August 2009 - Freeradius-Users - lists.freeradius.org

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

Hi I mnaged to follow the steps in /etc/raddb/certs/README and copied ca.der and client.p12 to XP machine When i run Radiusd -X i get Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 98 to 203.121.4.59 port 6001 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 92 with timestamp +7 Cleaning up request 1 ID 93 with timestamp +7 Cleaning up request 2 ID 94 with timestamp +7 Cleaning up request 3 ID 95 with timestamp +7 Cleaning up request 4 ID 96 with timestamp +7 Cleaning up request 5 ID 97 with timestamp +7 Waking up in 1.0 seconds. Cleaning up request 6 ID 98 with timestamp +7 Ready to process requests. 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: > Ivan > > this is my director permissiion on /etc/raddb/certs > > 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >> how do i chown radiusd /etc/raddb/certs >> >> >> >> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 48 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010704000dc0000009478204a43082038ca003020102020900d590cbda3a11a132300d06092a864886f70d0101050500308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479301e170d3039303830333033343830355a170d3039303930323033343830355a308192310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d42cbdfb9a6f9ceb5fbe99e32d62d9a6a8760e64b5a0026a45d42acac8d8de68009e3717cd35944d4030c9c85c2d95c9e75761a32c45adf3bec3c60b5a5f6dfdc622b70d486c407a54665d5ff58f74a5743f2e063aaa6d8d298169e792d370 >>> EAP-Message = >>> 0x6a7f3752c603ceb2be2ebfee7c3059ee4ceaca3695c3ef116a35e26f169b81d6e9c50bffe9c436bbbdf524db474435282a25febfb3b5ed973d81689c1328b84707c3c878f591e48b7aedb5161cafe8a6dd2e4493b8ed67e20d9142699bfda1681ae7139e7a105dbc45bc0b149dec5a280ef2a4cc0e2ad86867436bf1fbedfb5ef9f3d39ceccf7ec7efd164813e9ce202f06ef58c6d29470c23bfd1697d31cecd430203010001a381fa3081f7301d0603551d0e0416041449f8947678c307ad148fd0a0c5a391533ee6a0153081c70603551d230481bf3081bc801449f8947678c307ad148fd0a0c5a391533ee6a015a18198a48195308192310b300906 >>> EAP-Message = >>> 0x0355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479820900d590cbda3a11a132300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100af0f1f02bf323c429efb8f3edbedf6ee6062e61eeb456ba280dc01b51555c2c93ca3d1f3c0ea49ffda0c4ed70949260b0fe6642b689eab183588746e7c2458ce020f27 >>> EAP-Message = 0x72d0f2c8ef880796a48a4639 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x62deb6d561d9bb124f3aa51530d369f1 >>> Finished request 4. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=49, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x62deb6d561d9bb124f3aa51530d369f1 >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x020700060d00 >>> Message-Authenticator = 0x6d2e9d8a5cd95a1a8fc18325b8f88a39 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 7 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 49 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010801650d8000000947a1d78ae40853377f262dab6604e3534f9b991d387dda1acf7b2a165828cecf7198fa3519e9c398f9f54806d22a29777365a6651602590255d42009fadd80ccd452b671571840de2730d7d50b8478b6478b17cdb89e2a5b826aa1670805138427ff760119c30906bad29096307aaf871ca36d0a4b61e459ee52ea0f4b5c0f4eb2bd4c8f8049fcf44fcfda87cb9b3e1846aa7ab12ebe0a35148e378ef35181aabea20524ac7cfe702d701b8b57b661fd608716030100a50d00009d0301024000970095308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a31 >>> EAP-Message = >>> 0x1c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f726974790e000000 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x62deb6d566d6bb124f3aa51530d369f1 >>> Finished request 5. >>> Going to the next request >>> Waking up in 4.8 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=50, length=1672 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x62deb6d566d6bb124f3aa51530d369f1 >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x020805d20dc0000005ee16030105be0b0003ae0003ab0003a8308203a43082028ca003020102020103300d06092a864886f70d010104050030818a310b3009060355040613024d593111300f0603550408130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e312330210603550403131a50616c65747465205365727665722043657274696669636174653125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d301e170d3039303830333034313133345a170d3130303830333034313133345a308186310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e311f301d06035504031416646576696e6465724070616c657474656d6d2e636f6d3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a028f0c9637d0ba909226bfad97d1061d01ddf265185f2997d5243322335cd91343ed428c29ab9f7866fb26be520437de01cc109741dcbe0d7a83bf0cb92932c4674607eea85fdc0e2fb7682f214f708d0bd50520cd30d0cbf1a68477d1ef9ea04c6b8951ce9d57fbc3431 >>> EAP-Message = >>> 0x994b9cd5ea61c5608e963eb2d5301f78f3c4b6c93801374ccef2e8245d8fec043ad06b896cda97ecf0420669cdb4cf62826e31bb2ef967d09773254ced03ff60d0592b7da497a1c60e65862dc495fc9f99f78a4a5717d4b0563f35ceac77a053549eaf40c2eac3267cd7825fd3df9a5e6d9de45fff8cef6080aaa01b3c53ac846aa066552352d6b49b31ae445db5a8f9ac16ce7d2b0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003820101006085f5f8417b7ef1e1dcb74a200999dab452d98a9a900ce5cafc1c6e30f1d3574b82145ebc3b4815075d48b762cd0dba7d6216294f10 >>> EAP-Message = >>> 0x8627af0c641e1ef0b1d4f7cb60c1afdb304831b3c0101e1f93a3f50567aaa3e5e8fee424986b41af8671d18732958b502ae1b4cb476655c3dce2cc6f44d5572f056b4992053c5d27e10a30476236e535032e7449e77e6e85fb53a6f952631099b3ac9ba016a192bf3fa78eaacfd45fe67040eee31eb04639049e8b95662b455376234d09c3a5ba9fac4ead0a128395d70a76134278cd12e6fe12a4e71eb5fd13e109dab1a5a3c949ad8b59ad68913f4535b7afbda44f715669e965fbd5d77697e57606ed96af0b5e60271000010201007a1f5b250a891d30ab5d616e8e4ab4585bc384f73c877d8758cbea3cdd8d76ff288f6919b77abb6434ce9d8fe5 >>> EAP-Message = >>> 0x362368ac21c3841dfab96bba705bd3b60c1967386f9efb0fb50234b4f5ed3933d7c154b1f363557674d7aa8dfff723637c55145dca8ffef427c7115e6fcfa965be5e315c97ba624d9a2be383b4d0be1dc4d1514532dc4c4b5a7cd1ea1e9d7084e4c01cfd2835271ca0d5611318316bf53cf910f7e9d5bed30dbc957ce3ee97e143f24a1a79f45be99bfb812611c90376575f9754f6b8d7aad5fb7865e40b643334de76c68d2196c4105a3f221f7a8603ec2330db055efff70dc47fed5ddb5ae3bec19f31be655b7771e6e8582016d3626a41a00f00010201004bbfd3312cfc92fe9e217f90f05575e9592fc63d0cd11fe4d3f312e775862130095e7f6a >>> EAP-Message = >>> 0x6c7fe5fc510236d68a166fc71dcbc8abe4b7c21c7f41776ae3e89b3afa4134d105d33b10e8caf58fbc23ac07e3fc3b41eeb5abf29cd011dc43b3e05e99f3de81a819e5455ca14b218c86f973485844739388d20dba8af5e894f648b935896fd16fc833ffd3381e2e1a778b83dd9fefe103f647cad570fd94c865135277299307ef0c3ee70a31bbabbaea3021063807100a2e4f6563b1455e663df9ca8b3f73576ce45170280045a18d30b7aed639e99d479536d857ef6b7d44cde521590d6688045ed32a0a524fcfd2926777c53013747fc40d3fd98cf7402550e6d71403010001 >>> Message-Authenticator = 0x2d49686ce9585a8543c601ffb006fac4 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 8 length 253 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> TLS Length 1518 >>> [tls] Received EAP-TLS First Fragment of the message >>> [tls] eaptls_verify returned 9 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 50 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010900060d00 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x62deb6d567d7bb124f3aa51530d369f1 >>> Finished request 6. >>> Going to the next request >>> Waking up in 4.8 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=51, length=216 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x62deb6d567d7bb124f3aa51530d369f1 >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0209002c0d000116030100204fe855fc95e171b64cf548234edbbba8766c057c55fc938b4e64e30ebdd0e2ab >>> Message-Authenticator = 0x5717c92937ae05e6413b61d5a3ff3004 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 9 length 44 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] eaptls_verify returned 7 >>> [tls] Done initial handshake >>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >>> --> verify error:num=20:unable to get local issuer certificate >>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >>> TLS Alert write:fatal:unknown CA >>> TLS_accept:error in SSLv3 read client certificate B >>> rlm_eap: SSL error error:140890B2:SSL >>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>> TLS receive handshake failed during operation >>> [tls] eaptls_process returned 4 >>> [eap] Handler failed in EAP/tls >>> [eap] Failed in EAP select >>> ++[eap] returns invalid >>> Failed to authenticate the user. >>> Using Post-Auth-Type Reject >>> +- entering group REJECT {...} >>> [attr_filter.access_reject] expand: %{User-Name} -> >>> devinder(a)palettemm.com >>> attr_filter: Matched entry DEFAULT at line 11 >>> ++[attr_filter.access_reject] returns updated >>> Delaying reject of request 7 for 1 seconds >>> Going to the next request >>> Waking up in 0.9 seconds. >>> Sending delayed reject for request 7 >>> Sending Access-Reject of id 51 to 203.121.4.59 port 6001 >>> EAP-Message = 0x04090004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> Waking up in 3.8 seconds. >>> Cleaning up request 1 ID 45 with timestamp +27 >>> Cleaning up request 2 ID 46 with timestamp +27 >>> Cleaning up request 3 ID 47 with timestamp +27 >>> Cleaning up request 4 ID 48 with timestamp +27 >>> Cleaning up request 5 ID 49 with timestamp +27 >>> Cleaning up request 6 ID 50 with timestamp +27 >>> Waking up in 1.0 seconds. >>> Cleaning up request 7 ID 51 with timestamp +27 >>> Ready to process requests. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=52, length=181 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0201001b01646576696e6465724070616c657474656d6d2e636f6d >>> Message-Authenticator = 0xe5b179ce51b5db29be069ebd7000f412 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 1 length 27 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> [pap] WARNING! No "known good" password found for the user. >>> Authentication may fail because of this. >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] EAP Identity >>> [eap] processing type md5 >>> rlm_eap_md5: Issuing Challenge >>> ++[eap] returns handled >>> Sending Access-Challenge of id 52 to 203.121.4.59 port 6001 >>> EAP-Message = 0x0102001604108195b49b704b8992bd4258cf70513300 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4920b49c63e9e9d887da9f2ad >>> Finished request 8. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=53, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4920b49c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x02020006030d >>> Message-Authenticator = 0x22eb6a82d37f5eafd5ba8a5abc81f834 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 2 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> [pap] WARNING! No "known good" password found for the user. >>> Authentication may fail because of this. >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP NAK >>> [eap] EAP-NAK asked for EAP-Type/tls >>> [eap] processing type tls >>> [tls] Requiring client certificate >>> [tls] Initiate >>> [tls] Start returned 1 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 53 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010300060d20 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4930a40c63e9e9d887da9f2ad >>> Finished request 9. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=54, length=252 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4930a40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x020300500d800000004616030100410100003d03014a7794cc001bbe59615bb39e4e9a325ca1fd23210fdba327dda3ff227b9e03b400001600040005000a000900640062000300060013001200630100 >>> Message-Authenticator = 0xb50e7a762392b806ee2162fc3a3e13b7 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 3 length 80 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> TLS Length 70 >>> [tls] Length Included >>> [tls] eaptls_verify returned 11 >>> [tls] (other): before/accept initialization >>> [tls] TLS_accept: before/accept initialization >>> [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello >>> [tls] TLS_accept: SSLv3 read client hello A >>> [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello >>> [tls] TLS_accept: SSLv3 write server hello A >>> [tls] >>> TLS 1.0 Handshake [length 0869], Certificate >>> [tls] TLS_accept: SSLv3 write certificate A >>> [tls] >>> TLS 1.0 Handshake [length 00a5], CertificateRequest >>> [tls] TLS_accept: SSLv3 write certificate request A >>> [tls] TLS_accept: SSLv3 flush data >>> [tls] TLS_accept: Need to read more data: SSLv3 read client >>> certificate A >>> In SSL Handshake Phase >>> In SSL Accept mode >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 54 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010404000dc000000947160301002a0200002603014a77953adaad636bbf032c0b182768cb323f0ae98c04e48c76ca655c6956c20b0000040016030108690b0008650008620003b4308203b030820298a003020102020102300d06092a864886f70d0101040500308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f7269747930 >>> EAP-Message = >>> 0x1e170d3039303830333033353933355a170d3130303830333033353933355a30818a310b3009060355040613024d593111300f0603550408130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e312330210603550403131a50616c65747465205365727665722043657274696669636174653125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a02820101009c8f8d9eedcaf99b0366303d49b8576398606a36211c5c37f1253a8fc4aeb838f5ccb860559404d5757863308d1d983f >>> EAP-Message = >>> 0x30692d13aadb60700efb9d16bab77902a044fc6e4a10a1fba7d64eb02a791b4f94fc4602fa1e472c670769e9e2fb831bfffa719fae87e1c441e3333b2c675eaee504355a3cd971f1c622eaa1d8dab363a5d52dc4526fd8fe29d71c3b834972083cd2947e8833946e542a37a00f09afc83140308ee140e4450d9231c8a3b281d2ad9c95137f3bc54e2ea14f079cc54c469683b7dc064d90893fbda765454bd1d6ce8a6fd4e7b546ad1d0d744f0faa775cab24668a42363132f52cfcd73506b4b8c2e97cb6c24fb8a02a0b28dcea76ace30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500 >>> EAP-Message = >>> 0x03820101008f7692e8149dd275e0c14c3fc8453ab3c621911960ef3e63c5f1d1cc2af6a2b779b66427a9cdcd89e40dd173ec31e92e7dfc92bedf7fb91700f8409f625a5b369bed3d71922d7bee389d510146f300b0eeebdb94f0fa3444a93db04c61a02462970ca6042d3e837505c6ba0458e9ff2e629d4b044fd1c56a63674fca359d45cd115e91749d3899dfd60f55a2b8deb6ca90c2edd0ee4b2d00030495a73ff450e9bd059f3012873142b9f27b24c98a4f15bfcea7a9b47b75710a2f998e17654dd8e8a3e1c88f245469d332ea97935fcf7d43f00ba59a89a61885fa120840ce40c8f71358ef1335280be33cb331fb00158018d96db2b82efb7d >>> EAP-Message = 0x5cfc17ff37dd97490004a830 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4900d40c63e9e9d887da9f2ad >>> Finished request 10. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=55, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4900d40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x020400060d00 >>> Message-Authenticator = 0x3f1612c468a749f2d7be889ece43af04 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 4 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 55 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010504000dc0000009478204a43082038ca003020102020900d590cbda3a11a132300d06092a864886f70d0101050500308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479301e170d3039303830333033343830355a170d3039303930323033343830355a308192310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d42cbdfb9a6f9ceb5fbe99e32d62d9a6a8760e64b5a0026a45d42acac8d8de68009e3717cd35944d4030c9c85c2d95c9e75761a32c45adf3bec3c60b5a5f6dfdc622b70d486c407a54665d5ff58f74a5743f2e063aaa6d8d298169e792d370 >>> EAP-Message = >>> 0x6a7f3752c603ceb2be2ebfee7c3059ee4ceaca3695c3ef116a35e26f169b81d6e9c50bffe9c436bbbdf524db474435282a25febfb3b5ed973d81689c1328b84707c3c878f591e48b7aedb5161cafe8a6dd2e4493b8ed67e20d9142699bfda1681ae7139e7a105dbc45bc0b149dec5a280ef2a4cc0e2ad86867436bf1fbedfb5ef9f3d39ceccf7ec7efd164813e9ce202f06ef58c6d29470c23bfd1697d31cecd430203010001a381fa3081f7301d0603551d0e0416041449f8947678c307ad148fd0a0c5a391533ee6a0153081c70603551d230481bf3081bc801449f8947678c307ad148fd0a0c5a391533ee6a015a18198a48195308192310b300906 >>> EAP-Message = >>> 0x0355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a311c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f72697479820900d590cbda3a11a132300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100af0f1f02bf323c429efb8f3edbedf6ee6062e61eeb456ba280dc01b51555c2c93ca3d1f3c0ea49ffda0c4ed70949260b0fe6642b689eab183588746e7c2458ce020f27 >>> EAP-Message = 0x72d0f2c8ef880796a48a4639 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4910c40c63e9e9d887da9f2ad >>> Finished request 11. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=56, length=178 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4910c40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = 0x020500060d00 >>> Message-Authenticator = 0x9c8cc7715cfe14bc2ed6f2b8655c0220 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 5 length 6 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] Received TLS ACK >>> [tls] ACK handshake fragment handler >>> [tls] eaptls_verify returned 1 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 56 to 203.121.4.59 port 6001 >>> EAP-Message = >>> 0x010601650d8000000947a1d78ae40853377f262dab6604e3534f9b991d387dda1acf7b2a165828cecf7198fa3519e9c398f9f54806d22a29777365a6651602590255d42009fadd80ccd452b671571840de2730d7d50b8478b6478b17cdb89e2a5b826aa1670805138427ff760119c30906bad29096307aaf871ca36d0a4b61e459ee52ea0f4b5c0f4eb2bd4c8f8049fcf44fcfda87cb9b3e1846aa7ab12ebe0a35148e378ef35181aabea20524ac7cfe702d701b8b57b661fd608716030100a50d00009d0301024000970095308192310b3009060355040613024d593111300f0603550408130853656c616e676f72310b300906035504071302504a31 >>> EAP-Message = >>> 0x1c301a060355040a131350616c65747465204d756c74696d656469612e3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d311e301c06035504031315436572746966696361746520417574686f726974790e000000 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4960f40c63e9e9d887da9f2ad >>> Finished request 12. