July 2008 - Freeradius-Users - lists.freeradius.org

None
by Ray Stell 15 Dec '08

15 Dec '08

unsubscribe

4 4

freeradius password expiry
by yangcuilin 06 Dec '08

06 Dec '08

My requirement: 1. At FreeRADIUS (java) client side, judge the current user whether is password expiry in advance. If user password is expiry, prompt user to change password. My question: FreeRADIUS have an attribute of "Expiration" to judge whether the password is expiry, but can I get value of "Expiration" in advance? 2. User can send request (which is the FreeRADIUS attribute of "Expiration") to FreeRADIUS Server. My question: How do I change the value of FreeRADIUS attribute of "Expiration"? Two questions. Thanks in advance.

6 14

Freeradius error: "Discarding conflicting packet"
by jelle-e 27 Nov '08

27 Nov '08

Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 21

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8

freeradius for windows + mssql problem
by rodolfor 30 Oct '08

30 Oct '08

Hi all. I have installed freeradius for windows (www.freeradius.net) and it works well. Now I want to connect the service to an mssql database in the same machine. The error I receive (starting in debug mode) is (using mssql.conf): rlm_sql (sql): Could not link driver rlm_sql_unixodbc: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[10]: sql: Module instantiation failed. Could someone help me ? thanks -- View this message in context: http://www.nabble.com/freeradius-for-windows-%2B-mssql-problem-tf3731743.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

wpa_supplicant(eapol_test) with freeradius: error coming in TLS
by Gaurav Kansal 21 Oct '08

