March 2009 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 46, Issue 105 SOLVED - Why is groupname fieldblank in radacct
by ngwarai zed 03 Mar '09

03 Mar '09

Thanks Kalik, We changed the default sql to allow it to actually insert the grouname. 2009/2/26 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: SQLCounter configuration (Alan DeKok) > 2. Re: SQLCounter configuration (Alexander Solodukhin) > 3. Re: EAP-PEAP GTC auth_type (tnt(a)kalik.net) > 4. Re: Freeradius-Users Digest, Vol 46, Issue 102 Why is > groupname fieldblank in radacct (tnt(a)kalik.net) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 26 Feb 2009 11:03:22 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: SQLCounter configuration > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <49A668EA.40702(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > alt_ wrote: > > Can you show some examples please? I try to do like this: > > > > noresetBytecounter > > > > if (reject) { > > update reply { > > Reply-Message := "Traffic limit exceeded." > > } > > } > > > > but if noresetBytecounter return reject freeradius immediatly return > reject > > to user and do not process 'if' clause > > You need to put this in the "post-auth" section, "Reject" subsection. > See the example configuration files. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Thu, 26 Feb 2009 12:12:50 +0200 > From: "Alexander Solodukhin" <alt(a)softwarium.net> > Subject: Re: SQLCounter configuration > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <op.upyenokwqsf5os(a)demon.cris.net> > Content-Type: text/plain; format=flowed; delsp=yes; charset=koi8-r > > On Thu, 26 Feb 2009 12:03:22 +0200, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > alt_ wrote: > >> Can you show some examples please? I try to do like this: > >> > >> noresetBytecounter > >> > >> if (reject) { > >> update reply { > >> Reply-Message := "Traffic limit exceeded." > >> } > >> } > >> > >> but if noresetBytecounter return reject freeradius immediatly return > >> reject > >> to user and do not process 'if' clause > > > > You need to put this in the "post-auth" section, "Reject" subsection. > > See the example configuration files. > > > /etc/freeradius/sites-enabled/default[412]: "SQL Counter" modules aren't > allowed in 'post-auth' sections -- they have no such method. > > -- > ISP CrIS, Softwarium > > > ------------------------------ > > Message: 3 > Date: Thu, 26 Feb 2009 11:14:37 +0100 > From: <tnt(a)kalik.net> > Subject: Re: EAP-PEAP GTC auth_type > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <FwAfhIxV.1235643277.5432590.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >Great! It works perfectly. > >Other than enabling ldap in authorize and authenticate in > >inner-tunnel, I also had to change eap.conf's gtc section to auth_type > >= LDAP. > > > >This works, but it brings up another problem. Setting auth_type to > >PAP, Local, or commented out on gtc section does not work for LDAP. On > >the other hand, If I set auth_type = LDAP, PEAP-GTC with system user > >(which works if I set auth_type = PAP on gtc section) does not work. > > > >Is there a way I can authenticate with BOTH system user and LDAP using > PEAP-GTC? > >the main radiusd.conf can have multiple authorize methods available, > >right? Why does gct have to explicitly set auth_type? > > > > Leave gtc as pap. Change set_auth_type to no in ldap module > configuration. Module will then just collect the password and pass it to > pap module for authentication. It will not do "bind as user" ldap > authentication. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 4 > Date: Thu, 26 Feb 2009 11:34:28 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Freeradius-Users Digest, Vol 46, Issue 102 Why is > groupname fieldblank in radacct > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <I1ceiOfk.1235644468.0624740.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I have MySQL 5.0.67 and PostgreSQL 8.3.6 and freeRADIUS 2.17 installed on > >GNU/Linux Fedora 10 distribution. I have identical radius databases on > both > >MySQL and PostgreSQL. When I use the PostgreSQL, the groupname field in > the > >radacct table gets filled in but when I change the database to MySQL, the > >groupname filled is blank. I checked the queries in mysql/diaup.conf and > >postgresql/dialup.conf and found out that they are the same. Why is it > >working with PostgreSQL and not working with MySQL? The groupnames are > >defined in radusergroup table. > > > > Default queries that come with the source don't write to groupname > field. MySQL or PostgreSQL. You can place Class in radgroupreply and > give it the value of the group name. Then put %{Class} into groupname > field in accounting queries. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 46, Issue 105 > ************************************************* >