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=57, length=1672 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4960f40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x020605d20dc0000005ee16030105be0b0003ae0003ab0003a8308203a43082028ca003020102020103300d06092a864886f70d010104050030818a310b3009060355040613024d593111300f0603550408130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e312330210603550403131a50616c65747465205365727665722043657274696669636174653125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d301e170d3039303830333034313133345a170d3130303830333034313133345a308186310b3009060355040613024d593111300f06035504 >>> EAP-Message = >>> 0x08130853656c616e676f72311c301a060355040a131350616c65747465204d756c74696d656469612e311f301d06035504031416646576696e6465724070616c657474656d6d2e636f6d3125302306092a864886f70d0109011616646576696e6465724070616c657474656d6d2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a028f0c9637d0ba909226bfad97d1061d01ddf265185f2997d5243322335cd91343ed428c29ab9f7866fb26be520437de01cc109741dcbe0d7a83bf0cb92932c4674607eea85fdc0e2fb7682f214f708d0bd50520cd30d0cbf1a68477d1ef9ea04c6b8951ce9d57fbc3431 >>> EAP-Message = >>> 0x994b9cd5ea61c5608e963eb2d5301f78f3c4b6c93801374ccef2e8245d8fec043ad06b896cda97ecf0420669cdb4cf62826e31bb2ef967d09773254ced03ff60d0592b7da497a1c60e65862dc495fc9f99f78a4a5717d4b0563f35ceac77a053549eaf40c2eac3267cd7825fd3df9a5e6d9de45fff8cef6080aaa01b3c53ac846aa066552352d6b49b31ae445db5a8f9ac16ce7d2b0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003820101006085f5f8417b7ef1e1dcb74a200999dab452d98a9a900ce5cafc1c6e30f1d3574b82145ebc3b4815075d48b762cd0dba7d6216294f10 >>> EAP-Message = >>> 0x8627af0c641e1ef0b1d4f7cb60c1afdb304831b3c0101e1f93a3f50567aaa3e5e8fee424986b41af8671d18732958b502ae1b4cb476655c3dce2cc6f44d5572f056b4992053c5d27e10a30476236e535032e7449e77e6e85fb53a6f952631099b3ac9ba016a192bf3fa78eaacfd45fe67040eee31eb04639049e8b95662b455376234d09c3a5ba9fac4ead0a128395d70a76134278cd12e6fe12a4e71eb5fd13e109dab1a5a3c949ad8b59ad68913f4535b7afbda44f715669e965fbd5d77697e57606ed96af0b5e60271000010201007eeb09107338770671a4942b45c4ff05f3c5e1d51411c581cb4491aaef3bc2ea8240a30444083bbcc543e408db >>> EAP-Message = >>> 0x01f980dfc84174065984fea22109efff29f90fc2ffe3f777386d35cfd478a2ef082700be3a4e85218cb20c5756c94854f23521dadbacbc33cdc80174153213f7c506ba8b89cafbb447ba919ab5b6b9ead24e4f352f0e02cb1daf32beed767bd160e99c8ca76bdd6308311a320cc2431eff0342dc2e11597829aadce97dec048e0fb7b8aee32490143ce64e3a491ab9300f03a0acf9f4f1430884dfdf0e5dc93e5e009a27922153d227be5f7985c7c23beb2d8860a96982e88173765c604ed146381386428a38f5ad31ca34eedebfa00c5f78200f00010201006e383e587281e7cf69508af21ceb1f9335d9b666ecad0bdcf4f2b3d72827aa23479f4e47 >>> EAP-Message = >>> 0xaf27fdcfbeafc8da935c1df948d31300498f3eb96fed62f79734f7d016d83b69ce34e915cc6fac754c46169c33ff6a102712fbb61bb44201a5a60b1317b06bcd72c5fe9650d302d6c66e4b670f41c26aa4f38f1519a0071f1c6352f05fe85bdaa2eb7f90833d667877a5e4e9c6b36bdfe219659aa3c3c439ff304f10947da32aeecd1ab25cc553653d1a4260771906ac181160cb64f464391f33a50c8b93225ebae4b9d40cb737890946c9f3de7a696396a71393e3a9919279a216f5dc7f665be50965f0dda21a4482ce44dcb92c0de1310fc1af9b3ab0e2e71547661403010001 >>> Message-Authenticator = 0x3c5c56dd8206e86f40fc58199cff01bd >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 6 length 253 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> TLS Length 1518 >>> [tls] Received EAP-TLS First Fragment of the message >>> [tls] eaptls_verify returned 9 >>> [tls] eaptls_process returned 13 >>> ++[eap] returns handled >>> Sending Access-Challenge of id 57 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010700060d00 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x92094dc4970e40c63e9e9d887da9f2ad >>> Finished request 13. >>> Going to the next request >>> Waking up in 4.8 seconds. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=58, length=216 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> State = 0x92094dc4970e40c63e9e9d887da9f2ad >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0207002c0d000116030100206a37ffeef11849b1d0a6d9ef7e63012b68850674c5863fe770d7f04338d6e235 >>> Message-Authenticator = 0xcfa5e7a49f8af947020ce3ea3cef21eb >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 7 length 44 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] Request found, released from the list >>> [eap] EAP/tls >>> [eap] processing type tls >>> [tls] Authenticate >>> [tls] processing EAP-TLS >>> [tls] eaptls_verify returned 7 >>> [tls] Done initial handshake >>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >>> --> verify error:num=20:unable to get local issuer certificate >>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >>> TLS Alert write:fatal:unknown CA >>> TLS_accept:error in SSLv3 read client certificate B >>> rlm_eap: SSL error error:140890B2:SSL >>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>> TLS receive handshake failed during operation >>> [tls] eaptls_process returned 4 >>> [eap] Handler failed in EAP/tls >>> [eap] Failed in EAP select >>> ++[eap] returns invalid >>> Failed to authenticate the user. >>> Using Post-Auth-Type Reject >>> +- entering group REJECT {...