June 2009 - Freeradius-Users - lists.freeradius.org

RE: Free Radius users record samples for SmartEdgerouter subcriberauthentication.
by Ivan Kalik 17 Jun '09

17 Jun '09

> Now the subscriber config on Radius is as follows: > > abc@RADIUS Cleartext-Password := "test" > Service-Type = Framed-User, > Framed-Protocol = PPP Are you sure you are changing the correct users file? I don't see this entry in the debug. Do you know what server version you are using? Do radiusd -v if you don't. This debug looks older than 1.1.4. >>From redius debug: > rad_recv: Access-Request packet from host 10.205.1.1:1812, id=3, > length=187 > User-Name = "abc@RADIUS" > User-Password = "test" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Identifier = "Quiet" > NAS-Port = 167903232 > NAS-Real-Port = 2717909092 > NAS-Port-Type = Virtual > NAS-Port-Id = "10/2 vlan-id 100 pppoe 347" > Medium-Type = DSL > Mac-Addr = "00-0c-29-10-12-c3" > Platform-Type = SmartEdge-800 > OS-Version = "6.1.2.6p9" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > radius_xlat: > '/usr/local/var/log/radius/radacct/10.205.1.1/auth-detail-20090616' > rlm_detail: > /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m% > d expands to > /usr/local/var/log/radius/radacct/10.205.1.1/auth-detail-20090616 > modcall[authorize]: module "auth_log" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: Looking up realm "RADIUS" for User-Name = "abc@RADIUS" > rlm_realm: No such realm "RADIUS" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry DEFAULT at line 183 One of these sets Auth-Type System. Comment it out. > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > modcall[authenticate]: module "unix" returns notfound for request 0 > modcall: leaving group authenticate (returns notfound) for request 0 > auth: Failed to validate the user. > Login incorrect: [abc@RADIUS/test] (from client SE-Quiet port 167903232) > Delaying request 0 for 1 seconds > Finished request 0 > > Unfortunately, the login is still failing with no obvious reason why. Because default entry in users file sets Auth-Type to System. It was like that by default in old versions. If your version in pre 1.1.4 you will need to force Auth-Type. Probably to Local. But let's see the version first. Ivan Kalik Kalik Informatika ISP

3 2

Re: Wireless-802.11 vs. Ethernet and MSCHAP vs. EAP-TLS
by Ivan Kalik 16 Jun '09

16 Jun '09

> I have working, fresh FreeRADIUS 2.1.6 configuration with certificates for > EAP-TLS in wireless network - Access-Accept with real AP and eapol_test > tool. An attempt to use this environment (except NAS) for wired network - > this same client (MS Vista), server and certs unfortunately doesn't work > (logs below). Changing authentication protocol to MSCHAP allow to > authenticate client. Can anybody explain this? That Vista supplicant is broken: ... > rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=10, > length=132 > State = 0xa0f2d08ba418ddd73e9644301c3ef096 > NAS-Port-Type = Ethernet > User-Name = "user" > NAS-IP-Address = 192.168.167.10 > NAS-Port = 2 > Framed-MTU = 1000 > NAS-Port-Id = "Port 2" > Calling-Station-Id = "00-21-70-88-3f-c1" > Called-Station-Id = "00-30-4f-64-76-eb" > Message-Authenticator = 0xfbc6c2b85d0058ca9db53c130e84189c ... > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop ... It stopped doing EAP for some reason. There is no EAP-Message in that last packet. Ivan Kalik Kalik Informatika ISP

1 0

LDAP Authentication + Windows PKI
by Nik Alleyne 16 Jun '09

16 Jun '09

Guys just a quick question. Can I use freeradius to authenticate my LDAP users and instead of using OpenSSL for certificates I use a Microsoft Certificate Authority? Thanks Nik Nik

