June 2009 - Freeradius-Users - lists.freeradius.org

use_tunneled_reply has no effect
by Xiwen Cheng 18 Jun '09

18 Jun '09

I have searched through the maillinglist archive regarding this matter. There was one thread similar to the problem I'm facing with: Have the outer-tunnel reply with the user-name specified in the inner-tunnel; thus instead of anonymous(a)some.realm >From this thread: http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-June/msg005… In eap.conf: ttls { .... use_tunneled_reply = yes virtual_server = "inner-tunnel" } In users: .... DEFAULT User-Name = "%{User-Name}", Fall-Through = no Running radiusd in debug mode, the User-Name attribute remained unchanged through out the request session. Best regards, Xiwen --

4 7

Cisco WLC PEAP/MSCHAPv2 - unnecessary ldap lookups?
by Brian Wilson 18 Jun '09

18 Jun '09

Hi all, I have a functional question about freeradius and the ldap lookups. We currently run cisco wlc440x with WPA2-AES-PEAP-MSCHAPv2 against freeradius, and it is taking a while to authenticate - roughly 35 seconds. It seems most of this is being chewed up by our slow ldap lookups (about 4-6 seconds each, this is an ldap server issue), in combination with the number of ldap lookups freeradius does per session (5-6). Is it normal for the freeradius server to perform this many ldap lookups, or do I have a configuration error? It seems like it does ldap calls each time it receives an access-request from an access-challenge. I've played with the controller auth timeouts, it doesn't seem to make a difference. Here is the debug output from a single session: rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=5, length=196 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) Message-Authenticator = 0x8dd02304de9a3c5e3c732d1a622be134 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log](trimmed) [auth_log] expand: %t -> Wed Jun 17 10:00:10 2009 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 2 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr2] performing user authorization for test [LDAPsvr2] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr2] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr2] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr2] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr2] No default NMAS login sequence [LDAPsvr2] looking for check items in directory... [LDAPsvr2] looking for reply items in directory... [LDAPsvr2] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cfeaa7186011d5bcc3cb2528f Finished request 67. Going to the next request Waking up in 9.9 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=6, length=193 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060319 State = 0xfea96b9cfeaa7186011d5bcc3cb2528f Message-Authenticator = 0x7efad720ed506e1d3324a14c5f001a4c +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr1] performing user authorization for test [LDAPsvr1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr1] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr1] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr1] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr1] No default NMAS login sequence [LDAPsvr1] looking for check items in directory... [LDAPsvr1] looking for reply items in directory... [LDAPsvr1] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr1] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.21.130 port 32769 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cffad7286011d5bcc3cb2528f Finished request 68. Going to the next request Waking up in 5.2 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=7, length=267 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) State = 0xfea96b9cffad7286011d5bcc3cb2528f Message-Authenticator = 0x4564af3d0b691c04f6aaab9311bcdff3 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0889], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.21.130 port 32769 EAP-Message = (trimmed) EAP-Message = (trimmed) EAP-Message = (trimmed) EAP-Message = (trimmed) EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cfcac7286011d5bcc3cb2528f Finished request 69. Going to the next request Waking up in 5.2 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=8, length=193 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 State = 0xfea96b9cfcac7286011d5bcc3cb2528f Message-Authenticator = 0xbebcefc1657154e59fa5a56953d3e83e +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.21.130 port 32769 EAP-Message = (trimmed) EAP-Message = (trimmed) EAP-Message = (trimmed) EAP-Message = (trimmed) EAP-Message = 0x4f8b38b8c2084860 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cfdaf7286011d5bcc3cb2528f Finished request 70. Going to the next request Waking up in 5.2 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=9, length=193 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 State = 0xfea96b9cfdaf7286011d5bcc3cb2528f Message-Authenticator = 0x6c144e58a145ed24b615ed7080939873 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 9 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cfaae7286011d5bcc3cb2528f Finished request 71. Going to the next request Waking up in 5.2 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=10, length=509 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) EAP-Message = (trimmed) State = 0xfea96b9cfaae7286011d5bcc3cb2528f Message-Authenticator = 0x86b2b14c7b15cfcf3ed534de74b3e379 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 7 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 10 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cfba17286011d5bcc3cb2528f Finished request 72. Going to the next request Waking up in 5.2 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=11, length=193 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800061900 State = 0xfea96b9cfba17286011d5bcc3cb2528f Message-Authenticator = 0xa23b09f3a29bebaba1465480b07feef9 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 11 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cf8a07286011d5bcc3cb2528f Finished request 73. Going to the next request Waking up in 5.2 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=12, length=237 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) State = 0xfea96b9cf8a07286011d5bcc3cb2528f Message-Authenticator = 0xcee77e000cf68223253caa68e05da122 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 9 length 50 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - test [peap] Got tunneled request EAP-Message = (trimmed) server { PEAP: Got tunneled identity of test PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to test Sending tunneled request EAP-Message = (trimmed) FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" server { +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 9 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr2] performing user authorization for test [LDAPsvr2] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr2] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr2] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr2] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr2] No default NMAS login sequence [LDAPsvr2] looking for check items in directory... [LDAPsvr2] looking for reply items in directory... [LDAPsvr2] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server [peap] Got tunneled reply code 11 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3203b3053209a96aacfd5d3ebe154b12 [peap] Got tunneled reply RADIUS code 11 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3203b3053209a96aacfd5d3ebe154b12 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 12 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cf9a37286011d5bcc3cb2528f Finished request 74. