February 2010 - Freeradius-Users - lists.freeradius.org

Freeradius replacing Cisco ACS in an Active Directory Environment
by George Shearer 02 Feb '10

02 Feb '10

Hi All. This is my attempt at giving back to the freeradius community. Maybe others will find my configuration useful in their efforts. I'm a network guy, and I do quite a bit of consulting work for various companies. I have a customer in particular who (prior to this) was using a very out-of-date Cisco ACS Server, and couldn't afford the renewal/licensing fees to bring it uptodate. They are using Microsoft's Active Directory on Windows Server 2000 as the primary database for all identities/passwords. The goals of this configuration are: 1. Provide AAA for administrative access to network devices (mostly, SSH access to Cisco routers/switches/firewalls) 2. Provide AAA for 802.11 WLAN users who are using Windows XP and "Wireless Zero" clients. (Cisco 1231 series access points) 3. Provide AAA for VPN Users who use cisco Secure VPN client from remote locations (cisco 3000 series concentrators) The freeradius server itself will run on a CentOS 5.4 Linux box. The company doesn't like "make install" application installs (nor do I), so I simply grabbed the SRPM from the Fedora Project's KOJI build server for the latest freeradius, and built it. This process is outside the scope of this particular posting, as I want to focus on Freeradius itself. The Fedora spec file builds multiple binary packages that you can install based on what you want to do with freeradius. These are the packages I'm using: freeradius-utils-2.1.8-2 freeradius-2.1.8-2 freeradius-ldap-2.1.8-2 The company has one Active Directory forest, and one subdomain. Users exist under both. So, for this configuration, we'll call the primary zone COMPANY.COM and SUB.COMPANY.COM. Both domains must be queried for authorization & authentication. The following rules apply for access: 1. User must exist within the AD forest. (as defined by my LDAP search parameters) 2. User must be a member of a particular group (defined by the Users file) for certain types of access: a) For administrative access to network device, the user must be a member of the group networkteam. b) Access to use the VPN, user must be a member of the group vpnusers. c) Access to the Wireless network, user must be a member of group wifiusers. VPN and Network-Admin users achieve both Authorization and Authentication using nothing more than the rlm_ldap module. Wireless users do not use ldap at all, but instead, they use the eap and mschap modules. The mschap module is configured to use ntlm_auth which requires samba's winbind to be configured on the backend. It took me some time (and I will not admit how much time) to figure out how to make this all work. I blame most of this on the fact that freeradius has been around a long time, and as a result there's lots of obsolete documentation out there for google to find. I believe this configuration uses mostly uptodate syntax, however I'm always interested in feedback on how to do things better. Interestingly.. this whole process brought back a case of severe dejavu for me. I wrote a combination tacacs/radius server WAY back in the day when the Livingston Portmaster 2 series was king of dialup. Many users on the livingston mailing list used my source code. This really made me feel old. :( Anyway, on to the good stuff.

1 0

freeRadius LDAP auth using WPA-EAP on 802.11
by José Campos 02 Feb '10

02 Feb '10

Hello everyone. I have this problem. I cant get my ldap users authenticate throw radius. I have my AP configure to use WPA-EAP and pointing to my radius server. I think that the radiusd X output is sufficient for you to understand what roung is: ######################## FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 15 2009 at 11:31:29 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.22.0.21 { ipaddr = 172.22.0.21 require_message_authenticator = no secret = "test" shortname = "mypc" nastype = "other" } client AP1-E1 { ipaddr = 192.168.70.70 require_message_authenticator = no secret = "test" shortname = "AP1-E1" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "xxx.xxx.xxx.xxx" port = 389 password = "123456" identity = "uid=borat,dc=xpto,dc=pt" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=xpto,dc=pt" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8782e88 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. ################################### When I try connect with wireless using radius I get a bunch o debug, but I think this is relevant: The follow lines tend to repeated over and over. ######################################## rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=xpto,dc=pt, with filter (uid=myLDAPuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user myLDAPuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.70.70 port 1026 EAP-Message = 0x010100160410f14661baee3d7327186dd431deff0370 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38f703bb38f607a3224364ff73a6f80d Finished request 1. ######################################## Atentamente, José Campos

