April 2009 - Freeradius-Users - lists.freeradius.org

freeradius upgrade help
by ramesh p 01 May '09

01 May '09

Appreciate if some one can please forward any docs/details about the upgrade from old freeradius version 1.1.6 to 2.1.4 in linux. Thanks, Ramesh.

4 4

Debug log not logging date/time/epoch
by John Horne 30 Apr '09

30 Apr '09

Hello, Not sure if this is a simple request or not. I am currently running FreeRadius 2.0.5 in debug mode ('-X') and recording all the output into a log file. The problem is the debug output seems to show no indication of the date/time (or epoch time) at all. I'm trying to track down a local problem, and have users telling me when the problem occurs, but without the date/time being logged I am not getting too far. Is it possible to get FR to log the date/time or epoch time when using '-X'? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 587001

2 2

automated response
by Olaf Becker 30 Apr '09

30 Apr '09

Dear Sender, Thank you for your email. I will be out of the office until 17/05/2009. For help with general issues, please contact our Data Center Team in Frankfurt am Main Germany. Regards, Olaf Becker Teamleader IT Security & Network Celebrating 20 Years of Hotel Distribution Excellence Trust International Hotel Reservation Services Inc 1155 South Semoran Blvd. Suite 1129 Winter Park, FL 32792 http://www.trustinternational.com Place of business: Frankfurt am Main, Germany Register Information: AG Frankfurt am Main HRB 30120 Managing Directors: Richard Wiegmann TRUST International Latest Reservation and Distribution Technology for Your Success Please see our disclaimer via link http://www.trustinternational.com/tr/emailattachmentpolicy.htm

1 0

Error after installation
by Xiaochen Jing 30 Apr '09

30 Apr '09

Hello, I newly installed 2.1.4. When I want to run radiusd -X, I get an error saying "radiusd: error while loading shared libraries: libfreeradius-radius-2.1.5.so: cannot open shared object file: No such file or directory" I double checked, libfreeradius-radius-2.1.5.so and other lib files are indeed located in /usr/local/lib. And I notice that lib version (2.1.5) is different than freeradius version (2.1.4). Is that why I am having the error while running radius -X Now I am going through ./configure and trying to any error message. But does anyone know why this happens? Thanks in advance XJ

2 2

help in radius
by Basant Agarwal 30 Apr '09

30 Apr '09

Hello, I am installing freeradius .it is showing the error Undefined symbol "cbtls_password" . what is the problem ..?? i have installed openssl by apt-get install openssl. /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Failed to link EAP-Type/tls: /usr/local/lib/rlm_eap_tls-1.1.1.so: Undefined symbol "cbtls_password" radiusd.conf[9]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section.

