November 2011 - Freeradius-Users - lists.freeradius.org

ldap tls in freeradius
by Frank Skovboel 06 Nov '11

06 Nov '11

Hi, I'm trying to authorize users in different AD's (2003 and 2008), but I keep running into an error I can't find any thing on when I google it. For the purpose of the testing I have set the following in the ldap section: require_cert Freeradius tries to connect to the ldap server (2008), the connection fails and I get the following debug output. ============================ DEBUG ======================================= [ldap_CustA] performing user authorization for MyAccount [ldap_CustA] expand: (&(sAMAccountName=%{User-Name})) -> (&(sAMAccountName=MyAccount)) [ldap_CustA] expand: ou=OU1,ou=OU2,dc=domain,dc=local -> ou=OU1,ou=OU2,dc=domain,dc=local [ldap_CustA] ldap_get_conn: Checking Id: 0 [ldap_CustA] ldap_get_conn: Got Id: 0 [ldap_CustA] attempting LDAP reconnection [ldap_CustA] (re)connect to AD-IP-ADDRESS:636, authentication 0 [ldap_CustA] setting TLS mode to 1 [ldap_CustA] setting TLS CACert File to /etc/raddb/certs/ca.pem [ldap_CustA] setting TLS CACert Directory to /etc/raddb/certs/ [ldap_CustA] setting TLS Require Cert to never [ldap_CustA] setting TLS Cert File to /etc/raddb/certs/server.crt [ldap_CustA] setting TLS Key File to /etc/raddb/certs/server.key [ldap_CustA] setting TLS Key File to /etc/raddb/certs/random [ldap_CustA] bind as user(a)domain.local/PASSWORD to 193.47.81.75:636 TLS: could not add the certificate PEM Token #0:server.crt - 0 - error -8192:Unknown code ___f 0. TLS: error: could not initialize moznss security context - error -8192:Unknown code ___f 0 TLS: can't create ssl handle. =========================================================================== ======================= CONFIG SNIP ========================================= tls { start_tls = no cacertfile = /etc/raddb/certs/ca.pem cacertdir = /etc/raddb/certs/ certfile = /etc/raddb/certs/server.crt keyfile = /etc/raddb/certs/server.key randfile = /etc/raddb/certs/random require_cert = "never" } =========================================================================== I'm wondering why the random file is set as a TLS Key, and also what exactly is going wrong since I get the error for the PEM Token? Thank you for your help. -- Thanks for your help Frank

3 6

radiusd goes wrong
by Ivan Matala 05 Nov '11

05 Nov '11

rlm_sql (sql): Connected new DB handle, #79 Module: Instantiated sql (sql) Failed creating PID file /root/radiusd.pid: Permission denied pls help. tnx

5 11

Anybody can confirm this?
by tonimanel 04 Nov '11

04 Nov '11

Hi, I have two servers A and B configured. I have some doubts: I would like to get to copy accounting data (same set of information) from A to B. I have configured this and works fine (copy-acct-to-home-server & proxy.conf), BUT in radacct table of server B, the records have different acctstartime and different acctstoptime from server A. I know that this happens because server B catchs its time and records it (exists a delay - few seconds). In other post, suggest me modify sql queries to get this (I should catch time of packet that send A - Event-Timestamp, and record it). For do this, I have thought in to check "Packet-Src-IP-Address" and if it is equal to B's address, I have to use my query modified. I have a problem, "Event-Timestamp" has the follows format: "Oct 26 2011 13:03:14 CEST" and I want to get yyyy-mm-dd HH:MM:ss (mysql format and current format of freeradius' dates). Do you know how can I do it? I can't believe that I can't do this more easy... Any suggestions? I have to think that I will get it... Thanks and regards! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Anybody-can-confirm-this-tp4939606p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

radiusclient problems
by Miha Zoubek 04 Nov '11

04 Nov '11

Hi, I have installedradiusclient. When I start it for a test I get this: xxx.xxx.xxx.xxx: can't parse AV pair Radiusclientis on different server thatfreeradius. I checked dictionary s and all looks good. Please help me out with this issue. Thank you! BR, Miha

4 10

use pam as authentication medium of FreeRadius
by Ivan Matala 04 Nov '11

04 Nov '11

i have a server A with freeradius installed. is there anyway to use the pam of it to be use as authentication medium of freeradius? (instead of using Auth Type = System, Local, SQL The pam module (http://linuxexplore.wordpress.com/how-tos/pam-with-radius-authentication/) connects to another radius server (Server B), and then returns a reply whether it is valid or invalid. Thanks

2 2

data limit
by Tyron van Greunen 03 Nov '11

03 Nov '11

Hello, I know this question has been asked a few times,i've googled the topic and a few posts have popped up.I'd like to know which methods anyone has used to supply capped or limited data accounts on freeradius,some have created their own scripts or perhaps some have used attributes.I've seen mixed answers and suggestions on how to go about this, and being new to freeradius i would just like to know the general census on which is the favourable/easiest method to go about doing this.At the moment im using daloradius as the frontend. Thanks in advance Tyron