21 Oct '08

Hi I am trying to use EAP-TLS between wpa_supplicant and freeradius. I created the certificates (ca/server/client) as mentioned in freeradius-server-2.0.5/raddb/certs/README. In freeradius-server-2.0.5/raddb/users, following line is added at end: testuser Cleartext-Password := "password" On wpa_supplicant-0.5.10, created eapol_test.conf.tls with following contents: network={ eap=TLS eapol_flags=0 key_mgmt=IEEE8021X identity="testuser" ca_cert="/usr/local/etc/raddb/certs/ca.pem" client_cert="/usr/local/etc/raddb/certs/testuser(a)example.com.pem" private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" } Executed wpa_supplicant (eapol_test) with following command (wpa_supplicant side logs are after radius logs at end): eapol_test -c eapol_test.conf.tls -a127.0.0.1 -p1812 -stesting123 -r1 On executing /usr/local/sbin/radiusd -X, I get following log and error too: rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=0, length=124 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000d017465737475736572 Message-Authenticator = 0x0e5f593f30507d677e8d7e68b072b55f +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 32770 EAP-Message = 0x01010016041017695d19037d705af68ca37a7262ddcb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x267673582677771a69809cb3876d58ea Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=1, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02010006030d State = 0x267673582677771a69809cb3876d58ea Message-Authenticator = 0x6dd1d34467725c79f19b72ff9612e3ce +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/tls rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 32770 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735827747e1a69809cb3876d58ea Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=2, length=236 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202006b0d0016030100600100005c03014874ff7ae4659071f23a8aac506f1f25b7c9f1272eca 77a38aaea1b9788b532d00003400390038003500160013000a00330032002f006600050004006300 62006100150012000900650064006000140011000800060003020100 State = 0x2676735827747e1a69809cb3876d58ea Message-Authenticator = 0x1a18c152c7a7d0032d7876c2e02214d3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 107 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0060], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a7], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 32770 EAP-Message = 0x010304000dc000000b70160301004a0200004603014874ff7af840e0ce0c0562387841cbf363e6 be64f8dd2def0915579fb271a7d320bc89e200ccdb1ad9ae9498442013c69878623fb1e470357891 b9df6651cbf029003901160301085e0b00085a0008570003a6308203a23082028aa0030201020201 01300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d06035504 0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c 4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d70 6c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d303830 3730393138313131375a170d3039303730393138313131375a307c310b3009060355040613024652 310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e 312330210603550403131a4578616d706c6520536572766572204365727469666963617465312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a 864886f70d01010105000382010f003082010a0282010100c296eb2d169b654435a174fd8ead1b26 d65b1298d9a7bcc561a051d2b667 EAP-Message = 0x28a6c693620ce3c06c032ebe4dbeedff9020f24d06430433091b7e9762575c12fdb988ad5d6dfe e570df9a0aa1ce55de2d308c162bbcf917c8441071ea895cfb102721f2a5059f402317457a104650 b4fea1975e04fb83fc4d0a2cf72167830d5281398c981ac2f27370a34aa49b07e007fa955ebf187a 8fd476174e7493ffa02bf466b07846382b4eaf03551fef5ca60ab3fc3aa19983aeb5015147ed3317 f659f0355a43091eb19ab0c4a8d07651627d1fad596cc5ee44fa2ccfcd92d6c63d778a9d958a6ca4 a02409c546d3b8400928e1b635c26ef5ab7fc54b68b8aa2e98b2830203010001a317301530130603 551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100095935837d63c395fca941ae947c03fa c66f843b37c9969c2f46cb8b26348bfbd6348ac0d13b6a752886f1e83579122942dd8d0ab6b27578 49735dccfd82d06d3a07d1a2de3097c76cbb431042062e26df240d5d40ada6bc999bade14ebc0661 362f9a7f8644943e78a29e329c67ec32cf393205408021e56e461ce3320127b27df474f4c37be7cc cf46754c32ee8243500a194759ba6c5b2fcd563117b2ea94b9c63eb1678ff836afd92118a98b93fc 51992e9de619a9c7576fe3cae6a1e9988a2b10b0685ca7e58e5b100ec0817d511f34f59f794bcde2 5c247259a57ab8b1d686fce7c7cd EAP-Message = 