September 2010 - Freeradius-Users - lists.freeradius.org

ippool and cache-size
by Konstantin Chekushin 13 Sep '10

13 Sep '10

Hi all. I have a question about rlm_ippool and cache-size option. Info from description: cache-size: The gdbm cache size for the db files. Should be equal to the number of ip's available in the ip pool. Also, note the cache size matches the number of IP's in your pool. More is OK but wasteful, less is very bad. My pool size is 32k. And I'm using this pool only for fallback issue. So, I'll need it rarely in the future. If cache-size = 32768, then radiusd process takes all memory. "Mon Sep 13 12:33:46 2010 : Error: Couldn't fork: Cannot allocate memory" If cache-size = 16384 : top: PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                 3061 freerad   20   0  304m 261m 1080 S    0 52.1   0:00.00 radiusd radiusd takes 261m! :-[ ] So, here is my question. If I'll use default cache-size =800, and at some point radius will start using this pool, what will happen if all 800 ip-addresses will be taken? Will the system slowdown, or if there will be a segmentation fault or something else? Why is "less is very bad"?

2 3

Cisco AP + MySql + EAPTLS
by Esteban TALAVERA 13 Sep '10

13 Sep '10

Hi I have installed freeradius recently with MySQL and tested with success to authenticate VTY session en cisco routers and switches. However, my configuration with EAP_TLS is not working properly. I use a Cisco AP I create and copy the certificates to a Windows XP SP3 laptop to test if everything is OK, but in "freeradius -X" mode I got a lot of message and none give me the reason of the problem. The AP says authentication failed and the Radius server sends the challenge an wait, and later clean all request an "becomes" ready to process requests. here is a portion of the output of the radius activity Its appears that certificates are accepted, but XP stations continue trying to authenticated THANKS ===================================== rad_recv: Access-Request packet from host 10.10.10.5 port 1645, id=16, length=176 User-Name = "prueba1@mydomain" Framed-MTU = 1400 Called-Station-Id = "a8b1.d422.d432" Calling-Station-Id = "0019.d20c.4ed4" Service-Type = Login-User Message-Authenticator = 0x7c4ac4a412db3b9cfba443de50792eed EAP-Message = 0x0202001b01707275656261314062616e636f706c617a612e636f6d NAS-Port-Type = Wireless-802.11 NAS-Port = 19153 NAS-Port-Id = "19153" NAS-IP-Address = 10.10.10.5 NAS-Identifier = "AP_CISCO" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "mydomain.com" for User-Name = "prueba1@mydomain" [suffix] No such realm "mydomain" ++[suffix] returns noop [eap] EAP packet type response id 2 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> prueba1@mydomain [sql] sql_set_user escaped user --> 'prueba1@mydomain' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'prueba1@mydomain' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'prueba1@mydomain' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'TI' ORDER BY id [sql] User found in group TI [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'TI' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 16 to 10.10.10.5 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x765770697654693c62d8b4b34c9394a6 Finished request 0. Going to the next request . . ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 05c7], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0082], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 18 to 10.10.10.5 port 1645 . . . [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0086], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 20 to 10.10.10.5 port 1645 EAP-Message = 0x010700900099090099099999010001011603010020164176d954d98c1d1daf5753815c720f6ef0f6e55dc05b2d682f44342e259e66 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7657706972507d3c62d8b4b34c9394a6 Finished request 4. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 16 with timestamp +7 Cleaning up request 1 ID 17 with timestamp +7 Cleaning up request 2 ID 18 with timestamp +7 Cleaning up request 3 ID 19 with timestamp +7 Cleaning up request 4 ID 20 with timestamp +7 Ready to process requests. ===================================== -- *Esteban Talavera* * *

2 1

None
by workoutexcite＠yahoo.com 13 Sep '10

13 Sep '10

http://de3wpk.2010healthworld2.com/cap

1 0

help in troubleshooting PEAP authenticathion with XP client
by Stephane Brodeur 13 Sep '10

