August 2008 - Freeradius-Users - lists.freeradius.org

EAP-TNC supported?
by Martin Schneider 21 Aug '08

21 Aug '08

Hello everybody, I've got two questions: - I read in wikipedia, that the spring 2008 release of FreeRadius has "experimental EAP-TNC" support. I couldn't find any information on the FreeRadius homepage or wiki, that this information is correct. Has FreeRadius EAP-TNC support? And "how experimental" is the EAP-TNC support? - In case FreeRadius supports EAP-TNC, is it possible to run EAP-TNC "inside" a EAP-TTLS tunnel? EAP-TTLS as outer method and EAP-TNC as inner method? Hope anybody can help me! Thank you in advance Regards Martin

2 3

Re: Re: expiration or session-timeot
by Bozhan Boiadzhiev 20 Aug '08

20 Aug '08

ok thanks one more thing. is it possible to set timestamps instead date as Expiration attribute. I need this for example if i want to give a given customer access to internet for one day. As i understand Expiration attribute can get only date values. Can i set timestamp and radius to send Session-Timeout to NAS at that time, for example instead on 00:00 on given date on 13;45 on that date? >-------- Оригинално писмо -------- >От: "Ivan Kalik" >Относно: Re: expiration or session-timeot >До: "FreeRadius users mailing list" >Изпратено на: Сряда, 2008, Август 20 16:52:18 EEST >It calculates maximal session time and sends it to NAS as >Session-Timeout. If your NAS supports Session-Timeout attribute (and >most do) user will be signed off by the NAS if he is still logged on at >the expiration time. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 20/8/2008, "Bozhan Boiadzhiev" pi?e: > >>Hi, >>here is something i can't understand. >>If i set some user Expiration attribute for example 23.08.2008, >>and this user is connected to my NAS, how NAS will stop that user. >>Better explanation. >>I have setup mikrotik hotspot with radius authorization. >>Authorization works. User have access with given username and password, >>but i want to give user access to service for example for 7 days. >>Expiration attribute give me ability to set date when account expires. >>What happen on that give date. How radius will "tell" NAS to "unsubscribe"(cancel) >>access of that user. >> >>Thanks >> >>ps. >>sorry for bad english :( >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1

Re: performance report?
by Kevin J 20 Aug '08

20 Aug '08

Well, that's why I am saying we used the nas simulation tool. We can hammer a lot of traffic with this multi-threaded tool and also we tried at least three client boxes so don't assume our traffic was not enough. ----- Original Message ---- From: Anders Holm <anders.holm(a)sysadmin.ie> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, August 20, 2008 12:25:19 PM Subject: Re: performance report? Re: performance report? It is not likely your actually putting too much strain on the server side. You’ll need quite a lot of machines hammering the RADIUS server before it’ll break into a sweat. The client side would have higher CPU utilization then the server side, per request. Comparing one program to another is not exactly comparing apples with apples. It’s more like comparing a duck with a fork lift. One flies, the other just doesn’t (or rather, when it does, you don’t want to be there to see it) ... //anders On 20/08/2008 20:18, "Kevin J" <kevinsmailer(a)yahoo.com> wrote: Does anybody know the performance on Sun T-1000? Just noticed that radius cannot reach more than 20% CPU time when we ran a heavy traffic with nas simulations. We have tested some other programs and could reach even more than 90% so just curious anybody experienced the similar result. ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

performance report?
by Kevin J 20 Aug '08

20 Aug '08

Does anybody know the performance on Sun T-1000? Just noticed that radius cannot reach more than 20% CPU time when we ran a heavy traffic with nas simulations. We have tested some other programs and could reach even more than 90% so just curious anybody experienced the similar result.