1 0

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 03 Nov '11

03 Nov '11

looks like removing the 'unix' from the two enabled sites might have done the trick. i have a w7 machine running off of one of the AP's using the RADIUS server... more testing next tues. -m On 11/3/2011 2:40 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. use pam as authentication medium of FreeRadius (Ivan Matala) > 2. Re: cisco WAP/FreeRadius/OpenLDAP (Matthew Arguin) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 3 Nov 2011 07:08:32 -0700 > From: Ivan Matala<ivanmatala(a)gmail.com> > Subject: use pam as authentication medium of FreeRadius > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <CAH92aV5T6AoSqTF6ky4jWhQYdyK=p0xmHy-v6ODrL-CHcKT5cg(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > i have a server A with freeradius installed. is there anyway to use > the pam of it to be use as authentication medium of freeradius? > (instead of using Auth Type = System, Local, SQL > > The pam module (http://linuxexplore.wordpress.com/how-tos/pam-with-radius-authentication/) > connects to another radius server (Server B), and then returns a reply > whether it is valid or invalid. > Thanks > > > ------------------------------ > > Message: 2 > Date: Thu, 03 Nov 2011 14:40:06 -0400 > From: Matthew Arguin<matt.arguin(a)currensee.com> > Subject: Re: cisco WAP/FreeRadius/OpenLDAP > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4EB2E006.3040705(a)currensee.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > sorry about the snipped debug. i am attaching another fresh one here. > > there are no users in the files on the computer, all in LDAP so the > shadow file should not be an issue. I will find the 'unix' part and > comment it out. > > -m > > full debug below frm windows machine attempt: > > [root@ops2 ~]# radiusd -X > FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on > Oct 3 2011 at 10:29:04 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/replicate > including configuration file /etc/raddb/modules/dynamic_clients > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/mschap > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/redis > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/ldap > including configuration file /etc/raddb/modules/ntlm_auth > including configuration file /etc/raddb/modules/ldap.new > including configuration file /etc/raddb/modules/mac2vlan > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/soh > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/unix > including configuration file /etc/raddb/modules/opendirectory > including configuration file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/rediswho > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/inner-tunnel > including configuration file /etc/raddb/sites-enabled/default > including configuration file /etc/raddb/sites-enabled/control-socket > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > name = "radiusd" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/radius" > run_dir = "/var/run/radiusd" > libdir = "/usr/lib64/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm local.currensee.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "i6Lw7uNsG7pZDUGgxirg" > nastype = "other" > } > client ops2 { > ipaddr = 192.168.10.247 > require_message_authenticator = no > secret = "i6Lw7uNsG7pZDUGgxirg" > nastype = "other" > } > client ap1 { > ipaddr = 192.168.10.31 > require_message_authenticator = no > secret = "i6Lw7uNsG7pZDUGgxirg" > shortname = "ap1" > nastype = "cisco" > } > client ap2 { > ipaddr = 192.168.10.30 > require_message_authenticator = no > secret = "i6Lw7uNsG7pZDUGgxirg" > shortname = "ap2" > nastype = "cisco" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating module "exec" from file /etc/raddb/modules/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating module "expr" from file /etc/raddb/modules/expr > Module: Linked to module rlm_expiration > Module: Instantiating module "expiration" from file > /etc/raddb/modules/expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating module "logintime" from file > /etc/raddb/modules/logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server { # from file /etc/raddb/radiusd.conf > modules { > Module: Creating Auth-Type = LDAP > Module: Creating Post-Auth-Type = REJECT > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating module "pap" from file /etc/raddb/modules/pap > pap { > encryption_scheme = "auto" > auto_header = yes > } > Module: Linked to module rlm_chap > Module: Instantiating module "chap" from file /etc/raddb/modules/chap > Module: Linked to module rlm_mschap > Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap > mschap { > use_mppe = yes > require_encryption = yes > require_strong = yes > with_ntdomain_hack = no > allow_retry = yes > } > Module: Linked to module rlm_unix > Module: Instantiating module "unix" from file /etc/raddb/modules/unix > unix { > radwtmp = "/var/log/radius/radwtmp" > } > Module: Linked to module rlm_ldap > Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap > ldap { > server = "ldap.local.currensee.com" > port = 389 > password = "VcnxJbFqeAuAFyiu3zvi" > identity = "cn=manager,dc=currensee,dc=com" > net_timeout = 1 > timeout = 4 > timelimit = 3 > tls_mode = no > start_tls = yes > tls_cacertfile = "/etc/ldap/csca.crt" > tls_require_cert = "demand" > tls { > start_tls = no > require_cert = "allow" > } > basedn = "ou=people,dc=currensee,dc=com" > filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > base_filter = "(objectclass=radiusprofile)" > auto_header = no > access_attr = "uid" > access_attr_used_for_allow = yes > groupname_attribute = "cn" > groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap_debug = 40 > ldap_connections_number = 5 > compare_check_items = no > do_xlat = yes > set_auth_type = yes > } > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address > rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS > Tunnel-Private-Group-Id > conns: 0xb5bdcd0 > Module: Linked to module rlm_eap > Module: Instantiating module "eap" from file /etc/raddb/eap.conf > eap { > default_eap_type = "peap" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/etc/raddb/certs/radius.key.pem" > certificate_file = "/etc/raddb/certs/radius.crt.pem" > CA_file = "/etc/raddb/certs/cacert.pem" > private_key_password = "i6Lw7uNsG7pZDUGgxirg" > dh_file = "/etc/raddb/certs/dh" > random_file = "/dev/urandom" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating module "preprocess" from file > /etc/raddb/modules/preprocess > preprocess { > huntgroups = "/etc/raddb/huntgroups" > hints = "/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Linked to module rlm_realm > Module: Instantiating module "suffix" from file /etc/raddb/modules/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating module "files" from file /etc/raddb/modules/files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating module "acct_unique" from file > /etc/raddb/modules/acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating module "detail" from file /etc/raddb/modules/detail > detail { > detailfile = > "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Linked to module rlm_radutmp > Module: Instantiating module "radutmp" from file > /etc/raddb/modules/radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Linked to module rlm_attr_filter > Module: Instantiating module "attr_filter.accounting_response" from > file /etc/raddb/modules/attr_filter > attr_filter attr_filter.accounting_response { > attrsfile = "/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > relaxed = no > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Instantiating module "attr_filter.access_reject" from file > /etc/raddb/modules/attr_filter > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > relaxed = no > } > } # modules > } # server > server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel > modules { > Module: Checking authenticate {...