February 2010 - Freeradius-Users - lists.freeradius.org

eap-ttls and eap-peap againts OpenLdap
by John smith 22 Feb '10

22 Feb '10

Hello I trying to setting up the next scenario: freeradius 2.1.7 with eap-peap (mschapv2) and eap-ttls-pap authentication againts and OpenLDAP with userpassword and Samba attributes. I've installed OpenLdap with samba and userPassword attributes : My username credentiales (uid=ohnith) sambaLMPassword: 90B5B9BABA2A661CAAD3B435B51404EE sambaNTPassword: 0499CCC684CBC2FC38F9C4A3627BCAFD userPassword: {MD5}bpVSyb2OYcjyd8ISIBYCNA== I' ve installed freeradius 2.1.7 with the default configuration My problem is when I try to authenticate using peap-mschapv2 I've read a lot mails about similar problems but i can't find the answer to it I send you the debug output Any suggestions? Thanks Nick Ohn

2 3

Fw: freeradius and ldap using chap
by Eric Eric 22 Feb '10

22 Feb '10

Hi I want to change authentication pap to chap. The users with clear passwords are in ldap server. The error is : rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". Login incorrect (rlm_chap: Clear text password not available): I saw the problem in faq but I didn't find what is my mistake. The config is: in users : DEFAULT Client-IP-Address == 10.10.10.2 , Auth-Type := Vpn, Autz-Type := Vpn, Post-Auth-Type := Vpn, Session-type := Vpn in radius.conf: ldap ldap-Vpn{ .... password_attribute = userPassword password_header = "{clear}" } authorize { chap Autz-Type Vpn{ ldap-Vpn chap } } authenticate { Auth-Type CHAP { chap } Auth-Type Vpn{ chap ldap-Vpn } } .... what is my mistake? should I do any other config or change in ldap.attrmap?

1 1

ldap machine account auth tutorial
by cd 21 Feb '10

21 Feb '10

hello I'm looking for a toturial ti authenticate XP machines accounts (ldap backend) on boot with freeradius here a computer LDAP entry dn: uid=pc-42ee2079$,ou=computer,ou=ressources,ou=test,o=coin,c=fr objectClass: top objectClass: account objectClass: posixAccount objectClass: sambaSamAccount cn: pc-42ee2079$ uid: pc-42ee2079$ uidNumber: 10006 gidNumber: 515 homeDirectory: /dev/null loginShell: /bin/false description: Computer gecos: Computer structuralObjectClass: account sambaSID: S-1-5-21-902432509-630223792-3260868441-1000 displayName: pc-42EE2079$ sambaAcctFlags: [W ] sambaNTPassword: 2A8BBB29BEF5F91B02AF687290ADB4F7 sambaPwdLastSet: 1262772595 should I put in ldap.attr checkItem Cleartext-Password sambaNTPassword or should I put in modules/ldap password_attribute = sambaNTPassword What must I put in users file, if I want that assign VLAN If authentification succeed ? thanks

7 6

attribute and tabla in the database
by felix 20 Feb '10

20 Feb '10

Hello community I am new using freeradius and I use the freeradius v 2.1 and I need to find some documentation that speaks specifically to what each attribute of each table within the database, I've searched in google but I only see general explanations, and nothing specific. I would appreciate if I could help. Thanks in advance Participe en la 15 Convención Científica de Ingeniería y Arquitectura, del 29 de noviembre al 3 de diciembre de 2010 La Ingeniería y la Arquitectura por un Futuro Sustentable Palacio de Convenciones, La Habana, Cuba http://www.cujae.edu.cu/eventos/convencion

3 2

Cisco Parser View
by Siryx XL 19 Feb '10

19 Feb '10

Hi everyone I got my cisco router authentication working OK, i can get access to my cisco router with full privilege sendind "cisco-av-pair = shell:priv-lvl=15" from the freeradius server. I configured the "parser view" configuration in the router, to give some different commands to different kind of users, but i don't know what parameter or variable send from the freeradius server to achieve the parser configuration. Thanks in advice. Cisco Router Parser Configuration: parser view Connectivity secret 5 $1$z4It$J33phdP commands configure include all line commands configure include-exclusive all route-map commands configure include-exclusive all snmp-server commands configure include-exclusive all dialer-list commands configure include all access-list commands configure include-exclusive all ip prefix-list commands configure include all ip route commands configure include all ip access-list commands configure include-exclusive all router commands configure include all interface commands configure include-exclusive all dlsw commands configure include-exclusive all source-bridge commands configure include-exclusive all policy-map commands configure include-exclusive all class-map commands configure include-exclusive all chat-script commands configure include ip commands configure exclude crypto ... parser view Security secret 5 $1$UJcb$JREJYEXQ3Jn commands interface include all crypto commands configure include ip access-list log-update commands configure include ip access-list logging commands configure include ip access-list extended commands configure include ip access-list standard commands configure include ip access-list resequence commands configure include ip access-list commands configure include ip commands configure include all crypto commands configure include no ip access-list log-update commands configure include no ip access-list logging commands configure include no ip access-list extended commands configure include no ip access-list standard commands configure include no ip access-list resequence commands configure include no ip access-list commands configure include no ip commands configure include all no crypto commands configure include no commands exec include all crypto ... _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969

