December 2010 - Freeradius-Users - lists.freeradius.org

Stop after mac auth
by Rob Yamry 13 Dec '10

13 Dec '10

99% of my config authenticates against ldap. There are certain situations (mainly authenticating our old phones) where I need to have mac auth as well. Both methods are authenticating fine. The problem is that I would like for freeradius to not search ldap when the "if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i))" comes back as TRUE. As the config is now (output below), it runs the condition and regardless of the outcome it performs a search against ldap for the mac, which will always fail and causes unnecessary queries. How can I accomplish this? ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^00-24-d6-a6-ce-ce$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE ++? if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> TRUE ++- entering if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) {...} +++[control] returns noop ++- if ((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) returns noop ++[chap] returns noop [ldap] performing user authorization for 00-24-d6-a6-ce-ce [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> 00-24-d6-a6-ce-ce [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=00-24-d6-a6-ce-ce) [ldap] expand: o=kasd -> o=kasd [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.company.com:389, authentication 0 [ldap] setting TLS CACert File to /etc/raddb/certs/CA.pem [ldap] starting TLS [ldap] bind as cn=radmin,o=org/<password> to ldpa.company.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=org, with filter (cn=00-24-d6-a6-ce-ce) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CSID +- entering group CSID {...} ++? if (Chap-Password) ? Evaluating (Chap-Password) -> FALSE ++? if (Chap-Password) -> FALSE ++- entering else else {...} +++[ok] returns ok ++- else else returns ok Login OK: [00-24-d6-a6-ce-ce] (from client kasd port 0 cli 00-24-d6-a6-ce-ce) +- entering group post-auth {...} ++[ldap] returns noop ++[exec] returns noop ++? if (control:Auth-Type == 'CSID') ? Evaluating (control:Auth-Type == 'CSID') -> TRUE ++? if (control:Auth-Type == 'CSID') -> TRUE ++- entering if (control:Auth-Type == 'CSID') {...} [authorized_macs] expand: %{Calling-Station-ID} -> 00-24-d6-a6-ce-ce [authorized_macs] users: Matched entry 00-24-d6-a6-ce-ce at line 1 +++[authorized_macs.authorize] returns ok +++? if (!ok) ? Evaluating !(ok) -> FALSE +++? if (!ok) -> FALSE ++- if (control:Auth-Type == 'CSID') returns ok Sending Access-Accept of id 65 to 10.1.2.85 port 53168 Reply-Message = "MyLaptop" Service-Type := Call-Check Filter-Id = "Students" Finished request 0.

2 2

Re: ldap - edirectory authentication
by Gary Gatten 13 Dec '10

13 Dec '10

Look in the configure script, or maybe try ./configure --help. Else the config options are probably listed in one of the readme's. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'FreeRadius users mailing list' <freeradius-users(a)lists.freeradius.org> Sent: Fri Dec 10 08:54:18 2010 Subject: RE: ldap - edirectory authentication Not too sure. We've looked thru all the conf's. Where would I look? robert Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 >>> Gary Gatten <Ggatten(a)waddell.com> 12/10/2010 7:37 AM >>> It’s a configure flag no? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Robert Koskey Sent: Friday, December 10, 2010 8:30 AM To: FreeRadius users mailing list Subject: Re: ldap - edirectory authentication We really aren't too sure about that. We just installed it from the media that OpenSuse 11.3 came with. We have noticed the bit about the --with-edir but even when we downloaded and compiled the FR 2.1.10 (latest) we didn't see how we could install with that option. If you know, please shed some light. thanks, Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 >>> Peter Lambrechtsen <plambrechtsen(a)gmail.com> 12/9/2010 3:48 PM >>> You may need to comment out the logintime and pap sections, since this isn't a pap authentication. It seems like the password is being correctly extracted out of eDirectory using Universal Password, but are you sure that's properly configured in the build version of FreeRadius? On Fri, Dec 10, 2010 at 11:40 AM, Robert Koskey <rkoskey(a)rockyview.ab.ca<mailto:rkoskey@rockyview.ab.ca>> wrote: Can anyone help? We are trying to do a ldap authentication from novell's edirectory to an Aruba controller for wireless access. These are the error's we are getting. It used to work perfectly but the original radius server blew up. We installed a new one with the same configuration and it doesn't work. The problem areas are bold'ed. The problem seems to occur after the ldap authentication. I don't think we are entirely clear about the order in which the whole process happens. Any help or suggestions would be greatly appreciated. The set up is: OpenSuse 11.0 FreeRadius 2.0.5 We have tried: OpenSuse 11.3 FreeRadius 2.1.9 (same result) rad_recv: Access-Request packet from host 10.215.10.100 port 34806, id=218, length=199 User-Name = "jordanhkaltenbruner" NAS-IP-Address = 10.200.8.30 NAS-Port = 2 NAS-Identifier = "10.215.10.99" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "78CA39B5D3E5" Called-Station-Id = "000B8661AC58" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x02010018016a6f7264616e686b616c74656e6272756e6572 Aruba-Essid-Name = "SCHS-Student" Aruba-Location-Id = "SpringbankW2-9" Message-Authenticator = 0x4542e9b98b5978ca1ca52b7617910620 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@'<mailto:%27@%27> in User-Name = "jordanhkaltenbruner", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for jordanhkaltenbruner WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=jordanhkaltenbruner) expand: ou=springhigh_lab,o=springhigh -> ou=springhigh_lab,o=springhigh rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.215.0.3:636<http://10.215.0.3:636>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=admin,o=springhigh/???? to 10.215.0.3:636<http://10.215.0.3:636> rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=springhigh_lab,o=springhigh, with filter (uid=jordanhkaltenbruner) rlm_ldap: Added the eDirectory password 51601222 in check items as Cleartext-Password rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jordanhkaltenbruner authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> jordanhkaltenbruner attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 218 to 10.215.10.100 port 34806 Finished request 0. Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed. "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

