February 2010 - Freeradius-Users - lists.freeradius.org

Failed binding to socket: Address already in use
by George Greene 23 Feb '10

23 Feb '10

i would like to listen to the address assigned to the computer. 192.168.1.12 FreeRADIUS Version 2.1.0 g@lisa:/sbin$ sudo freeradius -X FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Sep 17 2009 at 17:22:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail- %Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to socket: Address already in use /etc/freeradius/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812

3 2

modules instantiation
by Latha Krishnamurthi 23 Feb '10

23 Feb '10

Hi, I am using the free radius 2.1.3. I have a module rlm_xxx and have initialized it as thread safe. I have configured the start_servers as 3. The issue I am having is as follows. I see that a new instance is getting created when the first one is busy handling a request. (I do this this by adding a sleep in the module and printing the threadid) I am expecting the xxx_instantiate function to get called each time a new instance is created (reading in the documentation). This does not happen. I am actually connecting to a server in the instantiate function and storing the socket id in the *instance, so that I can use it later in the authenticate etc. But it seems that the socket id is the same for all the instances. *instance seems to be shared by all the instances ?? Am I missing something/configuration, your help is grately appreciated. Thanks in advance for your inputs. Thanks, Latha.

5 16

pam_radius ruser option
by Winnicki, Brian (GE, Corporate) 23 Feb '10

23 Feb '10

I have a situation where I am trying to enable radius authentication for issuing the su command. I've added the ruser command to attempt to pull back the PAM_RUSER who is issuing the su command. However, from the debug logs, I can still see that it says Got user root. Immediately after that line in the debug, it actually does a Segmentation Fault and throws a core dump. On the user's side logging in, it prompts for password as expected, and then after entering, just comes back with su: Segmentation Fault. The OS is solaris 10. Any ideas? Thanks!

1 0

can't get simultaneous login to work Part 1
by J Brandon Polley 23 Feb '10

23 Feb '10

Some background on what we have here: - We have a Cisco wireless infrastructure (WLC 4400, a bunch of 1131s) and clients running SecureW2 supplicant. We want to authenticate and authorize them against our directory services. The 802.1x/EAP-TTLS/PAP method was suggested and we went with it. - user's directory is eDirectory and accessed via Novell LDAP v3 interface. (authentication is working and SSL secured [SLDAP]) - Radius server is on separate hardware, OS is Novell SUSE Enterprise Linux (SLES) 10 SP3 and is NOT running eDirectory. - FreeRADIUS 2.1.8 downloaded from FreeRADIUS.org and built from scratch with -eDIR options (compiled perfectly into RPMs and installed into OS perfectly). - Config files and debug output to follow the base email below. - I have my NAS listed in the huntgroups.config - I set correct type of NAS in the file "/etc/raddb/clients.config". I set it to "cisco" (We assume this directs "checkrad.pl" to use that method) - I set the username to SNMP, password is the community string in the clients config - I have accounting turned on my NAS and we see accounting messages coming in when sessions expire.(see debug output below) We can't get simultaneous login to work. We are trying to restrict simultaneous use to allow only one user to be logged at once. (1) Some things that we have picked up on are that the checkrad.pl perl script is not able to access the Cisco 4400 wireless controller's data properly to access the session information. I think this may be partly us not knowing how a session is considered unique and two how the cisco section in the script polls the MIB for session data. We know based on the new Cisco Airespace MIB that sessions are listed by MAC address but from there not sure how to map that onto what FreeRADIUS is looking for. SNMP access to the device is working, we can see the request on the line using Wireshark and snmpwalk returns system data. Perhaps it has something to do with adding Simultaneous-use parameter to the check items first line. I am not sure where to find "check items". Our usernames are coming from eDirectory and we have followed the Novell documentation on what to do there. The data is then presented to FreeRADIUS via LDAP. When I go into Radius users using Novell iManager I can see some options for "check items" but none are set. (2) Another oddity is radwho. When the user logs in the first time they show up in radwho. When I have someone login again using the same username but on a different laptop the newest login overwrites the entry in radwho instead of adding to it. Should that not be a separate unique session and thus two should appear in the listing? I have read the documentation: - I installed the mrtg package (to allow the chekrad.pl to talk SNMP natively and that does work just not polling the right data we think) - I put this line in the "/raddb/users.config" file at the top of the file (the first non commented line): DEFAULT Simultaneous-Use := 1 Fall-Through = 1 We are not doing groups, everyone in our directory is allowed on the wireless so we used "DEFAULT". Here is my debug output when I start radius: radius:~ # radiusd -X FreeRADIUS Version 2.1.8, for host i686-suse-linux-gnu, built on Jan 23 2010 at 01:51:06 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 172.16.33.2 { require_message_authenticator = no secret = 11111 shortname = "wlc-nsac-exteng-4404-6" nastype = "cisco" } client 172.16.33.4 { require_message_authenticator = no secret = "1111" shortname = "wlc-nsac-exteng-4404-7" nastype = "cisco" } client 172.16.19.130 { require_message_authenticator = no secret = "1111" nastype = "other" } client 172.16.3.107 { require_message_authenticator = no secret = "1111" nastype = "other" } client 172.16.19.132 { require_message_authenticator = no secret = "1111" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "172.16.3.52" port = 636 password = "111111" identity = "cn=THELDAPBIND,ou=USERS,o=NSAC" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no cacertfile = "/etc/raddb/certs/cert.b64" require_cert = "demand" } basedn = "o=NSAC" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(THELDAPBIND=1)))" base_filter = "(objectclass=radiusprofile)" password_attribute = "11111" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8189198 Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. part 2 has more output. I couldn't fit everyone in one email