1 0

Re: SAML support for freeRadius
by Stefan Winter 03 Mar '09

03 Mar '09

Hi, > Scenario 2 & 3 are close to my task. > Let me explain my scenario. > User identities are loacted in a SAML-enabled id store. > User requests are directed to a proxy. Proxy should authenticate the > user against the configured freeRaduis server. freeRadius server > should validate it against the SAML-enabled server. > Depending on the response from SAML-enabled server, radius server > accepts/rejects the user. You didn't specify in your (private! - please stick to the mailing list) reply what kind of credential the user sends in the request. Is it a password? Then we're talking about scenario 2. In which case the sad answer for you is: Sorry, this is not how SAML works. SAML doesn't transport or validate credentials. It transports assertions being made about an authentication which happened out-of-band. I.e. a SAML auth request is basically the question "Do you know if this user has succesfully authenticated to you by whatever means you used for authentication?" And the SAML response is "Yes, I know that guy. He's alright.". No passwords involved in this communication. So your user's password needs to be validated *somehow* - but not inline in SAML. You can see that in popular SAML implementations where the actual credentials are stored in $WHATEVER - quite often an LDAP/ActiveDirectory store. Authentication then happens by a user visiting the IdP's web site, entering his password there (HTTP - no SAML involved) which is then validated against that LDAP store. *Then* the IdP constructs a SAML authentication assertion *about* the authentication that just happened. In short, feeding a password into FreeRADIUS and then magically doing SAML doesn't exist. All hope is not lost, however. You can tap with FreeRADIUS onto the same backend that's also used by SAML. FreeRADIUS merrily uses LDAP stores to validate user logins. If, OTOH, the user is not supposed to send a password but rather a SAML artifact to prove that it authenticated before, and FreeRADIUS should accept the user based on him presenting the assertion, then we're talking business. In that case though, the equally sad answer is that there is no defined transport to send SAML within RADIUS. What you'd need then is a means to send SAML payloads in RADIUS attributes. The most logical way of doing so would be some kind of "EAP-SAML" - but such a thing doesn't exist as an IETF standard today. So if authenticating via SAML assertions is something you want to do - please present your use case loudly to IETF people - they might listen and get going :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

1 0

New FR server: CentOS 5 or Ubuntu 8
by Toledo, Luis Carlos 02 Mar '09

02 Mar '09

Hi all, Please accept my apologies for this complicate question. I need make a new FR server from sources with mysql support, and I have only two OS options: CentOS 5 or Ubuntu 8. I used only FreeBSD, but now I have only these two options. Any suggestions? Thx

4 3

EAP TTLS
by Kiran Kumar Balasubramanyam 02 Mar '09

02 Mar '09

Hi, I would like to test EAP TTLS with MS-CHAPv2 authentication. Can you please let me know the procedure and whether the radeapclient supports the same. Also any old traces or log files also will help. Thanks, Kiran.

2 1

Implementing Filter-Id's with MySQL
by Tawanda Kavayi 02 Mar '09

02 Mar '09

Hi, I am running a Freeradius server which queries a MySQL database (Vexim) for authentication of dial-up users. I would like to create two classes of dial-up users, Internet users and email-only users. The Intetrnet users have full Internet access while the email-only users can only access SMTP, POP and DNS services. I am using a Livingstone Portmaster 3 NAS, and will create a filter, emailonly.in to manipulate the IP traffic. My question is, how do I configure Freeradius/MySQL to add the Filter-Id attribute to email-only users and thus deny them full Internet access. Regards, Tawanda --

2 1

Implementing 'Invalid before' feature
by Santiago Balaguer García 02 Mar '09

02 Mar '09

Good morning, I am working with FR some years ago, and I have implemented a prepaid card system. I want to get an account which are not valid until some date. I am looking for some freeradius attribute which means 'account invalid until 15th march 2009'. I do not know if I have to use freeradius attributes (Expiration, Session-Terminate-Time or some other attribute) with special operator. Can someone help me to find out this freeradius feature? Thanks. _________________________________________________________________ Chatea sin límites en Messenger con la tarifa plana de Orange http://serviciosmoviles.es.msn.com/messenger/orange.aspx

2 1

Pls help: virtual server specific EAP-TTLS/PEAP inner tunnel setting
by ST Wong (ITSC) 02 Mar '09

02 Mar '09

Hi all, We got 2 problems when setting up a virtual server (testing.mydomain) to handle requests for realm @testing.mydomain: 1. we defined a new ldap server in modules/ldap and want to use it for authorization/authentication of realm @testing.mydomain, but have no idea how to use it since the ldap server defined in sites-enabled/inner-tunnel is always used. Can we define another inner-tunnel for this new virtual server? 2. seems authentication requests go through authorize section in sites-enabled/default before proxying to virtual server testing.mydomain. Can we skip this step or tell radiusd to go through authorize section other than the default one? Would anyone pls help? Thanks a lot. Best Regards, /ST Wong