4 4

Break Stream & disconnecting when use freeradius authentication.
by Robin 13 Dec '10

13 Dec '10

Hi Friends, I find a strange issue. When I only use Mikrotik RouterOS as PPPoE server to authenticate my DSL users, all is ok. But when I add FreeRaiuds as radius server and RouterOS as pppoe server, I find some users of using p2p video on demand will break stream of lost connection. At the time, user has to disconnect the DSL link manually and re-dial to network. When user log in again, about 1-2 minutes, user will break stream of lost connection again. P.S. If user uses download software, the issue will not appear. Is it because I don’t set Freeradius correctly? Thank you. Robin Lu

2 5

Freeradius COA trigger
by Johan Meiring 13 Dec '10

13 Dec '10

Hi, I have a freeradius setup generating COA successfully (when neccesary) after receiving accounting packets. This works well. Now I want to also make Freeradius generate a COA by some other means. e.g. a tech support guy clicking "disconnect" on a web page. I.e. I want to somehow "trigger" a coa that is not caused by an "update coa {}" block, but by some external trigger. Is this possible in any way? -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

5 7

Новое сообщение
by Vovan 12 Dec '10

12 Dec '10

http://samec.org.ua/

1 0

MySQL connection setup
by Robin 12 Dec '10

12 Dec '10

Hi Friends, There is a configuration in SQL.conf. Num_sql_socks= I would like to know if this value is set to smaller, fx. 20, can it cause breaking stream or disconnecting for DSL users? If I set it to larger, can it cause MySQL problem of “Too many connection”. I can’t find details information about this setting in SQL.conf file. I want to know what policy of setting numbers is. Thank you very much. Robin