0x3f8d16472d4a3eb1ee492fd3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735824757e1a69809cb3876d58ea Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=3, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0x2676735824757e1a69809cb3876d58ea Message-Authenticator = 0x86f3e31b265162f7716d461a9aae98f2 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 32770 EAP-Message = 0x010404000dc000000b70bf312a81c68194ac03b073abf2410004ab308204a73082038fa0030201 02020900ac4ad85feeea230a300d06092a864886f70d0101050500308193310b3009060355040613 024652310f300d060355040813065261646975733112301006035504071309536f6d657768657265 31153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d0109011611 61646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479301e170d3038303730393138313131325a170d30383038 30383138313131325a308193310b EAP-Message = 0x3009060355040613024652310f300d060355040813065261646975733112301006035504071309 536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a86 4886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d 01010105000382010f003082010a0282010100ccff47e75ebf3d06a9472810c0352b254cca71cbb5 2cb8202d29ae967c715640e4d2b6c3e60641c4d54fdc03fe6ebdfb1953dc1b8c1f44202cf488249d 37f2b7902efdf546fabb283a9653 EAP-Message = 0xfa065f9b063843f36456ac437df7cefeaad4d44004939d63ae9c4df03f1b856d8340ab4e6317a1 11aecfd860639f0056069404c4d2f9f10e9048b10f4bd65dfe2a61470543b7b323895dfbb54053f8 4cb0417f5eafdf8aa236a2afea06047be624e1f7b85e757be3749e6946439ad4e85de0d4f66f35e1 a4ee8258727033035877b43232c0697a2baf3d09e8aa337366b1cbbccf72a509b977d426d546c7b1 65f873308f0a6964f430ee01b74cc0a561d9869fd84f0203010001a381fb3081f8301d0603551d0e 041604141c71c3ab8dbd86f36bbf4b24d5b72d291bc88aaf3081c80603551d230481c03081bd8014 1c71c3ab8dbd86f36bbf4b24d5b7 EAP-Message = 0x2d291bc88aafa18199a48196308193310b3009060355040613024652310f300d06035504081306 5261646975733112301006035504071309536f6d65776865726531153013060355040a130c457861 6d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e 636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72 697479820900ac4ad85feeea230a300c0603551d13040530030101ff300d06092a864886f70d0101 05050003820101005925971768cfc1bb8f4b1dd4b9d0abd84cca91dc19d344451da159ae0925f192 4022b20ea548d56947a26c987dc0 EAP-Message = 0xfb36d1078bef2f36de91d2b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735825727e1a69809cb3876d58ea Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=4, length=135 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400060d00 State = 0x2676735825727e1a69809cb3876d58ea Message-Authenticator = 0xd88cda63a2776910572007659978dff0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 127.0.0.1 port 32770 EAP-Message = 0x0105038e0d8000000b7083ce8bd2a2e5a3df721979638d83518a19e079bf804773b82753a039b6 b053a357acb9d1954ecb25330390d4d54583a6fdeb74f039f492238f8d93bdc53d3acc2366af2771 253c218dbc3a006b911f1e4bb6fd491b99ed05b1520cf14d08d12119b177f754cae89d065edb4868 0f35d8df3c0e7fcec9c6e84d52a1136f7a56a90f539addc1ad3c44e25de731f0443844dbfe83d043 2ad61f7ed89184a407e0b41a9ffbc0389637071d937e63e136311e467b914839fd7382c216734b1d e93368e4fb6b2303f4160301020d0c0002090080b3afe7fd33f61741e813a2a82d3e2e44f4e3a6cb a8ba274ff2a14cdee764e7ec4e45 EAP-Message = 0x4df9c4b18aa0bb45b4dcbe5022790ed79559ec10e6b017165192ca92ee664df49dd6de389d1eba 0400804b550239ffca80cdd27f3cc0ce1fc851463b672a8e260e415d3d3a40e8ae5102105bddc30b 8c1a3031af0bc0a78b4ea69f5e66630001020080a0cc4357af8865d129c3e7c20c4283e7a4a4c522 e23e0f3cb9b462c2923ea92c3a2781665e6d1fe4096f9832e39c33424106d2429f569da06ac67c9b 0800351a1b7c512cd541edf0a135330412dbccd37885e35ce75111476fe045e0a85c70abf40a3008 9c4d4302179e1f084bffe853b1845c99010515a1970a03a87449615a010060149cd09ea980ec82c5 5cfe09857dbb7c5811f45c64e0fe EAP-Message = 0x9d59d03e704806e99f1cb29f0286c1015c81d7824e617a53bd69dacefe51425fec76315ad4861b 81d8aff93491a3b7a18988a9a9ee16acba071272b143c7bb8106d29ac8e6087a066498b3f47cf216 fb2a96f19d7ccd8459646ed27ce02852c2c402000778e68ec419b9f14059fea1eaaad700a5c1d71f 8ba516d820a6b0520e9a808736de80b97588f6b72b6b405b1f8a5a8779e01cd882c352aabb41e4a6 0fd2e4c64382e2a12deb09e8fb2caaa26a86aec4606044a283b9d20b0bf2637a953e8716d0b90958 aebeb9995898714edb927fb52e51c4a1a2ff1157ae26402265dbbbb03f99e23f2416030100a70d00 009f040304010200980096308193 EAP-Message = 0x310b3009060355040613024652310f300d06035504081306526164697573311230100603550407 1309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e0609 2a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d45 