2 5

radiusd -X with timestamps?
by freeradius＠corwyn.net 02 Feb '10

02 Feb '10

Is there any way to get timestamps to display when running radiusd -X? I get them when running as a service, but then I don't get the same detail in radius.log Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 2

autz-type according ldap server
by cd 02 Feb '10

02 Feb '10

I have a little problem but I think it's because autz-type is badly configured I have 2 ldaps (ldap_peda and ldap_admin) users account works fine on each servers but machine accounts work only on ldap_peda when a computer boot freeradius logs says +++[ldap_admin] returns ok [...] ++[ldap_peda] returns notfound (it s normal) but it says Sending Access-Accept with autz-type ldap_peda and not ldap_admin So machine is in the wrong vlan What do I miss ? my users file #### IT S FOR MACHINE ACCOUNT AUTH DEFAULT Autz-Type := ldap_peda Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="ok_hostpeda" DEFAULT Autz-Type := ldap_admin Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=10, Reply-Message="ok_hostadmin" #### IT S FOR USERS ACCOUNT AUTH DEFAULT ldap_peda-Ldap-Group=="Eleves" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="okeleves" DEFAULT ldap_peda-Ldap-Group=="professeurs" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="okprofs" DEFAULT ldap_admin-Ldap-Group=="administratifs" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=10, Reply-Message="admin" FreeRADIUS Version 2.1.7, for host i486-pc-linux-gnu, built on Oct 5 2009 at 14:59:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/control-socket group = freerad user = freerad including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" virtual_server = "inner-tunnel" } client 192.168.10.254 { require_message_authenticator = no secret = "momo" shortname = "Nortel" nastype = "other" virtual_server = "inner-tunnel" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } Module: Linked to module rlm_ldap Module: Instantiating ldap_admin ldap ldap_admin { server = "192.168.10.2" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=gouv,c=fr" filter = "(uid=%{mschap:User-Name})" base_filter = "(objectclass=radiusprofile)" password_attribute = "user-Password" auto_header = no access_attr = "uid" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{mschap:User-Name}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 15 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_admin-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_admin-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_admin rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8176838 Module: Instantiating ldap_peda ldap ldap_peda { server = "192.168.20.2" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=gouv,c=fr" filter = "(uid=%{mschap:User-Name})" base_filter = "(objectclass=radiusprofile)" password_attribute = "user-Password" auto_header = no access_attr = "uid" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{mschap:User-Name}))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 15 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_peda-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_peda-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_peda rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8177e58 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/ssl/certs/eole.key" certificate_file = "/etc/ssl/certs/eole.crt" CA_file = "/etc/ssl/certs/ca.crt" dh_file = "/etc/ssl/dh" random_file = "/dev/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=239, length=122 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xf9beb36136492c7928eb9131e2fb21ca NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" EAP-Message = 0x020b001201686f73742f70632d61646d696e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 11 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.20.2:389, authentication 0 rlm_ldap: bind as / to 192.168.20.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.10.2:389, authentication 0 rlm_ldap: bind as / to 192.168.10.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 239 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010c00271a010c002210d92b9fd31dccad929fdb3f2ca05a6646686f73742f70632d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25aff54b96dea318012fe73d9 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=240, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x21826287328e18d53b013ad8b9b196f1 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25aff54b96dea318012fe73d9 EAP-Message = 0x020c00060319 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 12 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 240 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010d00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25bfe57b96dea318012fe73d9 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=241, length=202 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x6939b9798b27d12e96581c83e621324d NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25bfe57b96dea318012fe73d9 EAP-Message = 0x020d005019800000004616030100410100003d03014b6829d4ba7efe234d701d03c5952b9eb8ead51c8105eb946369aacc24e8430000001600040005000a000900640062000300060013001200630100 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 