2 1

Wireless-802.11 vs. Ethernet and MSCHAP vs. EAP-TLS
by Roman Osinski 16 Jun '09

16 Jun '09

I have working, fresh FreeRADIUS 2.1.6 configuration with certificates for EAP-TLS in wireless network - Access-Accept with real AP and eapol_test tool. An attempt to use this environment (except NAS) for wired network - this same client (MS Vista), server and certs unfortunately doesn't work (logs below). Changing authentication protocol to MSCHAP allow to authenticate client. Can anybody explain this? I include also tcpdump udp log with wire EAP-TLS and MSCHAP attempts. Roman FreeRADIUS Version 2.1.6, for host x86_64-redhat-linux-gnu, built on Jun 13 2009 at 22:31:21 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radius including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 82.177.110.0/24 { require_message_authenticator = no secret = "testing123" shortname = "net1" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=5, length=125 EAP-Message = 0x02e500090175736572 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0xdaed83fa984e5b449d2b5ade2aa3d1ed +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 229 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 82.177.110.254 port 1031 EAP-Message = 0x01e600160410a0cbb341372205eb554eb0b2cd249087 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba014d4d73e9644301c3ef096 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=6, length=140 EAP-Message = 0x02e60006030d State = 0xa0f2d08ba014d4d73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0x4a5f43f0ed7660b314de11cd14d2f8a4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 230 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 6 to 82.177.110.254 port 1031 EAP-Message = 0x01e700060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba115ddd73e9644301c3ef096 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=7, length=249 EAP-Message = 0x02e700730d800000006916030100640100006003014a37f2d9d81d2e724b64f5a53b2b84ed 2627b68d7ef8bdc4a2bdcb9d59e9f19a000018002f00350005000ac009c00ac013c014003200 38001300040100001f00000009000700000475736572000a00080006001700180019000b0002 0100 State = 0xa0f2d08ba115ddd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0x6f3b0b9d224a69919e7d33f3ae7a7935 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 231 length 115 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 105 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0064], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 085e], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00a5], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 7 to 82.177.110.254 port 1031 EAP-Message = 0x01e803e40dc00000093c160301002a0200002603014a37f2d973f3e9b88d4843387565dbd3 9f0f6d058fef1b23a1ca2a53b3ed715f00002f00160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303631363138333933395a170d3130303631363138333933395a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100b5fed94d3f89e8354b4675953ecf5079731ed6c764f6e8463b76b57f1f467c3573951438 678735f1e16a4dc60c29b8627ba68bf7ad7fc726c00fd81f38bf EAP-Message = 0xde473e29474eacd059a054b6e50af989ba9a52b7428bbc739bb2fd61c628eddd1e262d44ab 80166dfbdbc9600c3e25347db96882921ee1dc9726e8359d37151267d0c79401d3a96c3e443f 2ffaaa18fb7d9342669fe8df3efd3fba51f6d5ca0db45186f59140aed4fc46e69432cc8faf78 9fcd3c1ae84369fb20768195b9a2166ac70e5f0b1a4dfd0cd360dc9401cdc6257071d38d777d 889fc1440863538193c173d3385c1e59f6b987522088aa3f1ec0fa7a1648872ccd5b7cbd91c2 91d26161510203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d01010405000382010100559f537cd2d6155201 EAP-Message = 0x4a35ace62804b09e3c149f09770968d8f3f6749c1c88f3d6fb5b53cf56a1b077d37dd37e82 e480568b04170e075499b422930842ba9e96247a1ba4d462e9237cf64f06da96b90b3c7c9619 ad368be68377e9d1f3c1069f53334753bda754958bb3b285e188f0022085301e7576de7d5d53 51a4eccbcdd825ea39015633c03f7989ffd54ec4568b0c917fe8d90659794958a2cb1c2b8e7e a80abcb46935819e6f896488e66dd9e9a5129609cde5914c35bce6beca6f40955d464ede3eb7 a58ece7fa46a00cf1a67fddf2e0f313d1da121eff97fb7b8181b8cd80e2db4f5c33125fd4154 6910edb6cb302641b015 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba21addd73e9644301c3ef096 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=8, length=140 EAP-Message = 0x02e800060d00 State = 0xa0f2d08ba21addd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0x3aa4dd5a2f13b1b0d46bd4f96a0cb57c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 232 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 8 to 82.177.110.254 port 1031 EAP-Message = 0x01e903e40dc00000093cd7d1933106981e3106ec0004ab308204a73082038fa00302010202 0900e6180639daca988e300d06092a864886f70d0101050500308193310b3009060355040613 024652310f300d060355040813065261646975733112301006035504071309536f6d65776865 726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01 