May 2009 - Freeradius-Users - lists.freeradius.org

Re: question about windows users
by Bartosz Chodzinski 25 May '09

25 May '09

I am using a standard settings of eap.conf when I change eap.conf to: # default_eap_type = md5 default_eap_type = peap I have similar communicate Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.206 port 1812, id=242, length=147 NAS-IP-Address = 192.168.5.206 NAS-Port = 50046 NAS-Port-Type = Ethernet User-Name = "user_certificate" Called-Station-Id = "00-0C-30-81-9B-EE" Calling-Station-Id = "00-0A-E4-13-1A-02" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001501757365725f6365727469666963617465 Message-Authenticator = 0x4fea88a60594825de9229268206fb02d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user_certificate", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 242 to 192.168.5.206 port 1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x54cef72d54cfee66f11829ca8f9f95d7 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 242 with timestamp +37 Ready to process requests. On Wed, May 20, 2009 at 3:51 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > > [eap] processing type md5 > > rlm_eap_md5: Issuing Challenge > > Hm, you are saying you want to do EAP-TLS but your server reports that it > has got EAP-MD5 request. Check connection settings on Windows machine. > > Ivan Kalik > Kalik Informatika ISP > >

2 2

Freeradius LDAP weird login issue
by cktan 25 May '09

25 May '09

Hi all, I'm using freeradius+LDAP for the PPPoE dialup access control for a while. Lately I noticed there is weird issue whereby an user login with username as "user=5C=5C=5C=5Cuser@domain" and surprisingly freeradius allow it to login although the actual username should be "user@domain". I've run radius in -X mode and capture the log for your reference as below. In radiusd -X, we noticed server received Access-Request with username "user=5C=5C=5C=5Cuser@domain" but when reach to radius_xlat, the uid will become "user" only and when it query my LDAP the account for "user" is available and it will accept the access request. The question is why "user=5C=5C=5C=5Cuser" = "user"? We try the username with xC (i.e. 1C, 2C, 3C and so on...) and all are able to login because radius will take as user@domain. After login, the username in radacct will become "user=5C=5C=5C=5Cuser@domain" instead of "user@domain". As the consequence, the smart user may have multiple logins (by using user=1C/2C/3C....) and the records in radacct is different and therefore we will out of control for multiple login with single account. Any idea to fix this? rad_recv: Access-Request packet from host 127.0.0.1:32877, id=87, length=93 User-Name = *"user=5C=5C=5C=5Cuser@domain"* User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rlm_ldap: performing user authorization for *user=5c=5c=5c=5cuser* radius_xlat: * '(uid=user)'* Regards -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 5

Create Database/Tables -PostgreSQL
by Just E. Mail 24 May '09

24 May '09

I am trying to create pgsql database/tables for freeRADIUS. I notice that PostgreSQL has a schema for freeRADUS. Is there any procedure to create the DB/Tables from this schema or I have to type all the lines to create table manually?

4 5

Re: Re: freeRADIUS + POPTOP
by Neville 24 May '09

24 May '09

>> I've search the INTERNET for 5 days now and late into the evening, but >> I'm >> totally stumped in resolving my problem, so I would appreciate any >> guidance from the experts. I've configured as per the many guides I've >> found and have a basic understanding of how this all works, but there is >> no information anywhere on how to setup the Users / Client details for >> freeRADIUS. > > Did you try reading comments in users file and clients.conf ie. files you > were about to change? First THANKS for replying... I did, but still cannot work out what I'm doing wrong on this as there is so many guides and different ways of doing things, or thats how it seems. Everything authenticates ok and the correct IP is allocated now, but I'm not able to BROWSE any sites and cannot even ping the ip address given to the PPP adatper. I can only access the VPN, but none of the traffice seems to be routing correctly. Can you offer any further supports, please. Windows IP Configuration PPP adapter testvpn Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . . : 10.0.0.168 Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 0.0.0.0 C:\Users\Nev>ping 10.0.0.168 Pinging 10.0.0.168 with 32 bytes of data: General failure. General failure. General failure. General failure. Ping statistics for 10.0.0.168: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), ppp0 Link encap:Point-to-Point Protocol inet addr:10.0.0.1 P-t-P:10.0.0.168 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1 RX packets:3890 errors:0 dropped:0 overruns:0 frame:0 TX packets:1731 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:442107 (431.7 KiB) TX bytes:108501 (105.9 KiB) Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 10.0.0.0/24 anywhere [root log]# cat /etc/sysctl.conf # Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. # Controls IP packet forwarding net.ipv4.ip_forward = 1 [root log]# cat /proc/sys/net/ipv4/ip_forward 1 RADIUS LOG.. +- entering group post-auth {...} [test_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 127.0.0.1 0 [test_pool] MD5 on 'key' directive maps to: ee0282d57992a30bce29ea43d092ac16 [test_pool] Searching for an entry for key: 'ee0282d57992a30bce29ea43d092ac16' rlm_ippool: Allocating ip to key: 'ee0282d57992a30bce29ea43d092ac16' [test_pool] num: 1 [test_pool] Allocated ip 10.0.0.168 to client key: ee0282d57992a30bce29ea43d092ac16 ++[test_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 95 to 127.0.0.1 port 51514 Service-Type = Framed-User Session-Timeout = 65000 Framed-Protocol = PPP Framed-MTU = 1400 MS-CHAP2-Success = 0xf2533d35303143344543324435364631324646424434313043314445303236314244324642323145323238 MS-MPPE-Recv-Key = 0x39c2ccda839a57b64583b1f3a55ed07e MS-MPPE-Send-Key = 0xeaa3b2169241344554880f6e3a6f956b MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 10.0.0.168 Framed-IP-Netmask = 255.255.255.0 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 40285, id=96, length=97 Acct-Session-Id = "4A1897253C3400" User-Name = "test1" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.168 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4A1897253C3400",User-Name = "test1"' [acct_unique] Acct-Unique-Session-ID = "2855668f1c6c9940". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090524 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090524 [detail] expand: %t -> Sun May 24 00:39:01 2009 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok [test_pool] This is not an Accounting-Stop. Return NOOP. ++[test_pool] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 96 to 127.0.0.1 port 40285 Finished request 1. Cleaning up request 1 ID 96 with timestamp +56 Going to the next request Waking up in 3.0 seconds. Cleaning up request 0 ID 95 with timestamp +54 Ready to process requests. >> The problem, I'm facing is the allocation of IP address / GW / DNS by >> freeRADIUS for the VPN connections coming onto my server. >> >> my service PrivateIP address is 19x.xxx.xxx.190 >> >> I've iptables setup to forward all NAT traffic through the PRIVATEIP, but >> allocation of a GW of 10.0.0.1 and a Client IP of 10.0.0.200 >> >> However, when I connect and freeRADIUS authenticates me SUCCESSFULLY. I >> get given a IP of 192.168.2.82 from the test_pool, but pool range-start = >> 10.0.0.100 range-stop = 10.0.0.199 which is totally different to the >> address allocated by the pool. ANY IDEAS? > > Was test_pool once upon a time in 192.168.2.x range? When you change the > IP range you need to delete db files. This is clearly stated in the ippool > module ie. the file you have changed. I did not delete this, as this was the first time test_pool was used, however this proved to be the issues and I thank you for that. So it must have come in as part of the RPM.

