June 2009 - Freeradius-Users - lists.freeradius.org

eap-peap username/password problem
by kalesameer 08 Jun '09

08 Jun '09

i have implemented eap-peap using freeradius-2.1.1. i am using windows XP machines as clients. when users try to connect to server using the peap protocol,they are asked for their username and password. my problem is that once the users are connected to the server,they are not asked for a username/password when they try to connect after logging out of the network.the username/password that was used to connect to network initially, is used automatically for subsequent purposes to connect to the network. is it a problem of the XP clients?or is the radius server caching all the requests so that the next time no username/password is required?is there any way so that the users are asked for a username/password every time they want to connect after disconnecting(logging out)? -- View this message in context: http://www.nabble.com/eap-peap-username-password-problem-tp23915126p2391512… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

Re: Re: eap-peap username/password problem
by David Mitton 08 Jun '09

08 Jun '09

1 0

Duplicate SQL records versus unique constraints
by Christian Balzer 08 Jun '09

08 Jun '09

Hello, First of, been using freeradius for 5-6 years now and we are happy campers thanks to it. Freeradius 2.04 (Debian Lenny package), but I don't think this is very version specific. Configuration is set for direct (sql, not sql_log) logging of accounting records into mysql. We've got a number of what can only be described as "maniac" customers which fire off new sessions every minute or 2 and one of these has managed to create over 2000 "identical" sessions, as far as actsessionid and the default generation of acctuniqueid are concerned. It seems that the NAS in question is prone to recycle actsessionids under the onslaught of this user (within days at times). We are talking to the upstream access provider about this, but I don't think much of anything will come out of it. In this setting the default key generation for the acctuniqueid of: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" did little to stop the duplicates, since only the Acct-Session-Id is variable (when not re-used by the NAS), the rest are more or less static. We changed the Client-IP-Address to Framed-IP-Address in the key generation as this gives a much, much smaller chance of duplicates. But of course it does not guarantee uniqueness either. In the analysis of this event it became clear that the sql module will happily update any and all records that share the same acctuniqueid with a new stop and session time, even if these were not NULL or 0 respectively. Never mind that this whole scenario should not happen in the first place it seems that overwriting valid data in an already "complete" accounting record would be big no-no. Could anybody comment on this? Given this behavior and the still existing (albeit vastly smaller) chance of future duplicate records making it into the database I have a question: If we add a CONSTRAINT to enforce uniqueness for acctuniqueid in the DB, will the failure to insert an accounting record confuse the freerad sql module and will those failures percolate up towards the radius protocol level and thus result in the NAS keep on sending that accounting packet? Regards, Christian -- Christian Balzer Network/Systems Engineer NOC chibi(a)gol.com Global OnLine Japan/Fusion Network Services http://www.gol.com/ https://secure3.gol.com/mod-pl/ols/index.cgi/?intr_id=F-2ECXvzcr6656

3 7

Reply-message and supplicant
by Sergio Belkin 08 Jun '09

08 Jun '09

Hi, Is possible that Reply-message can be seen from laptops running the supplicant? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

5 27

Question on proxying requests
by Josh Hiner 07 Jun '09

07 Jun '09

Have a question on proxying requests in Freeradius. I know how to proxy requests to other radius servers via the proxy.conf based on domain etc.. I would like to have one radius server and authenticate off multiple domain controllers based on domain using ntlm_auth. Right now I see that you can only configure ntlm_auth in the mschapv2 module in /etc/raddb/modules. This works fine for one domain. But if a user from domain ISD wants to authenticate on our wireless, I want the radius server to authenticate on the ISD file server (its a samba server). If the user is in the HTN domain I would like the radius server to authenticate off the HTN domain controller. Or maybe ntlm_auth isnt the way to do this? Maybe I'm looking at this the wrong way? Any ideas to get this to work or any other better ideas? Thanks! -Josh

2 1

Prevent uid sharing or hot to allow use uid only once
by Sergio Belkin 06 Jun '09