78616d706c6520436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2676735822737e1a69809cb3876d58ea Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=5, length=1532 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020505710d0016030103950b00039100038e00038b308203873082026fa003020102020102300d 06092a864886f70d0101040500307c310b3009060355040613024652310f300d0603550408130652 616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a45 78616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901 161161646d696e406578616d706c652e636f6d301e170d3038303730393138313132345a170d3039 303730393138313132345a3079310b3009060355040613024652310f300d06035504081306526164 69757331153013060355040a130c EAP-Message = 0x4578616d706c6520496e632e311d301b060355040314147465737475736572406578616d706c65 2e636f6d3123302106092a864886f70d01090116147465737475736572406578616d706c652e636f 6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b510efbf58ad 201585beac3f327bba71b761612df254a3e44ffe4f5a182852e2a64d11912ca27013be01dae059ef 3d8a9b2ca7a81c9da01b2291b6e38f07339c7668c6b7ce6c936bef181c33c16d5c34e17b0c878648 bb73199645bb81febb577aff69f4881080ea593f31b5efcccebd3772dda5666a5e139a38e89b9ca1 3712462098dbfc5c526253985609 EAP-Message = 0x583e54d9d74b9b263cda9647c523d9922c1992736d176c3b869b373a9824a8c046dfd49118a90d 5c8e9504cae9209d8254c31f98c3979a307f0515e88e820c29c9092c0de6c9af76c9a1bc8eee37ae a8d047bf8c1af257f42b550932995e5083364a7e185a62de08976e2ca45d334231109eeaf7020301 0001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104 0500038201010085cf673c6dd1deb8648e0589573c0e55e286ba9f3ef23a3882fbe024a5c54aeef5 10e96f36291f0172deb8bcf2b8ce9e6517a143c658e8fb24c80a7936138c5e6f7dda3ca8b33e4600 a1cb92c2f079793304c0ddc296c4 EAP-Message = 0x015d6d73cdae8f32eea68667d9cf33a6ad8c5e38a0ffbda541b5b789ffd0cd2b4de23592384ee2 3e154ea629f1a3743fcba443f8e6d355411d310f787d6551c413af2eccfabc2b28e9e786fd78cb32 50a0ca2cd0adf11d8045d03ea0cca6b28d5c498c0965a238b05ccf7cadc3946ee0c42d65594ca337 8ecd205c74b42b5f9c060287639e4cf76f5003ec0d3723abd391f4693556553f5aaac2684a2bb808 e2a2cf16b425c9736e1c16030100861000008200803d7d38a765634fe46cd97911bbb0826fd6bb31 7dc04dbb7ca60c2d352f4a9be2f147f261ccf2d7c5e05b85783810260ddaed3c3772fcceab264dd8 daf8a4467e6a6729a7152dabe5a4 EAP-Message = 0x4c2375c148a15096de5c28842d80507318656b36edc71772326fd6fddbc6dbb9d5476332d561de 95d1a40b59779113ada15e6b466977eb16030101060f00010201003fcdbdf9a53a3f14ce87dbc345 68e1cc53d78b24457c12a7be38fc6e07932f6a253fc07cf73579bc7dbb98eeaf91076ba912ff6fe2 f6bfc1d2803974757922cd8fa5142f870aae126053adf7b4c7456bb431a174446775b7e9f78fcfb0 925edee9a12cf5a76fc6ef7fdf983adeb3ec234d89af9e7298602df31a4febaa1c9aa039c3142ec5 7416c3771b1ae8934b1444dda9e28b932ae8ff1a22aae98ceb9f2d7a9caac9efb16c01a4cd3dadda 86513428a3bd3a11b262eaa750dc EAP-Message = 0xd50749f461997927394171b785ff74c98d883674fc8035287993a279f1ffa72b9c4cbc6b96fcaa d6e5daaca7bd9aca988c6a8b3c487bd1e5cc73dd3c3c59f8ec39549ebeb614030100010116030100 30f1c1d6ee34104fca2869c989529493079d85690315b83299b5d9567823fea467b507af2267dd69 305c7d35d7809adf12 State = 0x2676735822737e1a69809cb3876d58ea Message-Authenticator = 0xcc6ace4662072c78666cb7d873d7a354 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 0395], Certificate --> verify error:num=20:unable to get local issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 5 to 127.0.0.1 port 32770 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request Waking up in 4.4 seconds. Cleaning up request 0 ID 0 with timestamp +4 Cleaning up request 1 ID 1 with timestamp +4 Cleaning up request 2 ID 2 with timestamp +4 Cleaning up request 3 ID 3 with timestamp +4 Waking up in 0.1 seconds. Cleaning up request 4 ID 4 with timestamp +4 Waking up in 0.2 seconds. Cleaning up request 5 ID 5 with timestamp +5 Ready to process requests. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ wpa_supplicant logs (copying only FAILURE logs seen at end) ++++++++++++++++++++++++++++++++++++++++++++++++++++++ EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=5 length=44 Attribute 79 (EAP-Message) length=6 Value: 04 05 00 04 Attribute 80 (Message-Authenticator) length=18 Value: 7a 61 25 5b 8e cd 44 3b 18 b1 af e3 82 fd 32 5d STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=4 id=5 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=0 EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 2 FAILURE Regards, Gaurav Kansal

