July 2010 - Freeradius-Users - lists.freeradius.org

Re: FreeRadius + AD + Realms
by Matthew P 04 Jul '10

04 Jul '10

>> In a general regexp language, I guess that could be done with ([\w.-]+)(?=@.*). > Most regexes don't support \w, or (?... constructs. > > Keep it simple: > > if (User-Name =~ /^(.*)(a)(.*)$/) { > # name = %{1} > # realm = %{2} > } Makes sense now :) Thanks. man regex is written mostly descriptive, it's much easier to understand on examples like these, than on "weeknights" :D But I guess I missed to point with doing it this way, because: if (User-Name =~ /(a)mydomain.com/) { if (User-Name =~ /^(.*)(a)(.*)$/) { update request { Stripped-User-Name = %{1} } ldap } } doesn't work ^^ It gives: rlm_ldap - authorize rlmd_ldap: performing user authorization for %{1} ... Also, I tried to apply this directly in the ldap module configuration, different outcome, but also doesn't work. Where did I go wrong? -_- _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

freeradius2 with EAP-TLS and LDAP authorization ?
by Riccardo Veraldi 04 Jul '10

04 Jul '10

Hello, is it possible in some way to use EAP-TLS X509 authentication together with LDAP authorization in freeradius2 ? Actually freeradius2 allows EAP-TLS authentication, but if I wanted to extract the emailAddress or CN field from the X509 certificate and authorize it against my LDAP tree information to allow or disallow WiFi access, is it possible ?? Or the only way to authorize a EAP-TLS X509 user is only thru freeradius2 users file ? thanks Rick

3 5

Freeradius + AD + Cisco authetication
by Jevos, Peter 03 Jul '10

03 Jul '10

Hello friends I was reading few tutorials regarding the Cisco authetication against Freeradius and Windows AD. Actually I'm not really clever, because main tutorial on the main pages is connected with the older version , and there are more version of the Freradius 2.0, a bit different: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO http://deployingradius.com/documents/configuration/active_directory.html http://www.eduroamus.org/node/44 However, I have working and running samba and ntlm: Linux#/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYNAME --require-membership-of='DOMAIN+DOMAIN_GROUP' It returns OK. Can somebody please help me how to finish the freeradius configuration ( the NAS server will be cisco ) I know that there should be the entries in users file, eap file, mschap or ntlm_aut modules. But what should be the proper syntax I really don't know My aim should be: 1. authenticate users that belong to some certain domain group , as is showed in the ntlm_auth command above ( for the Cisco vpn client users ) 2. authenticate users to have privilege ( 15 ) access to the router Now I'm using IAS server, and I want to move to the FreeRadius Cisco configuration is solved and works without any problems. What remains is freeradius config Thank you BR Pet

3 7

Re: FreeRadius + AD + Realms
by Matthew P 03 Jul '10

03 Jul '10

Thanks for your help Alan, it really makes a difference when learning about Freeradius configuration. > So... decode the user-name using a regex. You can then use that in > the LDAP configuration. The LDAP user search is configurable for a > *reason*. I forgot to mention that I need the "user" portion of "user(a)mydomain.com" for sql too. "user(a)mydomain.com" only needs to be sent to the home server (in case the user doesn't have "@mydomain.com" or "@mydomain2.com"). In another words, both AD and DB contain usernames, without any realms. I've been reading http://freeradius.org/radiusd/man/unlang.html, and can't seem to figure out how to make the logic - "take everything before @ as a username". So please help. In a general regexp language, I guess that could be done with ([\w.-]+)(?=@.*). > It's an option, but not the only way to do it. > > if (User-Name =~ /(a)mydomain.com/) { > ldap > } > elsif (User-Name =~ /(a)mydomain2.com/) { > sql > } > else { > update control { > Proxy-To-Realm := "other" > } > } Works nicely, thanks for this hint. Matthew _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

