January 2011 - Freeradius-Users - lists.freeradius.org

problem installing freeRadius Server
by vijay s sheelavantar 24 Jan '11

24 Jan '11

Hello Friends,I am trying to install free radius on a old linux machine. the configuration is as fillows [root@localhost freeradius-server-2.1.10]# uname -aLinux localhost.localdomain 2.4.20-8 #1 Thu Mar 13 17:54:28 EST 2003 i686 i686 i386 GNU/Linux[root@localhost freeradius-server-2.1.10]# whereis pythonpython: /usr/bin/python2.2 /usr/bin/python /usr/lib/python2.2 /usr/local/bin/python2.7 /usr/local/bin/python2.7-config /usr/local/bin/python /usr/local/lib/python2.7 /usr/include/python2.2 /usr/share/man/man1/python.1.gz[root@localhost freeradius-server-2.1.10]# While compiling the server i get following errorsroot/vijay/freeradius-server-2.1.10/src/freeradius-devel/modules.h:12: warning: `used' attribute ignoredrlm_python.c: In function `python_error':rlm_python.c:177: `PyGILState_STATE' undeclared (first use in this function)rlm_python.c:177: (Each undeclared identifier is reported only oncerlm_python.c:177: for each function it appears in.)rlm_python.c:177: parse error before "__gstate"rlm_python.c:195: warning: implicit declaration of function `PyGILState_Release'rlm_python.c:195: `__gstate' undeclared (first use in this function)rlm_python.c: In function `python_init':rlm_python.c:215: warning: passing arg 2 of `PyModule_AddIntConstant' discards qualifiers from pointer target typerlm_python.c: In function `python_function':rlm_python.c:352: `PyGILState_STATE' undeclared (first use in this function)rlm_python.c:352: parse error before "gstate" By default i had python2.2 installed in my linux PC under the path "/usr/bin/python2.2", in the mailing list somebody replied that new version of python is required, so I installed Python2.7.1. but in "/usr/bin" i can't see python2.7.1  Please let me know how can i fix this error and install the Radius server successfully. Thank you in advance. Thanks and Regards,VIJAY S.

1 0

Help - SSH with Radius on one Server: no password match by authentication over sshd --- password match over NTRadPING
by Marius.Meisner 23 Jan '11