3 2

can't login with LDAP username/password
by Kelly Kloen 10 Dec '10

10 Dec '10

hi there, first time here, what i want fix is.. we want to connect with freeradius to a website ( http://breul.swp.nl ) and login with LDAP username and password..( and later with a token ) now i can put in the username kekl and the good for now mypassword ;) but then i get a message cannot login... and the log of freeradius is : Listening on authentication address 192.168.5.16 port 1812 Listening on accounting address * port 1813 Listening on proxy address 192.168.5.16 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.5.1 port 4693, id=1, length=88 Service-Type = Login-User User-Name = "kekl(a)administratie.net" User-Password = "mypassword" NAS-IP-Address = 192.168.5.16 NAS-Identifier = "radius" NAS-Port-Type = Virtual +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "administratie.net" for User-Name = "kekl(a)administratie.net" rlm_realm: Found realm "administratie.net" rlm_realm: Adding Stripped-User-Name = "kekl" rlm_realm: Adding Realm = "administratie.net" rlm_realm: Proxying request from user kekl to realm administratie.net rlm_realm: Preparing to proxy authentication request to realm "administratie.net" ++[suffix] returns updated rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 44 to 127.0.0.1 port 1812 Service-Type = Login-User User-Name = "kekl" User-Password = "mypassword" NAS-IP-Address = 192.168.5.16 NAS-Identifier = "radius" NAS-Port-Type = Virtual Proxy-State = 0x31 Proxying request 0 to home server 127.0.0.1 port 1812 Sending Access-Request of id 44 to 127.0.0.1 port 1812 Service-Type = Login-User User-Name = "kekl" User-Password = "mypassword" NAS-IP-Address = 192.168.5.16 NAS-Identifier = "radius" NAS-Port-Type = Virtual Proxy-State = 0x31 Going to the next request Waking up in 0.9 seconds. Waking up in 18.9 seconds. Rejecting request 0 due to lack of any response from home server 127.0.0.1 port 1812 There was no response configured: rejecting request 0 Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> kekl(a)administratie.net attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 1 to 192.168.5.1 port 4693 Finished request 0. WARNING: Marking home server 127.0.0.1 port 1812 as zombie (it looks like it is dead). Waking up in 4.9 seconds. Cleaning up request 0 ID 1 with timestamp +649 Ready to process requests. why do can't i login ???? gr kloenie

2 1

ERROR! Our request for peap was NAK'd with a request for peap
by Rob Yamry 10 Dec '10