2 1

Certificate problem on Windows XP clinet ...
by Venkata LK Mula 20 Aug '08

20 Aug '08

Hi, Regarding the above mentioned subject, we are facing the problem of "Windows was unable to find the certificate to log on to the network Roaming test2". Though the certificates are installed properly, and when we are using the same certificates for 'PEAP-MSCHAPv2' with 'validate server certificate' working fine. Can any one look into the same and respond me back please. regards, Venkat

1 0

Extend the ca certificates expire date
by Johan Nyman 20 Aug '08

20 Aug '08

Hello All, Can I extend the expire days for the CA certificate (ca.cnf) ? And if possible how long can I extend it as maximum? Right now the ca certificate´s maximum days are 30. Best regards, Johan Nyman

2 1

expiration or session-timeot
by Bozhan Boiadzhiev 20 Aug '08

20 Aug '08

Hi, here is something i can't understand. If i set some user Expiration attribute for example 23.08.2008, and this user is connected to my NAS, how NAS will stop that user. Better explanation. I have setup mikrotik hotspot with radius authorization. Authorization works. User have access with given username and password, but i want to give user access to service for example for 7 days. Expiration attribute give me ability to set date when account expires. What happen on that give date. How radius will "tell" NAS to "unsubscribe"(cancel) access of that user. Thanks ps. sorry for bad english :(

2 1

Mikrotik as NAS with PPPoE - checkval
by Maciej Drobniuch 20 Aug '08

20 Aug '08

Hi! I want to bind a login with Calling-Station-Id but i've got problems... *I've had added the Calling-Station-Id to mysql radcheck table. *I've had turned on the rlm_checkval by adding it into authorize section *I've had set the notfound-reject variable to yes I get the following errors in debug: rlm_checkval: Item Name: Calling-Station-Id, Value: 00:11:22:33:44:55 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound What is the problem? Please help! Thanks for all!!! -- ------------------------ Maciej Drobniuch