23 Jan '11

Hello, I'm a freeradius beginner and can't get further by my problem for days - reading a lot of stuff in dokumentation, books and forums on the net. Using a debian system with freeradius 2.04 and OpenSSH_5.1p1 Debian-5, OpenSSL 0.9.8g 19 on it - no NAS or other authenticator is used. Installed freeradius - everything works fine. On my XP client I run NTRadPING with radius secret key, user-name and passwort and get Access-accept response (by chap, by pap - Auth-Type = System; Cleartext-Password, Auth-Type := Local ...) Now I installed pam package: apt-get install -y libpam-radius-auth. make configs /etc/pam_radius_auth.conf: # server[:port] shared_secret timeout (s) 127.0.0.1 secret 2 /etc/freeradius/clients.conf: ... client 110.110.110.0/24 { secret = secret shortname = private-net } ... /etc/pam.d/sshd # PAM configuration for the Secure Shell service # Read environment variables from /etc/environment and # /etc/security/pam_env.conf. auth required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. auth required pam_env.so envfile=/etc/default/locale # Standard Un*x authentication. auth sufficient pam_radius_auth.so @include common-auth # Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so # Uncomment and edit /etc/security/access.conf if you need to set complex # access limits that are hard to express in sshd_config. # account required pam_access.so # Standard Un*x authorization. @include common-account # Standard Un*x session setup and teardown. @include common-session # Print the message of the day upon successful login. session optional pam_motd.so # [1] # Print the status of the user's mailbox upon successful login. session optional pam_mail.so standard noenv # [1] # Set up user limits from /etc/security/limits.conf. session required pam_limits.so # Set up SELinux capabilities (need modified pam) # session required pam_selinux.so multiple # Standard Un*x password updating. @include common-password /etc/freeradius/users # # # DEFAULT # Service-Type = Administrative-User # On no match, the user is denied access. "test" Cleartext-Password := "123" "1user" Cleartext-Password := "1user" Fall-Through = No "John" Cleartext-Password := "123" Reply-Message = "Hello, %{User-Name}" "will" Auth-Type = Accept "lameuser" Auth-Type := Reject Reply-Message = "Your account has been disabled." "mike" Auth-Type := Local, User-Password := "mike" "33user" Auth-Type = System Reply-Message = "Hello, %{User-Name}! Dein Passwort kommt aus shadow", Fall-Through = Yes To test secure shell session I took a system account with has no entries in the freeradius users-file. The user can log in, but radius-authentication failed. rad_recv: Access-Request packet from host 127.0.0.1 port 5572, id=176, length=89 User-Name = "user" User-Password = "j\205[\022\245\343/X\231\330R@\342\324\023=" NAS-IP-Address = 10.10.10.11 NAS-Identifier = "sshd" NAS-Port = 4547 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.10.10.200" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "j?[?¥ã/X?ØR@âÔ?=" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [user/j\205[\022\245\343/X\231\330R@\342\324\023=] (from client localhost port 4547 cli 10.10.10.200) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 176 to 127.0.0.1 port 5572 Waking up in 4.9 seconds. An other example with a non system-account "will" and Auth-Type = Accept passes radius authentication, but this is not what I want to have. rad_recv: Access-Request packet from host 127.0.0.1 port 5564, id=142, length=89 User-Name = "will" User-Password = "\354-YbQ\367\036\033\034\232\262I\260\327\322\013" NAS-IP-Address = 10.10.10.11 NAS-Identifier = "sshd" NAS-Port = 4539 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.10.10.200" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "will", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry will at line 212 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [will/\354-YbQ\367\036\033\034\232\262I\260\327\322\013] (from client localhost port 4539 cli 10.10.10.200) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 142 to 127.0.0.1 port 5564 Finished request 2. Going to the next request Waking up in 5.0 seconds. Cleaning up request 2 ID 142 with timestamp +118 Ready to process requests. The shared_secret in clients.conf and pam_radius_auth.conf are the same, and there are no spaces. perhaps it may be a problem with the tool puTTy (for manageing ssh-sessions) - here I can't find any location to place the shared_secret from the two files. But if I had changed system-authentication instead of sshd, there is the same problem with the diffrent passwords - and I'm sure they are written right. Any suggestions? Any hinds are welcome. Greets MM

1 0

EAP-TTLS client ignoring user attributes when moving from 1.0 to 2.1
by David Coulson 22 Jan '11

22 Jan '11

I am trying to move my RADIUS environment from RHEL4 to RHEL6. All it does is support WPA2-Enterprise authentication with access points. RHEL4: freeradius-1.0.1-3.RHEL4.5 RHEL6: freeradius-2.1.9-3.el6.x86_64 My Netgear APs are setup pointing to my RHEL4 systems right now and it works fine with this user config: testuser User-Password := "temp1234" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 100 When I duplicate this user config on RHEL6 the AP behaves like it does not receive any attributes and the user is dropped on the default VLAN. Is there a specific process for migrating from 1.x to 2.x? I really did not have a very elaborate configuration, so I was trying to just rebuild it from scratch. Thanks- David

2 2

Re: New to the lists
by Gary Gatten 22 Jan '11

22 Jan '11

I can't speak for the sql, but probably be ok there. I will warn you against simply copying the FR config files from something that old. I've seen several problems on here over the last few years relating to simply copying config files from old versions to new. The general impression I get is to not mess with the default confs unless you have to, and then make small changes at a time and test between each. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Fri Jan 21 19:33:41 2011 Subject: New to the lists Hi all. Looking forward to picking your brains regarding FreeRADIUS as I’m kinda new to it. I took over administrative duties for the person who previously took care of our network and I’m trying to work with some of the FreeRADIUS settings and update to a newer version in the process. Current version is 1.0.4 (I know, it ancient), however also in the middle of a CentOS build while hoping to deploy that latest version of FreeRADIUS. I have a curious question though. Since the current version is substantially older than what we’re moving to, how will this affect the sql database? Will I be able to install the newest version of FreeRADIUS and just perform a mysql dump from the old server to the new one? Thanks in advance, -Tim <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