} for more modules to load > Module: Checking authorize {...} for more modules to load > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/var/run/radiusd/radiusd.sock" > } > } > ... adding new socket proxy address * port 50281 > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file /var/run/radiusd/radiusd.sock > Listening on proxy address * port 1814 > Ready to process requests. > > > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=105, length=133 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0x7b50b55eaa1b8572fd679e2acff05bba > EAP-Message = 0x0202000e01616e6f6e796d6f7573 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 2 length 14 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [ldap] performing user authorization for anonymous > [ldap] expand: %{Stripped-User-Name} -> > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> anonymous > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> > (uid=anonymous) > [ldap] expand: ou=people,dc=currensee,dc=com -> > ou=people,dc=currensee,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] attempting LDAP reconnection > [ldap] (re)connect to ldap.local.currensee.com:389, authentication 0 > [ldap] setting TLS CACert File to /etc/ldap/csca.crt > [ldap] bind as cn=manager,dc=currensee,dc=com/VcnxJbFqeAuAFyiu3zvi to > ldap.local.currensee.com:389 > [ldap] waiting for bind result ... > request done: ld 0xb5ee050 msgid 1 > [ldap] Bind was successful > [ldap] performing search in ou=people,dc=currensee,dc=com, with > filter (uid=anonymous) > request done: ld 0xb5ee050 msgid 2 > [ldap] object not found > [ldap] search failed > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns notfound > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type tls > [tls] Initiate > [tls] Start returned 1 > ++[eap] returns handled > Sending Access-Challenge of id 105 to 192.168.10.31 port 1645 > EAP-Message = 0x010300061920 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd78df33bec47a0da331d3912 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=106, length=229 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0xab1d629124040d4a484088109c2dabd1 > EAP-Message = > 0x0203005c190016030100510100004d03014eb2df500e212426b1eb54e97dcf30eb655cfb3f10a02b7cda369f1be5bc676a00002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd78df33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 3 length 92 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] (other): before/accept initialization > [peap] TLS_accept: before/accept initialization > [peap]<<< TLS 1.0 Handshake [length 0051], ClientHello > [peap] TLS_accept: SSLv3 read client hello A > [peap]>>> TLS 1.0 Handshake [length 002a], ServerHello > [peap] TLS_accept: SSLv3 write server hello A > [peap]>>> TLS 1.0 Handshake [length 06cd], Certificate > [peap] TLS_accept: SSLv3 write certificate A > [peap]>>> TLS 1.0 Handshake [length 018d], ServerKeyExchange > [peap] TLS_accept: SSLv3 write key exchange A > [peap]>>> TLS 1.0 Handshake [length 0004], ServerHelloDone > [peap] TLS_accept: SSLv3 write server done A > [peap] TLS_accept: SSLv3 flush data > [peap] TLS_accept: Need to read more data: SSLv3 read client > certificate A > In SSL Handshake Phase > In SSL Accept mode > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 106 to 192.168.10.31 port 1645 > EAP-Message = > 0x0104040019c00000089c160301002a0200002603014eb2df2dbf13dc964c4b531d3eb1305f35f8be28746de76d5e5c8741d18bbd180000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f > EAP-Message = > 0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31 > EAP-Message = > 0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082 > EAP-Message = > 0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a > EAP-Message = 0x3081b931183016060355040a > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd68af33bec47a0da331d3912 > Finished request 1. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=107, length=143 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0x331b8832fcf1fc4ecce2b5d8b11d74e0 > EAP-Message = 0x020400061900 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd68af33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 4 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 107 to 192.168.10.31 port 1645 > EAP-Message = > 0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7 > EAP-Message = > 0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116 > EAP-Message = > 0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb > EAP-Message = > 0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080214043a4ba5893fc759b15a385d241d1adb217e7f74e7109031b3640e522e9ed150cc6dfccf1bd4cb9f01442d33a8c09b936e53faf477aa1eff2a2ba70c808f1309c8c20fe2cf7231b8935ee494cf8868c7517 > EAP-Message = 0xd6067c739d8d28db > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd58bf33bec47a0da331d3912 > Finished request 2. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=108, length=143 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0xd26c70de6bf8873741146ca58d32fc5d > EAP-Message = 0x020500061900 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd58bf33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 5 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake fragment handler > [peap] eaptls_verify returned 1 > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 108 to 192.168.10.31 port 1645 > EAP-Message = > 0x010600b61900c262d314f99faee60a3b1d641dc0639f14fc17da74acf016f52a585323c4f4597448ce37340080ac4cd31a3bdd6227eac7f5bff7134ca8897172a0533f3b6bbfbdca381a3c62ffc1fca799d5ed7fa8aab8d19ce8eb66f024b2e247dde53df5182ee42cb17aef581790d53feaacf1f35a0522c107ac8e32939b0899a5da755215e8758574e17aad17037d3bb79ef57b5ca937233bf3feee03d589b996aa635f676da7b9733458f116030100040e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd488f33bec47a0da331d3912 > Finished request 3. > Going to the next request > Waking up in 4.8 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=109, length=341 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0x5ea79a07344221e8a7b651c1590465f2 > EAP-Message = > 0x020600cc190016030100861000008200806b365dd6b7e8f0506b9beeff8cb047093b38f4ade146677bde95387db9a85179e3981438ecdb81dc8bd66ff17e75044860531e7a035008408cae1c45206bccb3b738ad64f073bd7f4047b618b619b618529ee0e3b4de03c98603332d4361b6806ce927f870ae05231c3137ee8ce31b9c74aeead97a5821a96d3f789c9552c5f9140301000101160301003075082bfc6ec0756f985b798560404ec0a42e93fc29e045e4d07dfb2cab101ee1db9c3dabb7cc87926bb2dce22b494a9f > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd488f33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 