} >>> [attr_filter.access_reject] expand: %{User-Name} -> >>> devinder(a)palettemm.com >>> attr_filter: Matched entry DEFAULT at line 11 >>> ++[attr_filter.access_reject] returns updated >>> Delaying reject of request 14 for 1 seconds >>> Going to the next request >>> Waking up in 0.9 seconds. >>> Sending delayed reject for request 14 >>> Sending Access-Reject of id 58 to 203.121.4.59 port 6001 >>> EAP-Message = 0x04070004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> Waking up in 3.8 seconds. >>> Cleaning up request 8 ID 52 with timestamp +164 >>> Cleaning up request 9 ID 53 with timestamp +164 >>> Cleaning up request 10 ID 54 with timestamp +164 >>> Cleaning up request 11 ID 55 with timestamp +164 >>> Cleaning up request 12 ID 56 with timestamp +164 >>> Cleaning up request 13 ID 57 with timestamp +165 >>> Waking up in 1.0 seconds. >>> Cleaning up request 14 ID 58 with timestamp +165 >>> Ready to process requests. >>> ^C >>> linux-h9qt:/etc/raddb # clear >>> linux-h9qt:/etc/raddb # radiusd -X >>> FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Dec >>> 3 2008 at 13:57:16 >>> Copyright (C) 1999-2008 The FreeRADIUS server project and >>> contributors. >>> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >>> PARTICULAR PURPOSE. >>> You may redistribute copies of FreeRADIUS under the terms of the >>> GNU General Public License v2. >>> Starting - reading configuration files ... >>> including configuration file /etc/raddb/radiusd.conf >>> including configuration file /etc/raddb/proxy.conf >>> including configuration file /etc/raddb/clients.conf >>> including files in directory /etc/raddb/modules/ >>> including configuration file /etc/raddb/modules/wimax >>> including configuration file /etc/raddb/modules/ippool >>> including configuration file /etc/raddb/modules/expiration >>> including configuration file /etc/raddb/modules/inner-eap >>> including configuration file /etc/raddb/modules/exec >>> including configuration file /etc/raddb/modules/mac2ip >>> including configuration file /etc/raddb/modules/krb5 >>> including configuration file /etc/raddb/modules/logintime >>> including configuration file /etc/raddb/modules/detail >>> including configuration file /etc/raddb/modules/digest >>> including configuration file /etc/raddb/modules/etc_group >>> including configuration file /etc/raddb/modules/sql_log >>> including configuration file /etc/raddb/modules/attr_filter >>> including configuration file /etc/raddb/modules/always >>> including configuration file /etc/raddb/modules/ldap >>> including configuration file /etc/raddb/modules/files >>> including configuration file /etc/raddb/modules/detail.log >>> including configuration file /etc/raddb/modules/radutmp >>> including configuration file /etc/raddb/modules/preprocess >>> including configuration file /etc/raddb/modules/realm >>> including configuration file /etc/raddb/modules/sradutmp >>> including configuration file /etc/raddb/modules/policy >>> including configuration file /etc/raddb/modules/linelog >>> including configuration file /etc/raddb/modules/counter >>> including configuration file /etc/raddb/modules/smbpasswd >>> including configuration file /etc/raddb/modules/expr >>> including configuration file /etc/raddb/modules/mac2vlan >>> including configuration file /etc/raddb/modules/checkval >>> including configuration file /etc/raddb/modules/unix >>> including configuration file /etc/raddb/modules/pam >>> including configuration file /etc/raddb/modules/echo >>> including configuration file /etc/raddb/modules/passwd >>> including configuration file /etc/raddb/modules/mschap >>> including configuration file /etc/raddb/modules/detail.example.com >>> including configuration file /etc/raddb/modules/acct_unique >>> including configuration file /etc/raddb/modules/attr_rewrite >>> including configuration file /etc/raddb/modules/chap >>> including configuration file /etc/raddb/modules/pap >>> including configuration file /etc/raddb/eap.conf >>> including configuration file /etc/raddb/sql.conf >>> including configuration file /etc/raddb/sql/mysql/dialup.conf >>> including configuration file /etc/raddb/sql/mysql/counter.conf >>> including configuration file /etc/raddb/policy.conf >>> including files in directory /etc/raddb/sites-enabled/ >>> including configuration file /etc/raddb/sites-enabled/default >>> including configuration file /etc/raddb/sites-enabled/inner-tunnel >>> group = radiusd >>> user = radiusd >>> including dictionary file /etc/raddb/dictionary >>> main { >>> prefix = "/usr" >>> localstatedir = "/var" >>> logdir = "/var/log/radius" >>> libdir = "/usr/lib64/freeradius" >>> radacctdir = "/var/log/radius/radacct" >>> hostname_lookups = no >>> max_request_time = 30 >>> cleanup_delay = 5 >>> max_requests = 1024 >>> allow_core_dumps = no >>> pidfile = "/var/run/radiusd/radiusd.pid" >>> checkrad = "/usr/sbin/checkrad" >>> debug_level = 0 >>> proxy_requests = yes >>> log { >>> stripped_names = no >>> auth = no >>> auth_badpass = no >>> auth_goodpass = no >>> } >>> security { >>> max_attributes = 200 >>> reject_delay = 1 >>> status_server = yes >>> } >>> } >>> client localhost { >>> ipaddr = 127.0.0.1 >>> require_message_authenticator = no >>> secret = "testing123" >>> nastype = "other" >>> } >>> client 192.168.1.0/24 { >>> require_message_authenticator = no >>> secret = "testing123-1" >>> shortname = "private-network-1" >>> } >>> client 203.121.4.11 { >>> require_message_authenticator = no >>> secret = "testing123-1" >>> shortname = "private-network3" >>> } >>> client 203.121.4.59 { >>> require_message_authenticator = no >>> secret = "testing123-1" >>> shortname = "Proxim-700" >>> nastype = "other" >>> } >>> radiusd: #### Loading Realms and Home Servers #### >>> proxy server { >>> retry_delay = 5 >>> retry_count = 3 >>> default_fallback = no >>> dead_time = 120 >>> wake_all_if_all_dead = no >>> } >>> home_server localhost { >>> ipaddr = 127.0.0.1 >>> port = 1812 >>> type = "auth" >>> secret = "testing123" >>> response_window = 20 >>> max_outstanding = 65536 >>> zombie_period = 40 >>> status_check = "status-server" >>> ping_interval = 30 >>> check_interval = 30 >>> num_answers_to_alive = 3 >>> num_pings_to_alive = 3 >>> revive_interval = 120 >>> status_check_timeout = 4 >>> } >>> home_server_pool my_auth_failover { >>> type = fail-over >>> home_server = localhost >>> } >>> realm example.com { >>> auth_pool = my_auth_failover >>> } >>> realm LOCAL { >>> } >>> radiusd: #### Instantiating modules #### >>> instantiate { >>> Module: Linked to module rlm_exec >>> Module: Instantiating exec >>> exec { >>> wait = no >>> input_pairs = "request" >>> shell_escape = yes >>> } >>> Module: Linked to module rlm_expr >>> Module: Instantiating expr >>> Module: Linked to module rlm_expiration >>> Module: Instantiating expiration >>> expiration { >>> reply-message = "Password Has Expired " >>> } >>> Module: Linked to module rlm_logintime >>> Module: Instantiating logintime >>> logintime { >>> reply-message = "You are calling outside your allowed timespan >>> " >>> minimum-timeout = 60 >>> } >>> } >>> radiusd: #### Loading Virtual Servers #### >>> server inner-tunnel { >>> modules { >>> Module: Checking authenticate {...} for more modules to load >>> Module: Linked to module rlm_pap >>> Module: Instantiating pap >>> pap { >>> encryption_scheme = "auto" >>> auto_header = no >>> } >>> Module: Linked to module rlm_chap >>> Module: Instantiating chap >>> Module: Linked to module rlm_mschap >>> Module: Instantiating mschap >>> mschap { >>> use_mppe = yes >>> require_encryption = no >>> require_strong = no >>> with_ntdomain_hack = no >>> } >>> Module: Linked to module rlm_unix >>> Module: Instantiating unix >>> unix { >>> radwtmp = "/var/log/radius/radwtmp" >>> } >>> Module: Linked to module rlm_eap >>> Module: Instantiating eap >>> eap { >>> default_eap_type = "md5" >>> timer_expire = 60 >>> ignore_unknown_eap_types = no >>> cisco_accounting_username_bug = no >>> max_sessions = 2048 >>> } >>> Module: Linked to sub-module rlm_eap_md5 >>> Module: Instantiating eap-md5 >>> Module: Linked to sub-module rlm_eap_leap >>> Module: Instantiating eap-leap >>> Module: Linked to sub-module rlm_eap_gtc >>> Module: Instantiating eap-gtc >>> gtc { >>> challenge = "Password: " >>> auth_type = "PAP" >>> } >>> Module: Linked to sub-module rlm_eap_tls >>> Module: Instantiating eap-tls >>> tls { >>> rsa_key_exchange = no >>> dh_key_exchange = yes >>> rsa_key_length = 512 >>> dh_key_length = 512 >>> verify_depth = 0 >>> pem_file_type = yes >>> private_key_file = "/etc/raddb/certs/server.pem" >>> certificate_file = "/etc/raddb/certs/server.pem" >>> CA_file = "/etc/raddb/certs/ca.pem" >>> private_key_password = "devin123" >>> dh_file = "/etc/raddb/certs/dh" >>> random_file = "/etc/raddb/certs/random" >>> fragment_size = 1024 >>> include_length = yes >>> check_crl = no >>> cipher_list = "DEFAULT" >>> make_cert_command = "/etc/raddb/certs/bootstrap" >>> cache { >>> enable = no >>> lifetime = 24 >>> max_entries = 255 >>> } >>> } >>> Module: Linked to sub-module rlm_eap_ttls >>> Module: Instantiating eap-ttls >>> ttls { >>> default_eap_type = "md5" >>> copy_request_to_tunnel = no >>> use_tunneled_reply = no >>> virtual_server = "inner-tunnel" >>> } >>> Module: Linked to sub-module rlm_eap_peap >>> Module: Instantiating eap-peap >>> peap { >>> default_eap_type = "mschapv2" >>> copy_request_to_tunnel = no >>> use_tunneled_reply = no >>> proxy_tunneled_request_as_eap = yes >>> virtual_server = "inner-tunnel" >>> } >>> Module: Linked to sub-module rlm_eap_mschapv2 >>> Module: Instantiating eap-mschapv2 >>> mschapv2 { >>> with_ntdomain_hack = no >>> } >>> Module: Checking authorize {...} for more modules to load >>> Module: Linked to module rlm_realm >>> Module: Instantiating suffix >>> realm suffix { >>> format = "suffix" >>> delimiter = "@" >>> ignore_default = no >>> ignore_null = no >>> } >>> Module: Linked to module rlm_files >>> Module: Instantiating files >>> files { >>> usersfile = "/etc/raddb/users" >>> acctusersfile = "/etc/raddb/acct_users" >>> preproxy_usersfile = "/etc/raddb/preproxy_users" >>> compat = "no" >>> } >>> Module: Checking session {...} for more modules to load >>> Module: Linked to module rlm_radutmp >>> Module: Instantiating radutmp >>> radutmp { >>> filename = "/var/log/radius/radutmp" >>> username = "%{User-Name}" >>> case_sensitive = yes >>> check_with_nas = yes >>> perm = 384 >>> callerid = yes >>> } >>> Module: Checking post-proxy {...} for more modules to load >>> Module: Checking post-auth {...} for more modules to load >>> Module: Linked to module rlm_attr_filter >>> Module: Instantiating attr_filter.access_reject >>> attr_filter attr_filter.access_reject { >>> attrsfile = "/etc/raddb/attrs.access_reject" >>> key = "%{User-Name}" >>> } >>> } >>> } >>> modules { >>> Module: Checking authenticate {...} for more modules to load >>> Module: Checking authorize {...} for more modules to load >>> Module: Linked to module rlm_preprocess >>> Module: Instantiating preprocess >>> preprocess { >>> huntgroups = "/etc/raddb/huntgroups" >>> hints = "/etc/raddb/hints" >>> with_ascend_hack = no >>> ascend_channels_per_line = 23 >>> with_ntdomain_hack = no >>> with_specialix_jetstream_hack = no >>> with_cisco_vsa_hack = no >>> with_alvarion_vsa_hack = no >>> } >>> Module: Checking preacct {...