2 3

rlm_chap clear text password not available
by Eric Eric 23 Feb '10

23 Feb '10

please help.It confused me ! I want to change authentication pap to chap. The users with clear passwords are in ldap server. but the is error with clear password in rlm-ldap radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Dial rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90f2d90 Module: Instantiated ldap (ldap-Vpn) Module: Loaded always Module: Instantiated always (ok) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded detail Module: Instantiated detail (auth_log) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Counter Module: Instantiated sqlcounter (monthly-Vpn) rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Vpn rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90fa4c8 Module: Instantiated ldap (ldap-Vpn) Module: Instantiated sqlcounter (monthly-Vpn) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Instantiated detail (detail) Module: Loaded SQL rlm_sql (sql-Vpn): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-Vpn): Attempting to connect to radius@localhost:/vpnradius rlm_sql (sql-Vpn): starting 0 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql-Vpn): Connected new DB handle, #0 rlm_sql (sql-Vpn): starting 1 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql-Vpn): Connected new DB handle, #1 rlm_sql (sql-Vpn): starting 2 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql-Vpn): Connected new DB handle, #2 rlm_sql (sql-Vpn): starting 3 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql-Vpn): Connected new DB handle, #3 rlm_sql (sql-Vpn): starting 4 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql-Vpn): Connected new DB handle, #4 Module: Instantiated sql (sql-Vpn) Module: Instantiated detail (reply_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.2:1866, id=78, length=246 Acct-Session-Id = "120" NAS-IP-Address = 10.10.10.2 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 128 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.10.10.24" Tunnel-Client-Endpoint:0 = "10.10.10.24" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d4955542d3834433132343936333646 User-Name = "test" CHAP-Challenge = 0x45c8e77e0465ea843dc5b419ccb3ca01 CHAP-Password = 0x008a7f35b2a09df3aa79b659a9909ca15f Message-Authenticator = 0x540b9a3a9a929db1621fd2cb4fa1b2cc rlm_chap: Setting 'Auth-Type := CHAP' rlm_ldap: - authorize rlm_ldap: performing user authorization for test rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 10.10.10.27:389, authentication 0 rlm_ldap: bind as / to 10.10.10.27:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for test is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 1080000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusSessionTimeout as Session-Timeout, value 10 & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Could not find clear text password for user test Login incorrect (rlm_chap: Clear text password not available): [test] (from client vpntist port 128 cli 10.10.10.24) I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap } } .... what is my mistake? should I do any other config or change ? please any idea?