1 0

rlm_perl DBI problems
by Александр Косых 29 Apr '09

29 Apr '09

hi I have some problem with perl module in freeradius There are an errors after that radius is fall down Tue Apr 28 19:23:07 2009 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/processing.pl , func = reject_log exit status= Undefined subroutine &DBD::mysql::dr::reject_log called at /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/mysql.pm line 142. Tue Apr 28 19:45:41 2009 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/processing.pl , func = reject_log exit status= Undefined subroutine &DBD::mysql::dr::reject_log called at /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/mysql.pm line 142. Wed Apr 29 15:11:52 2009 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/processing.pl , func = reject_log exit status= Undefined subroutine &DBI::Const::GetInfo::ODBC::reject_log called at /usr/local/lib/perl5/site_perl/5.8.9/mach/DBI/Const/GetInfo/ODBC.pm line 1337. Here is a processing.pl use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; my $username; my $debug = '1'; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ sub reject_log { # # -- function to log rejected users in xml format # $username = $RAD_REQUEST{'User-Name'}; $username =~ s/[^a-zA-Z0-9_-]//g; &radiusd::radlog(1, "DEBUG reject_log: RAD_REQUEST User-Name: ".$RAD_REQUEST{'User-Name'}) if $debug; &radiusd::radlog(1, "DEBUG reject_log: UserName: ".$username) if $debug; my $textlog; # /* !!! Don't comment this line !!! */ # Uncomment next line for text log readable from unix console (by default log in xml) # $textlog = '1'; # Log file my $logfile = '/var/log/radreject.log' if $textlog; my $logfilexml = '/var/log/radreject.xml'; open (LOG, ">>$logfile") or $RAD_REPLY{'Module-Failure-Message'} = "rlm_rejectlog: Can't open logfile." if $textlog; open (LOGXML, ">>$logfilexml") or $RAD_REPLY{'Module-Failure-Message'} = "rlm_rejectlog: Can't open xml logfile." and return RLM_MODULE_FAIL; my $now = localtime; if ($RAD_REQUEST{'Module-Failure-Message'} eq "rlm_chap: Wrong user password") { print LOG $now. " Password incorrect [ ". $RAD_REQUEST{'User-Name'} ." ]. (from ". $RAD_REQUEST{'NAS-IP-Address'} ." client ". $RAD_REQUEST{'Calling-Station-Id'} .")\n" if $textlog; print LOGXML "<date>". $now ."</date><message>Password incorrect</message><login>". $RAD_REQUEST{'User-Name'} ."</login><nas>". $RAD_REQUEST{'NAS-IP-Address'} ."</nas><cli_mac>". $RAD_REQUEST{'Calling-Station-Id'} ."</cli_mac>\n"; } elsif($RAD_REQUEST{'Module-Failure-Message'} eq "rlm_chap: Clear text password not available") { print LOG $now. " Login incorrect [ ". $RAD_REQUEST{'User-Name'} ." ]. (from ". $RAD_REQUEST{'NAS-IP-Address'} ." client ". $RAD_REQUEST{'Calling-Station-Id'} .")\n" if $textlog; print LOGXML "<date>". $now ."</date><message>Login incorrect</message><login>". $RAD_REQUEST{'User-Name'} ."</login><nas>". $RAD_REQUEST{'NAS-IP-Address'} ."</nas><cli_mac>". $RAD_REQUEST{'Calling-Station-Id'} ."</cli_mac>\n"; } else { close LOGXML; close LOG if $textlog; return RLM_MODULE_NOOP; } close LOGXML; close LOG if $textlog; return RLM_MODULE_UPDATED; } sub post_auth { # # -- this function add attributes to reply # use DBI; use Time::HiRes qw(usleep); my $dblogin = 'radius'; my $dbpass = 'secret'; my $dbname = 'RADDB'; my $dbh = DBI->connect("dbi:mysql:dbname=$dbname","$dblogin","$dbpass",{PrintError => 0}) or &radiusd::radlog(1, "DEBUG post_auth: DBI error: ".$DBI::errstr) if $debug; if ($DBI::err != 0) { usleep(100000); $RAD_REPLY {'Reply-Message'} = "Error connecting to database."; return RLM_MODULE_FAIL; } $username = $RAD_REQUEST{'User-Name'}; $username =~ s/[^a-zA-Z0-9_-]//g; &radiusd::radlog(1, "DEBUG post_auth: RAD_REQUEST User-Name: ".$RAD_REQUEST{'User-Name'}) if $debug; &radiusd::radlog(1, "DEBUG post_auth: UserName: ".$username) if $debug; my $query = "CALL rad_reply('".$username."')"; my $sth = $dbh->prepare($query); my $rv = $sth->execute(); &radiusd::radlog(1, "DEBUG: query error: ".$sth->errstr) if $debug; if (!defined $rv) { usleep(100000); $RAD_REPLY {'Reply-Message'} = "Error executing SQL query."; # # # -- why db disconnect don't work in next line? It's say that db connect already closed # # # $dbh->disconnect(); return RLM_MODULE_FAIL; } my $attr_hash = $sth->fetchrow_hashref(); if ($attr_hash->{is_blocked} == '0'){ $RAD_REPLY {'Filter-Id'} = 'allow'; } $RAD_REPLY {'Framed-IP-Address'} = $attr_hash->{ip}; $RAD_REPLY {'Framed-IP-Netmask'} = '255.255.255.255'; if ($attr_hash->{attr} ne 'NULL'){ $RAD_REPLY {'Mikrotik-Rate-Limit'} = $attr_hash->{attr}; } $RAD_REPLY {'Session-Timeout'} = '86400'; # # -- here is the same - don't work L # # $dbh->disconnect; return RLM_MODULE_UPDATED; } Other files raddb/modules/rejectlog # # This module made for loggin reject radius answers # using perl function reject_log # perl rejectlog { module = /usr/local/etc/raddb/rejectlog.pl func_post_auth = reject_log } raddb/sites-enable/my-site : post-auth { Post-Auth-Type REJECT { attr_filter.access_reject # # Log failed logins to xml log file or to unix log. # rejectlog } # Perl perl } : Radiusd work fine a little time - an hour or an 2-3 hours but then its fall What can I do with that errors?