2 1

SAML support for freeRadius
by krishna Mohan 02 Mar '09

02 Mar '09

Hi, I have been looking for freeradius with SAML authentication; but found nothing quite informative on this. Is there any plugin or pam module that supports communication between freeRadius and SAML protocol, like freeRadius with sql or ldap. Pls share any useful information on this. Appreciate your help. Thanks, Sri

2 1

rlm_python import error undefinde symbol
by Alexander Yu. Solodukhin 01 Mar '09

01 Mar '09

Hi all. I try to use rlm_python and got import error on importing any module that relevant on shared object. Here an rlm_python configuration: ## cut python { mod_instantiate = account func_instantiate = instantiate mod_authorize = account func_authorize = authorize mod_accounting = account func_accounting = accounting mod_preproxy = account func_preproxy = preproxy mod_postproxy = account func_postproxy = postproxy mod_postauth = account func_postauth = postauth mod_detach = account func_detach = detach } ## end cut account.py is radiusd_test.py from src/modules/rlm_python with one line added on top of file: import time 'time' is not plain python module, it is shared object found at /usr/lib/python2.5/lib-dynload/time.so After starting radius i got this error: rlm_python:python_load_function: module 'account' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /usr/lib/python2.5/lib-dynload/time.so: undefined symbol: PyExc_ValueError I was examine rlm_python code, and example 'C' code from python documentation on how to embedd python into 'C', and don't found major differences. This code works fine: #include <Python.h> int main(int argc, char *argv[]) { PyObject *pName, *pModule, *pDict, *pFunc; PyObject *pArgs, *pValue; int i; if (argc < 3) { fprintf(stderr,"Usage: call pythonfile funcname [args]\n"); return 1; } Py_Initialize(); pName = PyString_FromString(argv[1]); /* Error checking of pName left out */ Py_INCREF(pName); pModule = PyImport_Import(pName); Py_DECREF(pName); if (pModule != NULL) { pFunc = PyObject_GetAttrString(pModule, argv[2]); /* pFunc is a new reference */ if (pFunc && PyCallable_Check(pFunc)) { pArgs = PyTuple_New(argc - 3); for (i = 0; i < argc - 3; ++i) { pValue = PyInt_FromLong(atoi(argv[i + 3])); if (!pValue) { Py_DECREF(pArgs); Py_DECREF(pModule); fprintf(stderr, "Cannot convert argument\n"); return 1; } /* pValue reference stolen here: */ PyTuple_SetItem(pArgs, i, pValue); } pValue = PyObject_CallObject(pFunc, pArgs); Py_DECREF(pArgs); if (pValue != NULL) { printf("Result of call: %ld\n", PyInt_AsLong(pValue)); Py_DECREF(pValue); } else { Py_DECREF(pFunc); Py_DECREF(pModule); PyErr_Print(); fprintf(stderr,"Call failed\n"); return 1; } } else { if (PyErr_Occurred()) PyErr_Print(); fprintf(stderr, "Cannot find function \"%s\"\n", argv[2]); } Py_XDECREF(pFunc); Py_DECREF(pModule); } else { PyErr_Print(); fprintf(stderr, "Failed to load \"%s\"\n", argv[1]); return 1; } Py_Finalize(); return 0; } Compiled with: gcc call.c -o call -I/usr/include/python2.5 -L/usr/lib/python2.5/config -lpython2.5 Why this code does not through 'undefined symbol' error and rlm_python does? PS: I read mailing list before posting this question and saw that this problem was found in 2007. I try newst freeradius 2.1.3 and problem still exists. Any feedback will be great. -- ISP CrIS, Softwarium