0901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c 6520436572746966696361746520417574686f72697479301e170d3039303631363138333933 395a170d3130303631363138333933395a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f 6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a86 4886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d45 78616d706c6520436572746966696361746520417574686f7269747930820122300d06092a86 4886f70d01010105000382010f003082010a0282010100bae0132e85b4d333eb0f938649b9ff cdd3c4df1d9b95fbfdc27da949c4a57f0688afa287526b00e5dfe42a51dff2c7cb830ced5900 e07fff582e0f0f24e70c08651d3c421a4146ec205d5e780b7c18 EAP-Message = 0xe09d7762de128f4d81bb4e02634472257b8c97d6f8a31ecce8ac469875897a773bbeb313b9 9c3cc26e53ae8320a703cef8a09f10e3746150bed9a60b65954403e832066de56f5a5d04337b cb81b1c3ba52694bb1f17fe0e04835cdf15af01d40ae566aa5f74e8d54c14bd74d036d896b16 bc2a53a4bb76dde6d6568b9f9b2022b7ab97f266aaf31bd433789746f6d1b2ca988c29a3d740 6ab34673e3d972564199e72dc37fce778d9c6b719380d7663b970203010001a381fb3081f830 1d0603551d0e04160414bec5f6ac11f03b47a83f222fbe6396bb420561973081c80603551d23 0481c03081bd8014bec5f6ac11f03b47a83f222fbe6396bb4205 EAP-Message = 0x6197a18199a48196308193310b3009060355040613024652310f300d060355040813065261 646975733112301006035504071309536f6d65776865726531153013060355040a130c457861 6d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c 652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 74686f72697479820900e6180639daca988e300c0603551d13040530030101ff300d06092a86 4886f70d010105050003820101007ae730871704240abb7b5691e3157fc0e3ea6e8bd92e5e91 dede737b1f256939b062 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba31bddd73e9644301c3ef096 Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=9, length=140 EAP-Message = 0x02e900060d00 State = 0xa0f2d08ba31bddd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0xa930851fd6fe884a0ddc9807e3e5b400 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 233 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 9 to 82.177.110.254 port 1031 EAP-Message = 0x01ea01920d800000093c24bf9b2dff50e61be23fe43da862089bc076cba926f213a5866b8e 12bc81a0f89bae8541c8358e892bf9ab5752b626221fdac94d5083347646cf8113eba7da61dd 4a83ac68eebbc38f3c0e6eff9ef3c74352ebebed0e630d4a3cb320c6405068fea521004e981b 8bcabfb2e28cf3857ccb4f66693d667c7103467264cc8cb2236d5d170141b64b9b27ad156e72 82e175a740f996b020c008ff1d8a0b88e8e752b74d06c4b91d9426ef35450894731f383d96ca d66078dfbbd7c5c8a0f344bd497d111cc1b111c286dd3c05e0e0b920bf5eceb5ee4285bece6e 89722d50ac16030100a50d00009d02010200980096308193310b EAP-Message = 0x3009060355040613024652310f300d06035504081306526164697573311230100603550407 1309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e 06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 03131d4578616d706c6520436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba418ddd73e9644301c3ef096 Finished request 4. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=10, length=132 State = 0xa0f2d08ba418ddd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0xfbc6c2b85d0058ca9db53c130e84189c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: EAP-Message not found [eap] Malformed EAP Message ++[eap] returns fail Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 10 to 82.177.110.254 port 1031 Waking up in 3.5 seconds. tcpdump udp EAP-TLS 21:30:33.053733 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x06 length: 64 21:30:33.134032 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x07 length: 1060 21:30:33.230737 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x08 length: 1060 21:30:33.328955 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x09 length: 462 21:30:34.426570 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Reject (3), id: 0x0a length: 20 MSCHAP 21:33:43.143857 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0b length: 80 21:33:43.188373 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0c length: 64 21:33:43.240048 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0d length: 1060 21:33:43.336123 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0e length: 1056 21:33:43.432084 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0f length: 295 21:33:43.516841 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x10 length: 123 21:33:52.560700 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x11 length: 101 21:33:52.604671 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x12 length: 117 21:33:52.656651 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x13 length: 149 21:33:52.704461 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x14 length: 101 21:33:52.749780 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Accept (2), id: 0x15 length: 165