13 Sep '10

Hi, Can somebody indicates me if there is any log that can help me identifying the problem with my Windows XP client trying to authenticate to the radius server. I do not know how to interpret the RADIUS/DECODE: parse response no app start; FAIL since no communication was establish between the AP and the radius server. Thanks for your help Stephane The following is the debug output from the Ciso AP dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx *dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds * dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,TIMEOUT) for 0012.f078.xxxx *dot11_auth_dot1x_send_client_fail: Authentication failed for 0012.f078.xxxx *%DOT11-7-AUTH_FAILED: Station 0012.f078.xxxx Authentication failed *dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx *dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds * dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,EAP_START) for 0012.f078.xxxx * dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx * dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds * dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,CLIENT_REPLY) for 0012.f078.xxxx *dot11_auth_dot1x_send_response_to_server: Sending client 0012.f078.xxxx data to server * dot11_auth_dot1x_send_response_to_server: Started timer server_timeout 60 seconds RADIUS/ENCODE(0000001A):Orig. component type = DOT11 *RADIUS: AAA Unsupported Attr: ssid [263] 14 *RADIUS: 4D 6F 6E 6F 6E 63 6C 65 5F 53 74 65 [test] *RADIUS: AAA Unsupported Attr: interface [156] 3 RADIUS: 32 [2] RADIUS(0000001A): Storing nasport 281 in rad_db RADIUS(0000001A): Config NAS IP: 10.5.104.22 RADIUS/ENCODE(0000001A): acct_session_id: 26 RADIUS(0000001A): sending RADIUS/DECODE: parse response no app start; FAIL RADIUS/DECODE: parse response; FAIL dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,SERVER_FAIL) for 0012.f078.xxxx dot11_auth_dot1x_send_response_to_client: Forwarding serve r message to client 0012.f078.xxxx dot11_auth_dot1x_send_response_to_client: Started timer client_timeout 30 seconds *dot11_auth_dot1x_send_client_fail: Authentication failed for 0012.f078.xxxx *dot11_auth_dot1x_send_id_req_to_client: Sending identity request to 0012.f078.xxxx dot11_auth_dot1x_send_id_req_to_client: Client 0012.f078.xxxx timer started for 30 seconds

2 1

Re: Ignoring EAP-Type/tls because we do not have OpenSSL,> support.
by Douglas Caro 13 Sep '10

13 Sep '10

Hi David and Alexander... thank you, so much... I've tried your tips, but it didn't work... # dpkg -l |grep freeradius ii freeradius 2.1.9+git a high-performance and highly configurable R ii freeradius-common 2.1.9+git FreeRADIUS common files ii freeradius-dialupadmin 2.1.9+git set of PHP scripts for administering a FreeR ii freeradius-ldap 2.1.9+git LDAP module for FreeRADIUS server ii freeradius-utils 2.1.9+git FreeRADIUS client utilities ii libfreeradius-dev 2.1.9+git FreeRADIUS shared library development files ii libfreeradius2 2.1.9+git FreeRADIUS shared library # dpkg -l |grep libssl ii libssl-dev 0.9.8g-15+lenny8 SSL development libraries, header files and ii libssl0.9.8 0.9.8g-15+lenny8 SSL shared libraries # freeradius -v freeradius: FreeRADIUS Version 2.1.9, for host i486-pc-linux-gnu, built on Sep 13 2010 at 09:40:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. The messages keep appearing Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Thanks Douglas

