February 2008 - Freeradius-Users - lists.freeradius.org

Quick question RE: FreeRADIUS Trusted Root CA List
by Cerney, Lawrence 04 Feb '08

04 Feb '08

I work in a test environment and need to test with certs created with different CA's. I haven't been able to get more than one CA at a time to work. I've got 8 CA's and I need to keep 7 commented out for the certs to authenticate. The question is can FreeRADIUS support more than one CA at a time, and if so how? FreeRADIUS 1.0.0-Pre3 tls { private_key_password = password private_key_file = /etc/1x/freeradius.pem #private_key_file = /etc/1x/server512.pem #private_key_file = /etc/1x/server1024.pem #private_key_file = /etc/1x/server1024v3.pem #private_key_file = /etc/1x/server1536.pem #private_key_file = /etc/1x/server2048.pem #private_key_file = /etc/1x/server4096.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = /etc/1x/freeradius.pem #certificate_file = /etc/1x/server512.pem #certificate_file = /etc/1x/server1024.pem #certificate_file = /etc/1x/server1024v3.pem #certificate_file = /etc/1x/server1536.pem #certificate_file = /etc/1x/server2048.pem #certificate_file = /etc/1x/server4096.pem # Trusted Root CA list CA_file = /etc/1x/FlukeNetWotter.pem #CA_file = /usr/local/etc/raddb/certs/PV_512_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_768_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1024_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1280_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1536_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1792_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_2048_CA.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random thanks... Larry This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

3 2

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy(forward) request as PAP
by Joakim Lindgren 04 Feb '08

04 Feb '08

Hi again and thanks, EAP-TTLS/PAP is the defaultI tried configuring the TTLS-PAP inner and outer tunnel but it will not work. EAP-TTLS/PAP ended A. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "OTHER" (LOCAL) domain then the EAP-TTLS tunnel is ended and validated against the LDAP. PAP Tunneled (proxied) B. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "SECURSERVER" domain then the EAP-TTLS tunnel is ended and PAP is proxied to other Radius (Nr 2) Sincerely Joakim

6 16

Monitoring Tool for Freeradius
by Julian Stöver 04 Feb '08

04 Feb '08

Hello, is there any monitoring tool for freeradius or another possibility to see how many people are logged in and to do some other stuff? like the monitoring tool for openvpn? Would be nice if there's something avaible! bye! julian

7 25

freeRADIUS and Cisco switch errors, the server replies but the switch does not seem to authorise the login
by David Bradley 04 Feb '08

04 Feb '08

Hi, I'm hoping you can help! I have a server running FreeRADIUS and I'm trying to authorize exec sessions. If I remove the authorize line in the cisco config the authentication works fine, but once it starts to authorise it fails. There are 4 sections here: relevant parts of the cisco switch The users file, the freeRADIUS log and the cisco switch log. The bit that seems to fail is where the cisco switch recieves the radius reply, it just doesn't act on the reply.... aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius radius-server host 192.168.100.201 auth-port 1812 acct-port 1813 key 7 xxxxxxx radius-server source-ports 1645-1646 Users-file DEFAULT Service-Type = shell Cisco-AVPair = "shell:priv-lvl=15" ----------------------- rad_recv: Access-Request packet from host 192.168.100.254:1645, id=26, length=82 NAS-IP-Address = 192.168.100.254 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "dave" Calling-Station-Id = "192.168.100.109" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "dave", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 153 users: Matched DEFAULT at 228 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Login OK: [djbrad2/password] (from client rafmh port 2 cli 192.168.100.109) Sending Access-Accept of id 26 to 192.168.100.254:1645 Cisco-AVPair = "shell:priv-lvl=15" Finished request 0 -------- *Mar 1 02:05:01.335: RADIUS(00000000): Send Access-Request to 192.168.100.201:1812 id 1645/26, len 82 *Mar 1 02:05:01.335: RADIUS: authenticator 90 85 F6 37 C3 2C A4 BE - 97 44 D1 81 A4 DD 0F 2D *Mar 1 02:05:01.335: RADIUS: NAS-IP-Address [4] 6 192.168.100.254 *Mar 1 02:05:01.335: RADIUS: NAS-Port [5] 6 2 *Mar 1 02:05:01.335: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 02:05:01.335: RADIUS: User-Name [1] 9 "dave" *Mar 1 02:05:01.335: RADIUS: Calling-Station-Id [31] 17 "192.168.100.109" *Mar 1 02:05:01.335: RADIUS: User-Password [2] 18 * *Mar 1 02:05:01.339: RADIUS: Received from id 1645/26 192.168.100.201:1812, Access-Accept, len 45 *Mar 1 02:05:01.339: RADIUS: authenticator A7 47 9F 4C 58 BC CA A5 - E5 6B E4 9E 64 9F FB C9 *Mar 1 02:05:01.339: RADIUS: Vendor, Cisco [26] 25 *Mar 1 02:05:01.339: RADIUS: Cisco AVpair [1] 19 "shell:priv-lvl=15" *Mar 1 02:05:01.343: RADIUS: saved authorization data for user 1DF88C8 at 2238960 *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): Port='tty2' list='' service=EXEC *Mar 1 02:05:01.343: AAA/AUTHOR/EXEC: tty2 (606283324) user='djbrad2' *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): send AV service=shell *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): send AV cmd* *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): found list "default" *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): Method=radius (radius) *Mar 1 02:05:01.343: RADIUS: cisco AVPair "shell:priv-lvl=15" *Mar 1 02:05:01.343: RADIUS: no appropriate authorization type for user. *Mar 1 02:05:01.343: AAA/AUTHOR (606283324): Post authorization status = FAIL *Mar 1 02:05:01.343: AAA/AUTHOR/EXEC: Authorization FAILED