1 0

Help with Freeradius + OpenLDAP/Samba + 802.1x WLan auth for Windows
by Albrecht Dreß 29 Apr '09

29 Apr '09

Hi, sorry if my question is really dumb; I'm new to the list... I run Freeradius 1.1.7 on a Ubuntu 8.04 LTS/x86_64 box, and want to have the following: - Win XP WLan clients authenticate at an WLan access point with 802.1x; - the access points talks to the Freeradius server; - the user database is in OpenLDAP with the Samba schema, which Freeradius shall check; - every user who can authenticate properly shall get access. I am now at a point where Freeradius picks up the requests and authorises the user against ldap, but then eap authentication fails: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to kolab.lios-koeln.de:389, authentication 0 rlm_ldap: bind as [...] to [...]:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in [...], with filter (&(objectClass=inetOrgPerson)(uid=username)) rlm_ldap: Added password [...] in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "[...]" rlm_ldap: Adding sambaNTPassword as NT-Password == [...] rlm_ldap: looking for reply items in directory... rlm_ldap: user my-domain\username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Any idea what the eap error means (I do *not* have 'with_ntdomain_hack' enabled)? Does anyone have a working example configuration for the setup above (s)he could share? Thanks in advance, Albrecht.

2 2

Re: [Wimax TTLS with Alcatel - Lucent ASN GW]
by Jayanth1 29 Apr '09

29 Apr '09

Hi Thomas, I am trying to use freeradius as AAA server with ASNGW to authenticate WiMAX device. Would you be kind enough to provide details on how to configure freeradius for this? I saw that you were successful in getting it working and did not want to reinvent the wheels. Thanks a lot in advance.. Jayanth Thomas Fagart wrote: > > Hello, > > First thanks again for this new release that adds very interesting > features for debug, specially raddebug and radmin. > > Using basic setup, Freeradius successfully authenticate request coming > from CPE Wimax through ASN Alcatel GW (called WAC) using EAP/TTLS > > Fri Apr 3 01:05:10 2009 : Auth: Login OK: [00210400E0D7(a)test.fr/<via > Auth-Type = EAP>] (from client wimax port 0 cli 00-21-04-00-E0-D7) > Fri Apr 3 01:05:19 2009 : Auth: Login OK: [cpe2-lab(a)test.fr/<via > Auth-Type = mschap>] (from client wimax port 0 via TLS tunnel) > > I now have 2 issues to fill properly the access accept with correct > attribute. (This needs might be weird, but it is the way this ASN GW > works) > > 1. I would like that the outer access accept contains attributes coming > from the inner access accept > > So I tried to use the update outer.reply on post-auth section of the > inner-tunnel virtual server > > update outer.reply { > #User-Name = "%{request:User-Name}" > WiMAX-Packet-Data-Flow-Id = > "%{request:WiMAX-Packet-Data-Flow-Id}" > } > > But as I understand, you can only use "request" from the inner tunnel, > but not the attribute contained in the reply of the inner tunnel. Is > that true ? Is there a way to do that. > > To be more precise this is the reply in the inner tunnel > > Fri Apr 3 01:13:33 2009 > Packet-Type = Access-Accept > WiMAX-Packet-Data-Flow-Id = 1 > WiMAX-Service-Data-Flow-Id = 1 > WiMAX-Service-Profile-Id = 1 > WiMAX-Direction = Bi-Directional > WiMAX-QoS-Id = 1 > WiMAX-Media-Flow-Type = Robust-Browser > WiMAX-Schedule-Type = Best-Effort > WiMAX-Traffic-Priority = 0 > WiMAX-Maximum-Sustained-Traffic-Rate = 512000 > MS-CHAP2-Success = > 0xdf533d37443041423038393133393032414333353841304630414336383132453546434243364130323046 > MS-MPPE-Recv-Key = 0x1d7c9b57392b589e2849640bad969199 > MS-MPPE-Send-Key = 0x4aa107e5fa9573846af44d21c5080749 > MS-MPPE-Encryption-Policy = 0x00000001 > MS-MPPE-Encryption-Types = 0x00000006 > > and the one in the outer tunnel > > Fri Apr 3 01:13:34 2009 > Packet-Type = Access-Accept > MS-MPPE-Recv-Key = > 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395 > MS-MPPE-Send-Key = > 0x009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b > EAP-MSK = > 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b > EAP-EMSK = > 0xc5f48626093f9313c5090254ffc375d4594bf6570025a260801e4b8d0ff852167d0748bd50b27d214b0ee67c1bbe1a4395faf094a8cb56663177fa8f32586f40 > EAP-Message = 0x03f00004 > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "00210400E0D7(a)test.fr" > > > I would like the reply of the outer tunnel to contain all the Wimax > Attribute I got in the inner. > > > 2. For some weird reason again, Alcatel ASN needs to receive two times > the same attribute with differente value (Actually this > WiMAX-QoS-Descriptor (TLV Attribute)) > I guess this is not very compliant with RFC, but is there a way to send > 2 times the same attribute in the same reply. > > I've tried that but without surprise this send only the first part of > the attribute > > cpe2-lab(a)test.fr Cleartext-Password := "xxx" > WiMAX-Packet-Data-Flow-Id=1, > WiMAX-Service-Data-Flow-Id=1, > WiMAX-Service-Profile-Id=1, > WiMAX-Direction=Bi-Directional, > WiMAX-QoS-Id=01, > WiMAX-Media-Flow-Type=Robust-Browser, > WiMAX-Schedule-Type=BEST-EFFORT, > WiMAX-Traffic-Priority=0, > WiMAX-Maximum-Sustained-Traffic-Rate=512000, > WiMAX-QoS-Id=02, > WiMAX-Media-Flow-Type=Robust-Browser, > WiMAX-Schedule-Type=BEST-EFFORT, > WiMAX-Traffic-Priority=0, > WiMAX-Maximum-Sustained-Traffic-Rate=512000 > > > Maybe using perl module in the post-auth ? > > > Thanks > > Thomas Fagart > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- View this message in context: http://www.nabble.com/-Wimax-TTLS-with-Alcatel---Lucent-ASN-GW--tp22859070p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