4 4

Freeradius + AD + WiFi + EAP
by Kleber Larroyd 13 Sep '10

13 Sep '10

FreeRADIUS Version 2.1.9, for host x86_64-redhat-linux-gnu Active Directory - Windows Server 2008 Windows Vista (WPA-TKIP / Protected EAP (PEAP)) Wireless Access Point - CISCO WAP4410N File /etc/raddb/eap.conf eap { .... default_eap_type = peap ... peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } } File /etc/raddb/users DEFAULT Auth-Type = ntlm_auth .... File /etc/raddb/modules/mschap mschap { ... with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ... } File /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=%{mschap:User-Name} --password=%{User-Password}" } Files /etc/raddb/sites-enable/inner-tunnel and /etc/raddb/sites-enable/default authenticate { .... ntlm_auth ... } [root@radiusserver etc]# ntlm_auth --request-nt-key --domain=MYDOMAINTEST --username=testuser01 --password=test NT_STATUS_OK: Success (0x0) [root@radiusserver etc]# net join -U Administrator Enter Administrator's password: Using short domain name -- MYDOMAINTEST Joined 'RADIUSSERVER' to realm 'mydomaintest.com' [root@radiusserver /]# radtest testuser01 test localhost 0 teste123 Sending Access-Request of id 51 to 127.0.0.1 port 1812 User-Name = "testuser01" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=51, length=20 Have any idea ? Where can i find the solution ? When i trying connect (windows vista) freeradius server with wireless over access point i get this error: rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=189, length=189 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001401414e47454c4f4e495c63626f6c616e State = 0x6506f8af6507e17f97933c212e541ba3 Message-Authenticator = 0xbd99142be48ec558c3cbe5102cebc556 Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 1 length 20 Mon Sep 13 10:34:21 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:21 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:21 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:21 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:21 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:21 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:21 2010 : Info: [tls] Initiate Mon Sep 13 10:34:21 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.155.194 port 2050 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed76fc17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 1. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=190, length=300 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202008319800000007916030100740100007003014c8e2884af2dbe79e59a780b7c801b6a6f024ab05ed1164311f8e2c438576298000018002f00350005000ac009c00ac013c01400320038001300040100002f00000014001200000f616e67656c6f6e695c63626f6c616e000a00080006001700180019000b00020100ff01000100 State = 0xd76dd84ed76fc17a0790fefec05add19 Message-Authenticator = 0x93bc32a345dce54fc50f7bbb50ca7e3f Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 2 length 131 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Debug: TLS Length 121 Mon Sep 13 10:34:21 2010 : Info: [peap] Length Included Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 11 Mon Sep 13 10:34:21 2010 : Info: [peap] (other): before/accept initialization Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: before/accept initialization Mon Sep 13 10:34:21 2010 : Info: [peap] <<< TLS 1.0 Handshake [length 0074], ClientHello Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 read client hello A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write server hello A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 085e], Certificate Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write certificate A Mon Sep 13 10:34:21 2010 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 write server done A Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: SSLv3 flush data Mon Sep 13 10:34:21 2010 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Mon Sep 13 10:34:21 2010 : Debug: In SSL Handshake Phase Mon Sep 13 10:34:21 2010 : Debug: In SSL Accept mode Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.155.194 port 2050 EAP-Message = 0x0103040019c0000008a216030100310200002d03014c8e285d2beeb4138d9eee394a996f4f9eca58f023b887efdda363a09db4bff300002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3130303931333132343233355a170d3130313131323132343233355a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ee3a32108e4f3cbfaa7a92d4bd978ca40fc64b2a47661645c8b68d65044435a66076682fd05fa16778a5af94206ffc638de3ca5a2a99a7 EAP-Message = 0xc92a2cf32a0ee4b8318b2f6b48eed7145b30afb76af66a5ceb89811ae04a70d71efd284ddfacd426825d71a59a319b37da2bba0e088bb66183f25f6522af18a4fbd7104c308440dfd10444b93c8548363aa973a8a926a5dd2cdee98ab4334e76941732723504db3bc0d7f7ecbac57fe09389ef3472ad7b952baf531120d84c6e661360774007a6661c46e00344cec67a5626e1cb85d0a20d037aabb885560b01e2fbef6447971424dafda7b2b47a19a8ea30fa59cb5dfce23c3f2a52f1060bcb84f596fc54f37d8f970203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010011f6 EAP-Message = 0x5fe6dfff7362f46ed7015696230b784919f57eb0598b8cc5bc5aaafc91fb345324f2d8c409d3f4e89d7e16da467c611f98599c7e33ac6e6bea988f9dc1daad9102b4a4054f0cc9c6b1621088b3e2cc9d31f14adaea05d494919259f69778be393aab6efb9ddbb8d6a5949ae4c0231ff28820d4984cf5b319c9262a1fffc897ed56371008a993b0353d108a68b022384eb79b6b594d27f55fabc4215d96dde86b0e609bef9c04a2306c7c6b396ae07e9039815f0caec47148b6c5a8d5a353449e9d2b61a7f9c88dc86b90b94cfb3e98b1634da1923ba30d55e652d40c11c93eb5f6f1ee7827e134acbd4cc0f07d0b4d206e8df2fa9ecd78881348c1b157 EAP-Message = 0x2b0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed66ec17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 2. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=191, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xd76dd84ed66ec17a0790fefec05add19 Message-Authenticator = 0x149802ee2e900a377b4953192fd43319 Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 3 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.155.194 port 2050 EAP-Message = 0x010403fc1940a003020102020900fd77376b6dad365e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3130303931333132343233355a170d3130313131323132343233355a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d154c97876aafffd6e2c38d8d030b168f8dce7c480ee5e1f2e70f69b644f539598e82c35141f1fc6df2202d717a8d212224f57bd0a0e5e4f6ad9f86ba16f00651842cbf6a8ab15fd2e788309304f5dc5abd95811697d400a611cb69d60e8957024bd0a4fc7ff1267 EAP-Message = 0xb00fc2f26e74c5858497e66019676175f2cf11049781681ba950f2f9e0fc51045f12655aab1cfc4001e7de1bf7ad11cd4ce5a56cfc64f479d1c3fa84ef41275203b542cf17a0c7ea5d00ebdee20c53a432e0568669d036073870a155f3fac928212cdd0e071c5ae65784c83b6ac840dc198d51c6a59c6b1f6273a8c6c8906e0011842b96391df406225ca95c01649e518e235865d44d4d4d0203010001a381fb3081f8301d0603551d0e04160414e3bc4886052780b7f5e868e9f8c2e8188ee3f8b23081c80603551d230481c03081bd8014e3bc4886052780b7f5e868e9f8c2e8188ee3f8b2a18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900fd77376b6dad365e300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100886a41b64009cfdda5cbf1a1acc3b762ae831896a64568f23615de741e3911de3e1539a9cb018be1f0907182306a6296b2ab29391b905e3376391ab24c830be031aefa5e3ebf9f2bbc4862 EAP-Message = 0xec4672b63eb34dbe Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed569c17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 3. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=192, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0xd76dd84ed569c17a0790fefec05add19 Message-Authenticator = 0xd66c19cfcb0a9d15888c2f80c474a5de Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 4 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.155.194 port 2050 EAP-Message = 0x010500bc1900a8c1e930adad128d2a178d8d7a4c345b4f7ddd981d87e3a364ef65216c0e6485d99f22a335b4c31daf8ff28bac0d0375c0c0d6695cbda1d70898a7e2dfb8ddb5a9df14270422a6820bf42284b766a88d819b3a1f33f4962446a852c8a88469e39707436d52148d4c1277c1dbc2c97b1377dc77dca0cfc3374eb968b54acd07df27089f3c611bfddb24c32dd17da21321da1ff5856723398f2d948e896a051e1cf7ebfd5f5989198f265898af4e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed468c17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 4. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=193, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0xd76dd84ed468c17a0790fefec05add19 Message-Authenticator = 0x25610017540304c1a783aa7777ba392b Mon Sep 13 10:34:21 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:21 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:21 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:21 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:21 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:21 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:21 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:21 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:21 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:21 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:21 2010 : Info: [eap] EAP packet type response id 5 length 6 Mon Sep 13 10:34:21 2010 : Info: [eap] Continuing tunnel setup. Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns ok Mon Sep 13 10:34:21 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:21 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:21 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:21 2010 : Info: [eap] EAP/peap Mon Sep 13 10:34:21 2010 : Info: [eap] processing type peap Mon Sep 13 10:34:21 2010 : Info: [peap] processing EAP-TLS Mon Sep 13 10:34:21 2010 : Info: [peap] Received TLS ACK Mon Sep 13 10:34:21 2010 : Info: [peap] ACK handshake fragment handler Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_verify returned 1 Mon Sep 13 10:34:21 2010 : Info: [peap] eaptls_process returned 13 Mon Sep 13 10:34:21 2010 : Info: [peap] EAPTLS_HANDLED Mon Sep 13 10:34:21 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.155.194 port 2050 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd76dd84ed36bc17a0790fefec05add19 Mon Sep 13 10:34:21 2010 : Info: Finished request 5. Mon Sep 13 10:34:21 2010 : Debug: Going to the next request Mon Sep 13 10:34:21 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=194, length=171 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001401414e47454c4f4e495c63626f6c616e Message-Authenticator = 0x7fb8c0c166efca06b16e7f0b2c11acc4 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 0 length 20 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:23 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:23 2010 : Info: [tls] Initiate Mon Sep 13 10:34:23 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.155.194 port 2050 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x08a4aa3d08a5b341b6a6388fbdc863a8 Mon Sep 13 10:34:23 2010 : Info: Finished request 6. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=195, length=189 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001401414e47454c4f4e495c63626f6c616e State = 0x08a4aa3d08a5b341b6a6388fbdc863a8 Message-Authenticator = 0xdf84203e0b11202af2cae40b8121d33f Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 1 length 20 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] EAP Identity Mon Sep 13 10:34:23 2010 : Info: [eap] processing type tls Mon Sep 13 10:34:23 2010 : Info: [tls] Initiate Mon Sep 13 10:34:23 2010 : Info: [tls] Start returned 1 Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 195 to 192.168.155.194 port 2050 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa14ba8cfa149b12d443c6d1514b556f1 Mon Sep 13 10:34:23 2010 : Info: Finished request 7. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=196, length=175 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060311 State = 0xa14ba8cfa149b12d443c6d1514b556f1 Message-Authenticator = 0x59b31ae92c6fc003dd396d83f1ae2595 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 2 length 6 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:23 2010 : Info: [eap] EAP NAK Mon Sep 13 10:34:23 2010 : Info: [eap] EAP-NAK asked for EAP-Type/leap Mon Sep 13 10:34:23 2010 : Info: [eap] processing type leap Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Stage 2 Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Issuing AP Challenge Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: Successfully initiated Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns handled Sending Access-Challenge of id 196 to 192.168.155.194 port 2050 EAP-Message = 0x0103001f11010008ee1c3a6722d72f04414e47454c4f4e495c63626f6c616e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa14ba8cfa048b92d443c6d1514b556f1 Mon Sep 13 10:34:23 2010 : Info: Finished request 8. Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 192.168.155.194 port 2050, id=197, length=216 User-Name = "MYDOMAINTEST\\testuser01" NAS-IP-Address = 192.168.155.194 NAS-Port = 0 Called-Station-Id = "00-15-62-FF-AD-2D:ciscosb" Calling-Station-Id = "00-1E-65-DB-9D-86" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203002f11010018e3ecbf5161bbb5bd4cac88fff440256581950b19d079df4c414e47454c4f4e495c63626f6c616e State = 0xa14ba8cfa048b92d443c6d1514b556f1 Message-Authenticator = 0xdff169f98e2fa8a9a0b0b17b022b9733 Mon Sep 13 10:34:23 2010 : Info: +- entering group authorize {...} Mon Sep 13 10:34:23 2010 : Info: ++[preprocess] returns ok Mon Sep 13 10:34:23 2010 : Info: ++[chap] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[mschap] returns noop Mon Sep 13 10:34:23 2010 : Info: [suffix] No '@' in User-Name = "MYDOMAINTEST\testuser01", looking up realm NULL Mon Sep 13 10:34:23 2010 : Info: [suffix] No such realm "NULL" Mon Sep 13 10:34:23 2010 : Info: ++[suffix] returns noop Mon Sep 13 10:34:23 2010 : Info: [ntdomain] Looking up realm "MYDOMAINTEST" for User-Name = "MYDOMAINTEST\testuser01" Mon Sep 13 10:34:23 2010 : Info: [ntdomain] No such realm "MYDOMAINTEST" Mon Sep 13 10:34:23 2010 : Info: ++[ntdomain] returns noop Mon Sep 13 10:34:23 2010 : Info: [eap] EAP packet type response id 3 length 47 Mon Sep 13 10:34:23 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns updated Mon Sep 13 10:34:23 2010 : Info: ++[unix] returns notfound Mon Sep 13 10:34:23 2010 : Info: ++[files] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[expiration] returns noop Mon Sep 13 10:34:23 2010 : Info: ++[logintime] returns noop Mon Sep 13 10:34:23 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Sep 13 10:34:23 2010 : Info: ++[pap] returns noop Mon Sep 13 10:34:23 2010 : Info: Found Auth-Type = EAP Mon Sep 13 10:34:23 2010 : Info: +- entering group authenticate {...} Mon Sep 13 10:34:23 2010 : Info: [eap] Request found, released from the list Mon Sep 13 10:34:23 2010 : Info: [eap] EAP/leap Mon Sep 13 10:34:23 2010 : Info: [eap] processing type leap Mon Sep 13 10:34:23 2010 : Debug: rlm_eap_leap: No Cleartext-Password or NT-Password configured for this user Mon Sep 13 10:34:23 2010 : Info: [eap] Handler failed in EAP/leap Mon Sep 13 10:34:23 2010 : Info: [eap] Failed in EAP select Mon Sep 13 10:34:23 2010 : Info: ++[eap] returns invalid Mon Sep 13 10:34:23 2010 : Info: Failed to authenticate the user. Mon Sep 13 10:34:23 2010 : Info: Using Post-Auth-Type Reject Mon Sep 13 10:34:23 2010 : Info: +- entering group REJECT {...} Mon Sep 13 10:34:23 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> MYDOMAINTEST\testuser01 Mon Sep 13 10:34:23 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Sep 13 10:34:23 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Sep 13 10:34:23 2010 : Info: Delaying reject of request 9 for 1 seconds Mon Sep 13 10:34:23 2010 : Debug: Going to the next request Mon Sep 13 10:34:23 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 13 10:34:24 2010 : Info: Sending delayed reject for request 9 Sending Access-Reject of id 197 to 192.168.155.194 port 2050 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000