2 1

Unable to implement huntgroups--pls help
by Parashar Singh 23 May '09

23 May '09

I want to implement huntgroup for Radius server. In this respect I want to give access to user name test1, which authenticated via LDAP, to only one NAS with IP 172.16.0.150. For this I have modified /etc/raddb/users file with following data: kmcuser Auth-Type :=LDAP, Huntgroup-Name == "kmc1" Fall-Through = Yes DEFAULT Auth-Type = LDAP Fall-Through = 1 And I have modified /etc/raddb/huntgroups file with following data: kmc1 NAS-IP-Address == 172.16.0.150 User-Name = kmcuser But It is not working, with username kmcuser, I am able to login to other NAS as well, not having IP 172.16.0.150. Please suggest some solution, Thanks

2 1

Windows XP SP2 and SP3 EAP problem part #2
by Balgansuren Batsukh 23 May '09

23 May '09

Hello, I described problem previous email. Please find attached Linksys only debug information. 1.Linksys ======== . . . rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=0, length=176 Message-Authenticator = 0x09f3d899800a95c2a2d21b4f2e627112 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090174657374 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Challenge of id 0 to 10.0.1.254 port 1076 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a0a4be65b7c70cf134208ef5 Sat May 23 06:08:18 2009 : Info: Finished request 55. Sat May 23 06:08:18 2009 : Debug: Going to the next request Sat May 23 06:08:18 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=1, length=297 Message-Authenticator = 0xcf9d263efbdfb5ab9d56e8cc7ec47b7d Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a0a4be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201007019800000006616030100610100005d03014a17224d977e6fe8bb7128bc74538c018dd274e628a268fe0a4b441267a52e7c00003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Challenge of id 1 to 10.0.1.254 port 1076 EAP-Message = 0x0102040019c000000a67160301002a0200002603014a1722524c9da49788a4d7f63597495a7101f5d24238247830bd681e7d5d3e670000390016030108180b0008140008110003903082038c30820274a003020102020101300d06092a864886f70d0101040500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d303930353232303131353138 EAP-Message = 0x5a170d3130303532323031313531385a3076310b3009060355040613024d4e310b30090603550408130255423111300f060355040a1308486f6d656e65742e312630240603550403131d54736572656e646f726a20536572766572204365727469666963617465311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d307b83ea71ed1c6ee8867dd355590ec1e9d04b2301d284eddf4983dd53bcd1fcc7d219fbacb9deb9ae5f64f1a2d660a15c7ffc995c6a9462a840d452c13676e68ebb427f3f8d4ccbb1141fdb9a6ac9d8027d17b EAP-Message = 0xfe2e02e865530ad0e174d309e79164ce2ab8df0a7c676155022f298a0014bab98b68e23a06cf939d9c6b53fab8cb7b123df2b751a700ae1b12129cd05dcc6110c8b89f9b467142874b7249ae442d1680700f96ea69f511c388f198869375b1e86af0e4320dc81e6ec5dfa88817fef561b6c69561e6200412327b72d5915c9c292eaa2f4914c0ca4a102bd1ba198aa3224e20e8c635f9b4131042955409ab565377e64b005bf7ffd6db0af64f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010015a7d2ade3e88c984c89476f7823e6e178e82374fb9716b8aaae950f1d2040 EAP-Message = 0xca57298fb83500fed0f2c3f575f86cf242cc938cac77017fd0363d7e66618fc097b2221633733ab7e6ca92c5b02a455ef00820b642cfc955226e708f237981d52f4d25f5dbe60d094a22cdc32b2d09cfa4f4f959af0487552edf4835d20109016bbde20a5b79ab4cdc124ad0d6eb269cc6b2409f7f7c7221c6f03593032d7417d946af889568ca0ac8ee94786b8e8046a7e1e2fd93e1256dc4ed5cd62282b6f2cf02c0d5875867f2869c002bac9f7a6ef27e313e44492c04faa7d320ffe47d21e46b179945379d2834b9f23d8391fc44511ab29cb87950aca10042e2ba48fd3e9c00047b308204773082035fa0030201020209008b45c0e25d2e249a30 EAP-Message = 0x0d06092a864886f70d010105 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a1a7be65b7c70cf134208ef5 Sat May 23 06:08:18 2009 : Info: Finished request 56. Sat May 23 06:08:18 2009 : Debug: Going to the next request Sat May 23 06:08:18 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=2, length=191 Message-Authenticator = 0x4dbbc0fe7dca23743b20d9a862ccf0a0 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a1a7be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Challenge of id 2 to 10.0.1.254 port 1076 EAP-Message = 0x010303fc19400500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d3039303532323031313530345a170d3130303532323031313530345a308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a8648 EAP-Message = 0x86f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f5a581f6620f0dc9f19e0eb69943d39130695d3ac1cb6ce54907a7c67f6a0dcc674e78bf6fb8167ea02010a34035f5ba9ab8e5c494e49cf1d907db59e4e178dcb8e858cc2bd488f90a7339ea1526cd187b4eee2e4fdf6d121d1b49921fb8c7b17e11f89ae43e1179874cfbaba3407dfeea6b8ff0698b8dcfbd38ca6236bf1bff2e5fbe46d408b7f14cd35caa7ed972abf3f5ee12d07cd464fcecde6a475188b0e692dfad59 EAP-Message = 0xf670d03d01a26a8d469a6578ac0a59843565e53b2bc145919c3fef40c0e693645c644f50111f489d8115bf19af99a870c42ef8f0bea4df4e2b334460f6925eb73aff6c4ad2e4a9219005f57df0b5452229e337f2ef420d7c8dce8b0203010001a381eb3081e8301d0603551d0e041604140692c35ad5374aa0aca7a7407f0d255ed0719d303081b80603551d230481b03081ad80140692c35ad5374aa0aca7a7407f0d255ed0719d30a18189a48186308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a86 EAP-Message = 0x4886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f726974798209008b45c0e25d2e249a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007675cc71a220f326022857ac3670dd7540d9159c200dff570f331034e690b1418f2444083524b298ee48192da8f172a324574953c06149e4cb94dd89a2142e621d6ffafb7a815fbb417112fcd4ab2a0ed4645407be28896a6ba6b22cd7389ba79420ea233305c88be323a9e122761b27f747119a35714822d0b4ae66c3d7ecceb0594fe9c830de22a08a8b05cda84cc1b5c792089a309014 EAP-Message = 0xe78e4d77cbec2fb9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a2a6be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 57. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=3, length=191 Message-Authenticator = 0xfda5026403bab578a19ced16bfb4ca06 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a2a6be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 3 length 6 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] Received TLS ACK Sat May 23 06:08:19 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 3 to 10.0.1.254 port 1076 EAP-Message = 0x010402811900dffe3ea966d2f1d6b3f53ff8d7aca3209d32404ff2ea681dfe4e453405f0b9de3eee8c146c2e3ba3dcae73743550c267bc22ca8c9cb6da0d1b78606e707f17f535a4fda33aa48734e794b5e8c345dbe48a9715de963d83ae51473edcafff79bf160301020d0c0002090080c8659d434cd62c0eaec8d1eaef67094fc7dd52c72dc7e38e55ad4d74d9f14735cd89c320acef6ce8c251a50e943f4e92727f9f34bd997db7c16d1785e8b25d750946d21dae73209f0e41991b36edb184e1e3c475b9fbacab20ff57693c64007781193881c119dcee954c563c5e032929289a129de77e748167d2afd7982af81b000102008088a93c29af03b5 EAP-Message = 0x5fc69caa012ef601c99b04c0672b22de6742aadecbf90cffe8e72a8052520debf89eb6cd8670a01f24f744663c24a2542f6760179db8707c675018a7705fd89056403a5bd856f61a8e9d180866cb4320c3dccfff6efc269c09cca5a525c6216f2aa6708fe9c8bc2ce58583f492af5d9448665b22af5b298237010027fe410d157789a34a6cc996af6047db475d5bebfceb9072e29e95397474334b6b67d8621fedcefc52683efb363faf096749d20218cf92c08aa558e874782c9b9e199e274eb9b2eae0d9b6a407bf01a5acef8ae7161cb3736839567b3cc6b3729a5ce4b98447230fde4ed918f9e9b2028f0f414ba0887f748936e6f2181e73618ce5 EAP-Message = 0xb74090f454843a8d02d6a9a7ce694c91cd8d3f7f6bf965d5dca7ac9170a50c2d67e0ba8576b73d2fc9d6d1334998b14b35c0aa4773e2e1f3df4d4e14c0cfa9892dfed0f4fee4dbd560d8f17754af49b93f49b37179109914e794073a19a4f2d2381c269aae135e089f898d558f9246c1be2a5d0cf827201eb9872293417b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a3a1be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 58. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=4, length=393 Message-Authenticator = 0xc3dbc64530ddfbf01b82be637c015e3e Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a3a1be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400d01980000000c616030100861000008200803c767a3bed3fa96f9349bab37ac44b5db38abeda92b001fe54413b595317420c1f681027b921a78213f080ef59a208541ee5f780b2606acae7bb215bb7c483063a15271ddf202abbe73d3bda20d5dfb82277821f8f625c9c20e1cea7d21b23a32536dd5abffcb1aabf61cfc383d03d881847338bd7075f5f9ab02980ab2fc6051403010001011603010030b0b61396697f5ee1d3de6866e00912a6fbd0d339d13218b5661affca34fed8c08b17970c93036f1677ab3e5e55e88af9 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 4 length 208 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Debug: TLS Length 198 Sat May 23 06:08:19 2009 : Info: [peap] Length Included Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 11 Sat May 23 06:08:19 2009 : Info: [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 read client key exchange A Sat May 23 06:08:19 2009 : Info: [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] Sat May 23 06:08:19 2009 : Info: [peap] <<< TLS 1.0 Handshake [length 0010], Finished Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 read finished A Sat May 23 06:08:19 2009 : Info: [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 write change cipher spec A Sat May 23 06:08:19 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 0010], Finished Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 write finished A Sat May 23 06:08:19 2009 : Info: [peap] TLS_accept: SSLv3 flush data Sat May 23 06:08:19 2009 : Info: [peap] (other): SSL negotiation finished successfully Sat May 23 06:08:19 2009 : Debug: SSL Connection Established Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 4 to 10.0.1.254 port 1076 EAP-Message = 0x0105004119001403010001011603010030d14fffc16a5e0f7ba751a28eea1437de326ad1de3376133498aad572a5a52f4e9ef40b2ecae959253f8d6c3a811bf528 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a4a0be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 59. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=5, length=191 Message-Authenticator = 0x81bcaeac15608ae8414a0b28c31dcba6 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a4a0be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020500061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 5 length 6 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] Received TLS ACK Sat May 23 06:08:19 2009 : Info: [peap] ACK handshake is finished Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 3 Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 3 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_SUCCESS Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 5 to 10.0.1.254 port 1076 EAP-Message = 0x0106002b190017030100205765bd754394302906d7c5624244577db1c773bf6abb0da3dffcf7a11364c46c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a5a3be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 60. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=6, length=265 Message-Authenticator = 0x87072a36bbcda8c50e9e7f0b602aa9d6 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a5a3be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206005019001703010020529fd268b46c8afb5e648ce6a6aaa6927f8d8d55c1f63a091da6dfe631d717491703010020716f10f05b5a400b73c2a7fc8df3e15e905a78d6e3ab16f2681b1827456051a9 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 6 length 80 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] Identity - test Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled request EAP-Message = 0x020600090174657374 server { Sat May 23 06:08:19 2009 : Debug: PEAP: Got tunneled identity of test Sat May 23 06:08:19 2009 : Debug: PEAP: Setting default EAP type for tunneled EAP session. Sat May 23 06:08:19 2009 : Debug: PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020600090174657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" server { Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 6 length 9 Sat May 23 06:08:19 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:08:19 2009 : Info: ++[eap] returns updated Sat May 23 06:08:19 2009 : Info: ++[unix] returns notfound Sat May 23 06:08:19 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:08:19 2009 : Info: ++[files] returns ok Sat May 23 06:08:19 2009 : Info: ++[expiration] returns noop Sat May 23 06:08:19 2009 : Info: ++[logintime] returns noop Sat May 23 06:08:19 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:08:19 2009 : Info: ++[pap] returns noop Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] EAP Identity Sat May 23 06:08:19 2009 : Info: [eap] processing type mschapv2 Sat May 23 06:08:19 2009 : Debug: rlm_eap_mschapv2: Issuing Challenge Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled } # server Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x0107001e1a01070019105f46841a680c134eddbe469043e1685174657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0e37d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0107001e1a01070019105f46841a680c134eddbe469043e1685174657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0e37d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled Access-Challenge Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 6 to 10.0.1.254 port 1076 EAP-Message = 0x0107003b19001703010030e809ae694f14c8efbd16e0d03b4c55cbf81f3243b615a861b4523023daaed42cd0dd3d640345670b99ed665cba080847 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a6a2be65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 61. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=7, length=313 Message-Authenticator = 0xa3dfa44b322c9de16003e32d951586e3 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a6a2be65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0207008019001703010020df2362ed683aee9de5839bc43dfc36437f17cd3bba1672507087fe1f40c3a56f1703010050e584e37541e957f87c03300682884fd5cce115d8d84e7f654fdb97c35b2b09bf394e7b7ae815d8c6915a0aebdbb7cc081ef0c81c72f3779903ae486c58edb6288709ebdc48101909aa03f9ea6dc2d2b3 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 7 length 128 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] EAP type mschapv2 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled request EAP-Message = 0x0207003f1a0207003a3191cc1a9946c6cfba2be8580af0c5cf500000000000000000afb10f6969c8a441a65674cb1b11bf2dd60e1b11800a2ac20074657374 server { Sat May 23 06:08:19 2009 : Debug: PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x0207003f1a0207003a3191cc1a9946c6cfba2be8580af0c5cf500000000000000000afb10f6969c8a441a65674cb1b11bf2dd60e1b11800a2ac20074657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" State = 0x0e30cf7b0e37d5e801a16cd8c930d971 server { Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 7 length 63 Sat May 23 06:08:19 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:08:19 2009 : Info: ++[eap] returns updated Sat May 23 06:08:19 2009 : Info: ++[unix] returns notfound Sat May 23 06:08:19 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:08:19 2009 : Info: ++[files] returns ok Sat May 23 06:08:19 2009 : Info: ++[expiration] returns noop Sat May 23 06:08:19 2009 : Info: ++[logintime] returns noop Sat May 23 06:08:19 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:08:19 2009 : Info: ++[pap] returns noop Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/mschapv2 Sat May 23 06:08:19 2009 : Info: [eap] processing type mschapv2 Sat May 23 06:08:19 2009 : Info: [mschapv2] +- entering group MS-CHAP {...