September 2008 - Freeradius-Users - lists.freeradius.org

Problems with the authentication of users and certificates TLS
by Martin Silvero 03 Sep '08

03 Sep '08

alan!! and install the new version and the probe, probe with radtest and I get this: Sending Access-Request of id 236 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "testing123" NAS-IP-Address = 10.30.1.104 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=236, length=20 its ok but... radiusd -X run and I get this:: FreeRADIUS Version 2.0.5, for host x86_64-unknown-linux-gnu, built on Sep 3 2008 at 17:32:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client 10.0.6.29 { require_message_authenticator = no secret = "testing123" shortname = "ap" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Generating a 2048 bit RSA private key ........................................................................................................................................................................................................................................................................................................+++ .....+++ unable to write 'random state' writing new private key to 'ca.key' ----- Generating a 2048 bit RSA private key .......+++ ..................................+++ unable to write 'random state' writing new private key to 'server.key' ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Sep 3 20:51:16 2008 GMT Not After : Sep 3 20:51:16 2009 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Sep 3 20:51:16 2009 GMT (365 days) Write out database with 1 new entries Data Base Updated unable to write 'random state' unable to write 'random state' MAC verified OK Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time *****************************+*************************+****************************** ... unable to write 'random state' Exec-Program output: openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl dhparam -out dh 1024 Exec-Program-Wait: plaintext: openssl req -new -x509 -keyout ca.key -out ca.pem -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl dhparam -out dh 1024 Exec-Program: returned: 0 Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 ERROR: Failed to open socket: cannot bind socket: Address already in use /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 0.0.0.0port 1812 ¿a que se debe este error? Why is this wrong?

2 1

Problems with the authentication of users and certificates TLS
by Martin Silvero 03 Sep '08

03 Sep '08

ouch!! mmmm ok, change the version and started again :S Like thank you very much! -- -- Silvero Martin

2 1

Problems with the authentication of users and certificates TLS
by Martin Silvero 03 Sep '08

03 Sep '08

Good morning everyone! Well, I have progressed a bit in the installation of RADIUS EAP TLS. what I did was install the version FreeRADIUS-1.0.4.tar.gz on my server, configure the client (AP) and modules to work with eap tls, probe with "radtest" and the response was: Sending Access-Request of id 240 to 127.0.0.1:1812 User-Name = "test" User-Password = "testing123" NAS-IP-Address = radius NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=240, length=20 by what I see this perfec! my problem is that I already have everything set up, including the AP and try to connect with a notebook but, first, the SSID of the notebook is not if but listed under the name hidden, when I want to connect asks me to configure the profile of the connection, but it set the connection fails. to consider: -configure a local user on the server - + EAP TLS is handled with certificates, and I do not install any certificate or touch any folder and cert / I have this: -rw-r--r-- 1 root root 721 Aug 20 15:44 cert-clt.der -rw-r--r-- 1 root root 1741 Aug 20 15:44 cert-clt.p12 -rw-r--r-- 1 root root 2452 Aug 20 15:44 cert-clt.pem -rw-r--r-- 1 root root 717 Aug 20 15:44 cert-srv.der -rw-r--r-- 1 root root 1733 Aug 20 15:44 cert-srv.p12 -rw-r--r-- 1 root root 2439 Aug 20 15:44 cert-srv.pem drwxr-xr-x 2 root root 4096 Aug 20 15:44 demoCA -rw-r--r-- 1 root root 0 Aug 20 15:44 dh -rw-r--r-- 1 root root 2913 Aug 20 15:44 newcert.pem -rw-r--r-- 1 root root 1753 Aug 20 15:44 newreq.pem -rw-r--r-- 1 root root 1024 Aug 20 15:44 random -rw-r--r-- 1 root root 431 Aug 20 15:44 README -rw-r--r-- 1 root root 954 Aug 20 15:44 root.der -rw-r--r-- 1 root root 1973 Aug 20 15:44 root.p12 -rw-r--r-- 1 root root 2764 Aug 20 15:44 root.pem should they have to install certificates is not what (I Wxp service pack 3) they occur any idea? -- -- Silvero Martin

