July 2008 - Freeradius-Users - lists.freeradius.org

Configurable logging
by Alan DeKok 20 Jul '08

20 Jul '08

I have just committed updates to the "linelog" module (including documentation) that significantly increase it's usability. The goal is to move most of the hard-coded log messages to this module. Once these log messages are added to the configuration, the existing hard-coded messages can be deleted. We're looking for volunteers to examine the existing log messages, and to submit sample one-line log formats for the "linelog" module. Alan DeKok.

2 2

Logging attributes to the regular log
by Frank Bulk 20 Jul '08

20 Jul '08

I scoured online and in the archives but I haven't found a solution to my question: is there a way to log additional attributes, not unlike what's done in ISC's DHCP logging? I know that 'detail' logging is possible, but those are stored in a separate file for each connection. I just want to add another parameter that the NAS sends to FreeRADIUS. Regards, Frank

3 5

Solaris 10 - Zone Compiling FreeRadius 2.04
by thekat 19 Jul '08

19 Jul '08

Need some help compiling FreeRadius on Solaris 10 in a Sparse root zone. Goal My end goal to use an oracle 11G database that is installed and configured on the radius server. I have included all *hopefully* information needed.. - FreeRADIUS Version 2.04 - Sparc - Solaris 10 05/08 SunOS sm1gw1 5.10 Generic_127127-11 sun4v sparc SUNW,Sun-Fire-T200 Solaris SunFreeware installed packages -- coreutils-6.4 -- gcc-3.4.6 -- gdbm-1.8.3 -- libtool-1.5.24 -- libiconv-1.11 -- make-3.81 -- mysql-5.0.51 -- netsnmp-5.4.1 --openssl-0.9.8h -- sasl-2.1.21 -- zlib-1.2.3 PATH /local:/usr/local:/usr/local/bin:/bin:/usr/local/lib:/usr/libexec:/usr/local/libexec:/bin:/usr/bin:/usr/sbin:/usr/ucb:/usr/ccs/bin:/usr/sfw/bin Configure options: sm1gw1# pwd /export/packages/freeradius-server-2.0.4 ./configure \ --prefix=/usr/local \ --with-openssl=yes \ --with-openssl-dir=/usr/local/ssl \ --with-openssl-includes=/usr/local/ssl/include \ --with-mysql-dir=/usr/local/mysql \ --with-mysql-lib-dir=/usr/local/mysql/lib \ --with-oracle-home-dir=/usr/local/oracle/product/11G>config.out 2>&1 The output from config.out and config.log are too large for the list so I have posted here: http://kewlcat.com/config.out

2 8

Re : Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 19 Jul '08

19 Jul '08

ah okay! lol > "f you want to authenticate PEAP users via SQL (which you seem > to be saying), then don't configure the mschap module to use ntlm_auth." my mistake: i didn't know... back to Users based on AD. username=glouglou passwd=glouglou domain=PLUTON --------------------------------------------------------------------------------------------------- aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON password: NT_STATUS_OK: Success (0x0) aaa:~ # --------------------------------------------------------------------------------------------------- in etc/raddb/module/mschap, i have this for ntlm_auth: --------------------- mschap { use_mppe = yes #require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" #ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } --------------------- ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 19 Juillet 2008, 18h07mn 43s Objet : Re: Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Reveal MAP wrote: > user=maman > passwd= maman > is a sql based user. > > trying peap with sql based user give error message, Which... is what? Is it a secret? > but trying it with > Ad_based user give no error message, just don't connect... FreeRADIUS gives no error message? Or the client? Are you trying to debug the FreeRADIUS configuration by looking at the login screen on the client machine? > with radtest: Which sends a PAP request. Which doesn't use the MS-CHAP module. Which doesn't go to AD. > same credential with my Access-Point (part of output). > --------------------------------------------------------------------------------------------- > > rlm_eap: Request found, released from the list > rlm_eap: EAP/mschapv2 Which is using MS-CHAP. Which then uses the MS-CHAP module. Which *you* have configured to ask AD. > Exec-Program output: Logon failure (0xc000006d) So... fix that. Run ntlm_auth from the command line until it works. Then use the same password to log in via PEAP. Or... if you want to authenticate PEAP users via SQL (which you seem to be saying), then don't configure the mschap module to use ntlm_auth. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 19 Jul '08