6 length 204 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap]<<< TLS 1.0 Handshake [length 0086], ClientKeyExchange > [peap] TLS_accept: SSLv3 read client key exchange A > [peap]<<< TLS 1.0 ChangeCipherSpec [length 0001] > [peap]<<< TLS 1.0 Handshake [length 0010], Finished > [peap] TLS_accept: SSLv3 read finished A > [peap]>>> TLS 1.0 ChangeCipherSpec [length 0001] > [peap] TLS_accept: SSLv3 write change cipher spec A > [peap]>>> TLS 1.0 Handshake [length 0010], Finished > [peap] TLS_accept: SSLv3 write finished A > [peap] TLS_accept: SSLv3 flush data > [peap] (other): SSL negotiation finished successfully > SSL Connection Established > [peap] eaptls_process returned 13 > [peap] EAPTLS_HANDLED > ++[eap] returns handled > Sending Access-Challenge of id 109 to 192.168.10.31 port 1645 > EAP-Message = > 0x01070041190014030100010116030100300a48ff69d71686b3d02fc914361e30c20649d2bae5c5807b805036131c0ba13b94ac2fa8f3e095f265452a799724a29a > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd389f33bec47a0da331d3912 > Finished request 4. > Going to the next request > Waking up in 0.2 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=110, length=143 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0x4e6a3b2a54d77a7dd6d830e5371ce9d4 > EAP-Message = 0x020700061900 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd389f33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 7 length 6 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] Received TLS ACK > [peap] ACK handshake is finished > [peap] eaptls_verify returned 3 > [peap] eaptls_process returned 3 > [peap] EAPTLS_SUCCESS > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state TUNNEL ESTABLISHED > ++[eap] returns handled > Sending Access-Challenge of id 110 to 192.168.10.31 port 1645 > EAP-Message = > 0x0108002b1900170301002063d9c378f2cc040c57f69b9e176af752dc3b28f1b340bc482356cee997f5c7cc > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd286f33bec47a0da331d3912 > Finished request 5. > Going to the next request > Waking up in 0.2 seconds. > Cleaning up request 0 ID 105 with timestamp +16 > Cleaning up request 1 ID 106 with timestamp +16 > Cleaning up request 2 ID 107 with timestamp +16 > Cleaning up request 3 ID 108 with timestamp +16 > Waking up in 4.6 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=111, length=217 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0xfccbcc2ac4f1db3d69e75f2db50a71b1 > EAP-Message = > 0x020800501900170301002083120e205df189c08c8450ccf4ff0ce2c19a1b92251acb1bf4fe573413b384e117030100203af2415265a1b22ab46c54782d2fae8073830d3d8201f0a921cdb946eb1c86c8 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd286f33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 8 length 80 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state WAITING FOR INNER IDENTITY > [peap] Identity - marguin2 > [peap] Got inner identity 'marguin2' > [peap] Setting default EAP type for tunneled EAP session. > [peap] Got tunneled request > EAP-Message = 0x0208000d016d61726775696e32 > server { > [peap] Setting User-Name to marguin2 > Sending tunneled request > EAP-Message = 0x0208000d016d61726775696e32 > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "marguin2" > server inner-tunnel { > # Executing section authorize from file > /etc/raddb/sites-enabled/inner-tunnel > +- entering group authorize {...} > ++[chap] returns noop > ++[mschap] returns noop > ++[unix] returns updated > [suffix] No '@' in User-Name = "marguin2", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > ++[control] returns noop > [eap] EAP packet type response id 8 length 13 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [ldap] performing user authorization for marguin2 > [ldap] expand: %{Stripped-User-Name} -> > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> marguin2 > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> > (uid=marguin2) > [ldap] expand: ou=people,dc=currensee,dc=com -> > ou=people,dc=currensee,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in ou=people,dc=currensee,dc=com, with > filter (uid=marguin2) > request done: ld 0xb5ee050 msgid 3 > [ldap] checking if remote access for marguin2 is allowed by uid > [ldap] looking for check items in directory... > [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" > [ldap] looking for reply items in directory... > [ldap] user marguin2 authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/inner-tunnel > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type mschapv2 > rlm_eap_mschapv2: Issuing Challenge > ++[eap] returns handled > } # server inner-tunnel > [peap] Got tunneled reply code 11 > EAP-Message = > 0x010900221a0109001d100b6a17aa07733a1f91509b758d0a88b86d61726775696e32 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x602c86f460259c20be85326c7f25bc52 > [peap] Got tunneled reply RADIUS code 11 > EAP-Message = > 0x010900221a0109001d100b6a17aa07733a1f91509b758d0a88b86d61726775696e32 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x602c86f460259c20be85326c7f25bc52 > [peap] Got tunneled Access-Challenge > ++[eap] returns handled > Sending Access-Challenge of id 111 to 192.168.10.31 port 1645 > EAP-Message = > 0x0109004b190017030100408f8962038e1da77347bee429f2d4dc18cfb0e6f1116c844102ce42970981de33c538b4e8e19bd069b5d1fb6bf7513b67f6178f452f3d016b3cccefbc70f45238 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd187f33bec47a0da331d3912 > Finished request 6. > Going to the next request > Waking up in 3.7 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=112, length=217 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0x48c8b4886963729f80a85293243ad9a9 > EAP-Message = > 0x0209005019001703010020d22dda4e67687876b057da3c7c0555dc1d60323c6cc45bc6af2a53cad54722381703010020d6aab5196d83bf44cc35f02b892bbb5918c6dc786ac09570f3bbe96dc9fbe8b1 > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd187f33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 9 length 80 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state phase2 > [peap] EAP type nak > [peap] Got tunneled request > EAP-Message = 0x020900060306 > server { > [peap] Setting User-Name to marguin2 > Sending tunneled request > EAP-Message = 0x020900060306 > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "marguin2" > State = 0x602c86f460259c20be85326c7f25bc52 > server inner-tunnel { > # Executing section authorize from file > /etc/raddb/sites-enabled/inner-tunnel > +- entering group authorize {...