2 1

Freeradius - pairing users with clients.
by Michał Iwaszko 03 Sep '08

03 Sep '08

Hello. Is it possible to pair users with clients? I wan't to authenticate users on one RADIUS server for different services and "set up permissions", that certain client (that the user is connecting to) can only authenticate users for example with certain Auth-Type, so it will not be possible to access the service using different Auth-Type users (but with the same username). Is that doable? -- Pozdrawiam, Michał Iwaszko

2 1

ippool
by Alexandre Chapellon 03 Sep '08

03 Sep '08

Hi again, Looking at freeradius online doc, i saw that sqlippool requires transmission of interim-updates packets to the accounting server to "function correctly" (http://wiki.freeradius.org/Rlm_sqlippool#Important_Info) I what would like to use sqlippool to manage ip allocation of framed-users, but my NASes doesn't send me Interim packets. What issue may I face using sqlippool anyway? Is there a workaround? Does thius requirement still exists with ippool module? regards.

2 1

Realm delimiter characters
by Nemec Christopher 02 Sep '08

02 Sep '08

Hello list! Currently my installation of freeradius 2.0.5 only listens to realms including the "@" character. This seems to be the default behaviour; so far, so good. Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } However, I would like the rlm_realm module also to process prefixes. I know I need to configure the rlm_realm module in a way just like the following: realm prefix { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } Question: WHERE does this configuration go? I have not found any suitable configuration file. According to an outdated info in the wiki, this information is supposed to be made in the radiusd.conf ... but this information is no longer valid for version 2.0.5. Any help? Thank you! Christopher ------------------------------------------------------------------------------------- DI (FH) Nemec Christopher Österreichische Lotterien Ges.m.b.H., Rennweg 44, 1038 Wien, Österreich Netzwerk Management Telefon: +43 (1) 790 70-5567, Fax: +43 (1) 790 72-5567 ------------------------------------------------------------------------------------- Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706

5 8

GnuTLS support?
by Greg 02 Sep '08

02 Sep '08

Hi all, Are there still plans to add in GnuTLS support for freeradius, or have those died? I looked through the mail archives and found references to people wanting to do it in 2003 and 2006, against pre-2.0 code, and wondered if things had changed (either in freeradius or gnutls) to make it more or less likely. I'm a Debian user caught by their licensing trap, and I hateses compiling and revisioning one-off packages for something so simple. Thanks for your time. -Greg

3 3

sql table
by Alexandre Chapellon 02 Sep '08

02 Sep '08

Hy all, I have an oracle database storing authentication information for thousounds of differents users. This database is of course, not compliant at all with freeradius requirements (users file like). What is the best practice to make it work. I have many attributes to manage in checks as well in replys, such as simultaneous-use, counters, ippools, session-timeout,traffic-limit etc... I though using views to achieve compliance with freeradius tables specs, but maybe there is a better solution. Of course, the database structure cannot be changed.!

2 1

radact into sql
by Przemysław Backiel 02 Sep '08

02 Sep '08

hello, I have one small problem, and I am not sure.. I had a FreeRadius 1.0.x and there I had a loging radact into SQL now I have freeradius-1.1.0-6.amd64 and everything is working fine, but I have radact empty :( I think, that I should add accounting { detail sql } and I will have radact logs in file and in SQL - is that correct? or I have to change some more parameters? -- Z powazaniem Przemyslaw Backiel