10 Dec '10

I have a HP JetDirect 690n print server that Im trying to authenticate via FreeRadius 2.1.8 for wireless clients to use. If I tell the 690 to use peap then I get the error "ERROR! Our request for peap was NAK'd with a request for peap". If I tell it to use eap-tls I get the error "ERROR! Our request for tls was NAK'd with a request for tls". Also, I have a user setup in the users file, but it still tries to search ldap for that user. I can login fine with the local "ktest" user via radtest or ntradping. Debug log from a peap request is here: Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=283 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x0201000a016b74657374 Message-Authenticator = 0xef83aea844bdbfb74c34110c7fafa33f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry ktest at line 209 ++[files] returns ok [ldap] performing user authorization for ktest [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ktest [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=ktest) [ldap] expand: o=org -> o=org [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.company.com:389, authentication 0 [ldap] setting TLS CACert File to /etc/raddb/certs/ca.pem [ldap] starting TLS [ldap] bind as cn=radmin,o=org/<password> to ldap.company.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=org, with filter (cn=ktest) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 Filter-Id = "Students" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b21e261bc6f5440efd9d3572 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=361 Cleaning up request 0 ID 80 with timestamp +53 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x0202004619800000003c16030100370100003303010000000c2db78264c7293dabf829a390628548921ccd153f66aef981c50d964c00000c0035000a002f0005000400090100 State = 0xb21c3f23b21e261bc6f5440efd9d3572 Message-Authenticator = 0x047a88b42dd297aff674849e11cc719b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 70 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 60 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0037], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0b95], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 EAP-Message = 0x0103040019c000000bd2160301002a0200002603014cffb1ebbcc5475dcfc501c476c4728d86282b97d10966cfc06dd18a38bbef7f000035001603010b950b000b91000b8e0005b1308205ad30820495a003020102020103300d06092a864886f70d01010505003081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479 EAP-Message = 0x312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573301e170d3130303331363133333732345a170d3137303331343133333732345a3081a4310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c2044697374726963743120301e060355040313176c6461702e6b696d6265726c792e6b31322e77692e7573312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e757330820122300d06092a EAP-Message = 0x864886f70d01010105000382010f003082010a0282010100cad3696f20cbdc165ddd4dfdf8f4a1b96a1d4aca94548853d895b8e72a29d078e7fa69b4962adc66d2b8db9f8bcb9e49df313a06dabdbecca170d1a2a93341b2cffede3c8675053b9617aca00de9c263de036840e0982133f2e7972357662d6acd876ebfce2e14f7dc1408380fc802d6f0100d8014d7e818e59dda1307f59d5bcf2d861a54a28af634697fa10ce3ed1be9a95199a49a94c7fdf0b97a3e2bbc37b5aed07e002035f97d5231ba880ab7022ccf3e9b875654cd2dfde3d75558ad4287a29c74cfef1dfe9354c6a9f904ebff2c9b4d26b5f7ec4ff0da63fc2fe8c8171c029acbd4 EAP-Message = 0x97e9a89184d0bd309837c787de2c0af4f43773ccce11cfdb3aaeb50203010001a38201ca308201c630090603551d1304023000303006096086480186f842010d04231621596153542047656e65726174656420536572766572204365727469666963617465301106096086480186f8420101040403020640300b0603551d0f0404030205a0301d0603551d0e0416041467eabf6541c39d4ed474b25d1d42b4a40641ef053081f50603551d230481ed3081ea8014cb6f25029dcbc68e70aeff2fa9a9baee6af47f77a181c6a481c33081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c EAP-Message = 0x7931263024060355040a131d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b31f261bc6f5440efd9d3572 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=297 Cleaning up request 1 ID 80 with timestamp +54 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x020300061900 State = 0xb21c3f23b31f261bc6f5440efd9d3572 Message-Authenticator = 0xce8fce3cab0d91febe1a2b82b5f43071 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 EAP-Message = 0x010403fc19404b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573820900d6d85d886ad5a6f830270603551d110420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e757330270603551d120420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e7573300d06092a864886f70d0101050500038201 EAP-Message = 0x01003f8292ee1e98c0595f0da2e0692d632b818fdef25f4ef7e4b6748c075fc7ca14f22ce2de91d9e407ee786de26e2be17f1208470e3480374ef3ba826f5c55a42e1b3e229008322e04b72781f73ef22e2404561731f03da7c07cb80dcabbdcc0bc5c6fd3da0f4f3cfd8a54d17041a4b675a09d99845f6af40ed129299427a11d34c5551142232eef7c36ef1e8d95e695057d6dd7450b27359b5a89663b910934d28977bb80ed5430b4dc92022622f56a00e4143d507701b7dc49ff5bb7e46db5621c0667cc15d480ae1ecb764bb89c0c255d5b874e31e484293b823056cf9cbc8bc94015bb8d99db0571cbbfb49ab775a6de4d98da36df016ac968ff