1 0

Wireless-802.11 vs. Ethernet and MSCHAP vs. EAP-TLS
by Roman Osinski 16 Jun '09

16 Jun '09

I have working, fresh FreeRADIUS 2.1.6 configuration with certificates for EAP-TLS in wireless network - Access-Accept with real AP and eapol_test tool. An attempt to use this environment (except NAS) for wired network - this same client (MS Vista), server and certs unfortunately doesn't work (logs below). Changing authentication protocol to MSCHAP allow to authenticate client. Can anybody explain this? I include also tcpdump udp log with wire EAP-TLS and MSCHAP attempts. Roman FreeRADIUS Version 2.1.6, for host x86_64-redhat-linux-gnu, built on Jun 13 2009 at 22:31:21 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radius including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 82.177.110.0/24 { require_message_authenticator = no secret = "testing123" shortname = "net1" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=5, length=125 EAP-Message = 0x02e500090175736572 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0xdaed83fa984e5b449d2b5ade2aa3d1ed +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 229 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 82.177.110.254 port 1031 EAP-Message = 0x01e600160410a0cbb341372205eb554eb0b2cd249087 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba014d4d73e9644301c3ef096 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=6, length=140 EAP-Message = 0x02e60006030d State = 0xa0f2d08ba014d4d73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0x4a5f43f0ed7660b314de11cd14d2f8a4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 230 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 6 to 82.177.110.254 port 1031 EAP-Message = 0x01e700060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba115ddd73e9644301c3ef096 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=7, length=249 EAP-Message = 0x02e700730d800000006916030100640100006003014a37f2d9d81d2e724b64f5a53b2b84ed 2627b68d7ef8bdc4a2bdcb9d59e9f19a000018002f00350005000ac009c00ac013c014003200 38001300040100001f00000009000700000475736572000a00080006001700180019000b0002 0100 State = 0xa0f2d08ba115ddd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0x6f3b0b9d224a69919e7d33f3ae7a7935 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 231 length 115 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 105 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0064], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 085e], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00a5], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 7 to 82.177.110.254 port 1031 EAP-Message = 0x01e803e40dc00000093c160301002a0200002603014a37f2d973f3e9b88d4843387565dbd3 9f0f6d058fef1b23a1ca2a53b3ed715f00002f00160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303631363138333933395a170d3130303631363138333933395a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100b5fed94d3f89e8354b4675953ecf5079731ed6c764f6e8463b76b57f1f467c3573951438 678735f1e16a4dc60c29b8627ba68bf7ad7fc726c00fd81f38bf EAP-Message = 0xde473e29474eacd059a054b6e50af989ba9a52b7428bbc739bb2fd61c628eddd1e262d44ab 80166dfbdbc9600c3e25347db96882921ee1dc9726e8359d37151267d0c79401d3a96c3e443f 2ffaaa18fb7d9342669fe8df3efd3fba51f6d5ca0db45186f59140aed4fc46e69432cc8faf78 9fcd3c1ae84369fb20768195b9a2166ac70e5f0b1a4dfd0cd360dc9401cdc6257071d38d777d 889fc1440863538193c173d3385c1e59f6b987522088aa3f1ec0fa7a1648872ccd5b7cbd91c2 91d26161510203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d01010405000382010100559f537cd2d6155201 EAP-Message = 0x4a35ace62804b09e3c149f09770968d8f3f6749c1c88f3d6fb5b53cf56a1b077d37dd37e82 e480568b04170e075499b422930842ba9e96247a1ba4d462e9237cf64f06da96b90b3c7c9619 ad368be68377e9d1f3c1069f53334753bda754958bb3b285e188f0022085301e7576de7d5d53 51a4eccbcdd825ea39015633c03f7989ffd54ec4568b0c917fe8d90659794958a2cb1c2b8e7e a80abcb46935819e6f896488e66dd9e9a5129609cde5914c35bce6beca6f40955d464ede3eb7 a58ece7fa46a00cf1a67fddf2e0f313d1da121eff97fb7b8181b8cd80e2db4f5c33125fd4154 6910edb6cb302641b015 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba21addd73e9644301c3ef096 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=8, length=140 EAP-Message = 0x02e800060d00 State = 0xa0f2d08ba21addd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0x3aa4dd5a2f13b1b0d46bd4f96a0cb57c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 232 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 8 to 82.177.110.254 port 1031 EAP-Message = 0x01e903e40dc00000093cd7d1933106981e3106ec0004ab308204a73082038fa00302010202 0900e6180639daca988e300d06092a864886f70d0101050500308193310b3009060355040613 024652310f300d060355040813065261646975733112301006035504071309536f6d65776865 726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01 0901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c 6520436572746966696361746520417574686f72697479301e170d3039303631363138333933 