4 6

Problems with EAP and LDAP replyItems (2.0.2)
by tschaos＠gmx.net 20 Aug '08

20 Aug '08

Hi Guys, Since freeradius2 has some major improvements I try to upgrade from 1.1.4. Unfortunately there are a few problems i encounter: cause of some weird reason the server isn't sending back my LDAP replyItems back to the NAS along the Access-Accept packet. In short i want to authenticate using EAP/PEAP against the server, which itself checks against our LDAP Server. Additionally the server should also send back a specific replyItem stored in our LDAP. configuration looks like: authorize { preprocess eap { ok = return } ldap1 } authenticate { Auth-Type MS-CHAP { mschap } eap } in ldap.attrmap the following is configured: replyItem Airespace-Interface-Name radiusCallingStationId so LDAP-Attribute radiusCallingStationId should be transformed to an attribute called "Airespace-Interface-Name" and sent back to the NAS. As you can see in the following debug-output, at the beginning the server sends the attribute back as supposed, but for some weird reason in the access-accept packet the attribute isnt sent along. whats wrong here? Thanks in advance! debug-output: ------------------------------------------------ rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=237, length=182 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x0202000d0173737065726c3232 Message-Authenticator = 0x1c08d8491b0ebb2a032ab1ebb8f7ee59 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 2 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser expand: (|(uid=%u)(uid=%U)) -> (|(uid=testuser)(uid=_)) expand: dc=mydomain,dc=ac,dc=at -> dc=mydomain,dc=ac,dc=at rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.mydomain.com:389, authentication 0 rlm_ldap: bind as uid=service-user,ou=services,dc=mydomain,dc=ac,dc=at/passme to ldap.mydomain.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=ac,dc=at, with filter (|(uid=testuser)(uid=_)) rlm_ldap: Added User-Password = testpwd in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusCallingStationId as RADIUS attribute Airespace-Interface-Name = "599" rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap1] returns ok rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 237 to 10.110.101.4 port 32770 Airespace-Interface-Name = "599" EAP-Message = 0x0103001604104f56bcec8ceb0ba608af483ccb4111c9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046233b6000c0bb076d000b26f5e Finished request 0. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=238, length=193 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020300060319 State = 0x33b5046233b6000c0bb076d000b26f5e Message-Authenticator = 0xae7227a437741cee122a96438eb2b8c6 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser expand: (|(uid=%u)(uid=%U)) -> (|(uid=testuser)(uid=_)) expand: dc=mydomain,dc=ac,dc=at -> dc=mydomain,dc=ac,dc=at rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mydomain,dc=ac,dc=at, with filter (|(uid=testuser)(uid=_)) rlm_ldap: Added User-Password = testpwd in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusCallingStationId as RADIUS attribute Airespace-Interface-Name = "599" rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap1] returns ok rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 238 to 10.110.101.4 port 32770 Airespace-Interface-Name = "599" EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046232b11d0c0bb076d000b26f5e Finished request 1. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=239, length=299 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x0204007019800000006616030100610100005d030148aae3779ae468378b1a02b18a52c5e4aa225f2ea4fa778c7009ade24c04b71e209f4e050b6b3628bc21070999a9b287dd582f514b37e0dd5cdcf9544d19214cca001600040005000a000900640062000300060013001200630100 State = 0x33b5046232b11d0c0bb076d000b26f5e Message-Authenticator = 0x7fe6f515212a742a05072553d45829f1 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 4 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085f], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 239 to 10.110.101.4 port 32770 EAP-Message = 0x0105040019c0000008bc160301004a02000046030148aae37d9c530e8b159ab7521d53d58b44eacaa5ead88c1de2ec18d5bacbf3bb20d8d13f1f14119a30919cd5b9769b22a4fbe7bb65902a16cae2bfa7003cd17cbc000400160301085f0b00085b00085800040c30820408308202f0a003020102020b0100000000010cfd027957300d06092a864886f70d0101050500305f310b300906035504061302424531133011060355040a130a4379626572747275737431173015060355040b130e456475636174696f6e616c20434131223020060355040313194379626572747275737420456475636174696f6e616c204341301e170d30363038313131 EAP-Message = 