Re: FreeRadius + AD + Realms
by Matthew P 03 Jul '10

03 Jul '10

>> realm mydomain.com { >> auth_pool = active_directory > > You'll need a line: > > nostrip > > To avoid EAP identity issues. This worked, thanks. Preprocess doesn't strip the username in the default server and EAP works. Although, now a new problem arrised - I can't seem to get the (stripped) username in the inner-tunnel with preprocess. So the username stays in the form - "user(a)mydomain.com", but that isn't usable for a LDAP search (on the AD). (btw. if I test without the realm portion of the scenario, like AD is the only source of authentication, it works) > i.e. it doesn't proxy it. > > This *does* work in 2.1.9. So which version are you running? I'm sorry, it was my mistake. I configured proxy_requests = no, because I thought it was ment for a server when it was only proxying requests from other sources (since this option opens a special proxy-ing listening port). Fixed now, proxying to virtual server works. > And why are you creating this complicated configuration? The > "inner-tunnel" virtual server is set up *precisely* for this kind of > authentication. You do EAP in the "default" server. Then, the > "inner-tunnel" server gets the PAP password, and you can configure it to > look the user up in AD there. Because there are realms involved in the scenario. If the realm is "mydomain.com" then radius needs to lookup a user in AD. If the realm is "mydomain2.com" then it needs to consult sql. Otherwise it should proxy the request to a home server. What would be a proper way to do this? I thought setting up a virtual server for every scenario is the way to go? TIA! _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

2 1

FW: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi Alan, I tried using the default users file and the other one that works on the other server but I could not make it. BTW, the working users file is the same, but include DEFAULT Auth-Type := ntlm_auth at the beginning. However, the Freeradius log said: /etc/freeradius/users[3]: Parse error (check) for entry DEFAULT: Unknown value ntlm_auth for attribute Auth-Type Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/innet-tunnel-default[111]: Failed to find module "files". /etc/freeradius/sites-enabled/innet-tunnel-default[34]: Errors parsing authorize section. Cesar > Message: 5 > Date: Fri, 02 Jul 2010 17:20:28 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C2E03BC.6050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Cesar Ortega wrote: > > I managed to install Freeradius with OpenSSL under Debian Lenny and it > > did work like a charm for a while. However, after I did the same process > > of installation in another virtualbox machine, it has not worked > > anymore. The console log report the following error: > > > > [pap] WARNING! No "known good" password found for the user. > > Authentication may fail because of this. > > You did not follow the same installation process. The *other* machine > looks up users in a database, or in the "users" file. This machine is > not configured to look in any database. > > Alan DeKok. Discover the new Windows Vista Learn more! _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 1

warnings under cygwin
by tangfu 02 Jul '10

02 Jul '10

Hi,guys.I try to complie freeradius 2.19 under cygwin this afternoon,but i get some warning when i execute "./configure ..." ./configure --without-snmp --disable-shared --with-system-libtool --without-rlm_krb5 --without-rlm_pam --without-rlm_sql_oracle --without-rlm_perl --with-mysql-lib-dir=/usr/lib/mysql --without-rlm_eap_ikev2 --without-rlm_eap_tnc --prefix=C:/123 2>C:/warning ################################################################ configure: WARNING: snmpget not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: ****** BSD-style gethostbyaddr might NOT be thread-safe! ****** configure: WARNING: ****** BSD-style gethostbyname might NOT be thread-safe! ****** configure: WARNING: Static linking with libldap will probably result in unresolved symbols. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. ################################################################ I don't have installed net-snmp,but i add "--without-snmp" to configure.I am confused why these warnings about snmp occur. Additionally,iodbc and unixodbc seem merely to support non-windows platform.I always don't get build succeeded. Much to my puzzlement,libmysqlclient_r.a and libmysqlclient_r.la exsit in /lib/mysql,as well as files related to mysql,but warnings don't be removed.Even if i use --with-mysql-lib-dir=<path>,it doesn't work all the same. Any proposal will be appreciated. _________________________________________________________________ 想知道明天天气如何？必应告诉你！ http://cn.bing.com/search?q=%E5%A4%A9%E6%B0%94%E9%A2%84%E6%8A%A5&form=MICHJ2