1 0

can't get simultaneous login to work Part 2
by J Brandon Polley 19 Feb '10

19 Feb '10

Here is my login output: rad_recv: Accounting-Request packet from host 172.16.33.2 port 32768, id=142, length=216 User-Name = "STUDENTBRANDON" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 Framed-IP-Address = 172.16.19.110 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Acct-Session-Id = "4b7c3963/00:1b:77:94:eb:74/6105" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" Acct-Status-Type = Interim-Update Acct-Input-Octets = 13681 Acct-Output-Octets = 5808 Acct-Input-Packets = 114 Acct-Output-Packets = 22 Acct-Session-Time = 314 Acct-Delay-Time = 0 Calling-Station-Id = "172.16.19.110" Called-Station-Id = "172.16.33.2" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 172.16.33.2,NAS-IP-Address = 172.16.33.2,Acct-Session-Id = "4b7c3963/00:1b:77:94:eb:74/6105",User-Name = "STUDENTBRANDON"' [acct_unique] Acct-Unique-Session-ID = "51ddcb827685cf72". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/172.16.33.2/detail-20100217 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.33.2/detail-20100217 [detail] expand: %t -> Wed Feb 17 17:25:13 2010 ++[detail] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> STUDENTBRANDON ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> STUDENTBRANDON attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 142 to 172.16.33.2 port 32768 Finished request 10. Cleaning up request 10 ID 142 with timestamp +1121b Going to the next request Ready to process requests. Here is the second simultaneous login output: 2nd login info rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=28, length=207 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x020200130153545544454e544252414e444f4e Message-Authenticator = 0x2b9e3f7830cca848e4dd9e16e6ddecab Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 2 length 19 Thu Feb 18 11:47:09 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns updated Thu Feb 18 11:47:09 2010 : Info: [ldap] performing user authorization for STUDENTBRANDON Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Thu Feb 18 11:47:09 2010 : Info: [ldap] ... expanding second conditional Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(THELDAPBIND=1))) -> (&(uid=STUDENTBRANDON)(!(THELDAPBIND=1))) Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: o=NSAC -> o=NSAC Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Feb 18 11:47:09 2010 : Debug: [ldap] performing search in o=NSAC, with filter (&(uid=STUDENTBRANDON)(!(THELDAPBIND=1))) Thu Feb 18 11:47:09 2010 : Info: [ldap] Added the eDirectory password 1234567 in check items as Cleartext-Password Thu Feb 18 11:47:09 2010 : Info: [ldap] looking for check items in directory... Thu Feb 18 11:47:09 2010 : Info: [ldap] looking for reply items in directory... Thu Feb 18 11:47:09 2010 : Info: [ldap] user STUDENTBRANDON authorized to use remote access Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Feb 18 11:47:09 2010 : Info: ++[ldap] returns ok Thu Feb 18 11:47:09 2010 : Info: ++[expiration] returns noop Thu Feb 18 11:47:09 2010 : Info: ++[logintime] returns noop Thu Feb 18 11:47:09 2010 : Info: [pap] Found existing Auth-Type, not changing it. Thu Feb 18 11:47:09 2010 : Info: ++[pap] returns noop Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] EAP Identity Thu Feb 18 11:47:09 2010 : Info: [eap] processing type md5 Thu Feb 18 11:47:09 2010 : Debug: rlm_eap_md5: Issuing Challenge Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 28 to 172.16.33.2 port 32768 EAP-Message = 0x010300160410acef14eeddcbae87045ccd15fcc5ca21 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf184d7d8f187d3129f9578c3572f17ab Thu Feb 18 11:47:09 2010 : Info: Finished request 8. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=29, length=212 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x020300060315 State = 0xf184d7d8f187d3129f9578c3572f17ab Message-Authenticator = 0xee0cb9b1272a1be8ac8b864f58b49bd0 Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 3 length 6 Thu Feb 18 11:47:09 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns updated Thu Feb 18 11:47:09 2010 : Info: [ldap] performing user authorization for STUDENTBRANDON Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Thu Feb 18 11:47:09 2010 : Info: [ldap] ... expanding second conditional Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(THELDAPBIND=1))) -> (&(uid=STUDENTBRANDON)(!(THELDAPBIND=1))) Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: o=NSAC -> o=NSAC Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Feb 18 11:47:09 2010 : Debug: [ldap] performing search in o=NSAC, with filter (&(uid=STUDENTBRANDON)(!