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=13, length=291 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) State = 0xfea96b9cf9a37286011d5bcc3cb2528f Message-Authenticator = 0x45f0df4032fed071cefcab99032b1d3d +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 10 length 104 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = (trimmed) server { PEAP: Setting User-Name to test Sending tunneled request EAP-Message = (trimmed) FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" State = 0x3203b3053209a96aacfd5d3ebe154b12 server { +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 10 length 81 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr1] performing user authorization for test [LDAPsvr1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr1] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr1] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr1] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr1] No default NMAS login sequence [LDAPsvr1] looking for check items in directory... [LDAPsvr1] looking for reply items in directory... [LDAPsvr1] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr1] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server [peap] Got tunneled reply code 11 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3203b3053308a96aacfd5d3ebe154b12 [peap] Got tunneled reply RADIUS code 11 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3203b3053308a96aacfd5d3ebe154b12 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 13 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cf6a27286011d5bcc3cb2528f Finished request 75. Going to the next request Cleaning up request 67 ID 5 with timestamp +1805 Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=14, length=216 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) State = 0xfea96b9cf6a27286011d5bcc3cb2528f Message-Authenticator = 0xa49cac12cdb0cec38ff0d7e51bf95eb6 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 11 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020b00061a03 server { PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020b00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" State = 0x3203b3053308a96aacfd5d3ebe154b12 server { +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 11 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 178 ++[files] returns ok ++- entering redundant-load-balance group redundant-load-balance {...} [LDAPsvr1] performing user authorization for test [LDAPsvr1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [LDAPsvr1] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=test) [LDAPsvr1] expand: t=company -> t=company rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=company, with filter (cn=test) [LDAPsvr1] Added the eDirectory password password in check items as Cleartext-Password [LDAPsvr1] No default NMAS login sequence [LDAPsvr1] looking for check items in directory... [LDAPsvr1] looking for reply items in directory... [LDAPsvr1] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[LDAPsvr1] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} [reply_log] expand: (trimmed) [reply_log] (trimmed) [reply_log] expand: %t User-Name = "%{User-Name}" -> Wed Jun 17 10:00:29 2009 User-Name = "test" ++[reply_log] returns ok } # server [peap] Got tunneled reply code 2 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 14 to 192.168.21.130 port 32769 EAP-Message = (trimmed) Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfea96b9cf7a57286011d5bcc3cb2528f Finished request 76. Going to the next request Cleaning up request 68 ID 6 with timestamp +1809 Cleaning up request 69 ID 7 with timestamp +1814 Cleaning up request 70 ID 8 with timestamp +1814 Cleaning up request 71 ID 9 with timestamp +1814 Cleaning up request 72 ID 10 with timestamp +1814 Cleaning up request 73 ID 11 with timestamp +1814 Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.21.130 port 32769, id=15, length=225 User-Name = "test" Calling-Station-Id = "00-21-00-D9-10-DB" Called-Station-Id = "00-23-EA-7F-85-40:TFWAPR" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = (trimmed) State = 0xfea96b9cf7a57286011d5bcc3cb2528f Message-Authenticator = 0xa8b037f67e9531b8a502cca033121149 +- entering group authorize {...} [preprocess] expand: %{Called-Station-Id} -> 00-23-EA-7F-85-40:TFWAPR ++[preprocess] returns ok [auth_log] expand: (trimmed) [auth_log] (trimmed) [auth_log] expand: (trimmed) ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "company" for User-Name = "test" [ntdomain] Found realm "company" [ntdomain] Adding Stripped-User-Name = "test" [ntdomain] Adding Realm = "company" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 12 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} [reply_log] expand: (trimmed) [reply_log] (trimmed) [reply_log] expand: %t User-Name = "%{User-Name}" -> Wed Jun 17 10:00:33 2009 User-Name = "test" ++[reply_log] returns ok Sending Access-Accept of id 15 to 192.168.21.130 port 32769 MS-MPPE-Recv-Key = (trimmed) MS-MPPE-Send-Key = (trimmed) EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Finished request 77. Going to the next request Waking up in 0.6 seconds. Cleaning up request 74 ID 12 with timestamp +1814 Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 192.168.21.130 port 32769, id=165, length=154 User-Name = "test" NAS-Port = 1 NAS-IP-Address = 192.168.21.130 Framed-IP-Address = 192.168.21.65 NAS-Identifier = "AIR-WLC4404-DK-1" Airespace-Wlan-Id = 2 Acct-Session-Id = "4a38a2a4/00:21:00:d9:10:db/103" Acct-Authentic = RADIUS Acct-Status-Type = Start Calling-Station-Id = "192.168.21.65" Called-Station-Id = "192.168.21.130" +- entering group preacct {...} [preprocess] expand: %{Called-Station-Id} -> 192.168.21.130 ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 192.168.21.130,NAS-IP-Address = 192.168.21.130,Acct-Session-Id = "4a38a2a4/00:21:00:d9:10:db/103",User-Name = "test"' [acct_unique] Acct-Unique-Session-ID = "241f1d6c7aaf3e38". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: (trimmed) [detail] (trimmed) [detail] expand: (trimmed) ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 165 to 192.168.21.130 port 32769 Finished request 78. Cleaning up request 78 ID 165 with timestamp +1831 Going to the next request Waking up in 2.3 seconds. Cleaning up request 75 ID 13 with timestamp +1819 Waking up in 4.5 seconds. Cleaning up request 76 ID 14 with timestamp +1824 Cleaning up request 77 ID 15 with timestamp +1828 Ready to process requests.

