I have an small WISP and I use radius do authenticate/account my PPPoE/Hotspot clientes. This works fine using MySQL. My problem is that I need to control my clients MAC address that will connect into my APs. My AP will send it package like this to radius: Mon Dec 15 14:38:25 2008 : Auth: Login incorrect: [00:15:AF:6B:E0:E2/password] (from client ap2000 port 0) MAC address I already have into my mysql tables and password is the same for every mac. I just need to run another FreeRadius server on the same machine listening on another port (for auth and acco) and this new server should use another SQL instance. Is this possible? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

2 3

None
by Ray Stell 15 Dec '08

15 Dec '08

unsubscribe

4 4

Logging authentication attempts while TLS session resumption (caching) is enabled
by Jason Wittlin-Cohen 15 Dec '08

15 Dec '08

When authenticating via PEAP or TTLS with an anonymous identity, the log shows both the anonymous identity and the real identity tunneled through the TLS tunnel. However, when TLS session resumption (caching) is enabled, only the anonymous identity is logged. This is presumably due to the fact that the user is not actually sending the real ID and password through the tunnel; rather the saved session is being used. However, being that the tunneled username is still available, and obtained from the cache, it should be available to log. Is this the intended behavior? It would seem that logging authentication attempts would be more useful if the real username was provided in addition to the anonymous identity. Caching disabled: Fri Dec 12 17:35:38 2008 : Auth: Login OK: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) Fri Dec 12 17:35:38 2008 : Auth: Login OK: [Anonymous] (from client Wireless port 55 cli 0013e87d571d) Caching enabled: Fri Dec 12 17:35:56 2008 : Auth: Login OK: [Anonymous] (from client Wireless port 55 cli 0013e87d571d) However, the tunneled username does seem to be available. It's obtained from the cache and added to the Access-Accept message: [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] Adding cached attributes to the reply: User-Name = "Jason Wittlin-Cohen" Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

2 1

Need Help: 'Simultaneous-Use' don't work !!! =/ version 1.1.7 !
by Diogo Teixeira 15 Dec '08

15 Dec '08

Hi, I have a problem =/ I create this Querys: INSERT INTO radcheck(UserName, Attribute, op, Value) VALUES('cliente1', 'MD5-Password', ':=', MD5('projecto08')); INSERT INTO radgroupcheck (groupname, attribute, op, value) VALUES ('sessaounica', 'Simultaneous-Use', ':=', 1); INSERT INTO usergroup (username, groupname) VALUES ('cliente1','sessaounica'); But two different clients (PCs) whit the same pair user/password can do success login. =/ What i have done wrong ? I want that only one client have access to the network. And if one client are logged, another user with same pair user/pass don't have access until the user logged do the logoff. Very thanks for your pacience, Best Regards, Diogo Teixeira

4 11

Space after exec module - is it a bug?
by Lech Karol Pawłaszek 15 Dec '08

15 Dec '08

Hello. I've encountered a weird problem. Tested on the newest stable (2.1.3) too. Well it's not a problem anymore since I found out a way to make my unlangish things work but: I wanted to check some things in post-auth. I am passing some arguments to my script and I want to do something based on the script's output switch "%{exec:/script %{User-Name} %{outer.request:Calling-Station-Id}" { case 0 { update reply { Tunnel-Private-Group-Id := "2000" } } case "1" { update reply { Tunnel-Private-Group-Id := "1999" } } case "2 " { update reply { Tunnel-Private-Group-Id := "999" } } } As you can see it's not a rocket science. script prints a number 0, 1 or 2 and exits. What's weird is that only the last case example will work. Is this intentional that there has to be a space in case expression? The same applies to this situation: if ("%{Calling-Station-Id} " == "%{exec:/script2 %{Calling-Station-Id}") { $do_anything } when script2 only prints the argument. Why there is a need for a space? It won't work with this expression: if ("%{Calling-Station-Id}" == "%{exec:/script2 %{Calling-Station-Id}") { $never_here } Kind regards, PS script2 looks like this: #!/usr/bin/python import sys if __name__ == "__main__": print sys.argv[1] -- Lech Karol Pawłaszek <ike> "You will never see me fall from grace" [KoRn]

3 3

freeradius and IP pools
by Arrigo Savio 15 Dec '08

15 Dec '08

Hi. I need to use freeradius in multiple ways. I mean: based on realm, I need to assign or not an IP address. For example: user@with_ip has to receive an IP from configured RADIPPOOL table user@without_ip has only to be authenticated (a user who log to a portal, for example). How can I make it possibile? Where can I setup this behaviuor? Thanks. Arrigo.

3 6