395a170d3130303631363138333933395a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f 6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a86 4886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d45 78616d706c6520436572746966696361746520417574686f7269747930820122300d06092a86 4886f70d01010105000382010f003082010a0282010100bae0132e85b4d333eb0f938649b9ff cdd3c4df1d9b95fbfdc27da949c4a57f0688afa287526b00e5dfe42a51dff2c7cb830ced5900 e07fff582e0f0f24e70c08651d3c421a4146ec205d5e780b7c18 EAP-Message = 0xe09d7762de128f4d81bb4e02634472257b8c97d6f8a31ecce8ac469875897a773bbeb313b9 9c3cc26e53ae8320a703cef8a09f10e3746150bed9a60b65954403e832066de56f5a5d04337b cb81b1c3ba52694bb1f17fe0e04835cdf15af01d40ae566aa5f74e8d54c14bd74d036d896b16 bc2a53a4bb76dde6d6568b9f9b2022b7ab97f266aaf31bd433789746f6d1b2ca988c29a3d740 6ab34673e3d972564199e72dc37fce778d9c6b719380d7663b970203010001a381fb3081f830 1d0603551d0e04160414bec5f6ac11f03b47a83f222fbe6396bb420561973081c80603551d23 0481c03081bd8014bec5f6ac11f03b47a83f222fbe6396bb4205 EAP-Message = 0x6197a18199a48196308193310b3009060355040613024652310f300d060355040813065261 646975733112301006035504071309536f6d65776865726531153013060355040a130c457861 6d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c 652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 74686f72697479820900e6180639daca988e300c0603551d13040530030101ff300d06092a86 4886f70d010105050003820101007ae730871704240abb7b5691e3157fc0e3ea6e8bd92e5e91 dede737b1f256939b062 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba31bddd73e9644301c3ef096 Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=9, length=140 EAP-Message = 0x02e900060d00 State = 0xa0f2d08ba31bddd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0xa930851fd6fe884a0ddc9807e3e5b400 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 233 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 9 to 82.177.110.254 port 1031 EAP-Message = 0x01ea01920d800000093c24bf9b2dff50e61be23fe43da862089bc076cba926f213a5866b8e 12bc81a0f89bae8541c8358e892bf9ab5752b626221fdac94d5083347646cf8113eba7da61dd 4a83ac68eebbc38f3c0e6eff9ef3c74352ebebed0e630d4a3cb320c6405068fea521004e981b 8bcabfb2e28cf3857ccb4f66693d667c7103467264cc8cb2236d5d170141b64b9b27ad156e72 82e175a740f996b020c008ff1d8a0b88e8e752b74d06c4b91d9426ef35450894731f383d96ca d66078dfbbd7c5c8a0f344bd497d111cc1b111c286dd3c05e0e0b920bf5eceb5ee4285bece6e 89722d50ac16030100a50d00009d02010200980096308193310b EAP-Message = 0x3009060355040613024652310f300d06035504081306526164697573311230100603550407 1309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e 06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 03131d4578616d706c6520436572746966696361746520417574686f726974790e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa0f2d08ba418ddd73e9644301c3ef096 Finished request 4. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 82.177.110.254 port 1031, id=10, length=132 State = 0xa0f2d08ba418ddd73e9644301c3ef096 NAS-Port-Type = Ethernet User-Name = "user" NAS-IP-Address = 192.168.167.10 NAS-Port = 2 Framed-MTU = 1000 NAS-Port-Id = "Port 2" Calling-Station-Id = "00-21-70-88-3f-c1" Called-Station-Id = "00-30-4f-64-76-eb" Message-Authenticator = 0xfbc6c2b85d0058ca9db53c130e84189c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: EAP-Message not found [eap] Malformed EAP Message ++[eap] returns fail Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 10 to 82.177.110.254 port 1031 Waking up in 3.5 seconds. tcpdump udp EAP-TLS 21:30:33.053733 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x06 length: 64 21:30:33.134032 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x07 length: 1060 21:30:33.230737 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x08 length: 1060 21:30:33.328955 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x09 length: 462 21:30:34.426570 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Reject (3), id: 0x0a length: 20 MSCHAP 21:33:43.143857 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0b length: 80 21:33:43.188373 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0c length: 64 21:33:43.240048 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0d length: 1060 21:33:43.336123 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0e length: 1056 21:33:43.432084 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x0f length: 295 21:33:43.516841 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x10 length: 123 21:33:52.560700 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x11 length: 101 21:33:52.604671 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x12 length: 117 21:33:52.656651 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x13 length: 149 21:33:52.704461 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Challenge (11), id: 0x14 length: 101 21:33:52.749780 IP primer02.ihar.edu.pl.radius > ihar_254.ihar.edu.pl.iad2: RADIUS, Access Accept (2), id: 0x15 length: 165