(THELDAPBIND=1))) Thu Feb 18 11:47:09 2010 : Info: [ldap] Added the eDirectory password 1234567 in check items as Cleartext-Password Thu Feb 18 11:47:09 2010 : Info: [ldap] looking for check items in directory... Thu Feb 18 11:47:09 2010 : Info: [ldap] looking for reply items in directory... Thu Feb 18 11:47:09 2010 : Info: [ldap] user STUDENTBRANDON authorized to use remote access Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Feb 18 11:47:09 2010 : Info: ++[ldap] returns ok Thu Feb 18 11:47:09 2010 : Info: ++[expiration] returns noop Thu Feb 18 11:47:09 2010 : Info: ++[logintime] returns noop Thu Feb 18 11:47:09 2010 : Info: [pap] Found existing Auth-Type, not changing it. Thu Feb 18 11:47:09 2010 : Info: ++[pap] returns noop Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] Request found, released from the list Thu Feb 18 11:47:09 2010 : Info: [eap] EAP NAK Thu Feb 18 11:47:09 2010 : Info: [eap] EAP-NAK asked for EAP-Type/ttls Thu Feb 18 11:47:09 2010 : Info: [eap] processing type tls Thu Feb 18 11:47:09 2010 : Info: [tls] Initiate Thu Feb 18 11:47:09 2010 : Info: [tls] Start returned 1 Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 29 to 172.16.33.2 port 32768 EAP-Message = 0x010400061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf184d7d8f080c2129f9578c3572f17ab Thu Feb 18 11:47:09 2010 : Info: Finished request 9. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=30, length=262 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x020400381500160301002d010000290301e2158675d00f7dbebf4d3e046fd16d636ba0d7d470d25ef7fb34a52b5c466adb000002000a0100 State = 0xf184d7d8f080c2129f9578c3572f17ab Message-Authenticator = 0x1c89d60840ffd93ecdfb70e925c99ea7 Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 4 length 56 Thu Feb 18 11:47:09 2010 : Info: [eap] Continuing tunnel setup. Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns ok Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] Request found, released from the list Thu Feb 18 11:47:09 2010 : Info: [eap] EAP/ttls Thu Feb 18 11:47:09 2010 : Info: [eap] processing type ttls Thu Feb 18 11:47:09 2010 : Info: [ttls] Authenticate Thu Feb 18 11:47:09 2010 : Info: [ttls] processing EAP-TLS Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_verify returned 7 Thu Feb 18 11:47:09 2010 : Info: [ttls] Done initial handshake Thu Feb 18 11:47:09 2010 : Info: [ttls] (other): before/accept initialization Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: before/accept initialization Thu Feb 18 11:47:09 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 002d], ClientHello Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 read client hello A Thu Feb 18 11:47:09 2010 : Info: [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 write server hello A Thu Feb 18 11:47:09 2010 : Info: [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 write certificate A Thu Feb 18 11:47:09 2010 : Info: [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 write server done A Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 flush data Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A Thu Feb 18 11:47:09 2010 : Debug: In SSL Handshake Phase Thu Feb 18 11:47:09 2010 : Debug: In SSL Accept mode Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_process returned 13 Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 30 to 172.16.33.2 port 32768 EAP-Message = 0x0105040015c00000089b160301002a0200002603014b7d60fdcba961d3d55384b73eaf88197907c2ced3c87e8eac942226f575917b00000a00160301085e0b00085a0008570 003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d0603550408130652616469757331123010 06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e6 36f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3130303132333035353833325a170d3131303132333035353833325a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060 355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d01090116 1161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d145e91c1b7bf93502e27b6455cbf030407ba92 cac7d45fd09cb737966e7b42975ad34a77afa0265de702a8753a33e08374e45f5b61a7c74fc21a48c5400 EAP-Message = 0xe952489111f44a9f29ccb7aad6dc38830f9a031b1678e94b27693ec204ec6c54388b6a82275ad652b3f32aec40080a555de5069688a2611ec31a1be1eb1a480903be4d3762a 86b2c7cd0e6b906cd57308ac851dc63266ba32c0a9b5869833ed8200f577be9d03cb819da2b7889817878bffa27a6b1238e971a2d3a0c801c8413920873ec273c355cfd02dddb 603fc24e4aade061fcb26bb2f79233a1b6f5e2695a3ce2b5ace2bffaf1c28a664ea373f91d604270b2249b8a1b5a51b3aa400c3153430203010001a317301530130603551d250 40c300a06082b06010505070301300d06092a864886f70d010104050003820101007bfc011048758a9131 