06 Jun '09

Hi, Let's suppose that John Doe comes and login with jdoe uid, then Joe comes and wants to use wireless network, but he has not entry neither Ldap nor in radius users file, so he ask for jdoe that pass him its uid and password to login. Sorry if that sounds somewhat stupid but can we prevent that from radius? (please don't tell me to fire John Doe ;) ). Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 7

Re: Building a test tool
by Vinit Karandikar 06 Jun '09

06 Jun '09

Thanks for the prompt responses, Alan. I have a one follow up question before I head off and start poking through code, doxygen and writing some code. > > Vinit Karandikar wrote: > > >> So if I could run 10 copies of radclient in one process (each in a >> different thread for example), I can write code to co-ordinate what each >> thread should do for each test case. >> > > The server comes with a RADIUS API. You can use the API to create an > application that sends and receives RADIUS packets. > Aha ! Where can I find information on this API for what you correctly described as "very custom" development that I'm looking to do ? > >> Hope this illustrates the functionality I mentioned as desired in my >> original email. >> In BOTH cases, the AAA server is expected to forward RADIUS requests to >> a different network element and it behooves a test application to see >> both ends. >> > > What you're describing is a RADIUS simulator for a specific test > environment. That doesn't exist. It is a *very* custom piece of software. > > FreeRADIUS can do a lot of this, but you will still need to write all > of the custom rules for processing, timing, etc. > > > >> The point once again is just to ask if >> a) there is already a tool that can simulate multiple network elements >> and co-ordinate between them to know when to expect a packet and when to >> initiate traffic >> > > ... for your specific environment, and your specific test cases. > > The answer to that is "no". > > > > Alan DeKok. > > > ------------------------------ > >

2 1

RE: FreeRadius 2.1 + LDAP Authentication - mschap
by Mackey, Theral 05 Jun '09

05 Jun '09

[mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for sminhas with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Needs NT/LM passwords (or plain-text) for mschap to work. See perl's Crypt::SmbHash on CPAN for an easy way to generate the hash from plaintext. Look at the samba schema for openLdap, and probably want to compile the smbk5pwd module for openLDAP as well (in the contrib section of the source) to keep your pwds sync'd (also check pam/nssldap conf for passwd changes using LDAP-exop if you let shell accounts change pwds too). -T ----------------------------- Message: 7 Date: Fri, 05 Jun 2009 14:47:36 -0400 From: Nik Alleyne <nalleyne(a)brontecollege.ca> Subject: FreeRadius 2.1 + LDAP Authentication To: freeradius-users(a)lists.freeradius.org Message-ID: <20090605144736.cpa0ghg1wk4ok4gk(a)mail.brontecollege.ca> Content-Type: text/plain; charset=ISO-8859-1 Hi Guys, I'm hoping someone can help me, because I have been fighting with this issue for days now. Environment: FC10 + FreeRadius 2.1 + OpenLdap 2.4. I've successfully setup Certificate Based authentication on my FreeRadius server and that works well. My problem is I have some users I want to authenticate via username and password (EAP-PEAP). I configured FreeRadius for such and my radtest (Access-Accept) works as well as my NTRadPing Utility (Access-Accept) when checked against the users in LDAP. However, I cannot seem to get my Windows XP Wireless Clients to authenticate. Please see my debug info below for a sample user "sminhas" who has a cleartext LDAP password as "it". Thanks for the help. ---------------- radiusd -X ---------------------..snip