19 Jul '08

thank you Alan (i am on the FAQ) user=maman passwd= maman is a sql based user. trying peap with sql based user give error message, but trying it with Ad_based user give no error message, just don't connect... with radtest: radtest maman maman localhost 1812 testing123 Sending Access-Request of id 48 to 127.0.0.1 port 1812 User-Name = "maman" User-Password = "maman" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=48, length=20 same credential with my Access-Point (part of output). --------------------------------------------------------------------------------------------- rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: Told to do MS-CHAPv2 for maman with NT-Password expand: --username=%{mschap:User-Name} -> --username=maman mschap2: 64 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=2ebb047f9367e21a expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=9a350da9a792cd203c8bbc949a8522dc0540f2f6561bc24b Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [maman/<via Auth-Type = EAP>] (from client Ap8500 port 2 cli 00-12-F0-0C-97-61 via TLS tunnel) } # server (null) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\021E=691 R=1" EAP-Message = 0x04110004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x81d8f90 3 MS-CHAP-Error = "\021E=691 R=1" EAP-Message = 0x04110004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 93 to 10.10.44.246 port 1036 EAP-Message = 0x011200261900170301001b073fa5a0bd298ecb1079cb86c898132309fee25458125b2dd2fa73 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf57621b1f264389c4e317c094fd9f295 Finished request 477. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1036, id=94, length=194 User-Name = "maman" NAS-IP-Address = 10.10.44.246 NAS-Port = 2 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x021200261900170301001b45d08a0aa2a8e62c56613f082cafa76f4b6f51d358557fefd07b7f State = 0xf57621b1f264389c4e317c094fd9f295 Message-Authenticator = 0xc80003ff430d4f991ea016e1e620ecaf +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 18 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [maman/<via Auth-Type = EAP>] (from client Ap8500 port 2 cli 00-12-F0-0C-97-61) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> maman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 94 to 10.10.44.246 port 1036 EAP-Message = 0x04120004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 478. Going to the next request Waking up in 4.8 seconds. --------------------------------------------------------------------------------------------- ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 19 Juillet 2008, 17h19mn 58s Objet : Re: Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Reveal MAP wrote: > Now i am trying to authenticate via PEAP a user existing onmy sql database: The debug log doesn't show that. > the output is too long, mailing list parameters won't accept it. i post > part of the output that seem to give the point of misconfiguration. if > it is not sufficient, please let me know, and i will find a way to put > somewher the whole output of RADIUD -X. thank you. ... > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect What's the problem? You're using Samba to authenticate to Active Directory, and the password is wrong. Check that the passwords are correct. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 19 Jul '08

19 Jul '08

OK radtest maman maman localhost 1812 testing123 Sending Access-Request of id 48 to 127.0.0.1 port 1812 User-Name = "maman" User-Password = "maman" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=48, length=20 Log ------------------------------------------------------------------------------------ Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 32769, id=48, length=57 User-Name = "maman" User-Password = "maman" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> maman rlm_sql (sql): sql_set_user escaped user --> 'maman' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'maman' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'maman' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'maman' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Professeurs' ORDER BY id rlm_sql (sql): User found in group Professeurs expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Professeurs' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "maman" rlm_pap: Using clear text password "maman" rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [maman/maman] (from client localhost port 1812) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> maman rlm_sql (sql): sql_set_user escaped user --> 'maman' expand: %{User-Password} -> maman expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'maman', 'maman', 'Access-Accept', '2008-07-19 18:38:59') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'maman', 'maman', 'Access-Accept', '2008-07-19 18:38:59') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 48 to 127.0.0.1 port 32769 Finished request 359. Going to the next request Waking up in 4.9 seconds. Cleaning up request 359 ID 48 with timestamp +81320 Ready to process requests. rad_recv: Accounting-Request packet from host 10.10.44.246 port 1035, id=53, length=153 Acct-Session-Id = "00000000-00000007" Acct-Status-Type = Stop Acct-Authentic = RADIUS User-Name = "testuser01" NAS-IP-Address = 10.10.44.246 NAS-Port = 1 Called-Station-Id = "00-1C-F0-08-FB-F9:TLS" Calling-Station-Id = "00-12-F0-0C-97-61" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Time = 85 +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 10.10.44.246,NAS-IP-Address = 10.10.44.246,Acct-Session-Id = "00000000-00000007",User-Name = "testuser01"' rlm_acct_unique: Acct-Unique-Session-ID = "73713cdd1b906342". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "testuser01", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.10.44.246/detail-20080719 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.10.44.246/detail-20080719 expand: %t -> Sat Jul 19 18:39:41 2008 ++[detail] returns ok ++[unix] returns ok expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> testuser01 ++[radutmp] returns ok expand: %{User-Name} -> testuser01 rlm_sql (sql): sql_set_user escaped user --> 'testuser01' expand: %{Acct-Input-Gigawords} -> expand: %{Acct-Input-Octets} -> expand: %{Acct-Output-Gigawords} -> expand: %{Acct-Output-Octets} -> expand: %{Acct-Delay-Time} -> expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2008-07-19 18:39:41', acctsessiontime = '85', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = '', acctstopdelay = '0', connectinfo_stop = 'CONNECT 54Mbps 802.11g' WHERE acctsessionid = '00000000-00000007' AND username = 'testuser01' AND nasipaddress = '10.10.44.246' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok expand: %{User-Name} -> testuser01 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 53 to 10.10.44.246 port 1035 Finished request 360. Cleaning up request 360 ID 53 with timestamp +81362 Going to the next request Ready to process requests. ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 19 Juillet 2008, 17h19mn 58s Objet : Re: Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that? Reveal MAP wrote: > Now i am trying to authenticate via PEAP a user existing onmy sql database: The debug log doesn't show that. > the output is too long, mailing list parameters won't accept it. i post > part of the output that seem to give the point of misconfiguration. if > it is not sufficient, please let me know, and i will find a way to put > somewher the whole output of RADIUD -X. thank you. ... > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect What's the problem? You're using Samba to authenticate to Active Directory, and the password is wrong. Check that the passwords are correct. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 19 Jul '08