1 0

PPTP - Radius connection failure
by John Kane 16 Jun '09

16 Jun '09

Forgive me if this is not the correct mailing list for this question (and if not, point me to the correct one, if possible). I am running PPTP (poptop w/radiusclient) on the same RHEL Linux box as the freeradius server. Initially, all works well. But after some time (30-45 min?), the radius server quits responding, and I see this in the pptpd.log: Jun 16 14:32:35 time3 pppd[29588]: rc_send_server: no reply from RADIUS server localhost.localdomain:1812 Running radiusd in debug mode shows nothing coming in for this query, although the server shows to be listening: [root@time3 raddb]# netstat -ua | grep rad udp 19260 0 *:radius *:* udp 0 0 *:radius-acct *:* When this is occurring, radtest also fails, as it never gets a response (just keep resending). I am running (sorry, I realize that is no longer supported, but that's RH's latest Freeradius RPM, thus what I am required to use): freeradius 1.1.3 freeradius-client 1.1.6 ppp 2.2.4 pptpd 1.3.4 My configs: # cat /etc/radiusclient/radiusclient.conf | grep -v '#' | grep -v '^$' auth_order radius login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver localhost acctserver localhost servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login # cat /etc/radiusclient/servers | grep -v '#' | grep -v '^$' localhost/localhost testing123 # cat /etc/pptpd.conf | grep -v '#' | grep -v '^$' ppp /usr/sbin/pppd option /etc/ppp/options.pptpd debug stimeout 5 logwtmp connections 63 localip 172.20.1.143 remoteip 172.20.2.128-191 # cat /etc/ppp/options.pptpd | grep -v '#' | grep -v '^$' name pptpd refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns 172.24.2.197 ms-dns 172.24.2.196 proxyarp debug dump lock nobsdcomp novj novjccomp nologfd plugin radius.so plugin radattr.so Thanks for any help or suggestions, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 1