2 3

inner/outer Tunnel attributes of TTLS/MS-CHAPv2
by Vincent Magnin 04 Feb '08

04 Feb '08

Hello All, I've an issue with passing attributes from EAP TTLS MS-CHAPv2 to outer: My /etc/raddb/users contains: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name := `%{User-Name}`, Fall-Through = yes And my eap ttls module contains: > copy_request_to_tunnel = yes > use_tunneled_reply = yes The user-name and Tunnel-* are not rewiten/copied to the outer. This isssue is only with MS-CHAP, not PAP. Running version: freeradius-1.0.1-3.RHEL4.5 radius -X : rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 39 modcall: group Auth-Type returns ok for request 39 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 39 radius_xlat: '/var/log/radius/radacct/127.0.0.1/reply-detail-20080204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20080204 modcall[post-auth]: module "reply_log" returns ok for request 39 modcall: group post-auth returns ok for request 39 TTLS: Got tunneled reply RADIUS code 2 User-Name := "vmagnin(a)unil.ch" Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "16" Tunnel-Medium-Type:0 = IEEE-802 MS-CHAP2-Success = 0x5b533d31464345343644464444343239353838433043363243464630463638363938363532333336314637 MS-MPPE-Recv-Key = 0xcf199064e5ce16501ad868646e8e7b3c MS-MPPE-Send-Key = 0x053e079625529879fe9f4f1cb9b7ad47 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 39 modcall: group Auth-Type returns ok for request 39 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 39 radius_xlat: '/var/log/radius/radacct/130.223.222.60/reply-detail-20080204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/130.223.222.60/reply-detail-20080204 modcall[post-auth]: module "reply_log" returns ok for request 39 modcall: group post-auth returns ok for request 39 Sending Access-Accept of id 60 to 130.223.222.60:1645 MS-MPPE-Recv-Key = 0xc9abc77f52aa954231989e3bc26c35b2b6f6578dec2fe6b1bf06e9fb1b75740f MS-MPPE-Send-Key = 0xe940dd6f47a1a7102d876dacf2f36385a5e717f96372d87256b5e6c1c3ba962b EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Finished request 39

3 3

RE: Freeradius-Users Digest, Vol 34, Issue 16
by aziz yucelen 04 Feb '08

04 Feb '08

---------------------------------------------------> > What do you want to do? What do you want to achieve? What authentication are> you planning to use ? ---------------------------------------------------< Hi. Principally sorry for my bad english.I am setup freeradius .I want chain all network client.My problem is - ı am setup freeradius server - I am setup layer2 switch - Iam configure switch and client pc - and start -but client pc sending access request to switch, switch request to server ,server message is "access challenge" what is this I dont know and what I do? ------------------------------------------------------------------------------------------------------------> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=73> Threads: total/active/spare threads = 5/0/5> Thread 2 got semaphore> Thread 2 handling request 0, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> EAP-Message = 0x020100090174657374> Message-Authenticator = 0x40b01c65697a037c2aec79069d28d709> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> Waking up in 0.9 seconds.> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 1 length 9> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> ++[eap] returns updated> users: Matched ! entry test at line 93> expand: Hello, %{User-Name} -> Hello, test> ++[files] returns ok> ++[expiration] returns noop> ++[logintime] returns noop> rlm_pap: Found existing Auth-Type, not changing it.> ++[pap] returns noop> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> Reply-Message = "Hello, test"> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> Finished request 0.> Going to the next request _________________________________________________________________ Helping your favorite cause is as easy as instant messaging. You IM, we give. http://im.live.com/Messenger/IM/Home/?source=text_hotmail_join

