April 2011 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

pam_auth_radius
by Marc Phillips 16 May '11

16 May '11

Not sure if this is the appropriate forum for this, but I'll type it anyway. I have a need to add centralized auth and accounting to unix boxes (specifically a linux based "appliance." It's not really an actual appliance, just a standard linux box that a vendor provides). For my normal unix* boxes I have an identity management system. For appliances and network devices I use Radius, mostly. For this new appliance, I'd like to use Radius, but I don't want to manage users or what groups they belong to on the device itself. I'd like to have the users auth against Radius and then apply a group based on an attribute recieved. I've done a little looking and I see no group support for pam_auth_radius. One thought I had was to add some sort of auto provision function to the pam module to add the user and associate that user with a group via the supplied attribute from radius, then remove the user on logout. Any thoughts on this? Is there some other method that would be more appropriate? I have use for this for other psuedo-appliances. I've tried using LDAP for those, but the chatter with vendor supplied ldap modules was unmanagable. R. Marc

4 7

(no subject)
by arpitha arpitha 08 May '11

08 May '11

hi, 'm very new to freeradius, i want to setup radius server to authenticate another system connected through an access point. i'l b grateful if any1 can tell d steps 2 do this r give links 2 d related materials. Thnks in advance :-)

3 2

Help Compiling ikev2, EVP_sha256 and tncs: Freeradius 3.0
by akinpelu emmanuel 06 May '11

06 May '11

Hi All, Please I am having challange building ikev2 and tncs library into the freeradius 3.0.0. Though I have installed the latest version of ikev2_0.2 and libtnc this is the error message I keep getting, moreover could I be helped on how to indicate the tncs library path in the configure line. ./configure --prefix=/home/fradius/install/radius --with-mysql-dir=/home/fradius/install --with-eap-ikev2-includes=/home/fradius/install/net/include/ --with-eap-ikev2-libraries=/home/fradius/install/net/lib/ |grep warn configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: EVP_sha256 not found, may have issues wirh WiMAX certificates configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-include-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. Thank you Strenght and Honour! Akinpelu Emmanuel 08054711181 ok

3 5

Adding Vendor Specific Attribute to the Access-Accept
by normal ozone 06 May '11

06 May '11

Hello, I want to be able to receive the Vendor Specific Attribute that I set in a user. For example I added the following attribute to my user using daloradius: Vendor: dictionary.freeradius.internal Attribute: User-Category Value: MyCategory In the Oreilly Manual it mentions that Access-Accept can send Optional attributes. Is there a way to setup freeradius so that this attribute can be included in the Access-Accept message? By the way I'm using the installer version of freeradius for my radius server. And my radius client is also a pc (I use a java library named TinyRadius) Thanks. Ishmael

4 6

Multiple MACs per Network
by John Corps 03 May '11

03 May '11

Just a quick question, hope someone has an answer. Does anyone know how, or if its even possible, to do mac filtering for multiple networks? Say I have 1 AP with 2 WLAN SSIDs, I want list of macs allowed access to SSID1 but not SSID2 and list of macs allowed access to SSID2 and not SSID1. As far as I can see now it is a global list for mac authentication and will be applied to all SSIDs. I noticed in the "CALLED-STATION-ID it says the SSID at the end, for example 00-00-00-00-00-00:SSID. If anyone has any insight into this, that would be greatly appreciated. Thanks.

2 10

Mac Auth - Timeout Connecting WiFi
by John Corps 02 May '11

02 May '11

Hello, I had freeradius setup and running perfectly on an ubuntu test machine and now I have done the exact same setup and configuration on a new debian machine with the addition of daloradius for easy configuration by other members of the team. I am running latest freeradius 2.1.10. The ubuntu machine was working perfect for mac auth but now this setup is not working. I try and connect to the WiFi and it always times out. Putting freeradius in debug mode shows nothing useful, it shows that it's sending the access accept packet but the connection times out still. Here is a sample debug, if anyone can be of any assistance it would be great. For reference, I change my AP back to the ubuntu server to do the radius mac auth and connect to the wifi and it sends the access accept and connects right away. Maybe I am missing something here....I don't think its an issue using sql as the ubuntu machine isn't using sql but if i disable sql and use exact config etc the time out still occurs. Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.55 port 1030, id=0, length=160 User-Name = "00-1E-58-F9-A6-94" User-Password = "NOPASSWORD" NAS-IP-Address = 192.168.1.55 Called-Station-Id = "00-20-B0-E6-12-A6:TEST" Calling-Station-Id = "00-1E-58-F9-A6-94" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" Message-Authenticator = 0x946f027f36890c6b16ec5b4132e8e1d9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "00-1E-58-F9-A6-94", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 00-1E-58-F9-A6-94 [sql] sql_set_user escaped user --> '00-1E-58-F9-A6-94' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00-1E-58-F9-A6-94' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00-1E-58-F9-A6-94' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '00-1E-58-F9-A6-94' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 00-1E-58-F9-A6-94 [sql] sql_set_user escaped user --> '00-1E-58-F9-A6-94' [sql] expand: %{User-Password} -> NOPASSWORD [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00-1E-58-F9-A6-94', 'NOPASSWORD', 'Access-Accept', '2011-04-27 15:33:47') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00-1E-58-F9-A6-94', 'NOPASSWORD', 'Access-Accept', '2011-04-27 15:33:47') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.1.55 port 1030 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.55 port 1030, id=0, length=160 Sending duplicate reply to client AP01 port 1030 - ID: 0 Sending Access-Accept of id 0 to 192.168.1.55 port 1030 Waking up in 1.9 seconds. Cleaning up request 0 ID 0 with timestamp +4732 Ready to process requests.