13 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0914], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 241 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010e040019c000000951160301002a0200002603014b68298c6d7075b0b54fb873ef9fa975135522b70e535ab172d2d7a99533d73e0000040016030109140b00091000090d0004af308204ab30820393a003020102020120300d06092a864886f70d0101050500307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e301e170d3130303130343135303632365a170d31333031303431 EAP-Message = 0x35303632365a30818d310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573312630240603550403131d70662d616d6f6e2e30373231353732542e61632d6e616e7465732e667230820122300d06092a864886f70d01010105000382010f003082010a0282010100e4bed7c951596527195184c10821f2095377a90e673796557a48c155e02114854d78ef0a554f4508f9b65fabbbe13c41f336035031036c0406d1cfa48959aa70e6bbe935fa99 EAP-Message = 0x376c3784bbadd7617ab8ce3379b7b067a632c25ccbe005fcfc04e88fe73f53256aa16ee313b08ad0db3e843ab8c459e476f2e5d85779ccab883841a4b410efafa984bb03f2ae66f9bbdccc438edbf28b9ae2d2bfb99c72e37b6e9f43efec87f622bd64f50f281c42738a4d534b0588436d7bc05e2ebfd286f9f5202ca4ebd88d0b483f513f601ef41c0372e57e025264814e7c26d5cd550c14ceca6f04267766408a69cd9774a86d377dc39319419639f0ae531f64e65077ee310203010001a382012630820122300c0603551d130101ff04023000301d0603551d0e04160414d9d4f8e696b1018db9607d864c473313ecd52e533081ac0603551d2304 EAP-Message = 0x81a43081a18014323a4970ba53cf9fff2b2ce5436dd64e036b4cf7a17ea47c307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e820900f600a779ca4a31f2300b0603551d0f0404030205a0301106096086480186f8420101040403020640302406096086480186f842010d04171615436572746966696361742073656c66207369676e65300d06092a864886f70d01010505000382 EAP-Message = 0x010100738b52410508dfb265 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee258fd57b96dea318012fe73d9 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=242, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xfb36b01671119b3c8b0224e2688bb6e0 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee258fd57b96dea318012fe73d9 EAP-Message = 0x020e00061900 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 14 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 242 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x010f03fc19401182ca5390bea1fe88313c924d092dbd0cb475424af8c336fe26053d412f47c50fe19c560b380240cd0ffc099b2d1389efe8138320b9c39ff976bb256aa135220112ce2dcbda12a62d121874632f586a639ab589de66aab22d0c8be6b3038ef720750df0fc4a49d65fd28ac02cf66774b954084b383d2be00517d663023aee762e237709c22dfad7be540c986d88fb9e0cd1d07723dc5a1b86bac13bfc40ce7d6b640ab880491b96a5069e353e781586f8a1ed77c86e94b7eadb0ed3319ae20ace6a378133a7022b2080796dd1c122ac1f4a5c2e7257cdbff34956e38db82ab83ce720e860c087888c09c792fb0cd761cc6bf95f8d82ae EAP-Message = 0x000458308204543082033ca003020102020900f600a779ca4a31f2300d06092a864886f70d0101050500307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c6520284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e301e170d3130303130343135303632365a170d3133303130343135303632365a307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c65 EAP-Message = 0x20284d454e455352293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e30820122300d06092a864886f70d01010105000382010f003082010a0282010100c98d21324f37ff11d786d7c35d535d59aae2514ae1b9d0647cde3fb9f700505a1d945695c686888f85f5b36c083bee7d99d29dab7444ce49efa4a9802fa14565b1778f676baf779694fe8167ea4e3cf7cd350219e755c5389f981290b31d0414e7967d7f05b92bfbd52f188754f8a47e193638cf68927ca3c8bc307c860f3ef36b39bd3d10117cbe53837e3c60390357cb55a73c6f4b44 EAP-Message = 0x8ea1a5c9b451094d5c02f5e2e482071c7950df080d1f3644f47d9a7aefd6958e5eb5ebf2f93bdf1d65901ea2a3b9b110d16b808ef34a7c3374bb7263d077f063734d63b186b29928e17ef698ed7e4b2841387fc844cb07cc7eb4fd39de3ebc8e4fe0cf2eca4d1b93510203010001a381dc3081d930090603551d1304023000301d0603551d0e04160414323a4970ba53cf9fff2b2ce5436dd64e036b4cf73081ac0603551d230481a43081a18014323a4970ba53cf9fff2b2ce5436dd64e036b4cf7a17ea47c307a310b3009060355040613024652312f302d060355040a13264d696e69737465726520456475636174696f6e204e6174696f6e616c65 EAP-Message = 0x20284d454e455352 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee259fc57b96dea318012fe73d9 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=243, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xd8c323cc1c5dca53fdc26144184a55df NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee259fc57b96dea318012fe73d9 EAP-Message = 0x020f00061900 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 15 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 243 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0110016b1900293111300f060355040b1308303732313537325431123010060355040b130961632d6e616e746573311330110603550403130a43412d70662d616d6f6e820900f600a779ca4a31f2300d06092a864886f70d0101050500038201010042fb00de5ab000702d477a4af2d066894ac9481a89afd607a8e4f870038ca1f2e4c2ccba76f8c8db937ccc0c1607694dc7316a32ac04f88035c99b3802c40e6af4381339b21229c22e4bab13c4c0d12039f5030c932283e00dd5855df9a1c8172e257e3a41ad6928431aeb93813578cf9208816cd75e3306b3a31e175f3f6fe054317296231e4d53ca9fd6879b03330265e555633dd78100c55681 EAP-Message = 