3 3

simultaneous use logging
by James Devine 17 Jun '09

17 Jun '09

I have setup a custom module to do auth and acct. In debug mode everything appears correct, and responses appear correct. When I don't have radius running in debug mode, responses still appear correct, but if auth fails due to simultaneous use, radius is logging 'Auth: Login OK'. Authentication was successful, but the auth request failed due to simultaneous use, so it should be logging a failure I would think. Any idea what I might be doing wrong? FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.1, built on May 7 2009 at 10:48:55 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/gwis including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket group = freeradius user = freeradius including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.4" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 4096 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 0 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client local_clients { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testsecret" nastype = "other" } client allowed_clients { ipaddr = 10.10.10.231 require_message_authenticator = no secret = "testsecret" nastype = "other" } client web3 { ipaddr = 10.10.10.115 require_message_authenticator = no secret = "testsecret" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_gwis Module: Instantiating gwis gwis { log_level = 2 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests.

3 7

SSH authendication with radius server fails if the user does not exist in radius client
by kpani 17 Jun '09

17 Jun '09

Hi, I am trying to authenticate ssh login using radius server running in another linux machine. I added a new user in /usr/local/etc/raddb/users of radius server. Now when I do ssh to the radius client, the radius server denies request and says 'Password doesn't match. But I gave right password. If I add the new user in radius client machine, then if I do ssh, the server accepts and authenticates the request. So it looks like the radius client is not sending the password to radius server if the user does not exist in local machine. Do I need to configure anywhere in client or server to skip the local machine user check. Please help me to solve this issue. Thanks in advance. Regards, Dhandapani -- View this message in context: http://www.nabble.com/SSH-authendication-with-radius-server-fails-if-the-us… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

RE: [rad] RE: Free Radius users record samples for SmartEdgerouter subcriberauthentication.
by Ivan Kalik 17 Jun '09

17 Jun '09

> Just out for sake of completeness. On FreeRADIUS Version 1.1.7 > > I tried both User-Password == "test" and Cleartext-Password := "test". > > They both work fine when the user entry is before default setting in > users file. For a pap request. Try sending chap or mschap request and see what happens. Cleartext-Password will work with all cases, User-Password won't. Ivan Kalik Kalik Informatika ISP

2 1

Free Radius users record samples for SmartEdge router subcriber authentication.
by Elias Abou Zeid 17 Jun '09

17 Jun '09

Hi, I am trying a simple authenticate pppoe subscriber in radius server (v 1.188.2.4.2.11) for subscribers coming through Redback SmartEdge 800 router. As I am new to this I am looked for some examples for users configuration on RADIUS but could not find. I have tried something out but seems missing certain stuff: abc Auth-Type := Local, Password == "passwd" Service-Type = Framed-User, Framed-Protocol = PPP, Bind_Auth_Context = RADIUS Thanks for refering me to some examples. BR, Elias

5 24

Re: radclient: no response from server ... please help newbe.
by Ivan Kalik 17 Jun '09