EAP-Message = 0xc9780e6e2e466992b7e943d9dd6ee6b3d2c5be35857b6645c7eb414ab50deb1f9093df621553aec613246df6c2f593427a2eb14fb656a6105613b3dbff81f8ea21d0d7100a0 c988361c1b6f035c8507e9f0b2c8b6968dd3562b25e0135507c1ce698b8ffaf898519bd55f2698c1c611cb083eff0787c1ec70798d7ebf371df1b97e6f59281bae9671a8e49d3 098ed50f53d8f4dd08fc62271ea83c662dea50d287ff4fbb79b5921906fc55ee3aec24abdb3f9ab7d658918890e92e304e1c955e8e839990e25c18ceb293328c5c733c891bb18 8a70c00474bafdfd5271b89587c9147c202e70c5a15d11936d05021cb9cbdf09ed3f4e5620004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf184d7d8f381c2129f9578c3572f17ab Thu Feb 18 11:47:09 2010 : Info: Finished request 10. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=31, length=212 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x020500061500 State = 0xf184d7d8f381c2129f9578c3572f17ab Message-Authenticator = 0x8b1d7d879042d3b8b4be84fdb0f118be Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 5 length 6 Thu Feb 18 11:47:09 2010 : Info: [eap] Continuing tunnel setup. Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns ok Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] Request found, released from the list Thu Feb 18 11:47:09 2010 : Info: [eap] EAP/ttls Thu Feb 18 11:47:09 2010 : Info: [eap] processing type ttls Thu Feb 18 11:47:09 2010 : Info: [ttls] Authenticate Thu Feb 18 11:47:09 2010 : Info: [ttls] processing EAP-TLS Thu Feb 18 11:47:09 2010 : Info: [ttls] Received TLS ACK Thu Feb 18 11:47:09 2010 : Info: [ttls] ACK handshake fragment handler Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_verify returned 1 Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_process returned 13 Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 31 to 172.16.33.2 port 32768 EAP-Message = 0x0106040015c00000089b00f2b0a7a02f36a6e7300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d0603550408130652616469757331123 01006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c65 2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3130303132333035353833315a170d313130313233303 5353833315a308193310b3009060355040613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652 e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f00308201 0a0282010100a096038485366885b9d666de402c00dc2f41e6117c9793b4211e2ca0c8097e5101fc92bf286e72ef224e7f2d010c4f2c096714fe5c912e80e3694a4139732c1a7 b3b7dab5ae48ef4366fd1070880544a55f81ffb3b866fb506f1618e71636f41bca54a50c9b1a5c0629b7b EAP-Message = 0xf1f5f4655ca6467c3b56acad1ddd8017755c92f82aba8605955b702043ccb0d54f4e7cecfdea9a843a68b522f60e6378146a1fde27e35515732e31e82d22152ba97f5dbfe37 9b8b61ef292ec262a0ab0442a99d0cb321115dc71088e4f23645427e120aa4b076f627dca9db0ff60d5d9d3eba8290dbed25d0d0b7c62ec8e3577e314ef6f29069fd93462e595 d5e127765c2f2916530203010001a381fb3081f8301d0603551d0e0416041414bb9789767df723612d34db98d8b7f41b9e2b0f3081c80603551d230481c03081bd801414bb978 9767df723612d34db98d8b7f41b9e2b0fa18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010 901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900f2b0a7a02f36a6 e7300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010036737ecd034a3c80c578a142e99436ccb48ccafcdbd6eb258795dc2d263e651699bd8cc 98f49361d23280041f432d389b96dacde21a01a0d71ad7906aeb0d990444199a41dcd06484019ea3a08df EAP-Message = 0xa9aceeebd4f7e37a378b97db Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf184d7d8f282c2129f9578c3572f17ab Thu Feb 18 11:47:09 2010 : Info: Finished request 11. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=32, length=212 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x020600061500 State = 0xf184d7d8f282c2129f9578c3572f17ab Message-Authenticator = 0x4ab20b3997aa648ad7b138f4b8304293 Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 6 length 6 Thu Feb 18 11:47:09 2010 : Info: [eap] Continuing tunnel setup. Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns ok Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] Request found, released from the list Thu Feb 18 11:47:09 2010 : Info: [eap] EAP/ttls Thu Feb 18 11:47:09 2010 : Info: [eap] processing type ttls Thu Feb 18 11:47:09 2010 : Info: [ttls] Authenticate Thu Feb 18 11:47:09 2010 : Info: [ttls] processing EAP-TLS Thu Feb 18 11:47:09 2010 : Info: [ttls] Received TLS ACK Thu Feb 18 11:47:09 2010 : Info: [ttls] ACK handshake fragment handler Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_verify returned 1 Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_process returned 13 Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 32 to 172.16.33.2 port 32768 EAP-Message = 0x010700b915800000089b66db272fb6fb5fb066283fbed2ef931a20d9edbc1baf6dd0edd7a85c9810cca6ac5e349282c29e58f2e44f4ccd22da1a00f9e4062529305c6505974 ac6e257b92b3e473ee517b0eae68a8c01145136fabd1c948f23f417775f36e91389fc96672cef62061ba46aa0b5df7c739196e884da569536a46aedd959fdb6f127654cbd550e c79af1c175fc9f6f428cdf8144d10d41e08a80624aa5e9b310f7a68d4dd4b7c97e457b9f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf184d7d8f583c2129f9578c3572f17ab Thu Feb 18 11:47:09 2010 : Info: Finished request 12. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=33, length=532 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x020701441500160301010610000102010044d80f753446cab3fb4a950ecb23536835f48379ed6c6b63ed645f46bd4e8ec3c62d375bcc6d02a157f0bc43a9b89fa4a06987636 efb56ce2df15f64aa61e72250dbc49c640d39f1ecfadc5ac1547802c34a568039f5fc5d2e492b0171aad27049c1e950ad7ba60086d9c25fd6e31d11d83d15f0f3a7307965f89a fc78c889ae4d5d03a507ea369362e90a5f467d1be4c3b2d34dcbf24b8df6adedc6c8e3608875bb82109163f582dd0ad9f52bbc942bbd6d5933dd7ddc9a12a234730b30602d23f 1e28f542fc6dc5e71733fc07eab9404477947e6d8e3cd5effc68e278002265e884adcd48af568d3c88e35 EAP-Message = 0x8d33480abf4ca82c9a7275028c74d3376c56f1f7140301000101160301002876c9c626818695c04ee04e58435bea1adb06026c8d1755a467f92f0744f4329599565c6f2148a 8ce State = 0xf184d7d8f583c2129f9578c3572f17ab Message-Authenticator = 0xd3ac6c79b1378b3917146b0b4b34c17d Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 7 length 253 Thu Feb 18 11:47:09 2010 : Info: [eap] Continuing tunnel setup. Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns ok Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] Request found, released from the list Thu Feb 18 11:47:09 2010 : Info: [eap] EAP/ttls Thu Feb 18 11:47:09 2010 : Info: [eap] processing type ttls Thu Feb 18 11:47:09 2010 : Info: [ttls] Authenticate Thu Feb 18 11:47:09 2010 : Info: [ttls] processing EAP-TLS Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_verify returned 7 Thu Feb 18 11:47:09 2010 : Info: [ttls] Done initial handshake Thu Feb 18 11:47:09 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 read client key exchange A Thu Feb 18 11:47:09 2010 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Thu Feb 18 11:47:09 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 read finished A Thu Feb 18 11:47:09 2010 : Info: [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 write change cipher spec A Thu Feb 18 11:47:09 2010 : Info: [ttls] >>> TLS 1.0 Handshake [length 0010], Finished Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 write finished A Thu Feb 18 11:47:09 2010 : Info: [ttls] TLS_accept: SSLv3 flush data Thu Feb 18 11:47:09 2010 : Info: [ttls] (other): SSL negotiation finished successfully Thu Feb 18 11:47:09 2010 : Debug: SSL Connection Established Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_process returned 13 Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 33 to 172.16.33.2 port 32768 EAP-Message = 0x0108003d1580000000331403010001011603010028e9fc4a2a326f1783b766ac6b96a2e0fae0e32d9bdb2fca98edeb4def649c0a5a4eeace488ef3e445 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf184d7d8f48cc2129f9578c3572f17ab Thu Feb 18 11:47:09 2010 : Info: Finished request 13. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.33.2 port 32768, id=34, length=281 User-Name = "STUDENTBRANDON" Calling-Station-Id = "00-1d-e0-51-c2-6d" Called-Station-Id = "00-22-55-e0-7d-d0:cryptadmin" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" EAP-Message = 0x0208004b15001703010040242674092173e9f7f3209e69f50670d6f53f9c1d409767018f67a730a942a2eebfe1b817d2d648d7b993b20c390f07dc6b15a88fc8c61200821d2 a21354b18ee State = 0xf184d7d8f48cc2129f9578c3572f17ab Message-Authenticator = 0xd429653cd72df306994ae1761baac2c3 Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] EAP packet type response id 8 length 75 Thu Feb 18 11:47:09 2010 : Info: [eap] Continuing tunnel setup. Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns ok Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = EAP Thu Feb 18 11:47:09 2010 : Info: +- entering group authenticate {...