0xdc1181d3cf04302e58287bbf7cbbd102ddceeb821787e736217180fd90a1f0690e40338cfa058c84dae4404611e2a04aebf9a5f09c28f3bba02bc2663707c320ff8f40f9b3f6455f1a683d5c2e9b67a4cdf327665ebcd7e24afd894e826f76f5125763470e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25ee357b96dea318012fe73d9 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=244, length=444 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x9d064c122b5956c73615d6349ffcd178 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25ee357b96dea318012fe73d9 EAP-Message = 0x02100140198000000136160301010610000102010099e22fbe4a05d936accfcc683fd55f8b40700b04e65e3b78c86f9117140b263c154c7e549b412e66757099dcbb13dfb218779e04be85a67c741dddf6330b8873c677c47b0afbe278d88c68cfa0943459b196f5e12e02ed21271f9dbaa3289de2ce776cf3da2e30eea71308f185b2e7d4dbdd2ed4fc59316384ed6fa408dc96ec0a212a99cd89692a92b12717206fb0a3a0e8b9c70106f6840256733976809d3edb569081ba70d4bcaf6f65d6784eb7d457297c263f549c34f7f8db3f55eae388f086290d5bde0840af663c86a181464e1cc22b035e1434614f23ed4fc54ac3e39a404a2c71b3f0d3 EAP-Message = 0x22a99e4af56b9ca63a6dab50062bb096e513852043326d0a14030100010116030100204948fe1d6f1b3ecde1765601ef11cfd1936905e4f4948312a68781a0739e2666 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 16 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 244 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x01110031190014030100010116030100203700812b24e375749201076da0bd9b4c462587b2d818f14a726c9beb33feeb45 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25fe257b96dea318012fe73d9 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=245, length=128 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xb9d8ae0e08e37f9d172f8e0eda4b780c NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25fe257b96dea318012fe73d9 EAP-Message = 0x021100061900 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 17 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 245 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0112002019001703010015b30cb528421556a6b7595ed3761ee6c1aaebee96dc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25ce157b96dea318012fe73d9 Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=246, length=163 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xfe515d2dd1c0562720460ac87f8684ae NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25ce157b96dea318012fe73d9 EAP-Message = 0x021200291900170301001e8f577a77f3936128a808f14d17c3fb56dd053088ce04a8319e069b68bc4e server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 18 length 41 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - host/pc-admin [peap] Got tunneled request EAP-Message = 0x0212001201686f73742f70632d61646d696e server inner-tunnel { PEAP: Got tunneled identity of host/pc-admin PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to host/pc-admin Sending tunneled request EAP-Message = 0x0212001201686f73742f70632d61646d696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/pc-admin" NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 10 Framed-MTU = 1490 Calling-Station-Id = "00-0C-29-F7-CC-A0" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 18 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011300271a01130022103abcb825a9f3a4a3ef8a850d3573308d686f73742f70632d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5fa0a5401b55155387e6016c [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011300271a01130022103abcb825a9f3a4a3ef8a850d3573308d686f73742f70632d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5fa0a5401b55155387e6016c [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 246 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0113003e190017030100337504bfcfdd2686dec869ab4dc942775c76ad373a4014d7994c954b743803351ee1570e54043d7b3a6432bf116c45b3e40b9ce9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee25de057b96dea318012fe73d9 Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=247, length=217 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x34be6f17afd410895671a689cdaa2ace NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee25de057b96dea318012fe73d9 EAP-Message = 0x0213005f19001703010054d9a59f27d7f3fd8667cf9248bddcc6d8335f836aacc87e5567c1c17962874c425a7e3b8a0e137606a9f01fec1c5f6381f4382d502c02eb469d8a2a73513c55f2ab6a1834e641162955910e9fd80293782b4fc76b server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 19 length 95 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x021300481a021300433186b47cb64903955b806163bb51c35db8000000000000000041a2daf3776d80fcf8208f4fe0e697184864cb49983d513800686f73742f70632d61646d696e server inner-tunnel { PEAP: Setting User-Name to host/pc-admin Sending tunneled request EAP-Message = 0x021300481a021300433186b47cb64903955b806163bb51c35db8000000000000000041a2daf3776d80fcf8208f4fe0e697184864cb49983d513800686f73742f70632d61646d696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/pc-admin" State = 0x5fb3bf1f5fa0a5401b55155387e6016c NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 10 Framed-MTU = 1490 Calling-Station-Id = "00-0C-29-F7-CC-A0" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 19 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for host/pc-admin with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011400331a0313002e533d30453146453344413437333434303035434445323936383045394344354246303233344539384235 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5ea7a5401b55155387e6016c [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011400331a0313002e533d30453146453344413437333434303035434445323936383045394344354246303233344539384235 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fb3bf1f5ea7a5401b55155387e6016c [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 247 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x0114004a1900170301003fcaee9ba310faf92efca265d1525ab6435017cd256d841401359551ef19eb8dab39eaa87f35a8c2e079554a0291898d709de59a87219a6217fbd3e57f456337 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee252e757b96dea318012fe73d9 Finished request 8. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=248, length=151 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xd0a4155dd2819c7764b212492c148338 NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee252e757b96dea318012fe73d9 EAP-Message = 0x0214001d19001703010012207c339d428fdb827f4aef0d36ae8ae833ad server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 20 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x021400061a03 server inner-tunnel { PEAP: Setting User-Name to host/pc-admin Sending tunneled request EAP-Message = 0x021400061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/pc-admin" State = 0x5fb3bf1f5ea7a5401b55155387e6016c NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User NAS-Port = 10 Framed-MTU = 1490 Calling-Station-Id = "00-0C-29-F7-CC-A0" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 20 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok WARNING: Empty section. Using default return values. } # server inner-tunnel [peap] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x03140004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/pc-admin" [peap] Got tunneled reply RADIUS code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x03140004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/pc-admin" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled } # server inner-tunnel Sending Access-Challenge of id 248 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" EAP-Message = 0x011500261900170301001bf941565a3183097d130c6f900ea8d2b7449ccb3bdcccf59f96527b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5af34ee253e657b96dea318012fe73d9 Finished request 9. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=249, length=160 NAS-IP-Address = 10.172.253.110 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x50f80e51813b38b0aa944eba89d37efa NAS-Port = 10 Framed-MTU = 1490 User-Name = "host/pc-admin" Calling-Station-Id = "00-0C-29-F7-CC-A0" State = 0x5af34ee253e657b96dea318012fe73d9 EAP-Message = 0x021500261900170301001be0562040c9bb550ba6720c9d0826df79e9fc5b58f7427160c7c9ad server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 21 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++- entering group {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_peda] returns notfound [ldap_admin] performing user authorization for host/pc-admin [ldap_admin] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_admin] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) [ldap_admin] checking if remote access for host/pc-admin is allowed by uid [ldap_admin] No default NMAS login sequence [ldap_admin] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x3637444441324243414646313035424333373446304245434641463733333430 [ldap_admin] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap_admin] user host/pc-admin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap_admin] returns ok ++- group returns ok ++[expiration] returns noop ++[logintime] returns noop Using Autz-Type ldap_peda +- entering group ldap_peda {...} [ldap_peda] performing user authorization for host/pc-admin [ldap_peda] expand: (uid=%{mschap:User-Name}) -> (uid=pc-admin$) [ldap_peda] expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=pc-admin$) rlm_ldap: object not found [ldap_peda] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap_peda] returns notfound Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept [eap] Freeing handler ++[eap] returns ok WARNING: Empty section. Using default return values. } # server inner-tunnel Sending Access-Accept of id 249 to 192.168.10.254 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "20" Reply-Message = "ok_hostpeda" User-Name = "host/pc-admin" MS-MPPE-Recv-Key = 0x4cb00c191ad9ce2d5913f5218594324f3017e7efd7d209aa14b6b56b6a520f1a MS-MPPE-Send-Key = 0x48f134131000bba5b3f590233bc0e3d08e7d99b8f8806bb99b484ede6ce0b0b2 EAP-Message = 0x03150004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. Going to the next request Waking up in 4.7 seconds. Cleaning up request 0 ID 239 with timestamp +40 Cleaning up request 1 ID 240 with timestamp +40 Cleaning up request 2 ID 241 with timestamp +40 Cleaning up request 3 ID 242 with timestamp +40 Cleaning up request 4 ID 243 with timestamp +40 Cleaning up request 5 ID 244 with timestamp +40 Cleaning up request 6 ID 245 with timestamp +40 Cleaning up request 7 ID 246 with timestamp +40 Cleaning up request 8 ID 247 with timestamp +40 Cleaning up request 9 ID 248 with timestamp +40 Cleaning up request 10 ID 249 with timestamp +40 Ready to process requests.