} > ++[chap] returns noop > ++[mschap] returns noop > ++[unix] returns updated > [suffix] No '@' in User-Name = "marguin2", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > ++[control] returns noop > [eap] EAP packet type response id 9 length 6 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [ldap] performing user authorization for marguin2 > [ldap] expand: %{Stripped-User-Name} -> > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> marguin2 > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> > (uid=marguin2) > [ldap] expand: ou=people,dc=currensee,dc=com -> > ou=people,dc=currensee,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in ou=people,dc=currensee,dc=com, with > filter (uid=marguin2) > request done: ld 0xb5ee050 msgid 4 > [ldap] checking if remote access for marguin2 is allowed by uid > [ldap] looking for check items in directory... > [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" > [ldap] looking for reply items in directory... > [ldap] user marguin2 authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/inner-tunnel > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP NAK > [eap] EAP-NAK asked for EAP-Type/gtc > [eap] processing type gtc > [gtc] expand: Password: -> Password: > ++[eap] returns handled > } # server inner-tunnel > [peap] Got tunneled reply code 11 > EAP-Message = 0x010a000f0650617373776f72643a20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x602c86f461268020be85326c7f25bc52 > [peap] Got tunneled reply RADIUS code 11 > EAP-Message = 0x010a000f0650617373776f72643a20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x602c86f461268020be85326c7f25bc52 > [peap] Got tunneled Access-Challenge > ++[eap] returns handled > Sending Access-Challenge of id 112 to 192.168.10.31 port 1645 > EAP-Message = > 0x010a002b190017030100200420787dcb200576e528687e537fbcff4c0f871ed6b918a6126eb9f63e37d8ac > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcd084f33bec47a0da331d3912 > Finished request 7. > Going to the next request > Waking up in 2.6 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=113, length=217 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0x7e1a36f67f33d35949af6bf12455126d > EAP-Message = > 0x020a005019001703010020c6bef0b5339d234f36fac19dd890ccc11decb7ad21400e3a6f09cbe1463f187117030100204e26d40af582983750b24ee8ba17aff71f3cdeae50d8d1187402a263dbe0efda > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcd084f33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 10 length 80 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state phase2 > [peap] EAP type gtc > [peap] Got tunneled request > EAP-Message = 0x020a000d06723061646b696c6c > server { > [peap] Setting User-Name to marguin2 > Sending tunneled request > EAP-Message = 0x020a000d06723061646b696c6c > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "marguin2" > State = 0x602c86f461268020be85326c7f25bc52 > server inner-tunnel { > # Executing section authorize from file > /etc/raddb/sites-enabled/inner-tunnel > +- entering group authorize {...} > ++[chap] returns noop > ++[mschap] returns noop > ++[unix] returns updated > [suffix] No '@' in User-Name = "marguin2", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > ++[control] returns noop > [eap] EAP packet type response id 10 length 13 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [ldap] performing user authorization for marguin2 > [ldap] expand: %{Stripped-User-Name} -> > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> marguin2 > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> > (uid=marguin2) > [ldap] expand: ou=people,dc=currensee,dc=com -> > ou=people,dc=currensee,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in ou=people,dc=currensee,dc=com, with > filter (uid=marguin2) > request done: ld 0xb5ee050 msgid 5 > [ldap] checking if remote access for marguin2 is allowed by uid > [ldap] looking for check items in directory... > [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" > [ldap] looking for reply items in directory... > [ldap] user marguin2 authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] returns noop > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/inner-tunnel > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/gtc > [eap] processing type gtc > [gtc] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel > [gtc] +- entering group PAP {...} > [pap] login attempt with password "r0adkill" > [pap] Using CRYPT password "*" > [pap] Passwords don't match > ++[pap] returns reject > [eap] Handler failed in EAP/gtc > [eap] Failed in EAP select > ++[eap] returns invalid > Failed to authenticate the user. > } # server inner-tunnel > [peap] Got tunneled reply code 3 > EAP-Message = 0x040a0004 > Message-Authenticator = 0x00000000000000000000000000000000 > [peap] Got tunneled reply RADIUS code 3 > EAP-Message = 0x040a0004 > Message-Authenticator = 0x00000000000000000000000000000000 > [peap] Tunneled authentication was rejected. > [peap] FAILURE > ++[eap] returns handled > Sending Access-Challenge of id 113 to 192.168.10.31 port 1645 > EAP-Message = > 0x010b002b1900170301002096e49cfd808473952eb3fa75834f12426a53b614dfecd8be68ecf308d9c0e582 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd78eeafcdf85f33bec47a0da331d3912 > Finished request 8. > Going to the next request > Waking up in 1.1 seconds. > Cleaning up request 4 ID 109 with timestamp +21 > Cleaning up request 5 ID 110 with timestamp +21 > Waking up in 1.2 seconds. > rad_recv: Access-Request packet from host 192.168.10.31 port 1645, > id=114, length=217 > User-Name = "anonymous" > Framed-MTU = 1400 > Called-Station-Id = "64a0.e729.b890" > Calling-Station-Id = "1c65.9d32.fb68" > Service-Type = Login-User > Message-Authenticator = 0xc89f6cfb84abeaafca32c0ca19c71cda > EAP-Message = > 0x020b005019001703010020a5c60e28809a4129d771755d38edf4f696225365ed1ac4501fb72bab9eb3c3d017030100204a26a2449d048491deddc5081a17ee3198e1eeed73ca1b4bab8857cd7a5361be > NAS-Port-Type = Wireless-802.11 > NAS-Port = 2387 > NAS-Port-Id = "2387" > State = 0xd78eeafcdf85f33bec47a0da331d3912 > NAS-IP-Address = 192.168.10.31 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > [suffix] No '@' in User-Name = "anonymous", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 11 length 80 > [eap] Continuing tunnel setup. > ++[eap] returns ok > Found Auth-Type = EAP > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/peap > [eap] processing type peap > [peap] processing EAP-TLS > [peap] eaptls_verify returned 7 > [peap] Done initial handshake > [peap] eaptls_process returned 7 > [peap] EAPTLS_OK > [peap] Session established. Decoding tunneled attributes. > [peap] Peap state send tlv failure > [peap] Received EAP-TLV response. > [peap] The users session was previously rejected: returning reject (again.) > [peap] *** This means you need to read the PREVIOUS messages in the > debug output > [peap] *** to find out the reason why the user was rejected. > [peap] *** Look for "reject" or "fail". Those earlier messages will > tell you. > [peap] *** what went wrong, and how to fix the problem. > [eap] Handler failed in EAP/peap > [eap] Failed in EAP select > ++[eap] returns invalid > Failed to authenticate the user. > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> anonymous > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 9 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Cleaning up request 6 ID 111 with timestamp +22 > Sending delayed reject for request 9 > Sending Access-Reject of id 114 to 192.168.10.31 port 1645 > EAP-Message = 0x040b0004 > Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 1.0 seconds. > Cleaning up request 7 ID 112 with timestamp +23 > Waking up in 1.4 seconds. > Cleaning up request 8 ID 113 with timestamp +24 > Waking up in 2.4 seconds. > Cleaning up request 9 ID 114 with timestamp +26 > Ready to process requests. > > > > > On 11/2/2011 5:25 PM, freeradius-users-request(a)lists.freeradius.org wrote: >> Re: cisco WAP/FreeRadius/OpenLDAP -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