} for more modules to load >>> Module: Linked to module rlm_acct_unique >>> Module: Instantiating acct_unique >>> acct_unique { >>> key = "User-Name, Acct-Session-Id, NAS-IP-Address, >>> Client-IP-Address, NAS-Port" >>> } >>> Module: Checking accounting {...} for more modules to load >>> Module: Linked to module rlm_detail >>> Module: Instantiating detail >>> detail { >>> detailfile = >>> "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" >>> header = "%t" >>> detailperm = 384 >>> dirperm = 493 >>> locking = no >>> log_packet_header = no >>> } >>> Module: Instantiating attr_filter.accounting_response >>> attr_filter attr_filter.accounting_response { >>> attrsfile = "/etc/raddb/attrs.accounting_response" >>> key = "%{User-Name}" >>> } >>> Module: Checking session {...} for more modules to load >>> Module: Checking post-proxy {...} for more modules to load >>> Module: Checking post-auth {...} for more modules to load >>> } >>> radiusd: #### Opening IP addresses and Ports #### >>> listen { >>> type = "auth" >>> ipaddr = * >>> port = 0 >>> } >>> listen { >>> type = "acct" >>> ipaddr = * >>> port = 0 >>> } >>> Listening on authentication address * port 1812 >>> Listening on accounting address * port 1813 >>> Listening on proxy address * port 1814 >>> Ready to process requests. >>> >>> >>> >>> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>>> Hi Ivan, >>>> >>>> When i clik on my SSID palstaff it prompts for the certificate name >>>> >>>> username on certificate so i selected >>>> >>>> devinder(a)palettemm.com >>>> >>>> Click OK then authentication failed on the SSID >>>> >>>> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>>>> Hi Ivan >>>>> >>>>> Ok i managed to install ca.der and client.p12 on my XP >>>>> >>>>> When i run radiusd -X i get >>>>> >>>>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>>>> id=30, length=216 >>>>> User-Name = "devinder(a)palettemm.com" >>>>> NAS-IP-Address = 203.121.4.59 >>>>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>>>> Calling-Station-Id = "00-04-23-7b-56-b9" >>>>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>>>> State = 0xf30ae66df60debd09c91249e7b82f0a9 >>>>> Framed-MTU = 1400 >>>>> NAS-Port-Type = Wireless-802.11 >>>>> EAP-Message = >>>>> 0x0207002c0d000116030100205a6f866d20eb642ddc9f404f90d8650422eb751e7bb0199a016bb14e384df6fa >>>>> Message-Authenticator = 0x06206416bbe520db012eb924f72ba75e >>>>> +- entering group authorize {...} >>>>> ++[preprocess] returns ok >>>>> ++[chap] returns noop >>>>> ++[mschap] returns noop >>>>> [suffix] Looking up realm "palettemm.com" for User-Name = >>>>> "devinder(a)palettemm.com" >>>>> [suffix] No such realm "palettemm.com" >>>>> ++[suffix] returns noop >>>>> [eap] EAP packet type response id 7 length 44 >>>>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>>>> ++[eap] returns updated >>>>> ++[unix] returns notfound >>>>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>>>> ++[files] returns ok >>>>> ++[expiration] returns noop >>>>> ++[logintime] returns noop >>>>> ++[pap] returns noop >>>>> Found Auth-Type = EAP >>>>> +- entering group authenticate {...} >>>>> [eap] Request found, released from the list >>>>> [eap] EAP/tls >>>>> [eap] processing type tls >>>>> [tls] Authenticate >>>>> [tls] processing EAP-TLS >>>>> [tls] eaptls_verify returned 7 >>>>> [tls] Done initial handshake >>>>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >>>>> --> verify error:num=20:unable to get local issuer certificate >>>>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >>>>> TLS Alert write:fatal:unknown CA >>>>> TLS_accept:error in SSLv3 read client certificate B >>>>> rlm_eap: SSL error error:140890B2:SSL >>>>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>>>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>>>> TLS receive handshake failed during operation >>>>> [tls] eaptls_process returned 4 >>>>> [eap] Handler failed in EAP/tls >>>>> [eap] Failed in EAP select >>>>> ++[eap] returns invalid >>>>> Failed to authenticate the user. >>>>> Using Post-Auth-Type Reject >>>>> +- entering group REJECT {...} >>>>> [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com >>>>> attr_filter: Matched entry DEFAULT at line 11 >>>>> ++[attr_filter.access_reject] returns updated >>>>> Delaying reject of request 6 for 1 seconds >>>>> Going to the next request >>>>> Waking up in 0.9 seconds. >>>>> Sending delayed reject for request 6 >>>>> Sending Access-Reject of id 30 to 203.121.4.59 port 6001 >>>>> EAP-Message = 0x04070004 >>>>> Message-Authenticator = 0x00000000000000000000000000000000 >>>>> Waking up in 3.8 seconds. >>>>> Cleaning up request 0 ID 24 with timestamp +83 >>>>> Cleaning up request 1 ID 25 with timestamp +83 >>>>> Cleaning up request 2 ID 26 with timestamp +83 >>>>> Cleaning up request 3 ID 27 with timestamp +83 >>>>> Cleaning up request 4 ID 28 with timestamp +83 >>>>> Cleaning up request 5 ID 29 with timestamp +83 >>>>> Waking up in 1.0 seconds. >>>>> Cleaning up request 6 ID 30 with timestamp +83 >>>>> Ready to process requests. >>>>> >>>>> >>>>> >>>>> Users File >>>>> >>>>> >>>>> "devinder(a)palettemm.com" Auth-Type := EAP >>>>> >>>>> DEFAULT Auth-Type := Reject >>>>> Reply-Message = "Authentication Failed" >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> 2009/8/3 Ivan Kalik <tnt(a)kalik.net>: >>>>>>> Do i copy this file to the XP and install ca.der >>>>>>> >>>>>>> ca.der and client.p12 >>>>>> >>>>>> Yes. >>>>>> >>>>>> Ivan Kalik >>>>>> Kalik Informatika ISP >>>>>> >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> Devinder >>>>> >>>> >>>> >>>> >>>> -- >>>> Devinder >>>> >>> >>> >>> >>> -- >>> Devinder >>> >> >> >> >> -- >> Devinder >> > > > > -- > Devinder > -- Devinder