2 1

rlm-ldap error for chap
by Eric Eric 23 Feb '10

23 Feb '10

Hi I want to change authentication pap to chap. The users with clear passwords are in ldap server. but the is error with clear password in rlm-ldap radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Dial rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90f2d90 Module: Instantiated ldap (ldap-Vpn) Module: Loaded always Module: Instantiated always (ok) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded detail Module: Instantiated detail (auth_log) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Counter Module: Instantiated sqlcounter (monthly-Vpn) rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Vpn rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90fa4c8 Module: Instantiated ldap (ldap-Vpn) Module: Instantiated sqlcounter (monthly-Vpn) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Instantiated detail (detail) Module: Loaded SQL rlm_sql (sql-Vpn): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-Vpn): Attempting to connect to radius@localhost:/vpnradius rlm_sql (sql-Vpn): starting 0 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql-Vpn): Connected new DB handle, #0 rlm_sql (sql-Vpn): starting 1 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql-Vpn): Connected new DB handle, #1 rlm_sql (sql-Vpn): starting 2 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql-Vpn): Connected new DB handle, #2 rlm_sql (sql-Vpn): starting 3 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql-Vpn): Connected new DB handle, #3 rlm_sql (sql-Vpn): starting 4 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql-Vpn): Connected new DB handle, #4 Module: Instantiated sql (sql-Vpn) Module: Instantiated detail (reply_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.2:1866, id=78, length=246 Acct-Session-Id = "120" NAS-IP-Address = 10.10.10.2 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 128 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.10.10.24" Tunnel-Client-Endpoint:0 = "10.10.10.24" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d4955542d3834433132343936333646 User-Name = "test" CHAP-Challenge = 0x45c8e77e0465ea843dc5b419ccb3ca01 CHAP-Password = 0x008a7f35b2a09df3aa79b659a9909ca15f Message-Authenticator = 0x540b9a3a9a929db1621fd2cb4fa1b2cc rlm_chap: Setting 'Auth-Type := CHAP' rlm_ldap: - authorize rlm_ldap: performing user authorization for test rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 10.10.10.27:389, authentication 0 rlm_ldap: bind as / to 10.10.10.27:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for test is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 1080000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusSessionTimeout as Session-Timeout, value 10 & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Could not find clear text password for user test Login incorrect (rlm_chap: Clear text password not available): [test] (from client vpntist port 128 cli 10.10.10.24) I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap } } .... what is my mistake? should I do any other config or change ?

3 2

Re: How long it take to auth in 802.1X/WPA-enterprise?
by JaeJong Baek 23 Feb '10