1 0

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 03 Nov '11

03 Nov '11

sorry about the snipped debug. i am attaching another fresh one here. there are no users in the files on the computer, all in LDAP so the shadow file should not be an issue. I will find the 'unix' part and comment it out. -m full debug below frm windows machine attempt: [root@ops2 ~]# radiusd -X FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2011 at 10:29:04 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/ldap.new including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm local.currensee.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "i6Lw7uNsG7pZDUGgxirg" nastype = "other" } client ops2 { ipaddr = 192.168.10.247 require_message_authenticator = no secret = "i6Lw7uNsG7pZDUGgxirg" nastype = "other" } client ap1 { ipaddr = 192.168.10.31 require_message_authenticator = no secret = "i6Lw7uNsG7pZDUGgxirg" shortname = "ap1" nastype = "cisco" } client ap2 { ipaddr = 192.168.10.30 require_message_authenticator = no secret = "i6Lw7uNsG7pZDUGgxirg" shortname = "ap2" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = LDAP Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap ldap { server = "ldap.local.currensee.com" port = 389 password = "VcnxJbFqeAuAFyiu3zvi" identity = "cn=manager,dc=currensee,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = yes tls_cacertfile = "/etc/ldap/csca.crt" tls_require_cert = "demand" tls { start_tls = no require_cert = "allow" } basedn = "ou=people,dc=currensee,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr = "uid" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0xb5bdcd0 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/radius.key.pem" certificate_file = "/etc/raddb/certs/radius.crt.pem" CA_file = "/etc/raddb/certs/cacert.pem" private_key_password = "i6Lw7uNsG7pZDUGgxirg" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } ... adding new socket proxy address * port 50281 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=105, length=133 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x7b50b55eaa1b8572fd679e2acff05bba EAP-Message = 0x0202000e01616e6f6e796d6f7573 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for anonymous [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> anonymous [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=anonymous) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.local.currensee.com:389, authentication 0 [ldap] setting TLS CACert File to /etc/ldap/csca.crt [ldap] bind as cn=manager,dc=currensee,dc=com/VcnxJbFqeAuAFyiu3zvi to ldap.local.currensee.com:389 [ldap] waiting for bind result ... request done: ld 0xb5ee050 msgid 1 [ldap] Bind was successful [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=anonymous) request done: ld 0xb5ee050 msgid 2 [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 105 to 192.168.10.31 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd78df33bec47a0da331d3912 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=106, length=229 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xab1d629124040d4a484088109c2dabd1 EAP-Message = 0x0203005c190016030100510100004d03014eb2df500e212426b1eb54e97dcf30eb655cfb3f10a02b7cda369f1be5bc676a00002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd78df33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 92 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0051], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 06cd], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 106 to 192.168.10.31 port 1645 EAP-Message = 0x0104040019c00000089c160301002a0200002603014eb2df2dbf13dc964c4b531d3eb1305f35f8be28746de76d5e5c8741d18bbd180000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f EAP-Message = 0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31 EAP-Message = 0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082 EAP-Message = 0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a EAP-Message = 0x3081b931183016060355040a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd68af33bec47a0da331d3912 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=107, length=143 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x331b8832fcf1fc4ecce2b5d8b11d74e0 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd68af33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 107 to 192.168.10.31 port 1645 EAP-Message = 0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7 EAP-Message = 0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116 EAP-Message = 0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb EAP-Message = 0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080214043a4ba5893fc759b15a385d241d1adb217e7f74e7109031b3640e522e9ed150cc6dfccf1bd4cb9f01442d33a8c09b936e53faf477aa1eff2a2ba70c808f1309c8c20fe2cf7231b8935ee494cf8868c7517 EAP-Message = 0xd6067c739d8d28db Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd58bf33bec47a0da331d3912 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=108, length=143 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xd26c70de6bf8873741146ca58d32fc5d EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd58bf33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 108 to 192.168.10.31 port 1645 EAP-Message = 0x010600b61900c262d314f99faee60a3b1d641dc0639f14fc17da74acf016f52a585323c4f4597448ce37340080ac4cd31a3bdd6227eac7f5bff7134ca8897172a0533f3b6bbfbdca381a3c62ffc1fca799d5ed7fa8aab8d19ce8eb66f024b2e247dde53df5182ee42cb17aef581790d53feaacf1f35a0522c107ac8e32939b0899a5da755215e8758574e17aad17037d3bb79ef57b5ca937233bf3feee03d589b996aa635f676da7b9733458f116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd488f33bec47a0da331d3912 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=109, length=341 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x5ea79a07344221e8a7b651c1590465f2 EAP-Message = 0x020600cc190016030100861000008200806b365dd6b7e8f0506b9beeff8cb047093b38f4ade146677bde95387db9a85179e3981438ecdb81dc8bd66ff17e75044860531e7a035008408cae1c45206bccb3b738ad64f073bd7f4047b618b619b618529ee0e3b4de03c98603332d4361b6806ce927f870ae05231c3137ee8ce31b9c74aeead97a5821a96d3f789c9552c5f9140301000101160301003075082bfc6ec0756f985b798560404ec0a42e93fc29e045e4d07dfb2cab101ee1db9c3dabb7cc87926bb2dce22b494a9f NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd488f33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 109 to 192.168.10.31 port 1645 EAP-Message = 0x01070041190014030100010116030100300a48ff69d71686b3d02fc914361e30c20649d2bae5c5807b805036131c0ba13b94ac2fa8f3e095f265452a799724a29a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd389f33bec47a0da331d3912 Finished request 4. Going to the next request Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=110, length=143 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x4e6a3b2a54d77a7dd6d830e5371ce9d4 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd389f33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 110 to 192.168.10.31 port 1645 EAP-Message = 0x0108002b1900170301002063d9c378f2cc040c57f69b9e176af752dc3b28f1b340bc482356cee997f5c7cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd286f33bec47a0da331d3912 Finished request 5. Going to the next request Waking up in 0.2 seconds. Cleaning up request 0 ID 105 with timestamp +16 Cleaning up request 1 ID 106 with timestamp +16 Cleaning up request 2 ID 107 with timestamp +16 Cleaning up request 3 ID 108 with timestamp +16 Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=111, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xfccbcc2ac4f1db3d69e75f2db50a71b1 EAP-Message = 0x020800501900170301002083120e205df189c08c8450ccf4ff0ce2c19a1b92251acb1bf4fe573413b384e117030100203af2415265a1b22ab46c54782d2fae8073830d3d8201f0a921cdb946eb1c86c8 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd286f33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - marguin2 [peap] Got inner identity 'marguin2' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000d016d61726775696e32 server { [peap] Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x0208000d016d61726775696e32 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) request done: ld 0xb5ee050 msgid 3 [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900221a0109001d100b6a17aa07733a1f91509b758d0a88b86d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x602c86f460259c20be85326c7f25bc52 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900221a0109001d100b6a17aa07733a1f91509b758d0a88b86d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x602c86f460259c20be85326c7f25bc52 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 111 to 192.168.10.31 port 1645 EAP-Message = 0x0109004b190017030100408f8962038e1da77347bee429f2d4dc18cfb0e6f1116c844102ce42970981de33c538b4e8e19bd069b5d1fb6bf7513b67f6178f452f3d016b3cccefbc70f45238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd187f33bec47a0da331d3912 Finished request 6. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=112, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x48c8b4886963729f80a85293243ad9a9 EAP-Message = 0x0209005019001703010020d22dda4e67687876b057da3c7c0555dc1d60323c6cc45bc6af2a53cad54722381703010020d6aab5196d83bf44cc35f02b892bbb5918c6dc786ac09570f3bbe96dc9fbe8b1 NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd187f33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type nak [peap] Got tunneled request EAP-Message = 0x020900060306 server { [peap] Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020900060306 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0x602c86f460259c20be85326c7f25bc52 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) request done: ld 0xb5ee050 msgid 4 [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/gtc [eap] processing type gtc [gtc] expand: Password: -> Password: ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x602c86f461268020be85326c7f25bc52 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x602c86f461268020be85326c7f25bc52 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 112 to 192.168.10.31 port 1645 EAP-Message = 0x010a002b190017030100200420787dcb200576e528687e537fbcff4c0f871ed6b918a6126eb9f63e37d8ac Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcd084f33bec47a0da331d3912 Finished request 7. Going to the next request Waking up in 2.6 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=113, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x7e1a36f67f33d35949af6bf12455126d EAP-Message = 0x020a005019001703010020c6bef0b5339d234f36fac19dd890ccc11decb7ad21400e3a6f09cbe1463f187117030100204e26d40af582983750b24ee8ba17aff71f3cdeae50d8d1187402a263dbe0efda NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcd084f33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type gtc [peap] Got tunneled request EAP-Message = 0x020a000d06723061646b696c6c server { [peap] Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020a000d06723061646b696c6c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0x602c86f461268020be85326c7f25bc52 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) request done: ld 0xb5ee050 msgid 5 [ldap] checking if remote access for marguin2 is allowed by uid [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [gtc] +- entering group PAP {...} [pap] login attempt with password "r0adkill" [pap] Using CRYPT password "*" [pap] Passwords don't match ++[pap] returns reject [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 113 to 192.168.10.31 port 1645 EAP-Message = 0x010b002b1900170301002096e49cfd808473952eb3fa75834f12426a53b614dfecd8be68ecf308d9c0e582 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd78eeafcdf85f33bec47a0da331d3912 Finished request 8. Going to the next request Waking up in 1.1 seconds. Cleaning up request 4 ID 109 with timestamp +21 Cleaning up request 5 ID 110 with timestamp +21 Waking up in 1.2 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=114, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xc89f6cfb84abeaafca32c0ca19c71cda EAP-Message = 0x020b005019001703010020a5c60e28809a4129d771755d38edf4f696225365ed1ac4501fb72bab9eb3c3d017030100204a26a2449d048491deddc5081a17ee3198e1eeed73ca1b4bab8857cd7a5361be NAS-Port-Type = Wireless-802.11 NAS-Port = 2387 NAS-Port-Id = "2387" State = 0xd78eeafcdf85f33bec47a0da331d3912 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Cleaning up request 6 ID 111 with timestamp +22 Sending delayed reject for request 9 Sending Access-Reject of id 114 to 192.168.10.31 port 1645 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.0 seconds. Cleaning up request 7 ID 112 with timestamp +23 Waking up in 1.4 seconds. Cleaning up request 8 ID 113 with timestamp +24 Waking up in 2.4 seconds. Cleaning up request 9 ID 114 with timestamp +26 Ready to process requests. On 11/2/2011 5:25 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Re: cisco WAP/FreeRadius/OpenLDAP -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