17 Jun '09

> I'm using the following stack FreeRADIUS Version 2.1.3 with > coova-chilli-1.0.13 with Daloradius . > > > I'm having issues with sending POD from Daloradius and radclient via the > command line Send it to NAS (coova-chilli), not radius server. Ivan Kalik Kalik Informatika ISP

2 1

radclient: no response from server ... please help newbe.
by Gregory Machin 17 Jun '09

17 Jun '09

Hi Please could someone help a newbe ... I'm using the following stack FreeRADIUS Version 2.1.3 with coova-chilli-1.0.13 with Daloradius . I'm having issues with sending POD from Daloradius and radclient via the command line [root@localhost ~]# echo "User-Name='TC-Demo'" | radclient -c '1' -n '3' -r '3' -t '3' -x '192.168.11.1:1700' 'disconnect' 'test123' 2>&1 Sending Disconnect-Request of id 114 to 192.168.11.1 port 1700 User-Name = "TC-Demo" ^X^C [root@localhost ~]# echo "User-Name='TC-Demo'" | radclient -c '1' -n '3' -r '3' -t '3' -x '192.168.11.1:1814' 'disconnect' 'test123' 2>&1 Sending Disconnect-Request of id 77 to 192.168.11.1 port 1814 User-Name = "TC-Demo" Sending Disconnect-Request of id 77 to 192.168.11.1 port 1814 User-Name = "TC-Demo" Sending Disconnect-Request of id 77 to 192.168.11.1 port 1814 User-Name = "TC-Demo" radclient: no response from server for ID 77 socket 3 [root@localhost ~]# echo "User-Name='TC-Demo'" | radclient -c '1' -n '3' -r '3' -t '3' -x '192.168.11.1:1813' 'disconnect' 'test123' 2>&1 Sending Disconnect-Request of id 215 to 192.168.11.1 port 1813 User-Name = "TC-Demo" Sending Disconnect-Request of id 215 to 192.168.11.1 port 1813 User-Name = "TC-Demo" Sending Disconnect-Request of id 215 to 192.168.11.1 port 1813 User-Name = "TC-Demo" radclient: no response from server for ID 215 socket 3 [root@localhost ~]# echo "User-Name='TC-Demo'" | radclient -c '1' -n '3' -r '3' -t '3' -x '192.168.11.1:1812' 'disconnect' 'test123' 2>&1 Sending Disconnect-Request of id 168 to 192.168.11.1 port 1812 User-Name = "TC-Demo" Sending Disconnect-Request of id 168 to 192.168.11.1 port 1812 User-Name = "TC-Demo" Sending Disconnect-Request of id 168 to 192.168.11.1 port 1812 User-Name = "TC-Demo" radclient: no response from server for ID 168 socket 3 The server is listening on all the port's I have tried .. root@localhost ~]# netstat -antup | grep rad udp 0 0 0.0.0.0:1812 0.0.0.0:* 2461/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 2461/radiusd udp 0 0 0.0.0.0:1814 0.0.0.0:* 2461/radiusd What have I missed ... Regards Gregory Machin Email: gmachin(a)techconcepts.co.za Cell: +27 (0) 72 524 5098 gtalk: gmachin.techconcepts(a)gmail.com Support helpdesk(a)techconcepts.co.za Tell: +27 (0) 11 803 2169 Fax: +27 (0) 11 803 2189 After Hours Cell: +27 (0) 82 790 0796

2 1

Robust proxy accounting
by Chris Howley 17 Jun '09

17 Jun '09

Alan & Ivan, I can confirm that the change made to the event.c file fixed the problem with the robust proxy accounting. Many thanks for you help. Chris

2 1

Password conflict between Radius Server and Machine account
by kpani 17 Jun '09

17 Jun '09

Hi, When I was trying to authenticate ssh login through radius server, I noticed an conflict issue with password. I have a linux machine-1 in which radius server is installed. I have configured an user with name/password as root/public in /usr/local/etc/raddb/users. But the linux machine already have a 'root' user account with password 'public123'. Now I tried to ssh machine-2 with username 'root' and password 'public'. SSH of this machine-2 is configured with above radius server for authentication. But the radius server rejects the access-request and log as below. ----------------------------- ++[unix] returns updated [files] users: Matched entry root at line 107 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "public" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject ----------------------- Note the highlighted lines. First line says '[unix] returns updated. Later says 'password doesn't match'. But if I try with Machine-1 password 'public123', it accepts the request. So looks like that the radius server authenticates with machine password & not using the configured one. Please clarify me if you have faced this issue. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Password-conflict-between-Radius-Server-and-Machine-a… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4