23 Feb '10

Thank you very much. Your comment and advice are very helpful to understand Radius mechanism I replaced the AP(Belkin54g) with new one(DWL-8200AP, D-Link). As a result, the delay time is reduced from 18 sec to 0.15 sec I measured the time stamp the captured packet-based on Network Monitor 3.1(M$) However, I'm not sure it depends on AP's feature or not. I have already installed VMware tools in that measuring, so networking configuration is ok. Lastly, concerned with "Looking up realm", Actually, I didn't know very well about this, I just use the user name like that style. Can you explain in detail? Best. ******************** Jaejong Baek 02-365-7966 ******************* Message: 3 Date: Thu, 18 Feb 2010 10:02:22 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: How long it take to auth in 802.1X/WPA-enterprise? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc: "freeradius-users-owner(a)lists.freeradius.org" <freeradius-users-owner(a)lists.freeradius.org> Message-ID: <20100218100222.GA11728(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > How long it take to auth in 802.1X/WPA-enterprise? depends on the system and what methods etc...but easily under 1 second here > In this simple network model, I have tried to auth using > EAP-TLS(self-certification) and it works good. > By the way, about 18 seconds are taken to auth as follow debug logs. > (confer the timestamp (1) and (2)) wheres the real authentication - ie Access-Accept return packet? do you have vmware tools on your ubuntu VMware hosted system - and therefore using vmxnet driver instead of the slow pcnet32 ? (lsmod | grep vmx) turn off any non-needed modules - eg are you ever going to use /etc/passwd for user accounts? if not, comment out the unix module whenever it appears.. likewise files, expiration, logintime etc..... make sure you are not going to be needign them though! ..also... > Wed Feb 17 21:37:00 2010 : Info: [suffix] Looking up realm > "xxxx.yyy.zz.vv" for User-Name = "kkk(a)xxxx.yyy.zz.vv" > Wed Feb 17 21:37:00 2010 : Info: [suffix] No such realm "xxxx.yyy.zz.vv" are you deliberately not dealing with this realm? are you expecting it to be sent elsewhere? alan

1 0

EAP-TTLS configuration with PAP inner
by Colin Byelong 23 Feb '10

23 Feb '10

Hi, Apologies if this has been asked before. I am trying to configure freeradius to replicate our current radius server, there are a couple of things that im not clear about. We tend to use a anonymous@realm identity for the EAP outer ID, in our current radius server this is defined in a users file and has the format of anonymous Encrypted-Password=nevermatch is there a similar thing in freeradius and where should this be defined ? In the eap.conf file under the ttls section it asks for " default_eap_type = tls" if I am using a pap password for the inner that comes from a ldap server should I comment this section out ? Or will the server ignore it ? Thanks Colin -- ----------------------------------------------------------------------- Colin Byelong Email: C.Byelong(a)ucl.ac.uk Senior Network Development Officer Network Group Information Systems Division University College London Gower Street Phone: 020 7679-2572 London WC1E 6BT ------------------------------------------------------------------------

2 5

(rlm_chap: Clear text password not available)
by Eric Eric 23 Feb '10

23 Feb '10

I want to change authentication pap to chap. The users with clear passwords are in ldap server. but the is error with clear password in rlm-ldap radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Dial-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Dial rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90f2d90 Module: Instantiated ldap (ldap-Vpn) Module: Loaded always Module: Instantiated always (ok) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded detail Module: Instantiated detail (auth_log) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Counter Module: Instantiated sqlcounter (monthly-Vpn) rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap-Vpn-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap-Vpn rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x90fa4c8 Module: Instantiated ldap (ldap-Vpn) Module: Instantiated sqlcounter (monthly-Vpn) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Instantiated detail (detail) Module: Loaded SQL rlm_sql (sql-Vpn): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-Vpn): Attempting to connect to radius@localhost:/vpnradius rlm_sql (sql-Vpn): starting 0 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql-Vpn): Connected new DB handle, #0 rlm_sql (sql-Vpn): starting 1 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql-Vpn): Connected new DB handle, #1 rlm_sql (sql-Vpn): starting 2 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql-Vpn): Connected new DB handle, #2 rlm_sql (sql-Vpn): starting 3 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql-Vpn): Connected new DB handle, #3 rlm_sql (sql-Vpn): starting 4 rlm_sql (sql-Vpn): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql-Vpn): Connected new DB handle, #4 Module: Instantiated sql (sql-Vpn) Module: Instantiated detail (reply_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.2:1866, id=78, length=246 Acct-Session-Id = "120" NAS-IP-Address = 10.10.10.2 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 128 MS-RAS-Vendor = 311 MS-RAS-Version = "MSRASV5.20" NAS-Port-Type = Virtual Tunnel-Type:0 = PPTP Tunnel-Medium-Type:0 = IP Calling-Station-Id = "10.10.10.24" Tunnel-Client-Endpoint:0 = "10.10.10.24" Microsoft-Attr-35 = 0x4d5352415356352e3130 Microsoft-Attr-34 = 0x4d535241532d302d4955542d3834433132343936333646 User-Name = "test" CHAP-Challenge = 0x45c8e77e0465ea843dc5b419ccb3ca01 CHAP-Password = 0x008a7f35b2a09df3aa79b659a9909ca15f Message-Authenticator = 0x540b9a3a9a929db1621fd2cb4fa1b2cc rlm_chap: Setting 'Auth-Type := CHAP' rlm_ldap: - authorize rlm_ldap: performing user authorization for test rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 10.10.10.27:389, authentication 0 rlm_ldap: bind as / to 10.10.10.27:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: checking if remote access for test is allowed by vpnAccess rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 0 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 1 & op=21 rlm_ldap: extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 1080000 rlm_ldap: Adding radiusIdleTimeout as Idle-Timeout, value 1200 & op=11 rlm_ldap: extracted attribute Acct-Interim-Interval from generic item Acct-Interim-Interval := 300 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusSessionTimeout as Session-Timeout, value 10 & op=11 rlm_ldap: user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Could not find clear text password for user test Login incorrect (rlm_chap: Clear text password not available): [test] (from client vpntist port 128 cli 10.10.10.24) I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap } } .... what is my mistake? should I do any other config or change ? please any idea?