RE: Generating a Microsoft compatible CSR for FreeRADIUS
by Brett Littrell 21 Jan '11

21 Jan '11

Hi Jake, Have you tried enabling Tunnelled reply's on the freeradius server, believe it is in the eap.conf file? Not exactly sure of your config or what you are doing but some of the data in the debug looks like ciphertext, which indicates to me that something is not decrypting the packets or does not know that the information it is getting is encrypted. I was seeing similar stuff on a debug on a Cisco switch I was configuring for dynamic vlan switching with Radius, turned out I had to enable tunneled replies for PEAP, eap worked just fine. Brett Littrell Network Manager Milpitas Unified School District blittrell(a)musd.org Ph# (408)635-2600 X6086 Fax# (408)635-2632 >>> On Friday, January 21, 2011 at 6:10 AM, in message <3A9815D880FBAF41A523B3A35AF3C3DF06B0D246(a)AVATAR.umhb.edu>, "Sallee, Stephen (Jake)" <Jake.Sallee(a)umhb.edu> wrote: Has anyone gotten windows clients to work WITHOUT having to do any manual config on the clients? Is it even possible? Also, I have my shiny new publicly signed cert from comodo but my clients are still rejecting the connection ... i think the error is here: [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied [peap] WARNING: No data inside of the tunnel. But I don't know why i would be getting a read error, the certs that i installed have the same permissions as the test certs... here is the full debug, any help is appreciated: FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Sep 28 2010 at 09:20:29 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/UMHB including configuration file /usr/local/etc/raddb/sites-available/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/Cru including configuration file /usr/local/etc/raddb/sites-available/default including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 25600 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover nostrip } realm LOCAL { } realm Cru { } realm Cru.umhb.edu { } realm umhb { } realm umhb.edu { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.2.1.75/32 { require_message_authenticator = no secret = "Burg3rk1ng!" shortname = "PacketFence" } client 10.11.30.0/24 { require_message_authenticator = no secret = "Burg3rk1ng!" shortname = "Sanderford" } client 10.11.60.0/24 { require_message_authenticator = no secret = "Burg3rk1ng!" shortname = "Sanderford" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{outer.request:Realm} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/Production/myserver.key" certificate_file = "/usr/local/etc/raddb/certs/Production/STAR_umhb_edu.crt" CA_file = "/usr/local/etc/raddb/certs/Production/STAR_umhb_edu.ca-bundle" private_key_password = "Burg3rk1ng!" dh_file = "/usr/local/etc/raddb/certs/Production/dh" random_file = "/usr/local/etc/raddb/certs/Production/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/Production/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /usr/local/etc/raddb/modules/perl perl { module = "/usr/local/etc/raddb/packetfence.pm" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server UMHB { # from file /usr/local/etc/raddb/sites-enabled/UMHB modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server Cru { # from file /usr/local/etc/raddb/sites-enabled/Cru modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. ====================================================== rad_recv: Access-Request packet from host 10.11.60.2 port 32777, id=226, length=193 User-Name = "host/Lappy.umhb.edu" NAS-IP-Address = 10.11.60.2 NAS-Port = 129 Called-Station-Id = "00-0F-7D-05-0E-81:UMHB Secure WiFi" Calling-Station-Id = "C4-17-FE-33-C6-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 1Mbps/1Mbps 802.11b" EAP-Message = 0x0201001801686f73742f4c617070792e756d68622e656475 Message-Authenticator = 0x1ad7a675b5cb39b96e23f60e5340e801 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/Lappy.umhb.