1 1

Filter or restrict on NAS
by Rakotomandimby Mihamina 04 Aug '09

04 Aug '09

Hi all, Configuration (Debian packaged): - freeradius 2.0.4 - pgsql 8.3 When AUTHing and ACCounTing, the FreeRADIUS makes some SQL queries containing the NAS information. Currently, on our system, the query SELECTs a function and depending on that NAS information brought in the query we answer by a Access-Reject if from the bad NAS. - Is there, in the default FreeRadius proposed SQL schema a way to restrict on NAS? - Is there a query (or table) just for that usage? -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 2

phpRadmin,dialupAdmin?
by RANDRIAMAMPIONONA José Johnny 03 Aug '09

03 Aug '09

Hello, Does anyone know if these projects still active! In fact , I d like to install it on my server but it looks like non-existent! Thanks! Sincerly! -- JJohnny R.

2 1

rlm_ldap: ldap_search() failed: Operations error
by Alba 03 Aug '09

03 Aug '09

Hello all, I'm receiving this message: rlm_ldap: ldap_search() failed: Operations error and I found in the list archives ( http://www.nabble.com/FreeRadius-cannot-Authenticate-to-Windows-AD-td196909…) this information: > rlm_ldap: ldap_search() failed: Operations error > http://bugs.freeradius.org/show_bug.cgi?id=183 > You're running into two issues: > > - the OpenLDAP client libraries don't use the >authentication credentials they're given when following references. > > - Active Directory is following references because your domain >controller has two domains, and the user isn't found in one, so it's >being referred to the other domain. > >The patch might help, but your LDAP queries should be made more specific. > Alan DeKok. But I can't see the bug information ("Page not found"). Does anyone know were I can find this information or other information about what this message means? Thanks in advance for your help. Regards, Alba

3 6

Re: Re: Restart radiusd after new user added
by Alexandre Chapellon 03 Aug '09

03 Aug '09

Yes uncomment thoose lines, then restart freeradius. Re run radmin and pass it the "hup files" command. regards Don't forget to reply to the list it may help some else. Le lundi 03 août 2009 à 14:14 +0000, Paul.Blalock(a)gmail.com a écrit : > It looks like the control socket file > in /etc/freeradius/sites-enabled/ is a short-cut > to /etc/freeradius/sites-available/, and the file already has uid/gid > and mode =rw, but they are all commented out. Should I un-comment them > and then try it again? > > On Jul 31, 2009 5:37pm, Alexandre Chapellon > <alexandre.chapellon(a)mana.pf> wrote: > > > > > > > > > > Le vendredi 31 juillet 2009 à 16:17 -0500, Paul Blalock a écrit : > > > > > > I tried the radmin> hup files, command, with no luck. The command > was accepted, but it did nothing. > > > > > > > > > > > > > > What version of freeradius are you runing? > > > > > > > > If you have 2.1.1 or greater, just activate the control socket as a > virtual server (see in /etc/freeradius/sites-available) by linking it > to /etc/freeradius/sites-enabled/ > > > > Check that the soket is in read/write mode (mode =rw) and it has > correct uid/gid. > > > > Restart freeradius (yeah I know that's what we want to avoid :p) > > > > > > > > Then run radmin (as root), and try "hup files" > > > > > > > > This works properly on my setup... > > > > > > > > > > > > > > -- > > > > Paul > > > > > >

1 0

Chrooting freeradius 2.1.6
by Adam Osuchowski 03 Aug '09

03 Aug '09

Hi, what exactly should be placed in directory which freeradius 2.1 chroots to? I tried to configure chrooted environment for freeradius and I had to place all rlm_*.so (along with dependencies) and dictionary.* files inside chroot directory because chroot() is called earlier than these files are read. Even if I put modules names in instantiate section, it doesn't help. Also, putting these files under current directory is not a solution due to modules dependencies. Am I doing something wrong or it is impossible to jail freeradius into empty (or containing only /dev/log and /dev/urandom devices) directory? IMHO, it would be more logical to chroot after all initialization work was done and all files have been read. Regards.

3 2

Freeradius with AD integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

I was following http://deployingradius.com/documents/configuration/active_directory.html to create freeradius with AD integration. And also I was success to join with my domain net join. In this case I'm not using kerberos to join with my domain and only use samba. I'm no problems with radiusd.conf .. and normally start radiusd .. but if I use account from AD.. always Access Reject.. Please help me...

4 3

Freeradius with AD Integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

In this first time.. I'm surely was following http://deployingradius.com/documents/configuration/active_directory.html and successfully to join with my domain.. This problem is why always rejected if I use radtest <User_From_AD> <Password_From_AD> localhost 1812 testing 123... ?? There is no debug when I used radiusd -X... Sorry about my English..

2 1

invalid operator in auth section
by Hegedus Gabor 03 Aug '09

03 Aug '09

Hi ! I have a question, What is the operator I can use in the post auth section for this matching Nas-Port-id =* "tty" In the users file it is works, but I want use it in post auth section. The regular expression ("tty[0-9]") could be good but i don't know how to do. Module: Checking post-auth {...} for more modules to load Expected comparison at: =* /usr/local/radius/etc/raddb/sites-enabled/default[401]: Errors parsing post-auth section. Is any idea? Thank you!

2 1

Freeradius with AD Integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain= radius.satelite.net --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) exec: wait = yes exec: program = "/usr/sbin/ntlm_auth --request-nt-key --domain= radius.satelite.net --username=%{mschap:User-Name} --password=%{User-Password}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (ntlm_auth) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. .. Everything is fine when I start radiusd -X and radiusd... But if I use radtest <user_from_AD> <password_from_AD> localhost 1812 testing123 It's always... rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=125, length=20 please help me..

2 1