} Thu Feb 18 11:47:09 2010 : Info: [eap] Request found, released from the list Thu Feb 18 11:47:09 2010 : Info: [eap] EAP/ttls Thu Feb 18 11:47:09 2010 : Info: [eap] processing type ttls Thu Feb 18 11:47:09 2010 : Info: [ttls] Authenticate Thu Feb 18 11:47:09 2010 : Info: [ttls] processing EAP-TLS Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_verify returned 7 Thu Feb 18 11:47:09 2010 : Info: [ttls] Done initial handshake Thu Feb 18 11:47:09 2010 : Info: [ttls] eaptls_process returned 7 Thu Feb 18 11:47:09 2010 : Info: [ttls] Session established. Proceeding to decode tunneled attributes. TTLS tunnel data in 0000: 00 00 00 01 40 00 00 16 53 54 55 44 45 4e 54 42 TTLS tunnel data in 0010: 52 41 4e 44 4f 4e 00 00 00 00 00 02 40 00 00 0f TTLS tunnel data in 0020: 31 32 33 34 35 36 37 00 Thu Feb 18 11:47:09 2010 : Info: [ttls] Got tunneled request User-Name = "STUDENTBRANDON" User-Password = "1234567" FreeRADIUS-Proxied-To = 127.0.0.1 Thu Feb 18 11:47:09 2010 : Info: [ttls] Sending tunneled request User-Name = "STUDENTBRANDON" User-Password = "1234567" FreeRADIUS-Proxied-To = 127.0.0.1 server { Thu Feb 18 11:47:09 2010 : Info: +- entering group authorize {...} Thu Feb 18 11:47:09 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:09 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:09 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:09 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:09 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns noop Thu Feb 18 11:47:09 2010 : Info: [ldap] performing user authorization for STUDENTBRANDON Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Thu Feb 18 11:47:09 2010 : Info: [ldap] ... expanding second conditional Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(THELDAPBIND=1))) -> (&(uid=STUDENTBRANDON)(!(THELDAPBIND=1))) Thu Feb 18 11:47:09 2010 : Info: [ldap] expand: o=NSAC -> o=NSAC Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Feb 18 11:47:09 2010 : Debug: [ldap] performing search in o=NSAC, with filter (&(uid=STUDENTBRANDON)(!(THELDAPBIND=1))) Thu Feb 18 11:47:09 2010 : Info: [ldap] Added the eDirectory password 1234567 in check items as Cleartext-Password Thu Feb 18 11:47:09 2010 : Info: [ldap] looking for check items in directory... Thu Feb 18 11:47:09 2010 : Info: [ldap] looking for reply items in directory... Thu Feb 18 11:47:09 2010 : Info: [ldap] user STUDENTBRANDON authorized to use remote access Thu Feb 18 11:47:09 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Feb 18 11:47:09 2010 : Info: ++[ldap] returns ok Thu Feb 18 11:47:09 2010 : Info: ++[expiration] returns noop Thu Feb 18 11:47:09 2010 : Info: ++[logintime] returns noop Thu Feb 18 11:47:09 2010 : Info: ++[pap] returns updated Thu Feb 18 11:47:09 2010 : Info: Found Auth-Type = PAP Thu Feb 18 11:47:09 2010 : Info: +- entering group PAP {...} Thu Feb 18 11:47:09 2010 : Info: [pap] login attempt with password "1234567" Thu Feb 18 11:47:09 2010 : Info: [pap] Using clear text password "1234567" Thu Feb 18 11:47:09 2010 : Info: [pap] User authenticated successfully Thu Feb 18 11:47:09 2010 : Info: ++[pap] returns ok Thu Feb 18 11:47:09 2010 : Info: +- entering group post-auth {...} Thu Feb 18 11:47:09 2010 : Info: ++[exec] returns noop } # server Thu Feb 18 11:47:09 2010 : Info: [ttls] Got tunneled reply code 2 Thu Feb 18 11:47:09 2010 : Info: [ttls] Got tunneled Access-Accept Thu Feb 18 11:47:09 2010 : Info: [eap] Freeing handler Thu Feb 18 11:47:09 2010 : Info: ++[eap] returns ok Thu Feb 18 11:47:09 2010 : Info: +- entering group post-auth {...} Thu Feb 18 11:47:09 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 34 to 172.16.33.2 port 32768 MS-MPPE-Recv-Key = 0xd87c3954099dd119a9e8f5f5801c1ca00931b4d9ca8d07f5d378d9d247c5a078 MS-MPPE-Send-Key = 0xb028531f13aee19e321551ff73d7fea829b1634807b36b171f8cdb3d409171b6 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "STUDENTBRANDON" Thu Feb 18 11:47:09 2010 : Info: Finished request 14. Thu Feb 18 11:47:09 2010 : Debug: Going to the next request Thu Feb 18 11:47:09 2010 : Debug: Waking up in 4.5 seconds. rad_recv: Accounting-Request packet from host 172.16.33.2 port 32768, id=156, length=181 User-Name = "STUDENTBRANDON" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 Framed-IP-Address = 172.16.19.109 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Acct-Session-Id = "4b7d6125/00:1d:e0:51:c2:6d/19966" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" Acct-Status-Type = Start Calling-Station-Id = "172.16.19.109" Called-Station-Id = "172.16.33.2" Thu Feb 18 11:47:13 2010 : Info: +- entering group preacct {...} Thu Feb 18 11:47:13 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:47:13 2010 : Info: [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 172.16.33.2,NAS-IP-Address = 172.16.33.2,Acct-Session-Id = "4b7d6125/00:1d:e0:51:c2:6d/19966",User-Name = "STUDENTBRANDON"' Thu Feb 18 11:47:13 2010 : Info: [acct_unique] Acct-Unique-Session-ID = "fd5aca495820eabb". Thu Feb 18 11:47:13 2010 : Info: ++[acct_unique] returns ok Thu Feb 18 11:47:13 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:47:13 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:47:13 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:47:13 2010 : Info: ++[files] returns noop Thu Feb 18 11:47:13 2010 : Info: +- entering group accounting {...