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 24 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Calling-Station-Id = C4-17-FE-33-C6-A7 rlm_perl: Added pair Called-Station-Id = 00-0F-7D-05-0E-81:UMHB Secure WiFi rlm_perl: Added pair Message-Authenticator = 0x1ad7a675b5cb39b96e23f60e5340e801 rlm_perl: Added pair User-Name = host/Lappy.umhb.edu rlm_perl: Added pair EAP-Message = 0x0201001801686f73742f4c617070792e756d68622e656475 rlm_perl: Added pair Connect-Info = CONNECT 1Mbps/1Mbps 802.11b rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 10.11.60.2 rlm_perl: Added pair NAS-Port = 129 rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair Auth-Type = EAP ++[perl] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 226 to 10.11.60.2 port 32777 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x330f4dc9330d546872b9f993281128fc Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.60.2 port 32777, id=227, length=315 User-Name = "host/Lappy.umhb.edu" NAS-IP-Address = 10.11.60.2 NAS-Port = 129 Called-Station-Id = "00-0F-7D-05-0E-81:UMHB Secure WiFi" Calling-Station-Id = "C4-17-FE-33-C6-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 1Mbps/1Mbps 802.11b" EAP-Message = 0x0202008019800000007616030100710100006d03014d39919676cd85f8dcfe3f2afef335ec7a98b2eb9095d964891b3484c06fc78e000018002f00350005000ac013c014c009c00a00320038001300040100002cff0100010000000013001100000e6c617070792e756d68622e656475000a0006000400170018000b00020100 State = 0x330f4dc9330d546872b9f993281128fc Message-Authenticator = 0x9165fc9281fe451bdcf9db8487dd8e79 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/Lappy.umhb.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 118 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0071], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0ad8], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 227 to 10.11.60.2 port 32777 EAP-Message = 0x0103040019c000000b1c16030100310200002d03014d399195fd2d232a53dfee5dce680c057cfc54fe9686405232871c57112f6efa00002f000005ff010001001603010ad80b000ad4000ad10005cb308205c7308204afa003020102021012949e4e96f5c2b15c9a16c71c4cc811300d06092a864886f70d0101050500308189310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312f302d06035504031326434f4d4f444f20486967682d4173737572616e63652053656375 EAP-Message = 0x726520536572766572204341301e170d3130303831393030303030305a170d3135303831393233353935395a3081db310b3009060355040613025553310e300c060355041113053736353133310b3009060355040813025458310f300d0603550407130642656c746f6e311e301c06035504091315554d48422053746174696f6e20426f782038303035311b30190603550409131239303020436f6c6c6567652053747265657431293027060355040a1320556e6976657273697479206f66204d6172792048617264696e2d4261796c6f723121301f060355040b1318506c6174696e756d53534c205347432057696c64636172643113301106035504 EAP-Message = 0x03140a2a2e756d68622e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100dc8dbc42609826a3a26f48356951f40c4bf97815080528e6445fc6f8e9dfe2d260b1f3202c3e418654e8da0499ea4830c6ef7e1a5525575f1f70e0fe795af97b3774896016f3d275f8e27478e8b49ac8e03122822a72df6c6d4c988ffd456672849e9b62bd1e62f5bf1d24228190e3ca3153391cdd8797a685faaa35446f2dc33d64c4dbd310200ead4d58b2c3de92cf086b1de8a16a8f005feb688574c9cafe87bf878a9d2427ab8f273e533016a63ba4f8addfd6c9f2211052ee9e96e58e3b5e5d9c106e17c47d83a8e0216bf7dc EAP-Message = 0xd1174db8f8a566c3448912b2dd88413518c160c52b92ee57d46bff425ddd7ae381ad9b66e9448c485322fcff4d13c25e7b0203010001a38201d5308201d1301f0603551d230418301680143fd5b5d0d64479504a17a39b8c4adcb8b022646b301d0603551d0e0416041414a0d258941febc0b7d8a8b40c94615afa260bd4300e0603551d0f0101ff0404030205a0300c0603551d130101ff0402300030340603551d25042d302b06082b0601050507030106082b06010505070302060a2b0601040182370a030306096086480186f842040130460603551d20043f303d303b060c2b06010401b2310102010304302b302906082b06010505070201161d EAP-Message = 0x68747470733a2f2f73656375 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x330f4dc9320c546872b9f993281128fc Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.60.2 port 32777, id=228, length=193 User-Name = "host/Lappy.umhb.edu" NAS-IP-Address = 10.11.60.2 NAS-Port = 129 Called-Station-Id = "00-0F-7D-05-0E-81:UMHB Secure WiFi" Calling-Station-Id = "C4-17-FE-33-C6-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 1Mbps/1Mbps 802.11b" EAP-Message = 0x020300061900 State = 0x330f4dc9320c546872b9f993281128fc Message-Authenticator = 0x735474693c2ad02c4b885b94ea32aad5 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/Lappy.umhb.