EAP-Message = 0x4b78507d900005d7308205d3308204bba003020102020900d6d85d886ad5a6f8300d06092a864886f70d01010505003081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573301e170d31303033313631 EAP-Message = 0x33333331375a170d3230303331333133333331375a3081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e757330820122300d06092a864886f70d01010105000382010f003082010a0282010100d551d5fb EAP-Message = 0xb0e4092778a12e41 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b018261bc6f5440efd9d3572 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=297 Cleaning up request 2 ID 80 with timestamp +54 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x020400061900 State = 0xb21c3f23b018261bc6f5440efd9d3572 Message-Authenticator = 0x552a1288d35108114eb710baa5d4e06d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 80 to 10.1.1.1 port 47567 EAP-Message = 0x010503ec1900659f48472b8d2d5d9a8da76c445e33490bee5c5c155fe88108113ed74335a2ba068e51f7da1fa2c4ac8a156f3c5da7c0e1df69a27b32f3825880b80eff9cd02c2f3beeb9669ae0fea448d28da8498d9d227087fa2199c15dd80e9a6477e64fdb8b138265605f5ad61581084b9d7faa0deb343f6697ace0d0bdd3908736544251650239d0707fedf29c465e4bcecc92034249c23123dea30a5c85ed92f6d0475830555550d0997d1152892bb8ff7d7bd148652d69c1bcc014371df36e2f3a075b1f5f165dcdd816cb5e7750d6f6dd4ed1e4494cb0f050c53c0397f03e195d67f1d2f3dec0fc4a198d32775e34530ccf191e522cb3020301 EAP-Message = 0x0001a38201cc308201c8300f0603551d130101ff040530030101ff302c06096086480186f842010d041f161d596153542047656e657261746564204341204365727469666963617465301106096086480186f8420101040403020106300b0603551d0f040403020106301d0603551d0e04160414cb6f25029dcbc68e70aeff2fa9a9baee6af47f773081f50603551d230481ed3081ea8014cb6f25029dcbc68e70aeff2fa9a9baee6af47f77a181c6a481c33081c0310b3009060355040613025553310b30090603550408130257493111300f060355040713084b696d6265726c7931263024060355040a131d4b696d6265726c792041726561205363 EAP-Message = 0x686f6f6c204469737472696374313c303a060355040313334b696d6265726c792041726561205363686f6f6c20446973747269637420436572746966696361746520417574686f72697479312b302906092a864886f70d010901161c7765626d6173746572406b696d6265726c792e6b31322e77692e7573820900d6d85d886ad5a6f830270603551d110420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e757330270603551d120420301e811c7765626d6173746572406b696d6265726c792e6b31322e77692e7573300d06092a864886f70d010105050003820101004b96358c5945bbc3937219dc3371b00431ab3b6e EAP-Message = 0x67be20fd70177edba50c23cbe05be70995474416cc6562174c08602e4d075e8fd648a90b72be087d25fba87d2442973a4651da2690b02aab44222cc8336b8acf2d387b7606f5bb7a4f360e9381fc79c28535ff23aab2e3d2f31544a34f8ae2805ac32e6592ab7c9a090ddd1e15f7aba6a3c7758723b634d47dc7109564708bf0b30f04f55a6ea1ab28787407f33e0997412709d970d2fd79a4a5826967c41db74eb68bac6c309d1f1fe2b16fa0d18a5352159ac1bd7c29cbdf787ec92deb3d84cd27c32b351b8023f79f97a5e0b970b9fdb4456a626d87cbe45f1c36d580cbd51ff1572a27f7e5555ef8195e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb21c3f23b119261bc6f5440efd9d3572 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 47567, id=80, length=297 Cleaning up request 3 ID 80 with timestamp +54 User-Name = "ktest" NAS-IP-Address = 10.1.1.1 NAS-Port = 150 Framed-MTU = 1400 Called-Station-Id = "00:1f:45:7f:83:fa" Calling-Station-Id = "00:1b:78:eb:c8:1d" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "TEST" Siemens-AP-Serial = "0500010143052305" Siemens-AP-Name = "AP01" Siemens-VNS-Name = "TEST" Siemens-BSSID = "TEST" Siemens-BSS-MAC = "00:1f:45:7f:83:fa" Siemens-Policy = "NonAuth" Siemens-Topology = "Bridged at AP untagged" EAP-Message = 0x020500060319 State = 0xb21c3f23b119261bc6f5440efd9d3572 Message-Authenticator = 0xbb238eafebdfefd81192fb93cacdb01c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ktest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry ktest at line 209 ++[files] returns ok [ldap] performing user authorization for ktest [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ktest [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=ktest) [ldap] expand: o=org -> o=org [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=org, with filter (cn=ktest) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] ERROR! Our request for peap was NAK'd with a request for peap. Skipping the requested type. [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect ( [ldap] User not found): [ktest/<via Auth-Type = EAP>] (from client kasd port 150 cli 00:1b:78:eb:c8:1d) Using Post-Auth-Type Reject +- entering group REJECT {...} ++[ldap] returns noop Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 80 to 10.1.1.1 port 47567 Filter-Id = "Students" EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 4 ID 80 with timestamp +56 Ready to process requests.