3 5

Possible bug in unlang?
by Phil Mayers 14 Aug '08

14 Aug '08

We've recently moved our servers to FreeRadius 2, and we've been having reports of some problems with our wireless service. I investigated, and it seems the problem is the following stanza from the "inner-tunnel" config, which I just copied over from the default configs: post-auth { update outer.reply { User-Name = "%{request:User-Name}" } } ...specifically, it seems that the xlat of this string is treating embedded "\" as escape characters. For example; I was unable to stop the radius server, but a tshark capture of a failing user shows me (C: is radius client i.e. the NAS, S: is packet from the radius server); note the "\\" are tshark escaping the data, the actual username is "IC\nyshir" C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge C: access-request IC\\nyshir S: access-challenge IC\x0ayshir C: access-request IC\x0ayshir S: access-reject Note that the final "access-challenge" sends back IC<newline>ayshir; the AP then carries this over to the next request, which fails. I've solved that problem by removing the "update outer.reply", which leads me to a 2nd question - given that the "eap" module does this anyway (and since it uses a dumb "memcpy", correctly) why is that unlang statement there in the sample configs? Is it necessary? One final thing; can I suggest the attached patch (though it should probably escape the data, since it comes from the user)

2 10

xp sp3 and freeradius 2.0.5
by Oxiel 11 Aug '08

11 Aug '08

Hello Gurus. Apologies if this mail arrives twice, the first time i did send it (05/Jul/08), nothing showed on the list nor the archive. I'm new to freeradius 2.0.5, compiled it from sources and installed on CentOS v5.0, xp sp2 clients authenticate without problems with PEAP, but xp sp3 don't. I've searched the entire list, but none reference to xp sp3. Has anybody achieved to authenticate xp sp3 with default 802.1x client to freeradius ? Haven't yet tried Vista, but suspect will have the same problem..... This is the log: Best regards. Oxiel [root@radius ~]# radiusd -X FreeRADIUS Version 2.0.5, for host x86_64-redhat-linux-gnu, built on Jul 5 2008 at 10:14:20 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.100.245 { require_message_authenticator = no secret = "secreto" shortname = "192.168.100.245" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --username=%{mschap:User-Name} --request-nt-key --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/cert-srv.pem" certificate_file = "/etc/raddb/certs/cert-srv.pem" CA_file = "/etc/raddb/certs/demoCA/cacert.pem" private_key_password = "*l4Pr0.14" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.100.245 port 5001, id=218, length=286 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" User-Name = "COSMART\\jat" NAS-Identifier = "001cc5363882" NAS-Port = 268439554 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=2" NAS-Port-Type = Ethernet Calling-Station-Id = "0050-bac5-dfa5" Acct-Status-Type = Stop Acct-Authentic = RADIUS Acct-Session-Id = "110500010555d" NAS-IP-Address = 192.168.100.245 Event-Timestamp = "Jan 1 2005 01:57:37 BOT" Acct-Session-Time = 119 Acct-Delay-Time = 39 Acct-Input-Octets = 3232 Acct-Input-Packets = 43 Acct-Output-Octets = 8326 Acct-Output-Packets = 71 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Terminate-Cause = Lost-Carrier 3Com-Connect_Id = 81 3com-Attr-29 = 0x00000000 3Com-VLAN-Name = "\000\000\000\000" 3Com-Encryption-Type = "\000\000\000\000" 3Com-Time-Of-Day = "\000\000\000\000" 3com-Attr-22 = 0x00000000 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 268439554,Client-IP-Address = 192.168.100.245,NAS-IP-Address = 192.168.100.245,Acct-Session-Id = "110500010555d",User-Name = "COSMART\\jat"' rlm_acct_unique: Acct-Unique-Session-ID = "ea36fd6add7d8838". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "COSMART\jat", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.100.245/detail-20080705 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.100.245/detail-20080705 expand: %t -> Sat Jul 5 14:30:23 2008 ++[detail] returns ok ++[unix] returns ok expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> COSMART\jat ++[radutmp] returns ok expand: %{User-Name} -> COSMART\jat attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 218 to 192.168.100.245 port 5001 Finished request 0. Cleaning up request 0 ID 218 with timestamp +2 Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=0, length=240 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x0201001b01686f73742f63616a6130322e636f736d6172742e626f