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 228 to 10.11.60.2 port 32777 EAP-Message = 0x010403fc194072652e636f6d6f646f2e636f6d2f435053304f0603551d1f044830463044a042a040863e687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f486967682d4173737572616e636553656375726553657276657243412e63726c30818006082b0601050507010104743072304a06082b06010505073002863e687474703a2f2f6372742e636f6d6f646f63612e636f6d2f434f4d4f444f486967682d4173737572616e636553656375726553657276657243412e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d301f0603551d1104183016820a2a2e756d68 EAP-Message = 0x622e6564758208756d68622e656475300d06092a864886f70d010105050003820101003fc66065745e65bd58ad5b11aff73555ce334a1fa9b4329d126e4cf335956d58485ed85ec47fff9d8abb5e903319ec7a53384059f3b7c7a23638a843d56e38bf98d0a2cb1c21fc9de26e2cbeb25c855dd196304b6772c3d80da0cce7c8f14f969c375b4f72e729d1422f86114ae73824a06269fb092c6644d0a12997f72071c234a6354b7cbccf4c4887eee1a79dc8f4ee70e32f2aa1a97e0b1c1e8f9d016bffd1f4f6e90a478a89224190d6626787c20285398e54a521ad2faa65b0cf6813b1aa8cfba7ab8c997f9139e01040dd4af899604318f5a2167ce53c EAP-Message = 0x937c7e72ae0becce9621763408bc6467b4bf05f59a3fd5752c181d52aff7d71026296804930b000500308204fc308203e4a00302010202101690c329b6780607511f05b0344846cb300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3130303431363030303030305a170d3230303533303130343833385a308189310b3009060355040613024742311b301906 EAP-Message = 0x03550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312f302d06035504031326434f4d4f444f20486967682d4173737572616e6365205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e787dac077e4bb3afa6a24c88041acd21613153dfaf7f82a76dca82d3908ce484abe0f7df0debabb47d5bd2dd71bab0f2081230872b1c011950de6eaa987ffc76e1e4f6632ba53bc05aa1c2c0cef4d37476b100cdbc5a0987e58db37d6aee906bdd7a865f3 EAP-Message = 0x37b9c76dce77c726 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x330f4dc9310b546872b9f993281128fc Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.60.2 port 32777, id=229, length=193 User-Name = "host/Lappy.umhb.edu" NAS-IP-Address = 10.11.60.2 NAS-Port = 129 Called-Station-Id = "00-0F-7D-05-0E-81:UMHB Secure WiFi" Calling-Station-Id = "C4-17-FE-33-C6-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 1Mbps/1Mbps 802.11b" EAP-Message = 0x020400061900 State = 0x330f4dc9310b546872b9f993281128fc Message-Authenticator = 0x61212145984f95fcd4339ef828985296 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/Lappy.umhb.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 229 to 10.11.60.2 port 32777 EAP-Message = 0x010503361900e0d7741fa69816bb0c6bc8be77d0ef58a729a0b9b8690536cbb2da58a30b75ad3d8b2282203e7086991cb94fcf77a4071a2363d1385684ecbf8fc54ef418969b1ae893ec8daf159c24f05a3be80fb9a85a01d3b21c60c99c5204dd92a7fe0cace2458d0361bc79e0772e87413c585fcbf5c577f258c84d28d09afaf37309246874bc204cd82cb0aae8d94e6df28c24d3935d910203010001a382017730820173301f0603551d23041830168014adbd987a34b426f7fac42654ef03bde024cb541a301d0603551d0e041604143fd5b5d0d64479504a17a39b8c4adcb8b022646b300e0603551d0f0101ff04040302010630120603551d13 EAP-Message = 0x0101ff040830060101ff02010030110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c3081b306082b060105050701010481a63081a3303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e703763303906082b06010505073002862d687474703a2f2f6372742e7573657274727573742e636f6d2f416464547275737455544e53474343412e637274302506082b060105 EAP-Message = 0x050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d0101050500038201010013851f528018c953f7fe2e1aafccd90b3cc2d3858110f0288db9407e2c9e8fd636860a4c142dd69743924119374b969eeba930791295b3023657ed2bb91d981aa3180a3f9b398bcda149294c2ff9d0958cc84d95baa843cf33aa252a5a0eaa27c94e6bb1e6731fb37404c3f34ce2a8eb67b75db808051a569a542985f5294e803b95d07b53961156c102d3eab27fca8f9c704a148d5ab9166075d6cd271e16cd5b338e7940cf2848e7dc71164e749175b92a8cf170ac26dd04b940c285de1c9340d0cc6ec39baaef6065 EAP-Message = 0xdf6022f05aa57aa22fe47073ee3cd4262b6807c1207ae8985a3e7b9f028b62c085818060357ea51d0cd29cdf62450ddbfc37fbf5252216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x330f4dc9300a546872b9f993281128fc Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.60.2 port 32777, id=230, length=525 User-Name = "host/Lappy.umhb.edu" NAS-IP-Address = 10.11.60.2 NAS-Port = 129 Called-Station-Id = "00-0F-7D-05-0E-81:UMHB Secure WiFi" Calling-Station-Id = "C4-17-FE-33-C6-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 1Mbps/1Mbps 802.11b" EAP-Message = 0x020501501980000001461603010106100001020100d39af533c76344574a1afcff8cf5711ac18414345e29b157f02d808735c6214f74e1701e2163b79beaf3e584d3b7b1d6ef308efd0d1f6ca4f9d64ebe55229852a91e97de906b67813e0bd504510f7d5f80a0b083349314274566ce4ff387c95b4c82fc18b5abfda9feb7f893fe9bebe3572dfa2f5c4fe71abc08d95b10c88d4634ea8bdb9e2e946ec4f165c99deeffdee5a075cab3c1390b71713a5b7f2b77c5c1b0aeef836bfeda5840941c675bd32d04bc7d09017b5763310b4adb16a43833559624612363ea18f63e5e654ad1b255fb2ced330453a06516aabbb6550e5a409286363cef5e7661 EAP-Message = 0x1163bb4e662da80dabf30e1455b1be69bd55c68de35bcb7d1403010001011603010030f378c58fc4f96e96bf4aba29aa08962242ce0e3007898a99849af855f11f5116f7ecea3850db2d6561b4599c404e627a State = 0x330f4dc9300a546872b9f993281128fc Message-Authenticator = 0x06d78d3c33e3d757129782abcb1d3133 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/Lappy.umhb.