} Thu Feb 18 11:47:13 2010 : Info: [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/172.16.33.2/detail-20100218 Thu Feb 18 11:47:13 2010 : Info: [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.33.2/detail-20100218 Thu Feb 18 11:47:13 2010 : Info: [detail] expand: %t -> Thu Feb 18 11:47:13 2010 Thu Feb 18 11:47:13 2010 : Info: ++[detail] returns ok Thu Feb 18 11:47:13 2010 : Info: [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp Thu Feb 18 11:47:13 2010 : Info: [radutmp] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:47:13 2010 : Info: ++[radutmp] returns ok Thu Feb 18 11:47:13 2010 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:47:13 2010 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Feb 18 11:47:13 2010 : Info: ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 156 to 172.16.33.2 port 32768 Thu Feb 18 11:47:13 2010 : Info: Finished request 15. Thu Feb 18 11:47:13 2010 : Info: Cleaning up request 15 ID 156 with timestamp +218 Thu Feb 18 11:47:13 2010 : Debug: Going to the next request Thu Feb 18 11:47:13 2010 : Debug: Waking up in 1.4 seconds. Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 8 ID 28 with timestamp +214 Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 9 ID 29 with timestamp +214 Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 10 ID 30 with timestamp +214 Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 11 ID 31 with timestamp +214 Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 12 ID 32 with timestamp +214 Thu Feb 18 11:47:14 2010 : Debug: Waking up in 0.1 seconds. Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 13 ID 33 with timestamp +214 Thu Feb 18 11:47:14 2010 : Debug: Waking up in 0.1 seconds. Thu Feb 18 11:47:14 2010 : Info: Cleaning up request 14 ID 34 with timestamp +214 Thu Feb 18 11:47:14 2010 : Info: Ready to process requests. Here is some accounting output: rad_recv: Accounting-Request packet from host 172.16.33.2 port 32768, id=157, length=223 User-Name = "STUDENTBRANDON" NAS-Port = 29 NAS-IP-Address = 172.16.33.2 Framed-IP-Address = 172.16.19.109 NAS-Identifier = "wlc-nsac-exteng-4404-6" Airespace-Wlan-Id = 6 Acct-Session-Id = "4b7d6125/00:1d:e0:51:c2:6d/19966" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "240" Acct-Status-Type = Stop Acct-Input-Octets = 10940 Acct-Output-Octets = 5288 Acct-Input-Packets = 90 Acct-Output-Packets = 25 Acct-Terminate-Cause = Idle-Timeout Acct-Session-Time = 362 Acct-Delay-Time = 0 Calling-Station-Id = "172.16.19.109" Called-Station-Id = "172.16.33.2" Thu Feb 18 11:53:15 2010 : Info: +- entering group preacct {...} Thu Feb 18 11:53:16 2010 : Info: ++[preprocess] returns ok Thu Feb 18 11:53:16 2010 : Info: [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 172.16.33.2,NAS-IP-Address = 172.16.33.2,Acct-Session-Id = "4b7d6125/00:1d:e0:51:c2:6d/19966",User-Name = "STUDENTBRANDON"' Thu Feb 18 11:53:16 2010 : Info: [acct_unique] Acct-Unique-Session-ID = "fd5aca495820eabb". Thu Feb 18 11:53:16 2010 : Info: ++[acct_unique] returns ok Thu Feb 18 11:53:16 2010 : Info: [suffix] No '@' in User-Name = "STUDENTBRANDON", looking up realm NULL Thu Feb 18 11:53:16 2010 : Info: [suffix] No such realm "NULL" Thu Feb 18 11:53:16 2010 : Info: ++[suffix] returns noop Thu Feb 18 11:53:16 2010 : Info: ++[files] returns noop Thu Feb 18 11:53:16 2010 : Info: +- entering group accounting {...} Thu Feb 18 11:53:16 2010 : Info: [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/172.16.33.2/detail-20100218 Thu Feb 18 11:53:16 2010 : Info: [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.33.2/detail-20100218 Thu Feb 18 11:53:16 2010 : Info: [detail] expand: %t -> Thu Feb 18 11:53:15 2010 Thu Feb 18 11:53:16 2010 : Info: ++[detail] returns ok Thu Feb 18 11:53:16 2010 : Info: [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp Thu Feb 18 11:53:16 2010 : Info: [radutmp] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:53:16 2010 : Info: ++[radutmp] returns ok Thu Feb 18 11:53:16 2010 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> STUDENTBRANDON Thu Feb 18 11:53:16 2010 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Feb 18 11:53:16 2010 : Info: ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 157 to 172.16.33.2 port 32768 Thu Feb 18 11:53:16 2010 : Info: Finished request 16. Thu Feb 18 11:53:16 2010 : Info: Cleaning up request 16 ID 157 with timestamp +580 Thu Feb 18 11:53:16 2010 : Debug: Going to the next request Thu Feb 18 11:53:16 2010 : Info: Ready to process requests.