Message-Authenticator = 0xf1acdc9cf04cb956900a1812f75fc8e0 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 27 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.100.245 port 5001 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5073b7a3e2254835034dd3ceef Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=1, length=311 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x0202005019800000004616030100410100003d0301486fbdd4eecfde254716f92a39b631a3684a00787d5d6b063ba9c81cd22e195300001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xbec7d6563e28ca88de7723c45425b6a4 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5073b7a3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0666], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.100.245 port 5001 EAP-Message = 0x0103040019c0000006c3160301004a020000460301486fbdc4c5c76a2564aa4f526c944a51a1302a3c659a0b0961427630875f60f92028b6d005458c6b196869a0d631f1ce41013c4514747eeebbdd80e7b4bc5969af00040016030106660b00066200065f0002b9308202b53082021ea003020102020104300d06092a864886f70d0101050500308191310b300906035504061302424f311330110603550408130a53616e7461204372757a311330110603550407130a53616e7461204372757a3110300e060355040a1307436f736d6172743111300f060355040b130853697374656d6173311630140603550403130d61646d696e6973747261746f EAP-Message = 0x72311b301906092a864886f70d010901160c6a6174406d61696c2e63736d301e170d3038303730323231333833325a170d3138303633303231333833325a308195310b300906035504061302424f311330110603550408130a53616e7461204372757a311330110603550407130a53616e7461204372757a3110300e060355040a1307436f736d6172743111300f060355040b130853697374656d6173311a3018060355040313117261646975732e636f736d6172742e626f311b301906092a864886f70d010901160c6a6174406d61696c2e63736d30819f300d06092a864886f70d010101050003818d0030818902818100cbeb8d00c58afe573130 EAP-Message = 0x546535d403e375d6bd47f46e40c177715d4ecab36ec81bd674cf9e85001a18c8dff1f6a3c36157c4ae0b1081b6a09d177dd4e43da1feab1ad3611da0b973cc5e69d4ed7ddd58147c6ea6666c86d074dce2b4819153f104b1ce41c4c549231e386a04f5123ae40191488aaf93362f09b31eef336682470203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810035fdfe43e521364d5c730005b1307d1ed1fb9bbeb88cec2be4e362fe3779c4dd1196f0e5b0bb41cde48da1e7392549e989d1ea0e3af59191d05be8991ced0b557b2ea643c160b150e7c83ab667414bb8b670c1193c53 EAP-Message = 0xae386773f3124b7803f6ada10aa517a81bfa0cfe66d5a557da43773eafabe10cbd705a52e5303e0282c90003a03082039c30820305a003020102020900e224351ea6a8c75e300d06092a864886f70d0101050500308191310b300906035504061302424f311330110603550408130a53616e7461204372757a311330110603550407130a53616e7461204372757a3110300e060355040a1307436f736d6172743111300f060355040b130853697374656d6173311630140603550403130d61646d696e6973747261746f72311b301906092a864886f70d010901160c6a6174406d61696c2e63736d301e170d3038303730323231333435365a170d3138 EAP-Message = 0x303633303231333435365a30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5072b6a3e2254835034dd3ceef Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=2, length=237 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x020300061900 Message-Authenticator = 0x2690776a323a61b010a03df037aec344 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5072b6a3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.100.245 port 5001 EAP-Message = 0x010402d319008191310b300906035504061302424f311330110603550408130a53616e7461204372757a311330110603550407130a53616e7461204372757a3110300e060355040a1307436f736d6172743111300f060355040b130853697374656d6173311630140603550403130d61646d696e6973747261746f72311b301906092a864886f70d010901160c6a6174406d61696c2e63736d30819f300d06092a864886f70d010101050003818d0030818902818100a646305a573ba9462e50379658300d0d0d8af89c4c30d84d160cde108867f5008c5d5476b473d60cc52067227194c9d8cb838e251fad331103a0ef6b82d2fc1c775065420d91f1 EAP-Message = 0x69d61d23088d5d2fcaca82b78d432ae2e5a7bc2128ab1489512d0d5df2dc8057bcf5ecf9e5c1be94088977ffa69885442de5967c302cbb3a750203010001a381f93081f6301d0603551d0e0416041473a2a24959f00db826a07cf8489b046784765ead3081c60603551d230481be3081bb801473a2a24959f00db826a07cf8489b046784765eada18197a48194308191310b300906035504061302424f311330110603550408130a53616e7461204372757a311330110603550407130a53616e7461204372757a3110300e060355040a1307436f736d6172743111300f060355040b130853697374656d6173311630140603550403130d61646d696e69 EAP-Message = 