rlm_perl authorization/authentication and %RAD_CONFIG questions
by dorkusmonkey 29 Apr '09

29 Apr '09

I am running FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, have successfully configured rlm_perl and have it working with a modified example.pl file. I have noticed that the authorize callback in example.pl gets called before the authentication callback. From http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg01706.… , this looks like this is expected behavior. I apologize if I am missing something, but shouldn't authentication come before authorization? Shouldn't those two functions be called in reverse order? Also, I would like to pass in some configuration parameters to the example.pl script. I assume that is what the %RAD_CONFIG variable is there for, but I cannot seem to get anything meaningful into that hash ( as a test, I print out all hash keys for %RAD_CONFIG whenever a callback in the example.pl is called, and all I can see is a null valued 'Auth-Type' field ). I looked briefly at the source, but nothing jumped out at me as being obviously associated with configuration values and the %RAD_CONFIG variable. I was hoping someone could tell me how to get access to configuration value pairs from the example.pl file (hopefully without parsing the files myself from within the perl script) or at the very least point me in the right direction in the source so that I can figure this out myself. Thank you, dorkusmonkey

2 1

Mac-Based auth and HP chap
by jehan procaccia 29 Apr '09

29 Apr '09

hello, I use FreeRADIUS Version 2.1.3, and I try a basic configuration from my HP procurve2650 to do Mac-based radius auth. for this I've setup a simple users file 005004B7252E Auth-Type := Local, Cleartext-Password := "005004B7252E" Tunnel-type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 15 First ,it isn't clear to me wether to user Cleartext-Password or User-Password and == ou := , and "" or no "" around the password ...!? , anyway, with Cleartext-Password it works fine with radtest at least $ radtest 005004B7252E 005004B7252E 157.159.100.55 16 secret rad_recv: Access-Accept packet from host 157.159.100.55 port 1812, id=81, length=36 Now when my HP switch tries to auth my PC which has 005004B7252E as MAC@ for it's eth0, apparently the HP sends a chap password CHAP-Password = 0x07fae6d2c08ceb00229ea664ed50056e80 with turns radius into it's chap module and fails to Authenticate :-( Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "005004B7252E" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject I'am lost. I don't know If I have to set a chap password in "users" files or anywhere else ? (how, syntax ?) or if I have to tell my HP switch not to do chap (again how ?) Thanks . details of radius -X rad_recv: Access-Request packet from host 157.159.17.138 port 1125, id=8, length=195 Framed-MTU = 1480 NAS-IP-Address = 157.159.17.138 NAS-Identifier = "Sw-C01" User-Name = "005004B7252E" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 26 NAS-Port-Type = Ethernet NAS-Port-Id = "26" Called-Station-Id = "00-1c-2e-b4-f2-66" Calling-Station-Id = "00-50-04-b7-25-2e" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x07fae6d2c08ceb00229ea664ed50056e80 Message-Authenticator = 0x4f687fe44ece7630d3470b37598b43b8 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/157.159.17.138/auth-detail-20090429 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/157.159.17.138/auth-detail-20090429 [auth_log] expand: %t -> Wed Apr 29 17:28:16 2009 ++[auth_log] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "005004B7252E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "005004B7252E" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 005004B7252E attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 8 to 157.159.17.138 port 1125 Waking up in 4.9 seconds.

4 4