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 230 to 10.11.60.2 port 32777 EAP-Message = 0x010600411900140301000101160301003005369ff6b06a4224824062f6fcfe0092357c4da2fd59baab8c1c5b071e939e71e83b578bd081ee5fa8d3ac3566b8a1bd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x330f4dc93709546872b9f993281128fc Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.11.60.2 port 32777, id=231, length=234 User-Name = "host/Lappy.umhb.edu" NAS-IP-Address = 10.11.60.2 NAS-Port = 129 Called-Station-Id = "00-0F-7D-05-0E-81:UMHB Secure WiFi" Calling-Station-Id = "C4-17-FE-33-C6-A7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 1Mbps/1Mbps 802.11b" EAP-Message = 0x0206002f198000000025150301002071521862587c6d52360e98091cd5d99f81ea6febe82fd2a7401f8b1970c3cf65 State = 0x330f4dc93709546872b9f993281128fc Message-Authenticator = 0xe0cebdb5cdcd98a378bd88f15213b843 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/Lappy.umhb.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 47 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 37 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied [peap] WARNING: No data inside of the tunnel. [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state ? [peap] FAILED processing PEAP: Tunneled data is invalid. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/Lappy.umhb.edu attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 231 to 10.11.60.2 port 32777 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 226 with timestamp +18 Cleaning up request 1 ID 227 with timestamp +18 Cleaning up request 2 ID 228 with timestamp +18 Cleaning up request 3 ID 229 with timestamp +18 Cleaning up request 4 ID 230 with timestamp +18 Waking up in 1.0 seconds. Cleaning up request 5 ID 231 with timestamp +18 Ready to process requests. Jake Sallee Godfather of Bandwidth Network Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221 ________________________________ From: freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org [freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org] on behalf of Peter Lambrechtsen [plambrechtsen(a)gmail.com] Sent: Friday, January 21, 2011 7:11 AM To: FreeRadius users mailing list Subject: Re: Generating a Microsoft compatible CSR for FreeRADIUS On Fri, Jan 21, 2011 at 10:33 PM, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk<mailto:A.L.M.Buxey@lboro.ac.uk>> wrote: > 2) Issuing client certs isn't that difficult.? with windows vista/7, > installing a cert is a simple double-click operation, so if they have a > usb flash, you can use linux to zip a copy of their private key and a .doc > with instructions (including screenies!) on configuring their OS in a > matter of seconds, all they have to do is stop by IT to request a key > once, and it's good for as long as you honour it. if dealing with client keys - most of the times its just PEAP with user/pass and its the CA thats an issue. even then there are ways of doing this quite easily... eg https://su1x.sf.net I also quite like using the root certificates tool which happily imports certificates into the root certificate store in windows. Go to here: http://support.microsoft.com/kb/931125 Download the "rootsupd.exe<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/…>" from there and expand it with winzip or winrar. Then convert your DER file into a P7B using OpenSSL: openssl crl2pkcs7 -nocrl -certfile internalca1.der -certfile internalca2.der -out internalca.p7b Then use "updroots.exe" included in the exe to import the certificate into your local certificate chain: updroots -l internalca.p7b And you're done You can even use "iexpress" if you're running windows XP to re-package everything back into a self extracting exe. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Generating a Microsoft compatible CSR for FreeRADIUS
by Sallee, Stephen (Jake) 21 Jan '11