1 0

Problem with eap-peap
by Trujillo Carmona, Antonio 23 Feb '10

23 Feb '10

Thank in advance and sorry for my english. Realy I have spend several day reading from internet (wiki.freeradius.org, deployingradius.com and google) Itry all the thing, including apply a hotfix from microsoft but I can't make it work. I use a debian backport version of freeradius radius-2:/etc/freeradius# freeradius -v freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. my files are: radius-2:/etc/freeradius# cat eap.conf # -*- text -*- ## ## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.) ## ## $Id$ ####################################################################### eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no max_sessions = 4096 tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = ***** private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" cache { enable = no lifetime = 24 # hours max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } ----------------------------------------------- radius-2:/etc/freeradius# cat modules/mschap # -*- text -*- # # $Id$ # Microsoft CHAP authentication # # This module supports MS-CHAP and MS-CHAPv2 authentication. # It also enforces the SMB-Account-Ctrl attribute. # mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes authtype = MS-CHAP ntlm_auth = "/usr/bin/ntlm_auth \ --request-nt-key \ --username=%{mschap:User-Name:-None} \ --domain=%{mschap:NT-Domain:-HUVN} \ --challenge=%{mschap:Challenge:-00} \ --nt-response=%{mschap:NT-Response:-00}" } -------------------------------------------- radius-2:/etc/freeradius# cat sites-enabled/default ###################################################################### # # As of 2.0.0, FreeRADIUS supports virtual hosts using the # "server" section, and configuration directives. # # Virtual hosts should be put into the "sites-available" # directory. Soft links should be created in the "sites-enabled" # directory to these files. This is done in a normal installation. # # $Id $ # ###################################################################### authorize { #ntlm_auth preprocess #chap mschap suffix #ntdomain # eap { # ok = return # } eap #unix #files #expiration #logintime #pap } authenticate { Auth-Type MS-CHAP { mschap } eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique suffix # ntdomain # files } # # Accounting. Log the accounting data. # accounting { detail radutmp # sql attr_filter.accounting_response } session { radutmp # sql } post-auth { exec # Post-Auth-Type REJECT { # attr_filter.access_reject # } } pre-proxy { } post-proxy { eap } --------------------------------------------------- The output of a debug session: Linux radius-2 2.6.26-2-amd64 #1 SMP Tue Jan 12 22:12:20 UTC 2010 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Feb 18 09:17:57 2010 from 10.104.24.54 radius-2:~# freeradius -X FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL{ } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "*******" nastype = "other" } client 10.104.16.128 { ipaddr = 10.104.16.128 require_message_authenticator = no secret = "******" shortname = "Nostracom" nastype = "other" } client 192.168.69.1 { ipaddr = 192.168.69.1 require_message_authenticator = no secret = "******" shortname = "Nostracom" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired" } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-HUVN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "*****" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=43, length=163 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x02010012014855564e5c6764787472756a6f