5 11

ldap - edirectory authentication
by Robert Koskey 10 Dec '10

10 Dec '10

Can anyone help? We are trying to do a ldap authentication from novell's edirectory to an Aruba controller for wireless access. These are the error's we are getting. It used to work perfectly but the original radius server blew up. We installed a new one with the same configuration and it doesn't work. The problem areas are bold'ed. The problem seems to occur after the ldap authentication. I don't think we are entirely clear about the order in which the whole process happens. Any help or suggestions would be greatly appreciated. The set up is: OpenSuse 11.0 FreeRadius 2.0.5 We have tried: OpenSuse 11.3 FreeRadius 2.1.9 (same result) rad_recv: Access-Request packet from host 10.215.10.100 port 34806, id=218, length=199 User-Name = "jordanhkaltenbruner" NAS-IP-Address = 10.200.8.30 NAS-Port = 2 NAS-Identifier = "10.215.10.99" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "78CA39B5D3E5" Called-Station-Id = "000B8661AC58" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x02010018016a6f7264616e686b616c74656e6272756e6572 Aruba-Essid-Name = "SCHS-Student" Aruba-Location-Id = "SpringbankW2-9" Message-Authenticator = 0x4542e9b98b5978ca1ca52b7617910620 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "jordanhkaltenbruner", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for jordanhkaltenbruner WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=jordanhkaltenbruner) expand: ou=springhigh_lab,o=springhigh -> ou=springhigh_lab,o=springhigh rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.215.0.3:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as cn=admin,o=springhigh/???? to 10.215.0.3:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=springhigh_lab,o=springhigh, with filter (uid=jordanhkaltenbruner) rlm_ldap: Added the eDirectory password 51601222 in check items as Cleartext-Password rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jordanhkaltenbruner authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> jordanhkaltenbruner attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 218 to 10.215.10.100 port 34806 Finished request 0. Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 Robert Koskey, Systems and Network Manager Rocky View Schools Telephone: 403-945-4080 Cell: 403-988-4640 _____________________________________________________________________________________ This communication is intended for the use of the recipient to which it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communication received in error, or subsequent reply, should be deleted or destroyed.