} Sat May 23 06:08:19 2009 : Info: [mschap] Told to do MS-CHAPv2 for test with NT-Password Sat May 23 06:08:19 2009 : Info: [mschap] adding MS-CHAPv2 MPPE keys Sat May 23 06:08:19 2009 : Info: ++[mschap] returns ok Sat May 23 06:08:19 2009 : Debug: MSCHAP Success Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled } # server Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x010800331a0307002e533d38344635463445433735394531344635423138394545443141303541323245304139413446443439 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0f38d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d38344635463445433735394531344635423138394545443141303541323245304139413446443439 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0e30cf7b0f38d5e801a16cd8c930d971 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled Access-Challenge Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 7 to 10.0.1.254 port 1076 EAP-Message = 0x0108005b190017030100503f57f777451ccf96321b7674ea98d1ed79cde7eadb49087cf14047b05967ddd8d16c97f78c0062637b910c880d0ef9602ae33a26201f8e0c41d8c4f6ac646c37df62fb3d1d4bc766bab1a80515ca52ea Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a7adbe65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 62. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=8, length=265 Message-Authenticator = 0x9e4f07f9de3e3e39fe346941a2ef4f37 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a7adbe65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0208005019001703010020c8092f2cb2ce2a55c1998c54dc28298f4d569ce89c5922c9271c2c2228e406a91703010020daa06674ef244c479b08189b459f73773c7977fa57afe0e7ff7dbffca6af39a3 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 8 length 80 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] EAP type mschapv2 Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled request EAP-Message = 0x020800061a03 server { Sat May 23 06:08:19 2009 : Debug: PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" State = 0x0e30cf7b0f38d5e801a16cd8c930d971 server { Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 8 length 6 Sat May 23 06:08:19 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:08:19 2009 : Info: ++[eap] returns updated Sat May 23 06:08:19 2009 : Info: ++[unix] returns notfound Sat May 23 06:08:19 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:08:19 2009 : Info: ++[files] returns ok Sat May 23 06:08:19 2009 : Info: ++[expiration] returns noop Sat May 23 06:08:19 2009 : Info: ++[logintime] returns noop Sat May 23 06:08:19 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:08:19 2009 : Info: ++[pap] returns noop Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/mschapv2 Sat May 23 06:08:19 2009 : Info: [eap] processing type mschapv2 Sat May 23 06:08:19 2009 : Info: [eap] Freeing handler Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Auth: Login OK: [test/<via Auth-Type = EAP>] (from client home-ap port 0 via TLS tunnel) Sat May 23 06:08:19 2009 : Info: +- entering group post-auth {...} Sat May 23 06:08:19 2009 : Info: ++[exec] returns noop } # server Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sat May 23 06:08:19 2009 : Info: [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sat May 23 06:08:19 2009 : Info: [peap] Tunneled authentication was successful. Sat May 23 06:08:19 2009 : Info: [peap] SUCCESS Sat May 23 06:08:19 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 8 to 10.0.1.254 port 1076 EAP-Message = 0x0109002b1900170301002009170dedd3f16e1a5db03f10fd34f3821b56dea549adec30b66acf406f2d4d5f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0a5a769a8acbe65b7c70cf134208ef5 Sat May 23 06:08:19 2009 : Info: Finished request 63. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1076, id=9, length=265 Message-Authenticator = 0x1bdfaa9f02815052e1c90d8bda0ad5f8 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xa0a5a769a8acbe65b7c70cf134208ef5 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-18-F8-44-15-C0" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02090050190017030100201180bbdd1c0f51172eb6b157872924324c0fcbb2ba6232c881ae1eeac3b452ec1703010020ff76e4fb0e8a899a41b84b2078f1b6343f4b785038d1f41200a4b9ee8d69934a NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:08:19 2009 : Info: +- entering group authorize {...} Sat May 23 06:08:19 2009 : Info: ++[preprocess] returns ok Sat May 23 06:08:19 2009 : Info: ++[chap] returns noop Sat May 23 06:08:19 2009 : Info: ++[mschap] returns noop Sat May 23 06:08:19 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:08:19 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:08:19 2009 : Info: ++[suffix] returns noop Sat May 23 06:08:19 2009 : Info: [eap] EAP packet type response id 9 length 80 Sat May 23 06:08:19 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Info: Found Auth-Type = EAP Sat May 23 06:08:19 2009 : Info: +- entering group authenticate {...} Sat May 23 06:08:19 2009 : Info: [eap] Request found, released from the list Sat May 23 06:08:19 2009 : Info: [eap] EAP/peap Sat May 23 06:08:19 2009 : Info: [eap] processing type peap Sat May 23 06:08:19 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:08:19 2009 : Info: [peap] eaptls_verify returned 7 Sat May 23 06:08:19 2009 : Info: [peap] Done initial handshake Sat May 23 06:08:19 2009 : Info: [peap] eaptls_process returned 7 Sat May 23 06:08:19 2009 : Info: [peap] EAPTLS_OK Sat May 23 06:08:19 2009 : Info: [peap] Session established. Decoding tunneled attributes. Sat May 23 06:08:19 2009 : Info: [peap] Received EAP-TLV response. Sat May 23 06:08:19 2009 : Info: [peap] Success Sat May 23 06:08:19 2009 : Info: [eap] Freeing handler Sat May 23 06:08:19 2009 : Info: ++[eap] returns ok Sat May 23 06:08:19 2009 : Auth: Login OK: [test/<via Auth-Type = EAP>] (from client home-ap port 1 cli 00-18-F8-44-15-C0) Sat May 23 06:08:19 2009 : Info: +- entering group post-auth {...} Sat May 23 06:08:19 2009 : Info: ++[exec] returns noop Sending Access-Accept of id 9 to 10.0.1.254 port 1076 MS-MPPE-Recv-Key = 0xaee5abfa28444c372e4d93cb2143a55070b1571d659e6092782a7be2c21f1987 MS-MPPE-Send-Key = 0x025d7567a09cc9c1c513ca98c1d87b10b375e63f8c9d41db3f486f116864e131 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sat May 23 06:08:19 2009 : Info: Finished request 64. Sat May 23 06:08:19 2009 : Debug: Going to the next request Sat May 23 06:08:19 2009 : Debug: Waking up in 4.0 seconds. Sat May 23 06:08:23 2009 : Info: Cleaning up request 55 ID 0 with timestamp +434 Sat May 23 06:08:23 2009 : Info: Cleaning up request 56 ID 1 with timestamp +434 Sat May 23 06:08:23 2009 : Debug: Waking up in 0.5 seconds. Sat May 23 06:08:24 2009 : Info: Cleaning up request 57 ID 2 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 58 ID 3 with timestamp +435 Sat May 23 06:08:24 2009 : Debug: Waking up in 0.1 seconds. Sat May 23 06:08:24 2009 : Info: Cleaning up request 59 ID 4 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 60 ID 5 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 61 ID 6 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 62 ID 7 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 63 ID 8 with timestamp +435 Sat May 23 06:08:24 2009 : Info: Cleaning up request 64 ID 9 with timestamp +435 Sat May 23 06:08:24 2009 : Debug: Ready to process requests. Thanks, Balgaa