Message-Authenticator = 0x7a690fbe4e69ed232adb1afdd61eb451 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 43 to 10.104.16.128 port 45236 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3cd65c57a4c67a935e13b1f8 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=44, length=243 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x0202005019800000004616030100410100003d03014b7d355f9bf52e8c1779e6d1ef7add93b63615a7468de75e9cedc37734cb42ea00001600040005000a000900640062000300060013001200630100 State = 0x3cd4450c3cd65c57a4c67a935e13b1f8 Message-Authenticator = 0xb8c94b0c183743721d148fd2cc54e118 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 08a0], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 44 to 10.104.16.128 port 45236 EAP-Message = 0x0103038019c0000008dd160301002a0200002603014b7d3535617b3f06c7d3d6ee649ea0649f5c4514f3c355a63851a62eae88fcef0000040016030108a00b00089c0008990003ce308203ca308202b2a003020102020101300d06092a864886f70d010104050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f20 EAP-Message = 0x64656c204855564e301e170d3130303231383131303535385a170d3131303231383131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c75636961310d300b060355040a13044855564e313730350603550403132e70756572746168766e312e6875766e2e6469726179612e737370612e6a756e74612d616e64616c756369612e65733130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e657330820122300d06092a864886f70d01010105000382010f003082010a0282010100c9a0f9e752a29d36e20366b97df6d8bbae1c6b11c248 EAP-Message = 0x4e8a7ea13dbcdbb3397cc3551bca4317b8679c538ea5779bb256455ec5d26c8f96667cd42451ffadffe085cf807acd4f6766e6a50587a3e606921a657932f28bc4caf1b8b20de5da7dbbfc656cdbe70048743959573e6e2621131f1a6a7dd4284284d6425844a914165aa0f340b7f544d9faf5508acd1160671dce2c69d2a35d9398714c449bddd3ca981500b414c4b0b49f0995311ace024ba7eb5e266b6140d233aea138ec151c41e6c06085ac04837a5471e11274af01de2c5734d172dafc1cfaea87304ade8cecbf330204e702806cb5d562bd2656f43dc67bb3a36000ce69357bbbb4fe104fe6790203010001a317301530130603551d25040c30 EAP-Message = 0x0a06082b06010505070301300d06092a864886f70d01010405000382010100c8c0f7f55aa25c2518202181dd228e722a9890093284585289c10f6e1865f026114a38b545b2b8b39e11db1f4c4fb58053362835f18116ffd8800b21bef9197b1864ed09029c7edf3b18de94dc9ce886d83173962c156299079207020051552ef31d5735718832c9bdd3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3dd75c57a4c67a935e13b1f8 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=45, length=169 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT802.11g" EAP-Message = 0x020300061900 State = 0x3cd4450c3dd75c57a4c67a935e13b1f8 Message-Authenticator = 0x0d2248a94a51fd9be68bca50c67b8429 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 45 to 10.104.16.128 port 45236 EAP-Message = 0x0104037c1940407a2d7aaa916a7af56d6e11f0f2122fb35582b8c6d9fadcfb531363fb6c9178e625574622c8210d6d0d9688b73435c60e6d01daee7d8bdbe6b6e56d965a49efcf5019bea2bf61a8ea2753e7c33dd1c2149d96e83ecd56311111e3a9f4a0c264f82e85e1074b496f03fff45f273cbab792fab85804deb8b4026fd343b2a98849f4ed25ef76f19b38837c804620091ba9022ca4ac8a9d0004c5308204c1308203a9a0030201020209008235595e0380a483300d06092a864886f70d010105050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e61646131 EAP-Message = 0x0d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e301e170d3130303231383131303535385a170d3130303332303131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e65 EAP-Message = 