1 1

Framed-IP-Address Issue
by Tevfik Ceydeliler 02 Feb '10

02 Feb '10

Now i try to test with my freeradius. There are two tests: 1. User try to get IP from pool 2. Users try to get IP as Framed-IP-Address There is two log i deleted same lines. I send only differences ################################################################ ##Log for IP pool: ... ... [files] users: Matched entry tevfikceydeliler at line 98 ... Sending Access-Request of id 153 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172938111645" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x32 ... Sending Access-Request of id 153 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172938111645" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x32 ... rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=153, length=23 Proxy-State = 0x32 ... Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} expand: %{NAS-IP-Address} %{NAS-Port} -> 10.65.5.80 [TESTPOOL] MD5 on 'key' directive maps to: 5d6bfe9b8c4b166a1386c56a8286087e [TESTPOOL] Searching for an entry for key: '5d6bfe9b8c4b166a1386c56a8286087e' rlm_ippool: Allocating ip to key: '5d6bfe9b8c4b166a1386c56a8286087e' [TESTPOOL] num: 1 [TESTPOOL] Allocated ip 172.30.64.12 to client key: 5d6bfe9b8c4b166a1386c56a8286087e ++[TESTPOOL] returns ok ... Sending Access-Accept of id 2 to 10.65.5.80 port 57928 Framed-IP-Address = 172.30.64.12 Framed-IP-Netmask = 255.255.240.0 ... ##Log For Framed-IP-Address: ... ... [files] users: Matched entry tevfikceydeliler at line 114 ... Sending Access-Request of id 129 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172915933501" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x31 ... Sending Access-Request of id 129 to 10.1.1.51 port 1812 User-Name = "tevfikceydeliler" User-Password = "172915933501" NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = 0 Service-Type = 0 NAS-Port-Type = Virtual Calling-Station-Id = "905308507313" NAS-IP-Address = 10.65.5.80 Proxy-State = 0x31 ... rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=129, length=23 Proxy-State = 0x31 ... Found Auth-Type = Local Found Auth-Type = Accept Warning: Found 2 auth-types on request for user 'tevfikceydeliler' Auth-Type = Accept, accepting the user +- entering group post-auth {...} [TESTPOOL] Could not find Pool-Name attribute. ++[TESTPOOL] returns noop [STATICPOOL] Could not find Pool-Name attribute. ... Sending Access-Accept of id 1 to 10.65.5.80 port 57927 ... ################################################################ 1.) I realized that for IP pool test there is only one Auth-Type. In Framed-IP-Address test there is two! 2.) IP pool Test has 0x32 as Proxy-State, Framed-IP-Address test has 0x31 3.) User can get Ip from pool, cant get ip as static. Again my question is... what change if a user gets ip from pool or use static ip? I try to solve this problem. I am newbie. Thanks for your assistance already.. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

ELOM ETSE invites you to connect
by ELOM ETSE via Yahoo! 02 Feb '10

02 Feb '10

Join ELOM ETSE on Yahoo! Messenger. Come chat with me, share files and more. Stay in the loop with all your friends. Get started : http://invite.msg.yahoo.com/invite?op=accept&intl=us&sig=Y4dC6BBsI0enNCyVwo… * Stay connected at home, at work, or on the go * Have fun with games, emoticons, and more * Join a community of over 100 million people from around the world Join Your Friends : http://invite.msg.yahoo.com/invite?op=accept&intl=us&sig=Y4dC6BBsI0enNCyVwo… -- this email was sent to you by an automated system - please do not reply directly