1 0

FreeRADIUS Beginner's Guide
by Ian Pilcher 02 Nov '11

02 Nov '11

I'm a complete newbie to RADIUS, looking to make use of the features of my new "smart" switches and wireless access point to secure my home network, so the title certainly sounds right. Has anyone had a look at this book yet? If so, what are your thoughts? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================

6 9

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 02 Nov '11

02 Nov '11

So based on a previous recommendation, i just upgraded my freeradius2 to 2.1.12. here is the latest radtest run: [root@ops2 modules]# radtest marguin2 r0adkill localhost 0 <secret> Sending Access-Request of id 177 to 127.0.0.1 port 1812 User-Name = "marguin2" User-Password = "r0adkill" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=177, length=30 Filter-Id = "wireless" and here is the debug when i test a laptop connecting: Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 57047, id=177, length=78 User-Name = "marguin2" User-Password = "r0adkill" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x1ef5c6c6cf3f4ec1042b39d10a933a02 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.local.currensee.com:389, authentication 0 [ldap] setting TLS CACert File to /etc/ldap/csca.crt [ldap] bind as cn=manager,dc=currensee,dc=com/VcnxJbFqeAuAFyiu3zvi to ldap.local.currensee.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] radiusFilterId -> Filter-Id = "wireless" [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "r0adkill" [pap] Using CRYPT password "tGS8HbszeyDmM" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 177 to 127.0.0.1 port 57047 Filter-Id = "wireless" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +8 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=130, length=133 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x25e770a8cf7f8577f8a4915a0a234c74 EAP-Message = 0x0202000e01616e6f6e796d6f7573 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for anonymous [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> anonymous [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=anonymous) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=anonymous) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 130 to 192.168.10.31 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca945078caa5cbc436d046d9dce36c6 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=131, length=229 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x26889f61e8de8e2c6e10b74f96a452f1 EAP-Message = 0x0203005c190016030100510100004d03014eb1639686848537ddd0c96aa8062750416eae950922291bbba0af9cfae968a300002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca945078caa5cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 92 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0051], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 06cd], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 131 to 192.168.10.31 port 1645 EAP-Message = 0x0104040019c00000089c160301002a0200002603014eb163754412671a1fbb6aaea55315df6c22964f750047734d2cb35b79efe94a0000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f EAP-Message = 0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31 EAP-Message = 0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082 EAP-Message = 0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a EAP-Message = 0x3081b931183016060355040a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca945078dad5cbc436d046d9dce36c6 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=132, length=143 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x5b640da8918d526233c3ccf055c38e7b EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca945078dad5cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 132 to 192.168.10.31 port 1645 EAP-Message = 0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7 EAP-Message = 0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116 EAP-Message = 0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb EAP-Message = 0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080457f5a1c896e293042889a80baf76d52658d76eb64c92baa31e4b901a3b469af59ab71d68674af7c35a774d47fbfb3f9dbe504edc8caba6587868c7679d1274437a5fec323ecf5bb1dab4b41a12549484a1d94 EAP-Message = 0x83acccdaba7cfbd7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca945078eac5cbc436d046d9dce36c6 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=133, length=143 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xbcb3f7da663c62412c3d92eb9610b21a EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca945078eac5cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 133 to 192.168.10.31 port 1645 EAP-Message = 0x010600b61900b77eba9bc0d843a1e70cbc91337bad9c2f401fd7f237bfdd0121dd64bc036829e6972a13ab0080216a3ef15f4e23893134c1e8a68c4b204bc3f0049e345d68abe39e46dad39a5993492fc2e5fc889e16b8336dc0b4500ca85ab762cfc2981d8a72eb7e5a3ba754a257e2cd8404a97485640634fee929d3ca79a902fccc99ea73b7076b222b84b699e72f6302625e7cdad6afd38a17585f4175ceb5196a4c403cca197e6aa19d9b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca945078faf5cbc436d046d9dce36c6 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=134, length=341 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xd9d6c025a9cc8adf9b335e7da36824d1 EAP-Message = 0x020600cc19001603010086100000820080f936761756c50ab1fa1ebd2fbff6e71af919343742eb224468dae4bc4a0314cdf271c6ca9313cdd7efb584731d4c6ceba4a447e6e8a836b615ad353a5c6e41c31c4d2a6a3a2f3afbd373accbec80df6900bcaea06b7e7b9a0fc77e6c92603aa10413fb61d035760f58c7cfdd197ffc8ce8632df0c5096bc0ae23bf0dfa4c8ccf1403010001011603010030f2be8bbb65decb68454b4de12d99dde34bd5d1a039db44a9b14da5c5378388a0954eda1a5d4c386d797ee84c8d5923e7 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca945078faf5cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 134 to 192.168.10.31 port 1645 EAP-Message = 0x01070041190014030100010116030100300d1ee2c2c4bc3706cb476ffa3b74949d84502de1b01a5f6da3efef07c438426b4d17e4e07e0d703389d1e9dc08b1b22d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca9450788ae5cbc436d046d9dce36c6 Finished request 5. Going to the next request Waking up in 1.3 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=135, length=143 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x70dc4102a65e57d3bb58ee3ae0b975ac EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca9450788ae5cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 135 to 192.168.10.31 port 1645 EAP-Message = 0x0108002b190017030100204dfc77d11a861969c087157ec956873654e4212570ff9a9c8f74abf27a24bea2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca9450789a15cbc436d046d9dce36c6 Finished request 6. Going to the next request Waking up in 1.3 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=136, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xfcfd2de20f4dd17fe27a932940065613 EAP-Message = 0x0208005019001703010020a741a4d57b7df591341632d17eb4fbdd1e8a55f3e22b10c7bcb9c4b75ea3cdba17030100204e5f007345bed18e9454e29df1c9bb1482d137e2f4da1945eaaca40d5cd45aca NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca9450789a15cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - marguin2 [peap] Got inner identity 'marguin2' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000d016d61726775696e32 server { [peap] Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x0208000d016d61726775696e32 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] radiusFilterId -> Filter-Id = "wireless" [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Filter-Id = "wireless" EAP-Message = 0x010900221a0109001d101541ae87d9536c451df82fbb9eabdc3e6d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x769c0ec5769514377b463afe53c96b87 [peap] Got tunneled reply RADIUS code 11 Filter-Id = "wireless" EAP-Message = 0x010900221a0109001d101541ae87d9536c451df82fbb9eabdc3e6d61726775696e32 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x769c0ec5769514377b463afe53c96b87 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 136 to 192.168.10.31 port 1645 EAP-Message = 0x0109004b19001703010040ffb90c9da2e7017a24ff61dac25db142af27fa741fdb60fcc0c440acf0dcc75f5e6d7536ce64ee54612024ecb7bb0862e6bacb09b424babdf78c0b9d17d31f19 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca945078aa05cbc436d046d9dce36c6 Finished request 7. Going to the next request Waking up in 0.3 seconds. Cleaning up request 1 ID 130 with timestamp +60 Cleaning up request 2 ID 131 with timestamp +60 Cleaning up request 3 ID 132 with timestamp +60 Cleaning up request 4 ID 133 with timestamp +60 Waking up in 3.5 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=137, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x8f599fef2ab96537cbe0039355513370 EAP-Message = 0x020900501900170301002036347ccd731b599adf5ecabb4068fa5940970abfb4951607a87ef622fae453c21703010020a837e04a9155a6e12a5814378ee3efee9986e5069e0714a1cea941ff2f5492cf NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca945078aa05cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type nak [peap] Got tunneled request EAP-Message = 0x020900060306 server { [peap] Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020900060306 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0x769c0ec5769514377b463afe53c96b87 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] radiusFilterId -> Filter-Id = "wireless" [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/gtc [eap] processing type gtc [gtc] expand: Password: -> Password: ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Filter-Id = "wireless" EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x769c0ec5779608377b463afe53c96b87 [peap] Got tunneled reply RADIUS code 11 Filter-Id = "wireless" EAP-Message = 0x010a000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x769c0ec5779608377b463afe53c96b87 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 137 to 192.168.10.31 port 1645 EAP-Message = 0x010a002b19001703010020bc50433da891fded937957b95bc1d6d39b57d7ebe06d6e578c2cce0a84ecfe8c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca945078ba35cbc436d046d9dce36c6 Finished request 8. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=138, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0xe64adb38adc28db3b0e34547c38dd977 EAP-Message = 0x020a0050190017030100207294fdf97f3535985e24cd9a3c263476e4b9b0619349cbbb3d825e650cbf14701703010020e1bd830a1c52f8807d7e1b7c7b012163d5b581622eb0fbf5652ec7a450e76c5c NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca945078ba35cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type gtc [peap] Got tunneled request EAP-Message = 0x020a000d06723061646b696c6c server { [peap] Setting User-Name to marguin2 Sending tunneled request EAP-Message = 0x020a000d06723061646b696c6c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "marguin2" State = 0x769c0ec5779608377b463afe53c96b87 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "marguin2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for marguin2 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> marguin2 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... [ldap] radiusFilterId -> Filter-Id = "wireless" [ldap] user marguin2 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [gtc] +- entering group PAP {...} [pap] login attempt with password "r0adkill" [pap] Using CRYPT password "*" [pap] Passwords don't match ++[pap] returns reject [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 Filter-Id = "wireless" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 Filter-Id = "wireless" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 138 to 192.168.10.31 port 1645 EAP-Message = 0x010b002b19001703010020bc8ab82b419f499978e7d5faedce851471945ab65159cc3b5762de33d8eeb94b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8ca9450784a25cbc436d046d9dce36c6 Finished request 9. Going to the next request Waking up in 0.8 seconds. Cleaning up request 5 ID 134 with timestamp +64 Cleaning up request 6 ID 135 with timestamp +64 Waking up in 1.0 seconds. rad_recv: Access-Request packet from host 192.168.10.31 port 1645, id=139, length=217 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "64a0.e729.b890" Calling-Station-Id = "1c65.9d32.fb68" Service-Type = Login-User Message-Authenticator = 0x6eef9b0bc3f36009729481a23b6e8326 EAP-Message = 0x020b005019001703010020292b726e855a04ed0d00ef8437129fc3bff157c8cf703900a952f77e9575aeab1703010020bbddafa3746eafb2871786e57813ad848b14ff4f24df4312b8bfa8325ce5ab25 NAS-Port-Type = Wireless-802.11 NAS-Port = 1911 NAS-Port-Id = "1911" State = 0x8ca9450784a25cbc436d046d9dce36c6 NAS-IP-Address = 192.168.10.31 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 10 for 1 seconds Going to the next request Waking up in 0.4 seconds. Cleaning up request 7 ID 136 with timestamp +64 Waking up in 0.5 seconds. Sending delayed reject for request 10 Sending Access-Reject of id 139 to 192.168.10.31 port 1645 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.1 seconds. Cleaning up request 8 ID 137 with timestamp +66 Waking up in 1.5 seconds. Cleaning up request 9 ID 138 with timestamp +68 Waking up in 2.3 seconds. Cleaning up request 10 ID 139 with timestamp +69 Ready to process requests. On 11/1/2011 2:09 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: IPv6 ready? (Alan Buxey) > 2. Re: cisco WAP/FreeRadius/OpenLDAP (Alan Buxey) > 3. Re: add field in radcheck table (gary) > 4. Re: add field in radcheck table (Fajar A. Nugraha) > 5. Client hostname in clients.conf instead of IP address (tohaikmeng) > 6. Re: Client hostname in clients.conf instead of IP address > (Fajar A. Nugraha) > 7. Re: add field in radcheck table (gary) > 8. Re: add field in radcheck table (Fajar A. Nugraha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 31 Oct 2011 19:23:09 +0000 > From: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: IPv6 ready? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<20111031192309.GC19191(a)lboro.ac.uk> > Content-Type: text/plain; charset=iso-8859-1 > > Hi, >> Thank you all for your help. I added two more listen blocks in >> radiusd.conf and I updated detail { ... with the following: >> %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but >> ..... (there's always a but). if we use an IPv6 address, then >> Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and >> the path becomes : >> >> ?????????????? ${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log >> >> but FR crashes since it cannot create a folder with that name. Is there >> any way of overcoming this issue? replace : with . or so??? > well, you asked how it could be done..you didnt say you were > trying this on Windows! whats the next surprise? > > I would do something like use PERL to make %{Packet-Src-IPv6-Address} become > sanitized..... eg assign %{Tmp-String-0} and use SED to swap : with - > > this means no single source code line change and easily adaptable to whatever > else you might come across.... > > then use simly use %{Tmp-String-0} in your detail module config.... > > > alan > > > ------------------------------ > > Message: 2 > Date: Mon, 31 Oct 2011 19:25:49 +0000 > From: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: cisco WAP/FreeRadius/OpenLDAP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<20111031192549.GD19191(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> so now the password is not clear text in the log as it was before but >> still seeing that no good password error....but then there is that line >> towards the bottom that sasys user authorized to use remote access... do >> i need to configure Filter-Id or something in the sites-enabled/default >> or innertunnel or something like that? > getting confused with authorization and authentication? check your requirements > in LDAP - do they match (eg CN/DN?) > > have you got PAP listed after the ldap and is the auto_header enabled in the pap > module? > > alan > > > ------------------------------ > > Message: 3 > Date: Tue, 1 Nov 2011 10:07:00 +0800 > From: "gary"<gary.yang(a)browan.com> > Subject: Re: add field in radcheck table > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID:<003901cc983a$f335b490$cd15a8c0@ggyy40fbc8fbae> > Content-Type: text/plain; format=flowed; charset="iso-8859-1"; > reply-type=original > > ----- Original Message ----- > From: "Fajar A. Nugraha"<list(a)fajar.net> > To: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius.org> > Sent: Monday, October 31, 2011 8:34 PM > Subject: Re: add field in radcheck table > > >> On Mon, Oct 31, 2011 at 5:23 PM, gary<gary.yang(a)browan.com> wrote: >>> Hi Fajar >>> I think the secondname field may be realm instead of. >> First rule before asking anything: make SURE you know what you want. >> When you're not even sure, how can others help you? >> >>> I am thinking this in case without proxy, using local database it can >>> determine by two field "username+realm" instead one check field username >>> such as "gary@companyA" . User can see his/her name like "gary" only >>> without >>> "@companyA" character. >> What do you mean "User can SEE"? >> >> The question is simple. What does the user put as username? How do you >> want to process that username? >> >> If the user only inputs "gary", and you don't know how you you can get >> the realm, then how can FR do what you want? By being psychic? >> > Sorry for my poor english. > > From the login page,user can type his name and select pull-down option for > the realm and then send to FR server for authentication. > for example, gary@domain1 and gary@domain2 come from different company and > both in same database. > I can directly input gary@domain1 and gary@domain2 as user name for > authentication. > but I would like to separate two field for checking. > user can see(probably read) user infomation(eg:logout page) only user name > instead of gary@domain1 . > Furthermore, in case lot of data in radcheck, it can be search,sort...etc > according to the realm field to improve server performance. > >> -- >> Fajar >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Tue, 1 Nov 2011 10:02:22 +0700 > From: "Fajar A. Nugraha"<list(a)fajar.net> > Subject: Re: add field in radcheck table > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CAG1y0scMgFLgQivxcF+i12pUyFcMWWzZuXYgn8VdfMmz4QRBqw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On Tue, Nov 1, 2011 at 9:07 AM, gary<gary.yang(a)browan.com> wrote: >>> From the login page,user can type his name and select pull-down option for >> the realm and then send to FR server for authentication. >> for example, gary@domain1 and gary@domain2 come from different company and >> both in same database. >> I can directly input gary@domain1 and gary@domain2 as user name for >> authentication. >> but I would like to separate two field for checking. >> user can see(probably read) user infomation(eg:logout page) only user name >> instead of gary@domain1 . > This is a captive portal setup, right? FR doesn't really care what > user puts in "drop down box", it only cares what the NAS (e.g. > chillispot) sends. And the NAS doesn't really care what the user > inputs, it only cares what the captive portal sends it (which may or > may not be the same as what the user inputs). > > For example, in my setup the captive portal adds a realm automatically > (user can't put it manually) and pre-process the password that user > entered (e.g. using a custom hash). > > In that setup there's really no need to separate user and realm. Just > use the default setup. > >> Furthermore, in case lot of data in radcheck, it can be search,sort...etc >> according to the realm field to improve server performance. > I actually think the easiest way is to just add a "realm" field in > radcheck as ENUM type, indexed, used only for search/sorting purposes, > updated automatically by mysql trigger. That way you don't have to > modify anything on FR side. > -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

4 3