2 1

EAP-Message help
by Ahmet DÜLGAR 02 Sep '08

02 Sep '08

hi,iam using fedora 9 and freeradius 2.0.5 i am new at freeradiusi configured freeradius by using wiki.freeradius.com howto wpaand mysql connectineverting is ok when test with radtest or NTRadPing it is workingthen i create certificates by using make/etc/raddb/certs/makethen configure eap.conf filefor the file pathswhen i try to connect with phonehp ipaq514 voice messenger with windows mobile 6 standartit doesntthe log is abovethanks for replybest regards Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=2, length=75 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000a016672656466 NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0x09b6f0b9f8e49b359324c6b6615b1f3c+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns no! op rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop expand: %{User-Name} -> fredfrlm_sql (sql): sql_set_user escaped user --> 'fredf'rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'fredf' ORDER BY idrlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '! fredf' ORDER BY id expand: SELECT groupname FROM r adusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'fredf' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): User found in group dynamic expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): Released sql socket id: 4++[sql] returns ok++[expiration] returns noop++[logintime] returns nooprlm_pap: Found existing Auth-Type, not c! hanging it.++[pap] returns noop rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2rlm_eap_mschapv2: Issuing Challenge++[eap] returns handledSending Access-Challenge of id 2 to 88.232.68.198 port 1812 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 EAP-Message = 0x0102001f1a0102001a10b40f694adee6b04256901467c86cedbe6672656466 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7151f7a949d0adc7c3820393aFinished request 0.Going to the next requestWaking up in 4.9 seconds.Cleaning up request 0 ID 2 with timestamp +70Ready to process requests.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=3, length=89 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 State = 0x151d60e7151f7a949d0adc7c3820393a NAS-IP-Address = 88.232.68.198 Messa! ge-Authenticator = 0xc6b21f00eff9aef963a78417171ca381+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop expand: %{User-Name} -> fredfrlm_sql (sql): sql_set_user escaped user --> 'fredf'rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'fredf' ORDER BY idrlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username! , attribute, value, op FROM radreply WHERE username = 'fredf' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'fredf' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY idrlm_sql (sql): User found in group dynamic expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY idrlm_s! ql (sql): Released sql socket id: 3++[sql] returns ok++[expiration] re turns noop++[logintime] returns nooprlm_pap: Found existing Auth-Type, not changing it.++[pap] returns noop rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1++[eap] returns handledSending Access-Challenge of id 3 to 88.232.68.198 port 1812 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7141e79949d0adc7c3820393aFinished request 1.Going to the next requestWaking up in 4.9 seconds.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=4, length=161 User-Name = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203004e198000000044160301003f0100003b0! 301bcebeb91ed9bd986a195dfa0781baed40e796a4871993c1a42feee06af7ea3f2000014002f003500040005000a000900640062000300060100 State = 0x151d60e7141e79949d0adc7c3820393a NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0xae29ddd04e13e00cacdff162e56eea29+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 78 rlm_eap: Continuing tunnel setup.++[eap] returns ok rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 68rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tl! s: <<< TLS 1.0 Handshake [length 003f], ClientHello TLS_accept: S SLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate AIn SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED++[eap] returns handledSending Access-Challenge of id 4 to 88.232.68.198 port 1812 EAP-Message = 0x0104040019c0000008bb160301004a02000046030148bd4d107d305bb340e906e9227e66b88f083da3b498fac401412546ce31f3e020adff87a7dfe367a6cb0458cfbbb47509c0dec990fbaeffda8550531f4477de22002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d06035504081306526164697! 