1 0

Windows XP SP2 and SP3 EAP problem
by Balgansuren Batsukh 23 May '09

23 May '09

Hello, I am new to Freeradius world. Last two days trying to use Freeradius + Alcon AP WPA-Enterprise + Windows XP. I installed FreeBSD 7.2-STABL with Freeradius 2.1.4 and configured it. I followed instruction on http://wiki.freeradius.org/index.php?title=EAP-PEAP&redirect=no and http://ubuntuforums.org/showthread.php?t=478804 I have 2 WLAN card on my Windows XP laptop. After successfully install,configure freebsd/freeradius/AP and Windows XP. 1.My Linksys WPC300N WLAN card can connect to AP using PEAP/MS-CHAPv2. 2.But Intel PRO/Wireless 3945ABG card can't get connect, I tried many different way. First I tried Windows XP with SP2, then installed SP3 and all time same result. I captured Freeradius debugging information. 1.Linksys ======== Please find second my email. Because maximum mailing-list size is 100K. 2.Intel PRO/Wireless 3945ABG ======================= .rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=0, length=176 Message-Authenticator = 0xa0ca47a1b7294a8b23ae201660398ec5 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020000090174657374 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 0 length 9 Sat May 23 06:12:59 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat May 23 06:12:59 2009 : Info: ++[eap] returns updated Sat May 23 06:12:59 2009 : Info: ++[unix] returns notfound Sat May 23 06:12:59 2009 : Info: [files] users: Matched entry test at line 206 Sat May 23 06:12:59 2009 : Info: ++[files] returns ok Sat May 23 06:12:59 2009 : Info: ++[expiration] returns noop Sat May 23 06:12:59 2009 : Info: ++[logintime] returns noop Sat May 23 06:12:59 2009 : Info: [pap] Found existing Auth-Type, not changing it. Sat May 23 06:12:59 2009 : Info: ++[pap] returns noop Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] EAP Identity Sat May 23 06:12:59 2009 : Info: [eap] processing type tls Sat May 23 06:12:59 2009 : Info: [tls] Initiate Sat May 23 06:12:59 2009 : Info: [tls] Start returned 1 Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.0.1.254 port 1077 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012bab2c18f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 65. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=1, length=265 Message-Authenticator = 0xf38fba12d0d8983cafc03c4357006b1b Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012bab2c18f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014a17236630b686d1813e3c6999ff6c9c2bb7411a01b4b1b77582d0dd45012ae300001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 1 length 80 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Debug: TLS Length 70 Sat May 23 06:12:59 2009 : Info: [peap] Length Included Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 11 Sat May 23 06:12:59 2009 : Info: [peap] (other): before/accept initialization Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: before/accept initialization Sat May 23 06:12:59 2009 : Info: [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 read client hello A Sat May 23 06:12:59 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 write server hello A Sat May 23 06:12:59 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 0818], Certificate Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 write certificate A Sat May 23 06:12:59 2009 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 write server done A Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: SSLv3 flush data Sat May 23 06:12:59 2009 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Sat May 23 06:12:59 2009 : Debug: In SSL Handshake Phase Sat May 23 06:12:59 2009 : Debug: In SSL Accept mode Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 1 to 10.0.1.254 port 1077 EAP-Message = 0x0102040019c000000855160301002a0200002603014a17236b41fb4453090eaddd0875ba0824f11887113654d3439aaabac6b367d70000040016030108180b0008140008110003903082038c30820274a003020102020101300d06092a864886f70d0101040500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d303930353232303131353138 EAP-Message = 0x5a170d3130303532323031313531385a3076310b3009060355040613024d4e310b30090603550408130255423111300f060355040a1308486f6d656e65742e312630240603550403131d54736572656e646f726a20536572766572204365727469666963617465311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d307b83ea71ed1c6ee8867dd355590ec1e9d04b2301d284eddf4983dd53bcd1fcc7d219fbacb9deb9ae5f64f1a2d660a15c7ffc995c6a9462a840d452c13676e68ebb427f3f8d4ccbb1141fdb9a6ac9d8027d17b EAP-Message = 0xfe2e02e865530ad0e174d309e79164ce2ab8df0a7c676155022f298a0014bab98b68e23a06cf939d9c6b53fab8cb7b123df2b751a700ae1b12129cd05dcc6110c8b89f9b467142874b7249ae442d1680700f96ea69f511c388f198869375b1e86af0e4320dc81e6ec5dfa88817fef561b6c69561e6200412327b72d5915c9c292eaa2f4914c0ca4a102bd1ba198aa3224e20e8c635f9b4131042955409ab565377e64b005bf7ffd6db0af64f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010015a7d2ade3e88c984c89476f7823e6e178e82374fb9716b8aaae950f1d2040 EAP-Message = 0xca57298fb83500fed0f2c3f575f86cf242cc938cac77017fd0363d7e66618fc097b2221633733ab7e6ca92c5b02a455ef00820b642cfc955226e708f237981d52f4d25f5dbe60d094a22cdc32b2d09cfa4f4f959af0487552edf4835d20109016bbde20a5b79ab4cdc124ad0d6eb269cc6b2409f7f7c7221c6f03593032d7417d946af889568ca0ac8ee94786b8e8046a7e1e2fd93e1256dc4ed5cd62282b6f2cf02c0d5875867f2869c002bac9f7a6ef27e313e44492c04faa7d320ffe47d21e46b179945379d2834b9f23d8391fc44511ab29cb87950aca10042e2ba48fd3e9c00047b308204773082035fa0030201020209008b45c0e25d2e249a30 EAP-Message = 0x0d06092a864886f70d010105 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012baa2f18f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 66. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=2, length=191 Message-Authenticator = 0xe998fa0f52f462e1a8b21e3ec7f5c049 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012baa2f18f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 2 length 6 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Info: [peap] Received TLS ACK Sat May 23 06:12:59 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 2 to 10.0.1.254 port 1077 EAP-Message = 0x010303fc19400500308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a864886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f72697479301e170d3039303532323031313530345a170d3130303532323031313530345a308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a8648 EAP-Message = 0x86f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f5a581f6620f0dc9f19e0eb69943d39130695d3ac1cb6ce54907a7c67f6a0dcc674e78bf6fb8167ea02010a34035f5ba9ab8e5c494e49cf1d907db59e4e178dcb8e858cc2bd488f90a7339ea1526cd187b4eee2e4fdf6d121d1b49921fb8c7b17e11f89ae43e1179874cfbaba3407dfeea6b8ff0698b8dcfbd38ca6236bf1bff2e5fbe46d408b7f14cd35caa7ed972abf3f5ee12d07cd464fcecde6a475188b0e692dfad59 EAP-Message = 0xf670d03d01a26a8d469a6578ac0a59843565e53b2bc145919c3fef40c0e693645c644f50111f489d8115bf19af99a870c42ef8f0bea4df4e2b334460f6925eb73aff6c4ad2e4a9219005f57df0b5452229e337f2ef420d7c8dce8b0203010001a381eb3081e8301d0603551d0e041604140692c35ad5374aa0aca7a7407f0d255ed0719d303081b80603551d230481b03081ad80140692c35ad5374aa0aca7a7407f0d255ed0719d30a18189a48186308183310b3009060355040613024d4e310b3009060355040813025542311430120603550407130b556c61616e6261617461723111300f060355040a1308486f6d656e65742e311f301d06092a86 EAP-Message = 0x4886f70d010901161074736565656b407961686f6f2e636f6d311d301b0603550403131454736572656e646f726a20617574686f726974798209008b45c0e25d2e249a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007675cc71a220f326022857ac3670dd7540d9159c200dff570f331034e690b1418f2444083524b298ee48192da8f172a324574953c06149e4cb94dd89a2142e621d6ffafb7a815fbb417112fcd4ab2a0ed4645407be28896a6ba6b22cd7389ba79420ea233305c88be323a9e122761b27f747119a35714822d0b4ae66c3d7ecceb0594fe9c830de22a08a8b05cda84cc1b5c792089a309014 EAP-Message = 0xe78e4d77cbec2fb9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012ba92e18f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 67. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=3, length=191 Message-Authenticator = 0xdd87b957079c3f4f81b4c7a5ba4be6d6 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012ba92e18f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 3 length 6 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Info: [peap] Received TLS ACK Sat May 23 06:12:59 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 3 to 10.0.1.254 port 1077 EAP-Message = 0x0104006f1900dffe3ea966d2f1d6b3f53ff8d7aca3209d32404ff2ea681dfe4e453405f0b9de3eee8c146c2e3ba3dcae73743550c267bc22ca8c9cb6da0d1b78606e707f17f535a4fda33aa48734e794b5e8c345dbe48a9715de963d83ae51473edcafff79bf16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012ba82918f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 68. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.254 port 1077, id=4, length=191 Message-Authenticator = 0x1a9c69cd9f1a6a400346442e1b1da646 Service-Type = Framed-User User-Name = "test" Framed-MTU = 1488 State = 0xab2d012ba82918f6df82958be47c8d15 Called-Station-Id = "00-C0-A8-ED-84-11:CSMS" Calling-Station-Id = "00-1B-77-3D-97-CB" NAS-Identifier = "AP CSMS" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 10.0.1.254 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sat May 23 06:12:59 2009 : Info: +- entering group authorize {...} Sat May 23 06:12:59 2009 : Info: ++[preprocess] returns ok Sat May 23 06:12:59 2009 : Info: ++[chap] returns noop Sat May 23 06:12:59 2009 : Info: ++[mschap] returns noop Sat May 23 06:12:59 2009 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Sat May 23 06:12:59 2009 : Info: [suffix] No such realm "NULL" Sat May 23 06:12:59 2009 : Info: ++[suffix] returns noop Sat May 23 06:12:59 2009 : Info: [eap] EAP packet type response id 4 length 6 Sat May 23 06:12:59 2009 : Info: [eap] Continuing tunnel setup. Sat May 23 06:12:59 2009 : Info: ++[eap] returns ok Sat May 23 06:12:59 2009 : Info: Found Auth-Type = EAP Sat May 23 06:12:59 2009 : Info: +- entering group authenticate {...} Sat May 23 06:12:59 2009 : Info: [eap] Request found, released from the list Sat May 23 06:12:59 2009 : Info: [eap] EAP/peap Sat May 23 06:12:59 2009 : Info: [eap] processing type peap Sat May 23 06:12:59 2009 : Info: [peap] processing EAP-TLS Sat May 23 06:12:59 2009 : Info: [peap] Received TLS ACK Sat May 23 06:12:59 2009 : Info: [peap] ACK handshake fragment handler Sat May 23 06:12:59 2009 : Info: [peap] eaptls_verify returned 1 Sat May 23 06:12:59 2009 : Info: [peap] eaptls_process returned 13 Sat May 23 06:12:59 2009 : Info: [peap] EAPTLS_HANDLED Sat May 23 06:12:59 2009 : Info: ++[eap] returns handled Sending Access-Challenge of id 4 to 10.0.1.254 port 1077 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab2d012baf2818f6df82958be47c8d15 Sat May 23 06:12:59 2009 : Info: Finished request 69. Sat May 23 06:12:59 2009 : Debug: Going to the next request Sat May 23 06:12:59 2009 : Debug: Waking up in 4.9 seconds. Sat May 23 06:13:04 2009 : Info: Cleaning up request 65 ID 0 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 66 ID 1 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 67 ID 2 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 68 ID 3 with timestamp +715 Sat May 23 06:13:04 2009 : Info: Cleaning up request 69 ID 4 with timestamp +715 Sat May 23 06:13:04 2009 : Debug: Ready to process requests. 3.site-enabled/default ================ authorize { preprocess chap mschap eap { ok = return } files pap authenticate . . . Auth-Type MS-CHAP { mschap } 4.eap.conf ======== eap { default_eap_type = peap . . . tls { . . } check_cert_cn = %{User-Name} peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } } 5.users ====== test Cleartext-Password := "test" Is there anything wrong with configuration or? My guess is Windows XP wireless client sofware didn't respond to Freeradius Access-Challenge request, but Linksys client software doing well. Any suggestion? Thanks, Balgaa