1 0

FreeRadius 2.1 + LDAP Authentication
by Nik Alleyne 05 Jun '09

05 Jun '09

Hi Guys, I'm hoping someone can help me, because I have been fighting with this issue for days now. Environment: FC10 + FreeRadius 2.1 + OpenLdap 2.4. I've successfully setup Certificate Based authentication on my FreeRadius server and that works well. My problem is I have some users I want to authenticate via username and password (EAP-PEAP). I configured FreeRadius for such and my radtest (Access-Accept) works as well as my NTRadPing Utility (Access-Accept) when checked against the users in LDAP. However, I cannot seem to get my Windows XP Wireless Clients to authenticate. Please see my debug info below for a sample user "sminhas" who has a cleartext LDAP password as "it". Thanks for the help. ---------------- radiusd -X ------------------------------- FreeRADIUS Version 2.1.3, for host i386-redhat-linux-gnu, built on Dec 8 2008 at 15:31:31 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mschap.nik including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ldap.conf including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.16.3.0/24 { require_message_authenticator = no secret = "BronteCollege" shortname = "bcc_WiFi" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "localhost" port = 389 password = "pp2%dfs;e" identity = "cn=Manager,dc=bcc,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=bcc,dc=com" filter = "(uid=%u)" base_filter = "(objectclass=uid)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90433c8 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=2, length=157 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000c01736d696e686173 Message-Authenticator = 0xff3ec4918f7da24d224ee1e7f4e7687e +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=bcc,dc=com/pp2%dfs;e to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 2 to 172.16.3.243 port 1026 EAP-Message = 0x0101001604107dc67d8561a4104bcd5d2564a184ae21 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6448bc34871cad843bf022113 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=3, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060319 State = 0x448ac7e6448bc34871cad843bf022113 Message-Authenticator = 0xf484e28ce3364ad7c758370ff8a0fde7 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 3 to 172.16.3.243 port 1026 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64588de4871cad843bf022113 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=4, length=243 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0202005019800000004616030100410100003d03014a29675935525b99ff34aa90ab2f4f55de41f178895635aaf694bbc0d2abd39200001600040005000a000900640062000300060013001200630100 State = 0x448ac7e64588de4871cad843bf022113 Message-Authenticator = 0x17c9e0df16b03cba61ad387e61425b3c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 172.16.3.243 port 1026 EAP-Message = 0x0103040019c00000089b160301002a0200002603014a2967093886b79ce89d2dc53e161778e1e238caef726810b5810527a4520f2b00000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303630343135343334305a170d3130303630343135343334305a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c4f2b7365ca8b81ec1506ef0c4add00d31fed2645528fa5ed28e647ab1b422acc16cdb30486ee70a55b3b6fdaa4d2f98f7d6251ee8e2bec05b252429c256 EAP-Message = 0x14d07246a7fa8e4d9fc6a7cd62fc67d41e548186b4c0819fdf6702b1ed2514d21c79453e01d308c1e5016cb089477d655012f03117154d7f61748bd15246b49f7e56a854e9ff7613ab7c57431d6044c147eab4a9606e5af9342117902e0dc7559a3b3495f121ed3b25f346bc155eda23d90a47e43ac713c1a665b6b72319e8962984b9315a694672a50b39ff08e62c988f56ff02453f5769b15d921905a85b30a0300d4ec09198e407e9f19417fedef01268e74a80b7dbb940dc1005b2753f5f0fe70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010085dae846479873637b EAP-Message = 0x6430d3583e210c28d6c27cd677a2cb7f35800a81c563b55eb01ad51a0db37a5f0aec5a67884e8ca6dc1d5bfe8775615a627dc411b85966e54045bd38e16e5702398b887d4d8bc57e81ff01d17d35ef882f806268cfe6c7e4f8a85780c0e9b82dffdfa447b36887d19024bf49b36a91dc7c613110ff55d1a40abda5422d1cc5dafc83c80bdd982f9221b82d1d9fdc96a2775d69616ce2e15f352bc403e7770670ed625ed91a351c44b961bc89b7bb57c9321d01983b01760854fe350fa79b99c8b6db4d22cb1dc0201fa9cf29d69cf5e60086aa4669450188a288b40355bdf71d5c900e1a914ab9638375937ff93136ea3bb5e0bab6f22d0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64689de4871cad843bf022113 