4 3

How to connect to mySql
by johnson elangbam 04 Feb '08

04 Feb '08

hi, I am a new user in free radius server, i wanted to keep the username/password in mySql database. I've read almost all the radiusd.conffile to make through, but it doesn't help, please help me to configure to connect the database to make it work. Thanks, with regards, Elangbam Johnson

4 3

CRL signature failure
by zz zz 04 Feb '08

04 Feb '08

Hello, I have a lot of strange messages in radius.log regarding CRL signature failure (randomly). When this message occur in the log, users can't be authenticated on EAP-TLS -> Login Incorrect. Problem is solved with full restart of freeradius service (service freeradius restart). I'm running the latest version 1.1.7 of freeradius compiled from sources on RHEL3 with RHEL openssl-0.9.7a-33.24 (openssl is installed by up2date from RHEL3 repository). Every hour is CRL updated by external cron script together with c_rehash. Mon Feb 4 09:13:24 2008 : Error: --> verify error:num=8:CRL signature failure Mon Feb 4 09:13:24 2008 : Error: TLS Alert write:fatal:decrypt error Mon Feb 4 09:13:24 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Mon Feb 4 09:13:24 2008 : Error: rlm_eap: SSL error error:04077068:rsa routines:RSA_verify:bad signature Mon Feb 4 09:13:24 2008 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Mon Feb 4 09:13:24 2008 : Auth: Login incorrect: [Kris Jacob] (from client BEBRU765CZ101 port 1 cli 00-16-6F-61-5E-09) eap.conf -------- eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no leap { } tls { CA_path = ${raddbdir}/certs/ check_crl = yes CA_file = ${raddbdir}/certs/CA.pem crl_file = ${raddbdir}/certs/crl.pem certificate_file = ${raddbdir}/certs/radius.pem private_key_file = ${raddbdir}/certs/radius.key dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } } I can't found any similar problem in the radius discussion. Thanks --- Cajt ------------------------------------------ http://search.atlas.cz/

1 0

EAP-ttls tunnel inner outer authentication credential management
by theSnail 04 Feb '08

04 Feb '08

Is there a way to manage in a different way the inner and the outer authentication credential in a EAP-ttls + PAP tunnel? for example authenticate the outter credential against a file and the inner against ldap dir. thanks arjuna -- View this message in context: http://www.nabble.com/EAP-ttls-tunnel-inner-outer-authentication-credential… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Help me please!!
by aziz yucelen 04 Feb '08