1 1

EAP, Called-Station-Id and users file
by Cristiano Cumer 01 Mar '09

01 Mar '09

Dear list, I'm trying to configure a radius 1.14 (radiusd: FreeRADIUS Version 1.1.4, with security changes through 1.1.7 OSX Leopard Server) in such way that it doesn't authenticate users from a certain access point.. I have this entry in my users file DEFAULT Called-Station-Id =~ ".*MMP" Auth-Type := Reject from the logs I see it's being matched: users: Matched entry DEFAULT at line 220 but it has no effect on the authentication as I think (I'm a radius newbie) that EAP module is processed before the users file and the EAP module authenticates the user. I think I must process the DEFAULT Called-Station-Id =~ ".*MMP" Auth-Type := Reject before the EAP module, how can I do that ? In the hints file maybe? Thanks Cristiano rad_recv: Access-Request packet from host 192.168.2.31:2061, id=177, length=143 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00- n-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000801637269 Message-Authenticator = 0x5dbfc4d69e5f14b4a172f47575fdf842 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 0 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 177 to 192.168.2.31 port 2061 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x34c3e8f850f0bf36972e1df2a90487cd Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=178, length=297 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202009015800000008616030100810100007d030149a73723c89a6f08732f2687e4129ea4b5d0a774c90978664b86eeb2a05bbbc0202288bff5a023a17326bcbd7c54fffb96e226e27bd8b1ee5cb4c9e935bcaab9800036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x34c3e8f850f0bf36972e1df2a90487cd Message-Authenticator = 0x34083894e97ffcc560a45722a9ea0f75 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 144 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 1 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0081], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 035c], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 178 to 192.168.2.31 port 2061 EAP-Message = 0x010303c31580000003b9160301004a02000046030149a737233be77c3ca105b42a8a0d7b2484e366cecdfecd5b5aba727e1eec017120f63150f5cc916f5fd22442664f584e05f26b983b1b347a94cc3e39c2a9a921c1002f00160301035c0b0003580003550003523082034e308202b7a003020102020120300d06092a864886f70d01010405003068310b3009060355040613024954310b300906035504081302425a3110300e06035504071307426f6c7a616e6f310c300a060355040a13034d4d50310b3009060355040313026361311f301d06092a864886f70d0109011610637269737469616e6f406d6d702e6974301e170d3038303632333139 EAP-Message = 0x323232345a170d3138303632313139323232345a3063310b3009060355040613024954310b300906035504081302425a310c300a060355040a13034d4d50311d301b06035504031314787365727665312e7a656c696766696c6d2e6974311a301806092a864886f70d010901160b74656368406d6d702e697430819f300d06092a864886f70d010101050003818d0030818902818100ca15a262ecb6bbe89411dd24ea3700c03a5deb0057ce8be3dae436c049a1c3b524e60c78d1314d0c25e4bf460802e7cf2ba842b3d3d178cc94d8029e6cfe618864a97f5edb92546aea0560a4bc30009a77ef968c9a23059a66d9b242baf80c8b584e8420ba488d EAP-Message = 0x0347e112305903f10e0fe10d470a72cb9f37723c48c417cf9f0203010001a382010b3082010730090603551d1304023000301106096086480186f8420101040403020640303306096086480186f842010d042616244f70656e53534c2047656e65726174656420536572766572204365727469666963617465301d0603551d0e041604145558696c681a63dccb9f188428b4f134f9905cd63081920603551d2304818a30818780140fe9c37a309830caa1d3160ce4761381a140f07fa16ca46a3068310b3009060355040613024954310b300906035504081302425a3110300e06035504071307426f6c7a616e6f310c300a060355040a13034d4d5031 EAP-Message = 0x0b3009060355040313026361311f301d06092a864886f70d0109011610637269737469616e6f406d6d702e6974820100300d06092a864886f70d0101040500038181007cb6d0a86535805629183fe530940e285969afbd2870835982185152f6a951144a8bcaf1928e681325cf5a3804da48c60450022b059750cef706298a063a27c2991501930ca18ed9acffbde1e2872dcf7c306dda5b0d38ca752865bd9998e108128a8686d0dc55060c22029870a68755ea08fe82fa47deaff69373c5565605d716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x939aa97763146ddbdd239e658360f03e Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=179, length=361 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300d01580000000c6160301008610000082008084ee2c3608616ce6eba4d00c29044351d16e12f685ae7f3b681c6dab7d82305beee402988ed382fa4bd470c168bdc0a965a109d5c77248ac0ed4a80132dd2137ec4e6f465e3b87b652840a9a159b955a1b1295071845a7d8eb644d23035913d6d14a4e3129c2b34ae491a56023a4945687c73590065cab6655c6751556d3ce1014030100010116030100301e3574dc99e3fb202d0cab8eef90cb10d573d7cd1bf7f2293f6f60c82dacd3a7a6859bb080b5c2afc066f4f6e671b8da