0x73747261746f72311b301906092a864886f70d010901160c6a6174406d61696c2e63736d820900e224351ea6a8c75e300c0603551d13040530030101ff300d06092a864886f70d010105050003818100012eb34d9f4d44275d7141f817f9754d61b51a1205fe9326b51df1985a69c664e5a572a408ac098247e82621c48c097c72230ef3d4d4607636e721213b3a6bcae16cb65033eb9793e4bad604c5f8a4bd25638163cd556f283862542654cbcae9b86573ac3668cfad36b8b643abedbeb7a1ffb440c3af91d1a3a76d67ac84a2f016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5071b1a3e2254835034dd3ceef Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=3, length=423 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x020400c01980000000b616030100861000008200800d05f33fc8ee7d6b891fd473b79cbd08c00029c400a4a8b4f66a043855312f1ae4c9ebc4d5935b3dd33a2f8c43a91f5268b8c6feeb2045eb683a038e92faad3c109b80d461449c916764451ae0ad1d9cc5adc79124b328a9e1240a83ffa8cef0833a8f218ce6cffe3c92e4a3a2e421e5d3e31c47deeafb370be2c2ae35840013140301000101160301002071ab2c4c5ef80026ece917f82faa9c4bf68ea263927572bcf2eff9dbc1b51e93 Message-Authenticator = 0x9d34a0ceab1dba8f46192d60879ce9e6 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5071b1a3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 192 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 182 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.100.245 port 5001 EAP-Message = 0x01050031190014030100010116030100208af84b95006d4b91fba9d7169d916eb6809c68b34efddd8d7bb978243d04922e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5070b0a3e2254835034dd3ceef Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=4, length=237 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x020500061900 Message-Authenticator = 0xfb42b30cdfd2f35fc4e94d6b7b571349 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5070b0a3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.100.245 port 5001 EAP-Message = 0x0106002019001703010015bc754e60e537bc8fb1c7d29c5758b542685f2a6b11 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5077b3a3e2254835034dd3ceef Finished request 5. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=5, length=281 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x02060032190017030100272290fc8604f7a51d1b40db4729ff215118019fc7cab898e7f7d59299b9ba138f63ad3698ff0d0d Message-Authenticator = 0xdc1ac64c77e6220711e5b9da5a1483c7 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5077b3a3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 50 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - host/caja02.cosmart.bo PEAP: Got tunneled identity of host/caja02.cosmart.bo PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to host/caja02.cosmart.bo +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 6 length 27 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.100.245 port 5001 EAP-Message = 0x010700471900170301003c1e6805da43586305dd52fac9e77e5c0f59cf439f63276da038654693c461d78f2dff4238725874cbf4b94708899dcd5c661d56d09d4ef789e6c8d8ad Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5076b2a3e2254835034dd3ceef Finished request 6. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=6, length=335 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x020700681900170301005dd9e8df11c1c77181e304f5804625cc6d44f9ab95418534bff216737d94c26604aad2c35ddf65bccfedc9ee52b023fda66d370b6767fd533860ea5b75eb2cdaf251db63feb3991bc812f10e8b41a96942b928746d8e124cd3ff02208321 Message-Authenticator = 0x189158927107c3cc4dbfb70ddcec6879 NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5076b2a3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 7 length 104 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to host/caja02.cosmart.bo +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 81 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/caja02.cosmart.bo with NT-Password expand: --username=%{mschap:User-Name} -> --username=caja02$ expand: --domain=%{mschap:NT-Domain} -> --domain=cosmart mschap2: ca expand: --challenge=%{mschap:Challenge:-00} -> --challenge=2ee635f36876e135 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=3e2799722d4ae64a874fca7144dc868ba821b45ab8d3e5c9 Exec-Program output: NT_KEY: 2C5558B32AB95B9348365F364D596970 Exec-Program-Wait: plaintext: NT_KEY: 2C5558B32AB95B9348365F364D596970 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.100.245 port 5001 EAP-Message = 0x0108004a1900170301003f5b72a242149b0c849225ef274c8f16078a490d8b7017a19218015a39d51e11d4e4b5ec95727149d5d2d108ca87be5ac4572a1326c0be8912899588ed1dc79d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5075bda3e2254835034dd3ceef Finished request 7. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=7, length=260 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x0208001d19001703010012729a793115410148fb3e1894728ed9dd43a2 Message-Authenticator = 0xc0038ec1fb0e803e1447e0c672705c8c NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5075bda3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to host/caja02.cosmart.bo +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS Saving tunneled attributes for later ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.100.245 port 5001 EAP-Message = 0x010900261900170301001be69227ae08e478000a3caae737a96433d8bb3a4ff3a53f1fbb7c0c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73b5ba5074bca3e2254835034dd3ceef Finished request 8. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.100.245 port 5001, id=8, length=269 User-Name = "host/caja02.cosmart.bo" EAP-Message = 0x020900261900170301001b3916275431b7332459f3aaa1643e31720bc6ac34c224b51e2693c3 Message-Authenticator = 0x7093c15fac997292a12f6fc80059160c NAS-IP-Address = 192.168.100.245 NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0050-bac5-dfa5" State = 0x73b5ba5074bca3e2254835034dd3ceef 3Com-Connect_Id = 83 3Com-Product-ID = "5500G-EI" 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" 3Com-NAS-Startup-Timestamp = 1104537612 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 9 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success Using saved attributes from the original Access-Accept rlm_eap: Freeing handler ++[eap] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 8 to 192.168.100.245 port 5001 User-Name = "host/caja02.cosmart.bo" MS-MPPE-Recv-Key = 0xbc92e431af5c7ffb4d5b7995391751603d37b0f0ff4b90fbfecd1785d2d987b9 MS-MPPE-Send-Key = 0x298436d731ecef7178d901f10b1654124cb4b52e1e1ed23fd33b1ec32476b480 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 9. Going to the next request Waking up in 4.3 seconds. rad_recv: Accounting-Request packet from host 192.168.100.245 port 5001, id=219, length=228 User-Name = "host/caja02.cosmart.bo" NAS-Identifier = "001cc5363882" NAS-Port = 268439553 NAS-Port-Id = "unit=1;subslot=0;port=1;vlanid=1" NAS-Port-Type = Ethernet Calling-Station-Id = "0050-bac5-dfa5" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Session-Id = "110500010558e" NAS-IP-Address = 192.168.100.245 Event-Timestamp = "Jan 1 2005 01:58:37 BOT" 3Com-Connect_Id = 83 3com-Attr-29 = 0x00000000 3Com-VLAN-Name = "\000\000\000\000" 3Com-Encryption-Type = "\000\000\000\000" 3Com-Time-Of-Day = "\000\000\000\000" 3com-Attr-22 = 0x00000000 3Com-Ip-Host-Addr = "0.0.0.0 00:50:ba:c5:df:a5" +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 268439553,Client-IP-Address = 192.168.100.245,NAS-IP-Address = 192.168.100.245,Acct-Session-Id = "110500010558e",User-Name = "host/caja02.cosmart.bo"' rlm_acct_unique: Acct-Unique-Session-ID = "b9beac104c297af0". ++[acct_unique] returns ok rlm_realm: No '@' in User-Name = "host/caja02.cosmart.bo", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.100.245/detail-20080705 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.100.245/detail-20080705 expand: %t -> Sat Jul 5 14:30:28 2008 ++[detail] returns ok ++[unix] returns ok expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> host/caja02.cosmart.bo ++[radutmp] returns ok expand: %{User-Name} -> host/caja02.cosmart.bo attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 219 to 192.168.100.245 port 5001 Finished request 10. Cleaning up request 10 ID 219 with timestamp +7 Going to the next request Waking up in 4.2 seconds. Cleaning up request 1 ID 0 with timestamp +6 Cleaning up request 2 ID 1 with timestamp +7 Cleaning up request 3 ID 2 with timestamp +7 Cleaning up request 4 ID 3 with timestamp +7 Cleaning up request 5 ID 4 with timestamp +7 Cleaning up request 6 ID 5 with timestamp +7 Waking up in 0.1 seconds. Cleaning up request 7 ID 6 with timestamp +7 Cleaning up request 8 ID 7 with timestamp +7 Cleaning up request 9 ID 8 with timestamp +7 Ready to process requests. ______________________________________________ Enviado desde Correo Yahoo! La bandeja de entrada más inteligente.

10 14

Freeradius && Diffie-Hellman
by Sergio 10 Aug '08

10 Aug '08

Hi, Has anybody ever change the type of key exchange using eap-tls? eap.conf: ......... rsa_key_exchange = yes dh_key_exchange = no rsa_key_length =1024 dh_key_length....... ........... output of radiusd -X ........ Module: Instantiating eap-tls tls { rsa_key_exchange = yes dh_key_exchange = no rsa_key_length =1024 ........ } ........... Does it would be enough?

2 3

EAP-SIM and EAP-AKA fast-reauth support
by Geoffroy Arnoud 08 Aug '08

08 Aug '08

Hi all, I have a question about EAP-SIM and EAP-AKA authentication. Is fast-reauthentication supported (in eap or eap2 module)? Thanks in advance for your answers. Geoff. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 3