1 0

Re: must i use rlm_ldap to use groups/ou via winbind/Active Directory?
by john 23 May '09

23 May '09

. > > That depends on capabilities of your equipment. This how Cisco implements it: > > www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf > > Other vendors have more on less the same. It is enabled on some models and > not on others. Thanks for this. > >> So this policy would check the huntgroup that the NAS was a member of >> and then go on to check if the users was part of the proper >> Ldap-Group and assuming that both were true then access would be >> granted. I am still not clear how some hunt groups will always >> require a host cert and others never will. Is this set in the hunt >> group? > > No, on the equipment. Your setup is such that you have to enforce > (enable/disable) it on hardware. If you would require certificates for > access to all hardware you could enforce it with AD Group Policy. Like > this students don't need machine certificates for wireless access. So, you > should enable mac auth bypass on your student APs. Most APs should have > such feature.You should make students register mac address of their > wireless equipment if they want to connect. Hmm. I don't think I like this approach for a couple of reasons, perhaps you can let me know if I am thinking about this incorrectly. We already use mac address as an auth scheme and I want to move away from this because of the ease of mac spoofing in a wireless environment. That's why I hoped to move to username/password authentication with WPA2 that was centrally managed via freeradius <=> Active Directory. I currently have a fairly central way to manage access by mac, but I would have to give that up if I had to maintain a mac address table on each NAS. I guess I could add a list of allowed mac addresses in the freeradius/users file and maintain it from there? Just so I understand you clearly, we can't have 1 class of users who must use host certs via NAS A and another class of uses who never have to use certs via NAS B on the same freeradius server? If that is the case I think I might want to set up a second instance of Freeradius and point the NAS that don't require host certs at that one. I could simply mint another virtual freeradius instance in freeradius/sites-enabled couldn't I? If I have this all muddled up, I hope you'll straighten me out. Thanks for all of your help. John