3 5

My question again (was: Netmask HOWTO)
by loki 02 Jul '10

02 Jul '10

Hello all. I need some kind of solution very urgent. My question was - is it possible to set Framed-IP-Netmask, together with IPs through sqlippool, somehow by default, via groupreply or something, or to change sqlippool somewhow to achive this. Or is this only possible through ippool (txt - version in /etc). I tried through groupreply but it didn't work. Regards.... __________ Information from ESET Mail Security, version of virus signature database 5245 (20100702) __________ The message was checked by ESET Mail Security. http://www.eset.com

3 4

Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi Alan, I try using the default user file and the other one that works on the other server but I could not make it. BTW, the working users file is the same, but include DEFAULT Auth-Type := ntlm_auth at the beginning. However, the Freeradius log said: > Message: 5 > Date: Fri, 02 Jul 2010 17:20:28 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C2E03BC.6050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Cesar Ortega wrote: > > I managed to install Freeradius with OpenSSL under Debian Lenny and it > > did work like a charm for a while. However, after I did the same process > > of installation in another virtualbox machine, it has not worked > > anymore. The console log report the following error: > > > > [pap] WARNING! No "known good" password found for the user. > > Authentication may fail because of this. > > You did not follow the same installation process. The *other* machine > looks up users in a database, or in the "users" file. This machine is > not configured to look in any database. > > Alan DeKok. _________________________________________________________________ Discover the new Windows Vista http://search.msn.com/results.aspx?q=windows+vista&mkt=en-US&form=QBRE