Statistic RADIUS
by Marco De Magistris 16 Jun '09

16 Jun '09

Hi all, In my Scenario FreeRadius is used as RADIUS PROXY. Is it possible with FreeRadius generating the statistics based on an Attribute? i.e The statistics based on NAS-Port-ID. Thanks in advance for your support. Regards Marco

3 2

Re: Free Radius users record samples for SmartEdge router subcriber authentication.
by Ivan Kalik 16 Jun '09

16 Jun '09

> I am trying a simple authenticate pppoe subscriber in radius server (v > 1.188.2.4.2.11) for subscribers coming through Redback SmartEdge 800 > router. As I am new to this I am looked for some examples for users > configuration on RADIUS but could not find. I have tried something out > but seems missing certain stuff: > > abc Auth-Type := Local, Password == "passwd" > Service-Type = Framed-User, > Framed-Protocol = PPP, > Bind_Auth_Context = RADIUS > > Thanks for refering me to some examples. Examples relevant to your freeradius version will be - in users file. That example looks seriously outdated. What needs to be returned to Redback - will be in Redback documentation. Ivan Kalik Kalik Informatika ISP

1 0

pseudo-newbie exec scripts and session-time
by Charles Gregory 16 Jun '09

16 Jun '09

Greetings! I've been cruising the archives and pages and don't quite see what I am looking for. I am hoping someone can point me to a nice simple HOWTO or MAN page for specifying an 'exec' script in radiusd.conf that will set the Session-Timeout and return it to the NAS. I'm thinking: Session-Timeout := %{exec:timecalc} Or something like that. Also, where exactly should this go in the 'authorize' section? I'm presuming at the end, but have found no examples.... Our dialups have a couple of diffrent time parameters, including a user-option file, so while I appreciate any info on the radius 'counter' function, I don't think it will meet all my needs. Hmmm. While I'm here, if I set Session-Timeout to ZERO, what will happen? Thanks in advance! - Charles

7 46

Failover fails in proxy.conf
by Santiago Balaguer García 16 Jun '09

16 Jun '09

Hi, I am using in my AAA servers the freeradius 2.1.3 version. I am configuring the failover for the myrealm.com in proxy.conf. For myrealm.com realm I have two AAA servers: 1.2.3.4 and 1.2.3.5 ############################################################ home_server primary_server { type = auth+acct ipaddr = 1.2.3.4 port = 1812 secret = mysecret require_message_authenticator = no response_window = 5 zombie_period = 60 revive_interval = 5 status_check = status-server check_interval = 60 num_answers_to_alive = 3 } home_server secondary_server { type = auth+acct ipaddr = 1.2.3.5 port = 1812 secret = mysecret require_message_authenticator = no response_window = 5 zombie_period = 60 revive_interval = 5 status_check = status-server check_interval = 60 num_answers_to_alive = 3 } home_server_pool roam_pool { type = fail-over home_server = primary_server home_server = secondary_server } realm myrealm.com { nostrip pool = roam_pool } ################################################# With the primary server everything works fine, but my problem is when I force to switch to fallover server (I switch off IP 1.2.3.4 machine) my freeradius server does not change to request 1.2.3.5 server. I try the fowoling configuration: ################################################3 home_server primary_server { ... } home_server secondary_server { ... } home_server_pool roam_pool { type = fail-over home_server = primary_server } realm myrealm.com { nostrip pool = roam_pool } home_server_pool roam_pool2 { type = fail-over home_server = secondary_server } realm myrealm.com { nostrip pool = roam_pool2 } ############################################3 With the same result --> does not work. Any suggestion? _________________________________________________________________ Nuevo Windows Live, un mundo lleno de posibilidades. Descúbrelo. http://www.microsoft.com/windows/windowslive/default.aspx

3 4