4 3

radacct: detect accounting service
by John 12 Sep '10

12 Sep '10

I want to use 'radacct' to detect whether the accoounting aervice is alive or not. What kind Acct-Status-Type should I include in accounting message? Accouting-On or Accouting-start or others? Can you give some advice? John

2 2

After server rebuild the PEAP against Windows AD is not working any more!
by Difan Zhao 12 Sep '10

12 Sep '10

Hi experts, I'm getting really frustrated on this... I had the server rebuilt with REHL 5 and FreeRadius2.1.7. It was running REHL 4 with FreeRadius2.1.6. It looks like the server will send the last "challenge" and the client won't reply anymore... The ntlm_auth part should be working right because when I do "radtest 'gtcorp\\dzhao' <password> localhost 0 test123" it works fine... Sending Access-Request of id 119 to 127.0.0.1 port 1812 User-Name = "gtcorp\\dzhao" User-Password = "<password>" NAS-IP-Address = 10.26.105.105 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=119, length=41 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3" Tunnel-Preference:0 = 0 However it's not working when I have a laptop plugged in doing PEAP/802.1x with the same user account... The debug output is attached. Please help!! Thanks!!! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com INTERNET | MEDIA | VOICE The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 2

Construction of Response-Authenticator
by Theresa Otte 12 Sep '10

12 Sep '10

Hello, I use FreeRADIUS 2.1.8 on Ubuntu 10.4. For my course at university I have to write a program in which I need to re-calculate the response-authenticator (MD5(Code+ID+Length+Request-Auth.+Attributes+Secret)). Does anybody know how FreeRADIUS calculates it? Does it take the binary code of the message fields or an other encoding? When I try to re-calculate it, I never get the same Response-Authenticator as in the Access-Accept-Message. I'm programming with Python and using the libraries of scapy and hashlib. Perhaps anyone of you can help me. Thank you very much!

2 1

Disconnect idle user
by Yevgeny Kosarzhevsky 12 Sep '10

12 Sep '10

Hi, I am using pppd on linux nas. The client has connected, then after some time freeradius server has disappered on the network because of connection issue. The user disconnected when it was still down. Then, after freeradius came up the user wasn't able to login anymore because of simultaneous login check with error 691 on windows. Radius was reporting Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" How to make radius stop thinking the user is connected (like if no Acct-Interim-Update messages received in specified time).

2 5