1 0

Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this)
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi everyone, I managed to install Freeradius with OpenSSL under Debian Lenny and it did work like a charm for a while. However, after I did the same process of installation in another virtualbox machine, it has not worked anymore. The console log report the following error: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. The complete log is: xmobileb155ce:~# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Mar 18 2010 at 04:07:54 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/001mschap-default including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/001ntlm_auth-default including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/innet-tunnel-default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/default-default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client WiFi Network/24 { require_message_authenticator = no secret = "alejandro" shortname = "N1P2" } client AP's IP_ADD { require_message_authenticator = no secret = "alejandro" shortname = "mw-ltqFreeradius-N1-P2-01" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MI_DOMINIO} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/privkey.pem" certificate_file = "/etc/freeradius/certs/cert.pem" CA_file = "/etc/freeradius/certs/cacert.pem" private_key_password = "alejandro" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MI_DOMINIO} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" input_pairs = "request" shell_escape = yes } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=0, length=211 Message-Authenticator = 0x93930a64fe55679bbf166346dd01c8ee Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000017015044565341323030305c4f52544547414341 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 23 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to AP's IP_ADD port 1044 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03f0e72e0b3955098d1e297ca Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=1, length=286 Message-Authenticator = 0xe90497c13c690e16d5485c28de3e9496 Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 State = 0x3f0f6ba03f0e72e0b3955098d1e297ca Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014c2df82b1aaab762c4848152fd27fc2bf58bd616a171819685cdabc06742c01900001600040005000a000900640062000300060013001200630100 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 06da], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to AP's IP_ADD port 1044 EAP-Message = 0x0102040019c000000717160301002a0200002603014c2db8e16be0183427bbf13d7b13f051b0c5aa8b01478646849427c5da4b1bb80000040016030106da0b0006d60006d30003143082031030820279a003020102020101300d06092a864886f70d0101040500308199310b30090603550406130256453110300e060355040813074d6972616e6461311330110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f7274656761636140706476 EAP-Message = 0x73612e636f6d301e170d3130303632393135343231355a170d3131303632393135343231355a308184310b30090603550406130256453110300e060355040813074d6972616e64613110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f727465676163614070647673612e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d961f1c2b91f0d141af24b8159c77c896af5826680a71f1958da4fee26ae2daf2b6873b24b4f5f62983a394e00a12f34c1782b EAP-Message = 0xe32a821e8de6d8d6b93c4a2f56ebdb794505c286e8cf90afd49fa4ed7f2884c71c05fa433c8bc1eeb82047282ee632a335704d981f9abbd72db1e9c2651a41f7bb617b431b96e625160d5a7b250203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414f5e48dd3f3f7c9d2f8d1d238d806dc2d373b3f75301f0603551d230418301680148f5fef5cc045862dacaacab2743ac1b5e6004da4300d06092a864886f70d010104050003818100793f45a2857d4dd39a792ae4c3be4af073f884512cbc4df80e8ad6 EAP-Message = 0x9c1ab61196c6eb92f4ee31ddd0d2159085f44a602649ab1e8e99ada8964486e988554386b0a6447678b49ff53ddb06b964f737560fa2731cdb362a75d0894bd7c7f7d980b3100785eb9443172b2bb03fb26ca801099053e7c9e991a8de7447789db233077c0003b9308203b53082031ea003020102020900e41bd88320212e1b300d06092a864886f70d0101050500308199310b30090603550406130256453110300e060355040813074d6972616e6461311330110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434 EAP-Message = 0x312e70647673612e636f6d31 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03e0d72e0b3955098d1e297ca Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=2, length=212 Message-Authenticator = 0xf5bf8d910858176aa660a0b84bb59a47 Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 State = 0x3f0f6ba03e0d72e0b3955098d1e297ca Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to AP's IP_ADD port 1044 EAP-Message = 0x01030327190021301f06092a864886f70d01090116126f727465676163614070647673612e636f6d301e170d3130303632393135323433335a170d3135303632383135323433335a308199310b30090603550406130256453110300e060355040813074d6972616e6461311330110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f727465676163614070647673612e636f6d30819f300d06092a864886f70d010101050003818d00308189 EAP-Message = 0x02818100a1693e448c170a87ee7d3b25c570586058f1959e06ec4871faa592d4ba57f20402a53573d38770fcf4f78005e7655ad2569559de834ce0c5c7e12d9c764ac1ab9c39413656a0111bb850f70581faf2578ba579741b85eea4367879957da5a230d889c991ca32c2a1bc5cbe565119859281b2620074f3decd5ad97947ace7ebe30203010001a38201013081fe301d0603551d0e041604148f5fef5cc045862dacaacab2743ac1b5e6004da43081ce0603551d230481c63081c380148f5fef5cc045862dacaacab2743ac1b5e6004da4a1819fa4819c308199310b30090603550406130256453110300e060355040813074d6972616e64613113 EAP-Message = 0x30110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f727465676163614070647673612e636f6d820900e41bd88320212e1b300c0603551d13040530030101ff300d06092a864886f70d010105050003818100688cfdd5d90a010be714a0fe80a81214e8ec426cba6d9097c95b35bc8e170a3274db611b780393957b0a2fec6baaea321947061b5ab0b5935f980664bc8123826866430b3a66876e4b36d9f3029b5870baeb78a933fdbdb323 EAP-Message = 0xe0f8ab382e453520b31f1571471622b3b167ad75a49437a3155d091693e09f027deedc3d875a9d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03d0c72e0b3955098d1e297ca Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=3, length=212 Message-Authenticator = 0x816e317a044a6cc3f91a7f579f6126d5 Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 State = 0x3f0f6ba03d0c72e0b3955098d1e297ca Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to AP's IP_ADD port 1044 EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03c0b72e0b3955098d1e297ca Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +0 Cleaning up request 1 ID 1 with timestamp +0 Cleaning up request 2 ID 2 with timestamp +0 Cleaning up request 3 ID 3 with timestamp +0 Ready to process requests. ^C xmobileb155ce:~# Some help is appreciate. Regards, Cesar Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! Try it! _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 1