0x73312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d64bbd4ad1ec76d41f2ace6c442099ec85b405735600b46a821906475dc357b59c3edb22d05c5c22e7be1d99b1b847b30b95ec137d93bf8d652f6c14c3bf0665b702fee14eb64636fc50e3886483e3aacc75080d73f920da50529bb5103bb0de9c15d51c506c8920c1f8bcb3154b1359f6c00268940a7bfa3450bc9a0153cf04fddd5dc4f46067ec8f5183d3790f814570781e7c9d02f6f9e301e0b828f55edae4fc84390cdd3470b2f1f9a8558f28856ff253e9 EAP-Message = 0x5822c9ff96244b5e236006154a32c754fc01cdc883745964901b0e39f3ac6135a2a76dd351e9c4049e658ae2501f6221619b4a41d4acbf0c7f618168f6c04b5352d5b246ef2243fb63d359310203010001a382010430820100301d0603551d0e0416041454f9c12706d36e7282442b9838fce221ba5f26183081d00603551d230481c83081 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3ed05c57a4c67a935e13b1f8 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=46, length=169 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020400061900 State = 0x3cd4450c3ed05c57a4c67a935e13b1f8 Message-Authenticator = 0xe7a8886894f56a15a4e5dac3576cd04b +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 46 to 10.104.16.128 port 45236 EAP-Message = 0x010501f71900c5801454f9c12706d36e7282442b9838fce221ba5f2618a181a1a4819e30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e8209008235595e0380a483300c0603551d13040530030101ff300d06092a864886f70d010105050003820101005f562f88b85ff6fceaa39f3938ebe6 EAP-Message = 0x049eb9de52b47377c7896a46e87d244df4286d48d7f639856078ab9667b2bcee73921d017f66aeeee584acf6e5632a1b9ee18adc3a30679034580f348992803cfc4f7c8b49d518cab99093ba00db3e04ce612a01379a7443c8f38662f98801f58fc56bb574f6cb93314838c70f48d6089e2b03ca5efd96425a6d1205e244277ebf2856910f94e8027b681df32bb4e6247ce879c21ad5216fc7336aaec9dfd871e1f9690783c77dbfea0673c22a7bb282548be147de3f59074e1c21efbf586c07934fd3ae71e331b7c31fb5e15c83fdd52f44d6ee4a1d533a0c29a5f122610d4fbde8b8de8e361e6c79298aec559912533316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3fd15c57a4c67a935e13b1f8 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=47, length=485 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020501401980000001361603010106100001020100057a7c049e1e45ae4cdf01e672f90cdea597c9c86bf6f864a9b01e477f5d556b25c47bd19f8f22ef5905b86745dde3e454fd5aaa6c02379e47fdd9b2b0ac4d0777d8bcfc3e0e7c79986fac80eefc8bd9f9718229f4acd8bb53aa7d6e227f8aff3626cba1b13c1ca516ff8277e47a4291aa57c8da1381336cfaae51108058ca1d5e4c580fc242e1a9d5a35c2e37edc49063865fd29768d7952279c47fb9c8c17925e546e1723e10c781a9593d3e0c109d543462b2070930dfeb6dc3489259d73db520da2197ff47a960415b0c3a65db7837b980664e6ea5badf19ab9b0aa734a79bd73bb657bdf065 EAP-Message = 0x3da16cc050dde37f18a3011e5892db6e9f23a31aee647ed51403010001011603010020fc7cb78c3fcff4257432f413651ff1a68a331daa44063ee1ba7357d53c5c721f State = 0x3cd4450c3fd15c57a4c67a935e13b1f8 Message-Authenticator = 0xa0b751cab837d32aaade6144d6f08f2e +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 47 to 10.104.16.128 port 45236 EAP-Message = 0x010600311900140301000101160301002072ff86ea6e4c6cfc190a9297cf07fd15083137cd2f67edea5dd2f18e75102f06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c38d25c57a4c67a935e13b1f8 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=48, length=169 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020600061900 State = 0x3cd4450c38d25c57a4c67a935e13b1f8 Message-Authenticator = 0xc3f2a00bcc6e4f986a6aa4d573441d6a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 48 to 10.104.16.128 port 45236 EAP-Message = 0x0107002019001703010015832012a10a36559544d2d55db5f540a35b44d27aa0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c39d35c57a4c67a935e13b1f8 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=49, length=204 