State = 0x939aa97763146ddbdd239e658360f03e Message-Authenticator = 0xc745a0eba4da1470bc9051537c608ae5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 2 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 179 to 192.168.2.31 port 2061 EAP-Message = 0x0104004515800000003b1403010001011603010030724efe5892209f79ab0be929e2bcbf8e8b59a64d8dcbea3802424703b09caafead87b56b4e73d613a0cbe8630d9ecf3a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9bb6f2bd09a30769727417518278b1c6 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=180, length=296 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204008f15800000008517030100800d661d7c92bd96e81b9d59d94e07128c9f7819bcf142363d1effff4c19ff685b0325afdf5ee8982c3ac3c83fc773e6405afeacb014e655072689bf86e5e81c8caf19449932f280d02c8ee99c6f454a017c9058efcb2edb73704d287d03d419f3fb411d316618c3909096fbacdd2731a2f930c9c07d9347ff468940280e0d3a50 State = 0x9bb6f2bd09a30769727417518278b1c6 Message-Authenticator = 0x9d4d0299131dca34d8fcec115e162981 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 143 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled request User-Name = "cri" MS-CHAP-Challenge = 0xaac5cd367c8c6514065b78a2565af005 MS-CHAP2-Response = 0x4b006a5d287a775c2f4ec2dc8d5ee478803400000000000000003785e19f894564ea925070dd285bb53c762f75138e04eef0 FreeRADIUS-Proxied-To = 127.0.0.1 TTLS: Sending tunneled request User-Name = "cri" MS-CHAP-Challenge = 0xaac5cd367c8c6514065b78a2565af005 MS-CHAP2-Response = 0x4b006a5d287a775c2f4ec2dc8d5ee478803400000000000000003785e19f894564ea925070dd285bb53c762f75138e04eef0 FreeRADIUS-Proxied-To = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 3 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 modcall[authorize]: module "files" returns notfound for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 3 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for cri with NT-Password rlm_mschap: No NT-Password configured. Trying DirectoryService Authentication. ?rlm_mschap:username_string = cri, shortUserName=cristianoc (length = 10) ?rlm_mschap: stepbuf server challenge:? aac5cd367c8c6514065b78a2565af005 ?rlm_mschap: stepbuf peer challenge:?? 6a5d287a775c2f4ec2dc8d5ee4788034 ?rlm_mschap stepbuf p24:?? 3785e19f894564ea925070dd285bb53c762f75138e04eef0 rlm_mschap: dsDoDirNodeAuth returns stepbuff: S=94B97D6D9ECB538F5BC19670191AA6C539961B90?<?W ??M????? (len=40) modcall[authenticate]: module "mschap" returns ok for request 3 modcall: leaving group MS-CHAP (returns ok) for request 3 Login OK: [cri/<no User-Password attribute>] (from client localhost port 0) TTLS: Got tunneled reply RADIUS code 2 MS-CHAP2-Success = 0x4b533d39344239374436443945434235333846354243313936373031393141413643353339393631423930 TTLS: Got tunneled Access-Accept TTLS: Got MS-CHAP2-Success, tunneling it to the client in a challenge. modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 180 to 192.168.2.31 port 2061 EAP-Message = 0x0105005f15800000005517030100503d6bd35427103f31bd94fa61ded8e896daedf6fe82701d2d835ce1a0877797591fe2eefb0a839ac3e8a7b5dfcc9be6f361f002c0e30308cac5867f397e5ba6aaf5920ad41e2a0bd17a3198b773a66086 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xadaf96b5d3dfb8d5cbfb414029557575 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.31:2061, id=181, length=159 User-Name = "cri" NAS-IP-Address = 192.168.2.31 NAS-Port = 0 Called-Station-Id = "00-21-29-7C-AB-7B:MMP" Calling-Station-Id = "00-19-E3-00-55-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061500 State = 0xadaf96b5d3dfb8d5cbfb414029557575 Message-Authenticator = 0x4511af0f520283314c0820b2448124b4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 hints: Matched DEFAULT at 78 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "cri", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 220 modcall[authorize]: module "files" returns ok for request 4 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 192.168.2.31 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 4 modcall: leaving group authenticate (returns ok) for request 4 Login OK: [cri/<no User-Password attribute>] (from client ap1 port 0 cli 00-19-E3-00-55-4F) Sending Access-Accept of id 181 to 192.168.2.31 port 2061 MS-MPPE-Recv-Key = 0xebfef0baec2d46597caf6ca28d858fe6f5817944f42b00e9716049bad5ed0bd5 MS-MPPE-Send-Key = 0xd23487bdcbe1da395589674f0733646244d69600d3733ff8b6e4e816334d11e5 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "cri" Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... -

3 3