0x31333335335a170d3039303831313131333335335a3081b3310b3009060355040613024154310f300d060355040813065669656e6e61310f300d060355040713065669656e6e6131273025060355040a131e4d6564697a696e697363686520556e69766572736974616574205769656e310d300b060355040b130449545343312230200603550403131972616469757330312e6d6564756e697769656e2e61632e61743126302406092a864886f70d01090116177a6572746973406d6564756e697769656e2e61632e617430819f300d06092a864886f70d010101050003818d0030818902818100b218141a141f5ee1a7193e39ff21e19b635216e6ff EAP-Message = 0x8b3ecc95ee385b9427b118ce553f672b6574934621e236b74564094c57aa5c8e913277a712fc7234bcfc653f8a6998dde35022801e86aa4dcb6fe045e31f068ff4f65a4283093e064cca5c4a959a3d53f10365fc567a205e3df20e2c30f834d8c0ab28c07da4ec233b5a770203010001a381f33081f0300e0603551d0f0101ff0404030205a0301f0603551d230418301680146565a33dd73b11a30a072537c9424a5b767750e1301d0603551d0e041604145766eed4ad9de4c3622af482419e6f6d9a688bde303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f656475636174696f6e61 EAP-Message = 0x6c2e63726c304f06082b0601050507010104433041303f06082b060105050730028633687474703a2f2f7365637572652e676c6f62616c7369676e2e6e65742f6361636572742f656475636174696f6e616c2e637274301106096086480186f84201010404030206c0300d06092a864886f70d010105050003820101007d4d6f5c88760278e3d5c8d61704bf3366a7c4a3cb8b32796336751dfe3dafe1e433863f217aee63a3cafe34f44184282b62c6f5eac2de6c410ded98d2f72a2f108fb7780d5a3693da8b1e8169c9927ab649c5ae99cc1d66bac0bec02783f1ed34039783cd8039611bf0350f820dc2d00f4fc1975fe81ec1887d1731b6ebc9c3 EAP-Message = 0xd4b1a042429ceeafabf4d426 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046231b01d0c0bb076d000b26f5e Finished request 2. Going to the next request Waking up in 0.5 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=240, length=193 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020500061900 State = 0x33b5046231b01d0c0bb076d000b26f5e Message-Authenticator = 0x6ec4abd5178e006e61f2d81062fb224b +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 5 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 240 to 10.110.101.4 port 32770 EAP-Message = 0x010603fc194021684b7ee37f14ef584d748d3986b6838870b45c203c1281e3925d0e47db367cf132543d984f488f46fc6dadccaabe6c8386a64085b61289e343ec59a31bdddb2e79bf81621616cdfcbcaf49123ccdb267a1e167a65996d256a96c1220067a4c1571f5a6785a165dde13c1409d4d6e573063a46a00044630820442308203aba0030201020204040003fb300d06092a864886f70d01010505003075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a47 EAP-Message = 0x5445204379626572547275737420476c6f62616c20526f6f74301e170d3036303331343230333030305a170d3133303331343233353930305a305f310b300906035504061302424531133011060355040a130a4379626572747275737431173015060355040b130e456475636174696f6e616c20434131223020060355040313194379626572747275737420456475636174696f6e616c20434130820122300d06092a864886f70d01010105000382010f003082010a02820101009522a1101d4a46606e05919bdf83c2ed12b25a7cf8abe1f8505c282c7e7e003893b08b4af1c24c3c102c3cefb0eca1692fb9fccc08146b8d4f18f383d2faa9370820 EAP-Message = 0xaa5caa8060a2d5a52200cf5ae5b497dfba1ebe5c8e171966fdaf9f7c7b89b20e24d8c7ab63c495328d48e663597d04b833a8bdd75d64bc63b5f74d28fdf90672315cba459465a3d2b458ec3b615844a32f62b39b80b482fdd5c7cc5125e5953f472f307bacc8786ee2e16d27eb3dcc0182e835778dab58bb55d1d5a481568d1cd014b1b006dea09122f3f0a8341747c6e03ef60c5aac7e504bcde1696e06fc067e6a4db49599a0595c3566ecd949d417e060b05da5d71ae22a6e66f2af1d0203010001a382016f3082016b30450603551d1f043e303c303aa038a0368634687474703a2f2f7777772e7075626c69632d74727573742e636f6d2f636769 EAP-Message = 0x2d62696e2f43524c2f323031382f6364702e63726c301d0603551d0e041604146565a33dd73b11a30a072537c9424a5b767750e130530603551d20044c304a304806092b06010401b13e0100303b303906082b06010505070201162d687474703a2f2f7777772e7075626c69632d74727573742e636f6d2f4350532f4f6d6e69526f6f742e68746d6c3081890603551d23048181307fa179a4773075310b300906035504061302555331183016060355040a130f47544520436f72706f726174696f6e31273025060355040b131e475445204379626572547275737420536f6c7574696f6e732c20496e632e312330210603550403131a475445204379 EAP-Message = 0x6265725472757374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046230b31d0c0bb076d000b26f5e Finished request 3. Going to the next request Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=241, length=193 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020600061900 State = 0x33b5046230b31d0c0bb076d000b26f5e Message-Authenticator = 0x6881af793ac72122f91ce70287a33857 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 241 to 10.110.101.4 port 32770 EAP-Message = 0x010700d6190020476c6f62616c20526f6f74820201a5300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100300d06092a864886f70d01010505000381810043b345835471c41fdcb23c6b4ebf26f24ef2ad9a5bfa863788e8146c4118425fef653eeb0377a0b79e757a517cbb155bb8af91a0349253ed7f2a4984acb9804bb5c7b22322fbebd8fb6ec93cf3d2d1bbbec91cff6d01db69800e99a5ea9e7b97988fb7cf229cb3b85de5a9331774c697370fb4e926825f610b3f1e3d64e92b9b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046237b21d0c0bb076d000b26f5e Finished request 4. Going to the next request Waking up in 0.1 seconds. Waking up in 0.1 seconds. Waking up in 0.3 seconds. Waking up in 0.1 seconds. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=242, length=379 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020700c01980000000b61603010086100000820080759587d78c0703551ff978fe519c321fe329bccd9b7fad1efd212fe2cda2a265f46e323fe03bde8fa22c7c98049a912b4c55dbe8f24c0bfde5635d31455b532773d5e4fff79737566de5ed9216a2497fab58c9828e488099754db828e64ee445427f27ad4aad14e914298450bf18de6e2b1f82513154bfd35ff62b454e460f341403010001011603010020b296349dc8161aaa497406f4effff2fc353d108b10e272a0a03e95a9896b1a48 State = 0x33b5046237b21d0c0bb076d000b26f5e Message-Authenticator = 0xd5307429c8e98f0c4aa87fa9b091c71d +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 7 length 192 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 182 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 242 to 10.110.101.4 port 32770 EAP-Message = 0x01080031190014030100010116030100204498dbf2c565163f7e6a26fa40eb8660016e26c757d062c77fcbf95bda412553 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046236bd1d0c0bb076d000b26f5e Finished request 5. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=243, length=193 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020800061900 State = 0x33b5046236bd1d0c0bb076d000b26f5e Message-Authenticator = 0xf55e760a0cce74d7d22592a62623d0ee +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 8 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 243 to 10.110.101.4 port 32770 EAP-Message = 0x01090020190017030100151926618b8833d6c30ea7a122e304c84ade54456822 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046235bc1d0c0bb076d000b26f5e Finished request 6. Going to the next request Waking up in 0.8 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=244, length=223 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x0209002419001703010019180323a78f7b8135a6c953f187bdffca5fa6b06c8c67df7027 State = 0x33b5046235bc1d0c0bb076d000b26f5e Message-Authenticator = 0x9b1dec6840f0b3c3b2d74fed73c20f11 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 9 length 36 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testuser PEAP: Got tunneled identity of testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testuser +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 9 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser expand: (|(uid=%u)(uid=%U)) -> (|(uid=testuser)(uid=_)) expand: dc=mydomain,dc=ac,dc=at -> dc=mydomain,dc=ac,dc=at rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mydomain,dc=ac,dc=at, with filter (|(uid=testuser)(uid=_)) rlm_ldap: Added User-Password = testpwd in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusCallingStationId as RADIUS attribute Airespace-Interface-Name = "599" rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap1] returns ok rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 244 to 10.110.101.4 port 32770 EAP-Message = 0x010a00391900170301002e5a2ea886360afe6df6b573e2443e91c54801f93fef698c7f055c07bb71659b50cae786d192f486e08e6171a3f194 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b5046234bf1d0c0bb076d000b26f5e Finished request 7. Going to the next request Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=245, length=277 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020a005a1900170301004ff3f3ffb30ade8e919779e051585950a06e2804f6701ef53ec010c6e9e9ab369e103c6eb784d0575bd6a06d7da2e44c2d0af174ba5741c599759522c130c3311fe02969c6e4d9b52dc0d6888ec199c7 State = 0x33b5046234bf1d0c0bb076d000b26f5e Message-Authenticator = 0xaabb7129311a55137500d443e6743e86 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 10 length 90 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to testuser +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 10 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser expand: (|(uid=%u)(uid=%U)) -> (|(uid=testuser)(uid=_)) expand: dc=mydomain,dc=ac,dc=at -> dc=mydomain,dc=ac,dc=at rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mydomain,dc=ac,dc=at, with filter (|(uid=testuser)(uid=_)) rlm_ldap: Added User-Password = testpwd in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusCallingStationId as RADIUS attribute Airespace-Interface-Name = "599" rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap1] returns ok rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 245 to 10.110.101.4 port 32770 EAP-Message = 0x010b004a1900170301003fb978ce95576c24b8c9c4ed486e94f68a05ce98749d9a5b454e45f6874163e0542fe11ba1c72ccf25ddf99cf584609da7b5def8fe14a02036064d577dc835c8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b504623bbe1d0c0bb076d000b26f5e Finished request 8. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=246, length=216 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020b001d190017030100128029c36ca067214c72016b581f2a833e6f76 State = 0x33b504623bbe1d0c0bb076d000b26f5e Message-Authenticator = 0x3dfe36504d966fcdd7abcfcd39772580 +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 11 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to testuser +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser expand: (|(uid=%u)(uid=%U)) -> (|(uid=testuser)(uid=_)) expand: dc=mydomain,dc=ac,dc=at -> dc=mydomain,dc=ac,dc=at rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mydomain,dc=ac,dc=at, with filter (|(uid=testuser)(uid=_)) rlm_ldap: Added User-Password = testpwd in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusCallingStationId as RADIUS attribute Airespace-Interface-Name = "599" rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap1] returns ok rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok Login OK: [testuser/<via Auth-Type = EAP>] (from client wism port 0) PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled Sending Access-Challenge of id 246 to 10.110.101.4 port 32770 EAP-Message = 0x010c00261900170301001b0b0e7060107185be702bb1b626fafe2809eaed7d3ce4e32dc4d269 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33b504623ab91d0c0bb076d000b26f5e Finished request 9. Going to the next request Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.110.101.4 port 32770, id=247, length=225 User-Name = "testuser" Calling-Station-Id = "00-0E-35-AE-DB-DF" Called-Station-Id = "00-1A-30-2E-C9-60:wlan-test" NAS-Port = 29 NAS-IP-Address = 10.110.101.4 NAS-Identifier = "WiSM-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "995" EAP-Message = 0x020c00261900170301001bdeb9ab7c06db2649499c19ad9bce23935a0b22d50b8e76768c84fe State = 0x33b504623ab91d0c0bb076d000b26f5e Message-Authenticator = 0xec5e5f7d3cd9c702aaf2a92a72d0dd0d +- entering group authorize ++[preprocess] returns ok rlm_eap: EAP packet type response id 12 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Login OK: [testuser/<via Auth-Type = EAP>] (from client wism port 29 cli 00-0E-35-AE-DB-DF) Sending Access-Accept of id 247 to 10.110.101.4 port 32770 MS-MPPE-Recv-Key = 0x86dbea1332577adf8f730aefa33ae6fb35895997395317210fd146031f39ee43 MS-MPPE-Send-Key = 0xb4be9f7f22a1911de9c1faf3ab43ab54bda9efa245a749ef7e3ab155979f268b EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testuser" Finished request 10. Going to the next request Waking up in 0.1 seconds. Waking up in 0.1 seconds. Waking up in 0.2 seconds. Waking up in 0.1 seconds. Waking up in 0.1 seconds. Waking up in 1.2 seconds. Cleaning up request 0 ID 237 with timestamp +34 Cleaning up request 1 ID 238 with timestamp +34 Waking up in 0.3 seconds. Cleaning up request 2 ID 239 with timestamp +34 Waking up in 0.1 seconds. Cleaning up request 3 ID 240 with timestamp +34 Waking up in 0.2 seconds. Cleaning up request 4 ID 241 with timestamp +35 Waking up in 0.9 seconds. Cleaning up request 5 ID 242 with timestamp +36 Waking up in 0.1 seconds. Cleaning up request 6 ID 243 with timestamp +36 Waking up in 0.1 seconds. Cleaning up request 7 ID 244 with timestamp +36 Waking up in 0.2 seconds. Cleaning up request 8 ID 245 with timestamp +36 Waking up in 0.1 seconds. Cleaning up request 9 ID 246 with timestamp +36 Waking up in 0.2 seconds. Cleaning up request 10 ID 247 with timestamp +36 Ready to process requests. -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

3 4

Re: I've started to put the book online
by Do Nguyen Ha 20 Aug '08

20 Aug '08

its good news for everyone who love FreeRadius :) > Date: Tue, 19 Aug 2008 09:23:06 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: I've started to put the book online > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48AA74DA.6060408(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > http://deployingradius.com/book/ > > Only parts of the first chapter are online. It covers the basic > concepts behind RADIUS, and should hopefully address a number of common > misunderstandings about how it all works. > > Keep checking the site. More will be coming later. > > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 40, Issue 81 > ************************************************

2 1