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x020700291900170301001e2acbee97084e2e33afc6ef6db5c15e21dc7840292d08f56549fa5f953b01 State = 0x3cd4450c39d35c57a4c67a935e13b1f8 Message-Authenticator = 0x917540a49ced99b1188e2bc396e9b16b +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 41 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - HUVN\gdxtrujo [peap] Got tunneled request EAP-Message = 0x02070012014855564e5c6764787472756a6f server { PEAP: Got tunneled identity of HUVN\gdxtrujo PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to HUVN\gdxtrujo Sending tunneled request EAP-Message = 0x02070012014855564e5c6764787472756a6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HUVN\\gdxtrujo" server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 49 to 10.104.16.128 port 45236 EAP-Message = 0x0108003e19001703010033d2f9963fe2a7c1570b905e3678ce7c0cc342fd75dee75aeef1fab414d1c6bc9087f988a525c3046586add694814100e03271cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3adc5c57a4c67a935e13b1f8 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=50, length=258 User-Name = "HUVN\\gdxtrujo" NAS-IP-Address = 192.168.69.1 NAS-Port = 8193 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" Calling-Station-Id = "00-15-AF-DC-45-2E" Framed-MTU = 900 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" EAP-Message = 0x0208005f190017030100543af645994c32ed46321e5112cff49a097d65e4a8c10596daba1d5514e2fcebedeba22162932f16450175f7488236bcd243aeb981cebf39d532e62916477ef5555ab630072f0bc847a80ce9975b4051a215abe698 State = 0x3cd4450c3adc5c57a4c67a935e13b1f8 Message-Authenticator = 0x180916b71df70e8ab7d54867f9c22baa +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 95 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f server { PEAP: Setting User-Name to HUVN\gdxtrujo Sending tunneled request EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HUVN\\gdxtrujo" State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for gdxtrujo with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=gdxtrujo [mschap] expand: --domain=%{mschap:NT-Domain:-HUVN} -> --domain=HUVN [mschap] mschap2: 10 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cacf5023c11e7ea7 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=3e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2 Exec-Program output: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC Exec-Program-Wait: plaintext: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e2f84029084a6a7e3a6f63f8 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3f15a23e2f84029084a6a7e3a6f63f8 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 50 to 10.104.16.128 port 45236 EAP-Message = 0x0109004a1900170301003f27dd660624182f35234bd9f80b3c7ad5c4ca8c538fc86c6bae1ba3991e4d3fd17f1a934ac2f7453801032ca9894b0d4a8687ceccbb61bb439c4c9fc642d244 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cd4450c3bdd5c57a4c67a935e13b1f8 Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 43 with timestamp +35 Cleaning up request 1 ID 44 with timestamp +35 Cleaning up request 2 ID 45 with timestamp +35 Cleaning up request 3 ID 46 with timestamp +35 Cleaning up request 4 ID 47 with timestamp +35 Cleaning up request 5 ID 48 with timestamp +35 Cleaning up request 6 ID 49 with timestamp +35 Cleaning up request 7 ID 50 with timestamp +35 Ready to process requests. -- Por favor, NO utilice formatos de archivo propietarios para el intercambio de documentos, como DOC y XLS, sino HTML, RTF, TXT, CSV o cualquier otro que no obligue a utilizar un programa de un fabricante concreto para tratar la información contenida en él. SALUD.

2 2