1 0

Blocking a user before proxy
by Lovaas,Steven 19 Feb '10

19 Feb '10

Hello - I'm new to the list, because I've encountered a question I can't find the answer to in the wiki or the archives. We've had a stable Freeradius implementation for several years, and we love it! Authentication decisions are being made on a group of linux servers; some locally, some handed off via ldap, and more recently some via peap-mschapv2. Now, we are in a position where we'd like to implement proxying with realms, to hand off the 802.11i decision to a Microsoft NPS (IAS) server we don't control, but we want to retain the ability to reject a user on the linux boxes before handing the question to NPS. Up until now we've rejected individual users by an $INCLUDE of a bad-users file into the USERS file. My question is about what step in the sequence is most efficient to get this done, and if there are any implications for which tool works best in the different steps. It makes sense to me (and with what I've seen written on the lists) to make that decision BEFORE proxying, and if possible before even making the decision to DO proxying. If I understand the process correctly... 1) It would be nice to do it during the Authorization phase (so as not to waste time with proxying activities) 2) The existing files in Preprocess (hints, huntgroups) don't seem to be set up for individual user blocking 3) Checkval doesn't take non-matches, so we can't use that. So I guess I'll need to insert some conditional logic evaluating against a list of bad usernames in one of those areas, using the language of radiusd.conf or with Perl or write a custom module. Anyone have any advice about what the best approach would be? Or am I missing something a lot easier? Thanks! Steve Lovaas

1 0

which version well works with digest?
by basteon 19 Feb '10

19 Feb '10

hi Alan, I've seen this one http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg22204.… Also I've tried (1.1.1, 1.1.3 and 2.1.8) freeradius version, but anyway still can't get it working. I'm looking for digest auth for sip protocol, I to testing it by the way... http://freeradius.org/radiusd/man/rlm_digest.html I've got this troubles with 2.1.8.. [digest] Adding Auth-Type = DIGEST ++[digest] returns ok Found Auth-Type = digest +- entering group authenticate {...} [digest] Cleartext-Password or Digest-HA1 is required for authentication. ++[digest] returns invalid Failed to authenticate the user. Login incorrect: [test/test] (from client localhost port 0) Delaying reject of request 0 for 1 seconds 1.1.1 and 1.1.3..... A2 = REGISTER:sip:5555551212@example.com KD = 412325717cf44c1b4a628b2742d096a9:1234abcd:ce566eb71723da08a54d906325db74f6 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 I tries to use libradiusclient-ng and radiusclient from freeradius, anyway I've got this weird things. my configuration...... prefix = /usr/local/freeradius-1.1.1 exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 127.0.0.1 port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { files { usersfile = ${confdir}/users compat = no } digest { } } authorize { digest files } authenticate { digest }

1 0

RES: Accounting queries logging just after Acct-Stop packet
by Luiz Gustavo de Villa Scandelari 19 Feb '10

19 Feb '10

Thanks very much Fajar, I didn´t noticed that the radacct has also changed, therefore I got some errors. I´ve already changed it and it work greats now. Thanks again. Luiz Gustavo Scandelari Date: Thu, 18 Feb 2010 19:07:27 +0700 From: "Fajar A. Nugraha" <fajar(a)fajar.net> Subject: Re: Accounting queries logging just after Acct-Stop packet To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <7207d96f1002180407re3919c6wf8418a11bf1ea946(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Thu, Feb 18, 2010 at 6:22 PM, Luiz Gustavo de Villa Scandelari <luizgustavo(a)wni.com.br> wrote: > compared to the previous version (1.x.x) the accounting queries are not > logging the accounting session at radacct, as it should. > After we receive an > Acct-Stop Packet the sql module logs the accounting session data to the > database, so what can I do in order to have the sql module logging just > after the Acct-Start Packet? Start by comparing the default sql query for acct-start to the one you currently use. Perhaps you're missing something (wrong table name, wrong fields?). Then run FR in debug mode. verify that you got acct-start packet correctly. After that enable sql trace, so you know what queries were executed. That should help you find out which sql query (if any) is causing the problem. -- Fajar

1 0

Alan- any luck deciphering the problem I had with PEAP on 2.1.8 vs 2.1.4?
by Mike Bernhardt 18 Feb '10

18 Feb '10

Just checking in on this, I have plenty of patience. I just don't want to find myself in a situation down the road where a currently-unknown security issue or bug in 2.1.4 forces an upgrade, since our current configuration doesn't seem to work with 2.1.8...

3 2