19 Jul '08

Re hello: Now i am trying to authenticate via PEAP a user existing onmy sql database: the output is too long, mailing list parameters won't accept it. i post part of the output that seem to give the point of misconfiguration. if it is not sufficient, please let me know, and i will find a way to put somewher the whole output of RADIUD -X. thank you. ---------------------------------------- auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: Told to do MS-CHAPv2 for maman with NT-Password expand: --username=%{mschap:User-Name} -> --username=maman mschap2: dc expand: --challenge=%{mschap:Challenge:-00} -> --challenge=42199e911fc846b6 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=f597ba61948e2ca2d0d108962a8d4d933e2eceba92acfe27 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [maman/<via Auth-Type = EAP>] (from client Ap8500 port 2 cli 00-12-F0-0C-97-61 via TLS tunnel) } # server (null) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x81da268 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 32 to 10.10.44.246 port 1030 EAP-Message = 0x010800261900170301001b87ea6c21d531f819e4f7aa4107a0597deda9fd0e2abda3a5196a2d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x15d6165412de0f4c4e5f14457cfcd56a Finished request 237. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.44.246 port 1030, id=33, length=194 User-Name = "maman" NAS-IP-Address = 10.10.44.246 NAS-Port = 2 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b7f8d9a1114a91aa324b023d74676e1d5613e1824df38b29b776f9a State = 0x15d6165412de0f4c4e5f14457cfcd56a Message-Authenticator = 0x05c147f8e161153a89766257956164c0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "maman", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [maman/<via Auth-Type = EAP>] (from client Ap8500 port 2 cli 00-12-F0-0C-97-61) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> maman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 33 to 10.10.44.246 port 1030 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 238. Going to the next request Waking up in 4.8 seconds. Cleaning up request 230 ID 25 with timestamp +80150 Cleaning up request 231 ID 26 with timestamp +80150 Cleaning up request 232 ID 27 with timestamp +80150 Cleaning up request 233 ID 28 with timestamp +80150 Cleaning up request 234 ID 29 with timestamp +80150 Cleaning up request 235 ID 30 with timestamp +80150 Cleaning up request 236 ID 31 with timestamp +80150 Cleaning up request 237 ID 32 with timestamp +80150 Cleaning up request 238 ID 33 with timestamp +80150 Ready to process requests. -------------------------------------- _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : EAP-TLS OK - EAP-PEAP KO!! why that?
by Reveal MAP 19 Jul '08

19 Jul '08

Ok, does someone find normal that EAP-TLS authentication works and not EAP-PEAP? - it is sure, it is not a question of certificate. Alan said someday that that NAS is broken. He might be true, but maybe i missed something in the configuration, but where? - it reminds me a question and i don't know how to answer: I called a SSID "TLS" where security is "WPA Enterprise". it expet users to be authenticated via FREERADIUS to be allowed on the network. so i use a certificate, and the commonname of this certificate is "testuser01". authentication success cause certificate is valid, but i have no user called "testuser01" on user file, sql database, or AD. so my first question is: doing EAP-TLS authentication, user is based_what? i mean, does user have to exist on a base like sql, ldap or a file, or just the certificate credentials are enough? second: using RADIUS for authetication in a LAN means that 802.1x is used. That's what i read. Right now, i notice that 802.1x is off on all my NAS... i forgot to set it "ON". so why does EAP-TLS Authentication runs OK... why that? (and EAP-PEAP still not ??) - Yes, i know it's not school here but realize that it's not easy to surround alone. thank your for your explanation and your time! ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 18 Juillet 2008, 20h00mn 31s Objet : Re: Re : EAP-TLS OK - EAP-PEAP KO!! why that? > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no //i set "yes in /etc/raddb/module/mschap for this > but still stay on "no" > } Because this is from eap.conf. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

rlm_chap: Password check failed
by Maciej Drobniuch 19 Jul '08

19 Jul '08

Hi! I have a problem with chap authorization. PAP works fine but chap gives out this output: http://paste-it.net/public/id5f751/ Thanks! -- ------------------------ Maciej Drobniuch

1 0

avoid accounting of identical requests
by Raffael Himmelreich 19 Jul '08

19 Jul '08

Hi, we're encountering that our radius clients - who don't send anything but access requests and session stop packets with accounting info - repeatedly send the same accounting stop request multiple times. We tried to filter those requests with increasing both the cleanup_delay and max_requests configuration settings, but were not really successful. Looks like the cleanup_delay counter is not effective per request's unique id but for all requests received so far. Are we misinterpreting the cleanup_delay setting? Is there any fast and reliable method built into freeradius to reject multiple identical accounting requests, or do you have any better suggestions? freeradius: FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu (Debian package) Thanks a lot

3 2