5733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303832393135343335315a170d3039303832393135343335315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c8724bd3d2f8cba9064070ab59fd1da710b93549b417644dc713593bc315 EAP-Message = 0xc6ba9db08a4da00aaf0cf7d9d222022863c37f448b78f92ef83c6d41a2771077012b44d8fcc5ddbaa0b7fffe948f0740fb1e24be23c673fb880d2f404dbe1af965196f60e147a214bc99feee7d944af93394a5cd121062d624b9abcc2bb1486aaa06aff579692e5a1b7bff8a96646c2531dc205aa7611439cb21cbf1b9cbaa27e875f32a5f3a4f81127! edec516f233b6872e70fa63960adf139f5cef9b9cb490c786ebc90971785f44860a4a9 84fd98c893710e5c52f552acb2da6f96629b7da18226632f71ff4f21e28afed4bb4eea260084732b818b85872bec32fa8fe37c355590203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100bedb2fdc9f0b7b294c9ba9d2aa41ef62bebd926e5367f307a3dcf691dd15297fed8a02f3f1cfd27286512e8f097fb94f5ce7b038cf2b7a5e9666906ae0a46c81721c70a8b0769aa1ac56573dcbcc37c897749dbe17c3fc9adc86fba01776ae9e8633e26dab5df3de503077e295f27d1fac9f0d04c2b724f5ba8e0b160652cfceb90ae3327bddffc0ae9962becbcc4ae2859d708d52400b508acfd8ec3c7c944672daeb46e0ae1f5a07926a4f14b5f1815e724973fae1dd030703801a7f58f6cd1b87c8507e8d70bf104e7230d03cb49cfa11a6b1c30dca1ace6de6841e93e167e33f3f08878d EAP-Message = 0x40cfb1207782f80db36bf525 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7171979949d0adc7c3820393aFinished request 2.Going to the next requestWaking up in 4.7 seconds.rad_recv: Access-Request packet from host 88.232.68.198 port 1812, id=5, length=89 User-Name ! = "fredf" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 State = 0x151d60e7171979949d0adc7c3820393a NAS-IP-Address = 88.232.68.198 Message-Authenticator = 0x6895d55d69b15f1217c98df49dc9f7bb+- entering group authorize++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop rlm_realm: No '@' in User-Name = "fredf", looking up realm NULL rlm_realm: No such realm "NULL"++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup.++[eap] returns ok rad_check_password: Found Auth-Type EAPauth: type "EAP"+- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLSrlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED++[eap] returns handledSendin! g Access-Challenge of id 5 to 88.232.68.198 port 1812 EAP-Message = 0x 010503fc1940afffeff3ca66f8c0d7ebff0ad54c0004ab308204a73082038fa003020102020900c2ea1bc473e970d6300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303832393135343335315a170d3038303932383135343335315a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d476404929c0754b9c2e6383b2ecc21a51da896284fb791574b777126060dc9f48d5ea73ebf5f3ac22b3feffbc2e711524d59a62e9ddb67c9cf877! b6da5319d92222baa46f5a87e5d1e49f0eab077c EAP-Message = 0x332d9e414225e89ea4b649b314946ca4768d3a7b512904a4e306055271a72c99fb11990c268a276e7ee4f14592e0ba5a43378cf8a6634b1d683306ce3942516c0e42e65530ff68c82b274f9db29ae2f1ce849144f41f8814413796c85bfe1847b762d566c4caeb8a49632ba75891509498c39b9bb6465cbc65cc4da7f7c61ca2c6854a36042733a832f787b54f8575e0a78e99f6ae9ae345a86669f7bfbeb0e51d915a56ce535c13855ca7c0d590214d910203010001a381fb3081f8301d0603551d0e041604145ed3fe386bcbd98a1b39d274a83c63fbd1d0e8543081c80603551d230481c03081bd80145ed3fe386bcbd98a1b39d274a83c63fbd1d0 EAP-Message = 0xe854a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900c2ea1bc473e970d6300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010043! d24f57da27341993923c32e4d20a629033d989264f9dd2e30b0ebf7b24e536763ca531 1a3b0c1f8b8e126e32ceacd38fab EAP-Message = 0x9b46ebf107121ea6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151d60e7161879949d0adc7c3820393aFinished request 3.Going to the next requestWaking up in 4.3 seconds.Cleaning up request 1 ID 3 with timestamp +100Waking up in 0.2 seconds.Cleaning up request 2 ID 4 with timestamp +100Waking up in 0.3 seconds.Cleaning up request 3 ID 5 with timestamp +100Ready to process requests. Tamamıyla yeni Windows Live Messenger ailesine katıl Buraya tıkla! _________________________________________________________________ Yeni nesil Windows Live Services'ı ücretsiz edinin. http://get.live.com

1 0