04 Feb '08

Hi.. I am receiving this "Access-Challenge " message.I dont know what I do.Please help me. Thanks... ------------------------------------------------------------------------------------------------------------> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=73> Threads: total/active/spare threads = 5/0/5> Thread 2 got semaphore> Thread 2 handling request 0, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> EAP-Message = 0x020100090174657374> Message-Authenticator = 0x40b01c65697a037c2aec79069d28d709> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> Waking up in 0.9 seconds.> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 1 length 9> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> ++[eap] returns updated> users: Matched entry test at line 93> expand: Hello, %{User-Name} -> Hello, test> ++[files] returns ok> ++[expiration] returns noop> ++[logintime] returns noop> rlm_pap: Found existing Auth-Type, not changing it.> ++[pap] returns noop> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> Reply-Message = "Hello, test"> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> Finished request 0.> Going to the next request> Thread 2 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=162> Cleaning up request 0 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 3 got semaphore> Thread 3 handling request 1, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> EAP-Message => 0x0202005019800000004616030100410100003d030147ac558d77684de77a5d4e927a0c8abbd79d3e8c289aa3006aa63ea402fae95c00001600040005000a000900640062000300060013001200630100> Message-Authenticator = 0xb38e6c9574648ff3b9b43230ab24f470> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 2 length 80> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> TLS Length 70> rlm_eap_tls: Length Included> eaptls_verify returned 11> (other): before/accept initialization> TLS_accept: before/accept initialization> rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello> TLS_accept: SSLv3 read client hello A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello> TLS_accept: SSLv3 write server hello A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0589], Certificate> TLS_accept: SSLv3 write certificate A> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone> TLS_accept: SSLv3 write server done A> TLS_accept: SSLv3 flush data> TLS_accept: Need to read more data: SSLv3 read client certificate A> In SSL Handshake Phase> In SSL Accept mode> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message => 0x0103040019c0000005e6160301004a02000046030147a319d725ef54f7b8675834e99662060c8f0d046180fc473283e66e4672c67a205ba7f2ccb2f755a847a0e47c06522a98b521b9d02fe5a07f13bc49b5cb49637800040016030105890b00058500058200029730820293308201fca003020102020101300d06092a864886f70d01010505003078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564> EAP-Message => 0x752e7472301e170d3038303230313132353931325a170d3039303133313132353931325a30818d310b3009060355040613025452310d300b0603550408130454524e43311330110603550407130a646979617262616b697231153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100b45cb01aaa76827408cd147b1e395998e31ce1fb2124f5f199f8bf9ba98c85b87dc6f425eafd260829153b36> EAP-Message => 0x1ed91744ac08f259793c02c6033d4bcb7c443b5d01e179b81f19182a4f6fbe212616e54184512b813d0f7fa7b71cd0a0b8f479a3841e079339f070594cc15799cb20cb370aa6ad5e1bb607676186a80c40145e1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003e369a0269de8132e852e07c3e8d41ca9a8feabbddbec18ba7d87c8a93c8f711d84485d528c1e52db85d6d233eae7f08fc9d45579ba7dd8b7eb0a9864dfd88eda4d5eead488dddb371af95a81d786abd18a1950fce63c9872c6c6e874983090b85578bba6a2a4fc523b36e463b78cd5d9de64abbf462ef0a> EAP-Message => 0x18c65cf0625345740002e5308202e13082024aa003020102020100300d06092a864886f70d01010505003078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a060355040b130342494d3110300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e7472301e170d3038303230313132343535315a170d3131303133313132343535315a3078310b3009060355040613025452310d300b0603550408130454524e4331153013060355040a0c0c44c384c2b0434c452042494d310c300a> EAP-Message = 0x060355040b130342494d3110> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f67aff0d3d2c202f1c7a8b9c> Finished request 1.> Going to the next request> Thread 3 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=88> Cleaning up request 1 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 5 got semaphore> Thread 5 handling request 2, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f67aff0d3d2c202f1c7a8b9c> EAP-Message = 0x020300061900> Message-Authenticator = 0xf30dca65a4d02ac05f72f49a8c603c32> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 3 length 6> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> rlm_eap_tls: Received EAP-TLS ACK message> rlm_eap_tls: ack handshake fragment handler> eaptls_verify returned 1> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message => 0x010401f61900300e0603550403130742494d484f53543123302106092a864886f70d010901161463636f736b756e406469636c652e6564752e747230819f300d06092a864886f70d010101050003818d0030818902818100c74f8084794bb5e24142b92ed730c80507ff7a16fbb013b222787dd18b7d1f9d19d72ba7c41da18a32b32db41ae6de80c3113a615ff7016120b14dddbc5f2a5b696e501ff9f317a000448de5c9e60ab6f6ce295538591c208504cc3f9ec6dc0703c92372b4f98189b57c20a7a78edc18ef58627aa1e789fad4f7f7a8bccbd5910203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d> EAP-Message => 0x4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414a6a25d7143fd89ada9d0a8b9e6b09f25fe26c8b0301f0603551d23041830168014a6a25d7143fd89ada9d0a8b9e6b09f25fe26c8b0300d06092a864886f70d010105050003818100a53c167b89b48d0b030926b38a337e7ac9e65f3bd4f788f2e7d132859059ddd63ca436149dd929ff168de011bf53e5b5a51189c44467589c4eabfef504c25507510a3749e2e8fa3189f5a571260458fbf2d4e58b3857a1726a0af4a21c5539472e24e96f7678256e32141babf86921d8c7f57a5b92790a5782c7d232fadbd3bc16030100040e000000> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f57dff0d3d2c202f1c7a8b9c> Finished request 2.> Going to the next request> Thread 5 waiting to be assigned a request> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=88> Cleaning up request 2 ID 0 with timestamp +553> Waking up in 0.9 seconds.> Thread 4 got semaphore> Thread 4 handling request 3, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> State = 0xf779e639f57dff0d3d2c202f1c7a8b9c> EAP-Message = 0x020400061900> Message-Authenticator = 0x7011b465e9976763874b73745ac1d791> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 4 length 6> rlm_eap: Continuing tunnel setup.> ++[eap] returns ok> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: Request found, released from the list> rlm_eap: EAP/peap> rlm_eap: processing type peap> rlm_eap_peap: Authenticate> rlm_eap_tls: processing TLS> rlm_eap_tls: Received EAP-TLS ACK message> rlm_eap_tls: ack handshake fragment handler> eaptls_verify returned 1> eaptls_process returned 13> rlm_eap_peap: EAPTLS_HANDLED> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> EAP-Message = 0x010500061900> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f47cff0d3d2c202f1c7a8b9c> Finished request 3.> Going to the next request> Thread 4 waiting to be assigned a request> Waking up in 4.0 seconds. _________________________________________________________________ Need to know the score, the latest news, or you need your Hotmail®-get your "fix". http://www.msnmobilefix.com/Default.aspx

2 1