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=5, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 State = 0x448ac7e64689de4871cad843bf022113 Message-Authenticator = 0xf3aa0fbb6061e253f2b396247dbe34f3 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 172.16.3.243 port 1026 EAP-Message = 0x010403fc194000bfbe10f4dc17bc57300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303630343135343334305a170d3130303630343135343334305a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a2df5bcfc7dfaf404123cd9eee92293fc10e130290d95b45f1d5ee1477cd79cc642a29f98e6969b06c1ebcee8f7891d7d8f9f98ccfbc8d847f39c463addd68571300b9580ed93fb65aa4134ea9ea50739aeb66af4eebf7b3f22b371d09e8b358460ed87c64c97b2ce77dd66422b397 EAP-Message = 0x885f56aa694174cdfda8df7b4ac3c4a727b3abadfa483529e5f8dabc90e1282472eefe3bdebe6b16f4a5281ab7e6fa930b29bd997b2d24642e2688c6bdefe837f46110a56b6fb021fc238e6d16cc992fe5174fdf2a30ff39513a9b0dd4f0a3bcf43eadd3050afaaebd8490b522a8465d32b9d9176ba04eb13bb28df11c9fd7f9cb8da5f5cd8abfd73c622348a9038ae6c30203010001a381fb3081f8301d0603551d0e041604140fd0a4d97630cf12b249f8118e1e5e2b6616e4033081c80603551d230481c03081bd80140fd0a4d97630cf12b249f8118e1e5e2b6616e403a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900bfbe10f4dc17bc57300c0603551d13040530030101ff300d06092a864886f70d010105050003820101000d1b7c610b8269f7f60db4f7eb582e2cd3c2e6ec7a557f3d40ab21ce614c28aa7547535ec6d82fc11e95b51dae4502dbd8c75bae4530ebf9a0d5385d0e154656592ebb02df514c8de95378f084d449a83d1a EAP-Message = 0x0734802e45757914 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6478ede4871cad843bf022113 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=6, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 State = 0x448ac7e6478ede4871cad843bf022113 Message-Authenticator = 0x326c80c3d6ff6c66412892224cf04b87 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 6 to 172.16.3.243 port 1026 EAP-Message = 0x010500b519003340e5531cf0d388c39fd268db69a6b64329725766db06e51180f8cfb46d1dbed8f37dea0603d57576dad3fbbbfb27e55399fe1f7627abea0db94c5a33ff94d14d7592541bf619e787d19b83f4f4b1ecb1f2c0d2a58727e99855ad1ad66b0f9548a5bbb5c341bcf87367f7e7e7efdf521f3831b651a1b000bc0f9091a55cf56dc542d451dca7a0fb49bf0644099d3fb486a217187331461833a35b3027e12970551a49d276ec16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6408fde4871cad843bf022113 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=7, length=485 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205014019800000013616030101061000010201001840b9b0f1e3847e833de04563d437492c9370f225da60f3459d8269ad02b68d20bf5239675f64e3edbdf95b6d382b88b55299f0477a413949cb59d8d8fc9eb26a3df28360901144b030c15efcc37eee5fd2134d3edaf9dcbb836cef2085ec74ec81bcaa203a7985f2e0c47f740a718b22f42f4a14f99aed538488cc6379e5c4c0d42379f3a883e012fcc9c317ce650a210f2a9879fb10718b9920f3e81db14deb55762928448f8d5b80f621311593b65942b6f5f5590a6c4140693c25296938079f9be0d3621a52cc8a9cccdc0a81fb7a75890707c4c13939977008cf3268ac21f4770920ac610b EAP-Message = 0x77fb54d881fc654231d061b03f32d4e145cc5fb8ca0432861403010001011603010020e378e0b99dbd0025936afc79910bd597d21aa1ab287ffa689325d8e2f8845670 State = 0x448ac7e6408fde4871cad843bf022113 Message-Authenticator = 0xa56256998c90432cc95ac5e2862624b0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 7 to 172.16.3.243 port 1026 EAP-Message = 0x010600311900140301000101160301002069824744e087b896e73cdf48efd1922ee26a4e3e58d0581dacb5d8f9c5bb9dcf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6418cde4871cad843bf022113 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=8, length=169 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020600061900 State = 0x448ac7e6418cde4871cad843bf022113 Message-Authenticator = 0x0f5f4b99a72b15cd40e377dee0ce705c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 8 to 172.16.3.243 port 1026 EAP-Message = 0x0107002019001703010015398fdaf093922be8a86b61cd34aa8f7c5b71e2874f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e6428dde4871cad843bf022113 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=9, length=198 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02070023190017030100189045a426a592c65afb91c5447a54fb5440f72e95e4f760ed State = 0x448ac7e6428dde4871cad843bf022113 Message-Authenticator = 0xb1ad0301d20dcfa679c747016d1d161f +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 35 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - sminhas [peap] Got tunneled request