2 1

freeRADIUS + POPTOP
by Neville 22 May '09

22 May '09

Firstly, let me apologies now for asking what is most probably a simple question to you long standing veterans of freeRADIUS. I've search the INTERNET for 5 days now and late into the evening, but I'm totally stumped in resolving my problem, so I would appreciate any guidance from the experts. I've configured as per the many guides I've found and have a basic understanding of how this all works, but there is no information anywhere on how to setup the Users / Client details for freeRADIUS. I've been using poptop (pptpd) server for several weeks, with great success, but now I wish to introduce freeRADIUS. The problem, I'm facing is the allocation of IP address / GW / DNS by freeRADIUS for the VPN connections coming onto my server. my service PrivateIP address is 19x.xxx.xxx.190 I've iptables setup to forward all NAT traffic through the PRIVATEIP, but allocation of a GW of 10.0.0.1 and a Client IP of 10.0.0.200 However, when I connect and freeRADIUS authenticates me SUCCESSFULLY. I get given a IP of 192.168.2.82 from the test_pool, but pool range-start = 10.0.0.100 range-stop = 10.0.0.199 which is totally different to the address allocated by the pool. ANY IDEAS? /var/log/messages May 22 21:49:13 server pppd[765]: MPPE 128-bit stateless compression enabled May 22 21:49:15 server pppd[765]: Cannot determine ethernet address for proxy ARP May 22 21:49:15 server pppd[765]: local IP address 10.0.0.1 May 22 21:49:15 server pppd[765]: remote IP address 192.168.2.82 radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 34510, id=245, length=133 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test1" MS-CHAP-Challenge = 0xd4fd1b2f3b03fa424ae2ccc6dcd11029 MS-CHAP2-Response = 0x87001d6e9a747c3545dd123d19c410c037be00000000000000002b9c7e96783abd1954a72ae8f4bc4733b1470477ba725366 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090522 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090522 [auth_log] expand: %t -> Fri May 22 22:46:15 2009 ++[auth_log] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 70 [files] users: Matched entry test1 at line 77 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test1 with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [test_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 127.0.0.1 0 [test_pool] MD5 on 'key' directive maps to: ee0282d57992a30bce29ea43d092ac16 [test_pool] Searching for an entry for key: 'ee0282d57992a30bce29ea43d092ac16' rlm_ippool: Allocating ip to key: 'ee0282d57992a30bce29ea43d092ac16' [test_pool] num: 1 [test_pool] Allocated ip 192.168.2.82 to client key: ee0282d57992a30bce29ea43d092ac16 ++[test_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 245 to 127.0.0.1 port 34510 Service-Type = Framed-User Session-Timeout = 65000 Framed-Protocol = PPP Framed-MTU = 1400 MS-CHAP2-Success = 0x87533d46313037374533443535323430343534463737333338463639364534383642374434433244333842 MS-MPPE-Recv-Key = 0x5a21400d6e5601f9c7201a94d401eefb MS-MPPE-Send-Key = 0x14eadb5ada027ccdd63a6cf372f0defd MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.2.82 Framed-IP-Netmask = 255.255.255.0 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 43515, id=246, length=97 Acct-Session-Id = "4A172B390A9300" User-Name = "test1" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.2.82 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4A172B390A9300",User-Name = "test1"' [acct_unique] Acct-Unique-Session-ID = "29e101f9a598e8fe". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090522 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090522 [detail] expand: %t -> Fri May 22 22:46:17 2009 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok [test_pool] This is not an Accounting-Stop. Return NOOP. ++[test_pool] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 246 to 127.0.0.1 port 43515 Finished request 1. Cleaning up request 1 ID 246 with timestamp +44 Going to the next request Waking up in 2.9 seconds. Cleaning up request 0 ID 245 with timestamp +42 Ready to process requests. freeRADIUS Configurations users DEFAULT Pool-Name := test_pool Fall-Through = Yes test1 Cleartext-Password := "test1" Service-Type = Framed-User, Session-Timeout = 65000, Framed-Protocol = PPP, Framed-MTU = 1400, ippool module ippool test_pool { range-start = 10.0.0.100 range-stop = 10.0.0.199 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } POPTOP Configuration Files /etc/ppp/options.pptpd name pptpd #chapms-strip-domain refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns 208.67.222.222 ms-dns 208.67.222.220 proxyarp debug dump lock nobsdcomp novj novjccomp noipv6 noipx nologfd plugin radius.so plugin radattr.so /etc/pptpd.conf ppp /usr/sbin/pppd option /etc/ppp/options.pptpd debug noipparam #logwtmp #bcrelay eth1 delegate connections 100 localip 10.0.0.1

2 1

must i use rlm_ldap to use groups/ou via winbind/Active Directory?
by john 22 May '09

22 May '09

Hi all, I am gradually refining my thinking thanks to help from Ivan and others on the list. I am using the current freeradius stable along with Active Directory to provide dot1x based access for our school district. Our test setup looks like this: active directory <=>winbind<=> Freeradius<=>NAS<=>supplicant Problem: I want to enforce different access policies for users depending on who they are and where they try to authenticate. (1) If students or teachers try to authenticate on the wired lan I want my dot1x capable NAS to provide access only if they user has a computer cert and valid domain credentials (2) If students try to connect via the student wireless lan they must only receive access if they are a member of the Active Directory based "student wireless users group", e.g. no staff member should be able to join. (3) If teachers try to connect via the teacher wireless lan, I want them to connect only if they HAVE a computer cert AND they have valid credentials. e.g only members of the Active Directoy based "staff group" using computers with a valid host credential may receive access. One solution would be two have two different radius servers, and point different NAS clients at the appropriate server, but I this is probably not the "right" way to do this. Ideally, I should be able to do it all from a single radius server with appropriate controls. I see that in the past folks have done similar things with openLdap and freeradius. But I think that using winbind may have changed this for users of Active Directly. I am not sure how to proceed. I would appreciate any guidance you wish to share. Thanks! John

4 7