21 Jan '11

I need help generating a Microsoft compatible CSR for my FR server that I can get signed by a public CA. The documentation mentions special OID's that need to be present for MS machines to accept the cert, but I can't find WHAT those OID's are so I can make sure I include them in the CSR. I know the docs also say that it is not best practices to use a publicly signed cart because ANYONE can auth against the server, however since I am in a position where almost all of the computers will NOT be managed by our staff (they are student workstations) a public cert seems perfect. If anyone has another route that will allow me to auth windows clients without having to manually install certs and/or manually configuring the wireless adapters I would be very grateful to hear your suggestions. THANKS! Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

8 15

Radius should assign based on the connected SSID/VLAN different Authentications rules ...
by Philipp Hanselmann 21 Jan '11

21 Jan '11

Hi, We have the following setup: Wireless Client (authentication with EAP-TTLS/PAP) | | SSID (wlan) \/ WLAN Access Point (NAS with EAP-PEAP, Cihpher TKIP ) -> SSID: wlan connected to VLAN 111 | | \/ Radius Server (Check if user in member of the LDAP group company-users) If yes, check his credentials with the LDAP Server. | | \/ LDAP Server (for Authentication) Up to know this is working. Now the idea is that the same AP is managing a second SSID called wlan-public. This SSID should be connection too a separate VLAN (ID 113). Mostly this SSID should be used by our guests for basic Internet access (No access to our company network) To release that the RADIUS server must be able to detect the connected SSID. Based on that different users groups are allowed. We noticed that the AP is informing the Radius about the connected SSID (see below), but we couldn't figure out the right way to detect that the information or too use it. We tried to detect the value Cisco-AVPair with /etc/freeradius/users <snip> # wlan-public - Connected to guest vlan - four our guest. # (Access with user guest, password guest) DEFAULT Cisco-AVPair =~ "ssid=wlan-public" Reply-Message = "Your SSID:qwlan-public", Fall-Through = Yes # debug DEFAULT Reply-Message = "Cisco-AVPair: %{Cisco-AVPair[*]}", Fall-Through = Yes # qwlan - Connected to company vlan - for our employees - membership company-users is needed # (Access with every LDAP account, No access with the user guest) DEFAULT Cisco-AVPair =~ "ssid=wlan" Reply-Message = "Your SSID:wlan", Fall-Through = Yes DEFAULT Ldap-Group == "company-users" Reply-Message = "Welcome to the Wireless Network wlan" <\snip> but without success. Even based on the debug output it looks like that the value %{Cisco-AVPair[*]} is empty? Help would be appreciated. Regards, Philipp Hanselmann -- * freeradius -X | grep Cisco [files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair: Reply-Message = "Cisco-AVPair: " [files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair: Reply-Message = "Cisco-AVPair: " [files] expand: Cisco-AVPair: %{Cisco-AVPair[*]} -> Cisco-AVPair: Reply-Message = "Cisco-AVPair: " Cisco-AVPair = "ssid=wlan-public" Cisco-AVPair = "vlan-id=113" Cisco-AVPair = "nas-location=unspecified" Cisco-AVPair = "connect-progress=Call Up" * freeradius -X | grep Cisco <snip> ++[exec] returns noop Sending Access-Accept of id 39 to 192.168.110.210 port 1645 MS-MPPE-Recv-Key = 0xdcf7bf00aa1600ac7ba7032d9exxxxxcd5xxxxxxxxxxx115738 MS-MPPE-Send-Key = 0x8cf29e70b657866e446fb2a8c9xxxxxxxxxxxxxxxxxxxc EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "phanselmann" Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Accounting-Request packet from host 192.168.110.21 port 1646, id=81, length=230 Acct-Session-Id = "00000312" Called-Station-Id = "001a.e35f.42e1" Calling-Station-Id = "0090.4b9a.6ac4" Cisco-AVPair = "ssid=wlan-public" Cisco-AVPair = "vlan-id=113" Cisco-AVPair = "nas-location=unspecified" User-Name = "phanselmann" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 NAS-Port = 392 NAS-Port-Id = "392" Service-Type = Framed-User NAS-IP-Address = 192.168.110.21 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 392,Client-IP-Address = 192.168.110.21,NAS-IP-Address = 192.168.110.21,Acct-Session-Id = "00000312",User-Name = "phanse"' [acct_unique] Acct-Unique-Session-ID = "8eebd433aaed7864". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "p </snip> <snip> -- Philipp Hanselmann System Administrator Qnamic AG Fabrikstrasse 10 CH-4614 Hägendorf Switzerland Phone: +41 62 209 70 40 Fax: +41 62 209 70 44 philipp.hanselmann(a)qnamic.com www.qnamic.com

2 1

freeradius 2.1.10 & postgresql & custom attributes
by slash13 21 Jan '11

21 Jan '11

hello freeradius users I managed to install freeradius together with a working postgresql database. Does anybody know what would be the easiest way to add custom accounting attributes both in configuration and database? So far I couldnt find any fast solution! looking forward hearing from you. cheers Alex -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-2-1-10-postgresql-custom… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

Re: FR 2.1.10 + dialup_admin Could not connect to SQL database
by Jim Rice 20 Jan '11

20 Jan '11

Yes, I know. I was merely illustrating that I was able to configure freeradius to use sql. I am trying to add dialup_admin into the mix... As I mentioned, dialup_admin Could not connect to SQL database when trying to access any of the menu choices. I figured it out. I wasn't even able to connect using mysql from the command line for the user dialup_admin. It turned out to be a GRANT USAGE issue with dialup_admin@localhost. (It did not have the IDENTIFIED BY PASSWORD ...). Working now. (But I need to turn off the debug stuff.) Jim

1 0

FR 2.1.10 + dialup_admin Could not connect to SQL database
by jmrice 20 Jan '11

20 Jan '11

Followed the README and HOW TO as best I could. I think I am finally close. radiusd -X shows it connecting to sql when I tried radtest, but dialup_admin cannot connect. I have sql_debug : true and even set sqltrace = yes but it does not produce an sqltrace.sql file. There is also nothing in mysqld.log. I have been through quite a bit getting this far, nd feel like I have just overlooked something simple. Can anyone help point me in the right direction? Thanks, Jim -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-10-dialup-admin-Could-not-co… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1