3 7

WiMAX Home Agent Authentication
by Marck Gorszwick 10 Dec '10

10 Dec '10

Hi All- We're doing some work with integrating FreeRADIUS using EAP-TLS into a network with HItachi ASN-GW and Cisco HA that only uses Mobile-IP. We successfully pass phase-1 authentication, and generate the appropriate keying material for the HA, but at phase-2 authentication we fail, since the MN-hHA-MIP4-KEY is not stored. The rlm_wimax module implies that the HA authentication portion needs to retrieve the MN-hHA-MIP4-KEY from a store based on the SPI in the request, a couple questions: -Does FreeRADIUS have any way of linking the two authentications, and can the TLS session cache can be used to store the TLVs from phase 1 access accept, or does it need to be done externally? If it can be cached within FreeRADIUS, how? -FreeRADIUS complains that this phase-2 authentication has no known Auth-Type. What needs to be done to have FreeRADIUS consider this? Can we just pre-process or HINT the request to accept it with the when we have the appropriate KEY? Phase 1 Access-Accept: Sending Access-Accept of id 227 to 172.17.10.10 port 1814 EAP-Message = 0x030d0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous(a)grid-net.com" WiMAX-IP-Technology = PMIP4 WiMAX-FA-RK-Key = 0x4cf2d4149289d9a0ce8cbeb264cdb41206fc679a Chargeable-User-Identity = "gridnet" WiMAX-NSP-Id = 0x000021 WiMAX-hHA-IP-MIP4 = 172.29.163.6 Service-Type = Framed-User WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Idle-Mode-Notification-Cap = Not-Supported WiMAX-AAA-Session-Id = 0x12346789012345678901 WiMAX-DNS-Server = 1.2.3.4 WiMAX-MSK = 0x4b0b12e1ea34fea4ae762a3d63eda2ed3bbb446bcc46f25af546f35b47a26bc287017df6af42587c4b46cacf960812c00d212635324bca42bd96172b346e56e6 WiMAX-MN-hHA-MIP4-Key = 0x468d6588a03a1096acfd145a946b9dec0b8c44d2 WiMAX-MN-hHA-MIP4-SPI = 754533938 WiMAX-FA-RK-SPI = 754533937 Proxy-State = 0x313630 Wed Dec 8 16:33:45 2010 : Info: Finished request 491. Wed Dec 8 16:33:45 2010 : Debug: Going to the next request Wed Dec 8 16:33:45 2010 : Debug: Waking up in 0.2 seconds. Wed Dec 8 16:33:45 2010 : Info: Cleaning up request 484 ID 191 with timestamp +1844 Wed Dec 8 16:33:45 2010 : Debug: Waking up in 0.2 seconds. Wed Dec 8 16:33:45 2010 : Info: Cleaning up request 485 ID 217 with timestamp +1844 Wed Dec 8 16:33:45 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:46 2010 : Info: Cleaning up request 486 ID 188 with timestamp +1845 Wed Dec 8 16:33:46 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:46 2010 : Info: Cleaning up request 487 ID 111 with timestamp +1845 Wed Dec 8 16:33:46 2010 : Debug: Waking up in 0.4 seconds. Wed Dec 8 16:33:46 2010 : Info: Cleaning up request 488 ID 30 with timestamp +1845 Wed Dec 8 16:33:46 2010 : Debug: Waking up in 2.7 seconds. Wed Dec 8 16:33:49 2010 : Info: Cleaning up request 489 ID 67 with timestamp +1848 Wed Dec 8 16:33:49 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:49 2010 : Info: Cleaning up request 490 ID 35 with timestamp +1848 Wed Dec 8 16:33:49 2010 : Debug: Waking up in 0.3 seconds. Wed Dec 8 16:33:50 2010 : Info: Cleaning up request 491 ID 227 with timestamp +1849 Wed Dec 8 16:33:50 2010 : Info: Ready to process requests. And Phase-2 Access-Request: rad_recv: Access-Request packet from host 172.17.10.10 port 1814, id=168, length=153 WiMAX-HA-IP-MIP4 = 172.29.163.6 WiMAX-NSP-Id = 0x000021 NAS-Identifier = "xxxxx" User-Name = "anonymous(a)grid-net.com" WiMAX-Release = "01.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Not-Supported WiMAX-MN-hHA-MIP4-SPI = 754533938 Chargeable-User-Identity = "" Framed-IP-Address = 10.24.0.100 Message-Authenticator = 0xee2061e520a73223364859f2c0822248 NAS-IP-Address = 172.29.176.37 Proxy-State = 0x313631 Wed Dec 8 16:33:58 2010 : Info: # Executing section authorize from file /opt/local/etc/raddb/sites-enabled/default Wed Dec 8 16:33:58 2010 : Info: +- entering group authorize {...} Wed Dec 8 16:33:58 2010 : Info: ++[preprocess] returns ok Wed Dec 8 16:33:58 2010 : Info: ++[chap] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[mschap] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[wimax] returns ok Wed Dec 8 16:33:58 2010 : Info: [suffix] Looking up realm "grid-net.com" for User-Name = "anonymous(a)grid-net.com" Wed Dec 8 16:33:58 2010 : Info: [suffix] No such realm "grid-net.com" Wed Dec 8 16:33:58 2010 : Info: ++[suffix] returns noop Wed Dec 8 16:33:58 2010 : Info: [eap] No EAP-Message, not doing EAP Wed Dec 8 16:33:58 2010 : Info: ++[eap] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[unix] returns notfound Wed Dec 8 16:33:58 2010 : Info: [files] users: Matched entry DEFAULT at line 34 Wed Dec 8 16:33:58 2010 : Info: ++[files] returns ok Wed Dec 8 16:33:58 2010 : Info: ++[expiration] returns noop Wed Dec 8 16:33:58 2010 : Info: ++[logintime] returns noop Wed Dec 8 16:33:58 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Dec 8 16:33:58 2010 : Info: ++[pap] returns noop Wed Dec 8 16:33:58 2010 : Info: expand: %{request:User-Name} -> anonymous(a)grid-net.com Wed Dec 8 16:33:58 2010 : Info: ++[reply] returns noop Wed Dec 8 16:33:58 2010 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Wed Dec 8 16:33:58 2010 : Info: Failed to authenticate the user. Wed Dec 8 16:33:58 2010 : Auth: Login incorrect: [anonymous(a)grid-net.com/<no User-Password attribute>] (from client winghead port 0) Wed Dec 8 16:33:58 2010 : Info: Using Post-Auth-Type Reject Wed Dec 8 16:33:58 2010 : Info: # Executing group from file /opt/local/etc/raddb/sites-enabled/default Wed Dec 8 16:33:58 2010 : Info: +- entering group REJECT {...} Wed Dec 8 16:33:58 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> anonymous(a)grid-net.com Wed Dec 8 16:33:58 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Dec 8 16:33:58 2010 : Info: ++[attr_filter.access_reject] returns updated Wed Dec 8 16:33:58 2010 : Info: Delaying reject of request 492 for 1 seconds Wed Dec 8 16:33:58 2010 : Debug: Going to the next request Wed Dec 8 16:33:58 2010 : Debug: Waking up in 0.9 seconds. Wed Dec 8 16:33:59 2010 : Info: Sending delayed reject for request 492 Sending Access-Reject of id 168 to 172.17.10.10 port 1814 Proxy-State = 0x313631 Wed Dec 8 16:33:59 2010 : Debug: Waking up in 4.9 seconds. Wed Dec 8 16:34:04 2010 : Info: Cleaning up request 492 ID 168 with timestamp +1862 Wed Dec 8 16:34:04 2010 : Info: Ready to process requests.

2 1