EAP-Message = 0x0207000c01736d696e686173 server { PEAP: Got tunneled identity of sminhas PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to sminhas Sending tunneled request EAP-Message = 0x0207000c01736d696e686173 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800211a0108001c10a2cce07996096b9995cd579953c8a0d2736d696e686173 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd835184ed83d026fcd510a2453380f9a [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800211a0108001c10a2cce07996096b9995cd579953c8a0d2736d696e686173 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd835184ed83d026fcd510a2453380f9a [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 9 to 172.16.3.243 port 1026 EAP-Message = 0x010800381900170301002df6dd96a1a3fefcb4dd9d07c8d6d525f94e852f0d3b70ea23e25445b745e48fcfd13751108f6480bd9887df0305 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64382de4871cad843bf022113 Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=10, length=252 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800591900170301004ef4f5895ae1386b18210c59be786e3390e65624aa56459564747a196beca068c47e0f4073c6607c1625606abc4dd02ebbedfd0e6bd349be90fb2fa92e52717805bca7d7decd285bc123c57d6a32ce State = 0x448ac7e64382de4871cad843bf022113 Message-Authenticator = 0x996225c55ce5b8971faab11de63db92c +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 89 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800421a0208003d312ecef7d7d8908f1a6b5c42a5d6cc5cda000000000000000011ecf3f719610d92861576e00d82c67ae8142c4416d96da200736d696e686173 server { PEAP: Setting User-Name to sminhas Sending tunneled request EAP-Message = 0x020800421a0208003d312ecef7d7d8908f1a6b5c42a5d6cc5cda000000000000000011ecf3f719610d92861576e00d82c67ae8142c4416d96da200736d696e686173 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sminhas" State = 0xd835184ed83d026fcd510a2453380f9a NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for sminhas [ldap] expand: (uid=%u) -> (uid=sminhas) [ldap] expand: dc=bcc,dc=com -> dc=bcc,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=bcc,dc=com, with filter (uid=sminhas) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user sminhas authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for sminhas with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 10 to 172.16.3.243 port 1026 EAP-Message = 0x010900261900170301001b5c6c4555857f37d167f81d4e781468a5a5798f70aaade757f2758a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x448ac7e64c83de4871cad843bf022113 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.3.243 port 1026, id=11, length=201 User-Name = "sminhas" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-21-91-AF-8E-10:bccsecure" Calling-Station-Id = "00-13-E8-DC-B7-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020900261900170301001ba2885943dd8bbf7b657eb24589528193b4bac719e9b697782b8fa9 State = 0x448ac7e64c83de4871cad843bf022113 Message-Authenticator = 0x1d0008416ffcf27d3ad5f09e8f875f19 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.3.243/auth-detail-20090605 [auth_log] expand: %t -> Fri Jun 5 14:42:17 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sminhas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sminhas attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 11 to 172.16.3.243 port 1026 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 2 with timestamp +16 Cleaning up request 1 ID 3 with timestamp +16 Cleaning up request 2 ID 4 with timestamp +16 Cleaning up request 3 ID 5 with timestamp +16 Cleaning up request 4 ID 6 with timestamp +16 Cleaning up request 5 ID 7 with timestamp +16 Cleaning up request 6 ID 8 with timestamp +16 Cleaning up request 7 ID 9 with timestamp +16 Cleaning up request 8 ID 10 with timestamp +16 Waking up in 1.0 seconds. Cleaning up request 9 ID 11 with timestamp +16 Ready to process requests. ------------------------- -------------------------- Once again Thanks Nik

1 0

Upgrading from 1.17 to 2.14 MySQL schema
by Steve Bertrand 05 Jun '09

05 Jun '09

Hi all, I'm in the process of migrating our RADIUS servers from 1.17 to 2.14. I've scoured all over for any information relating to the migration of the MySQL database. Am I just missing something here, or are the two versions completely non-compatible? If this is the case, I'll have to write a translator to migrate the data from the old DB into the new one. Steve

3 3