2 1

Auth-Type LDAP and testing for if(reject)
by Harry Hoffman 01 Feb '10

01 Feb '10

Hi, So, I'm trying to get multiple sources of authentication (i.e. LDAP and Active Directory via ntlm_auth) working from a Cisco ASA to freeradius-2.x. The username and password come over in clear text. The Auth-Type is being set to LDAP and works with ldap. If I switch from ldap to ntlm_auth in Auth-Type LDAP { ... } in the authenticate section of the default server then I can authenticate to Active Directory. I've tried doing the following to have a "continue on fail" authenticate{ ... Auth-Type LDAP{ ldap if(reject){ ntlm_auth } } This doesn't work. If I give my AD credentials the authenticate rejects on ldap and never goes to ntlm_auth. Any ideas what I can do to get this to work? Cheers, Harry

2 2

Allowing Access via 'users' when LDAP fails
by Amaru Netapshaak 01 Feb '10

01 Feb '10

Hello, I've got FreeRADIUS querying an OpenLDAP server successfully. Users can login and their appropriate VLAN information is returned and everythings great. Right now, if a user isnt found in the LDAP database, a reject is returned to the switch and the port goes offline. What I'd rather have,is RADIUS reply with a standard response (if the LDAP auth fails). I tried to do this in the users file, by moving 'files' to below 'ldap' in sites-enabled/default and then creating a DEFAULT entry in users that returned the VLAN information I wanted, but then it didnt include other relevant info that the switch needs. Am I on the right track? Thanks! -AMARU

5 12

Re: ldap machine account auth tutorial
by Phil Mayers 01 Feb '10

01 Feb '10

On 01/02/10 16:04, cd wrote: > thanks Phil > > but it looks like that i get an access-accept without ldap password validation ??! Please don't email me directly; I'm on the list. > rad_recv: Access-Request packet from host 192.168.10.254 port 1024, id=151, length=136 > NAS-IP-Address = 10.172.253.110 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe35737afd4fb25d9a9cab4dc24bffa77 > NAS-Port = 10 > Framed-MTU = 1490 > User-Name = "host/crid72-42ee2079" > Calling-Station-Id = "00-0C-29-7E-44-54" > EAP-Message = 0x020d001901686f73742f6372696437322d3432656532303739 SNIP; your LDAP debugging level is way, way too high. It's very hard to read the debugging output. > rlm_ldap: sambaNtPassword -> NT-Password == 0x3241384242423239424546354639314230324146363837323930414442344637 > [ldap_admin] performing user authorization for host/crid72-42ee2079 ...why are you running 2 LDAP modules? > +++[ldap_sw] returns ok > ++- policy redundant returns ok > rlm_ldap: Entering ldap_groupcmp() > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type mschapv2 > rlm_eap_mschapv2: Issuing Challenge > ++[eap] returns handled > } # server inner-tunnel > Sending Access-Challenge of id 151 to 192.168.10.254 port 1024 > EAP-Message = 0x010e002e1a010e002910924d24419c6082e80c304f8d76c22109686f73742f6372696437322d3432656532303739 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x517b79b8517563ae61de7219537f52df Ok, so EAP challenge sent. > Found Auth-Type = EAP > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP NAK > [eap] EAP-NAK asked for EAP-Type/peap So it's using PEAP. Then after lots and lots of unnecessary LDAP debug output: > Sending Access-Accept of id 161 to 192.168.10.254 port 1024 > User-Name = "host/crid72-42ee2079" > MS-MPPE-Recv-Key = 0xc83951c8f97b57386194b58be2d66edbe3a7b37cbaead57df65c61d64cea65e1 > MS-MPPE-Send-Key = 0xeefc2477dc12da93c583c05676c8474a66fd2ad11b1cd90ef3ff575dcf876010 > EAP-Message = 0x03170004 > Message-Authenticator = 0x00000000000000000000000000000000 It succeeds. So what's the problem? Radius looked the NT password up in LDAP, and did a PEAP/MS-CHAP against it. It worked.

2 1

dictionary per nas
by Marcus Kipp 01 Feb '10

01 Feb '10

Hi @all, I want to replace our old CiscoSecure Radius-Server to a new version of FreeRadius (2.1.8). I´ve checked several things but one thing I miss on FreeRadius: On CiscoSecure it was possible to bound a NAS to a dedicated dictionary. I need this feature now on the FreeRadius I need that because I want to use one user-account for different NAS and set different reply-attributes for each NAS. Do anyone have an idea how to do this with FreeRadius ? Regards Marcus

2 1