3 5

ERROR in the EAP/PEAP test of eapol_test
by xuyu 02 May '11

02 May '11

Hi ! I meet a ERROR in the test of EAP/PEAP " radtest sqluser 123 localhost 1812 testing123 " is OK ,I just delete the # before 'eap' in radiusd.conf and default files. the test eapol_test -c peap.txt -s testing123 my peap.txt is network={ eap=PEAP eapol_flags=0 key_mgmt=IEEE8021X identity="sqluser" password="123" ca_cert="/usr/local/freeradius/etc/raddb/certs/ca.pem" phase2="auth=MSCHAPV2" anonymous_identity="anonymous" } The result is(too long I cut it,all the messages which contain 'fail'and'warning' are here) rad_recv: Access-Request packet from host 127.0.0.1 port 40004, id=0, length=126 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000e01616e6f6e796d6f7573 Message-Authenticator = 0x028746a6804037ea96543cd3853748ca # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 3 …… [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 40004 EAP-Message = 0x010100160410d8844619dd6d7c77c5de455754592c0b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e0cc3a22e0dc751cc2cadc82e7658db Finished request 1 .…… rlm_sql (sql): Released sql socket id: 2 [sql] User anonymous not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 40004 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e0cc3a22f0eda51cc2cadc82e7658db Finished request 2. Going to the next request …… Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 40004 EAP-Message = 0x0103040019c000000ab416030100310200002d03014da1adfaa31490e821fdfa4885df0c8fc2d0ddd363a209a6143ab7d68062c397000039010005ff01000100160301085e0b00085a0008570003a6308203a23082028 …… [eap] EAP packet type response id 5 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled …… # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800421a0208003d318e803c23b5c6b460818c1e4b130f8f380000000000000000c8a4e6213ba5a367e9b0f70e15b31f87b770936006d21fa70073716c75736572 server { PEAP: Setting User-Name to sqluser Sending tunneled request EAP-Message = 0x020800421a0208003d318e803c23b5c6b460818c1e4b130f8f380000000000000000c8a4e6213ba5a367e9b0f70e15b31f87b770936006d21fa70073716c75736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sqluser" State = 0xf9185daef910470fecfcaff659a7b6a6 server inner-tunnel { # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sqluser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: sqluser [mschap] Told to do MS-CHAPv2 for sqluser with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 8 to 127.0.0.1 port 40004 EAP-Message = 0x0109003b190017030100302ab43a32e6ec7ff42289efbdfda591f3a3562799d9559589146b128457125284645e7d72ef66bb121d8dbb003bdab8ab Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e0cc3a22605da51cc2cadc82e7658db Finished request 9. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 40004, id=9, length=226 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0209006019001703010020b314a72f4acdfaf2dd08dcf94fd6c7082929e8fd0472499fb3f0ba7b79cae39517030100300bbd73ce8691181df7af8f7caabe39c7c75fa967f055a40ba68caf2780dbcf60a2f6b8be08e9d789e433758deacb3e88 State = 0x2e0cc3a22605da51cc2cadc82e7658db Message-Authenticator = 0x6b7fca3ade7064bc39fb78dc05a9d319 # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 10 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 10 Sending Access-Reject of id 9 to 127.0.0.1 port 40004 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. can somebody give me a hand . best regards. thank you!

3 3

Configuration Doubt
by anoop toffy 30 Apr '11

30 Apr '11

I have recently configured freeradius for mac authentication I have a successful login from client . But when trying to connect to server again from client after disconnecting the server is sending a access-reject packet. But when restarted the os and again connecting there is no problem . But when trying to reconnect there exits the earlier mentioned problem. Is this caused due to switch or client os I have also found that for some case the switch is not for warding the request . i am using a DWL-3200 dlink switch why this is happening ? Hope some one will respond .

1 0

IPs will not be assigned
by subcode 29 Apr '11

29 Apr '11

Hi freeRadius users, My goal is a hotspot for a coffee. My freeRadius is on Debian and the Access Point is an Vodafone WLAN Router. All Function of the Vodafone Router are disabled. Only Network Security WPA/WPA2 and Authentication: 802.1X, Server IP: 192.168.2.1, Server Port: 1812, Secret Key: testing123 If I try to authenticated with an Apple Mac, I get the access but no IP, so I don't have Internet. What I'm doing wrong ?? #radiusd -X FreeRADIUS Version 2.1.11, for host i686-pc-linux-gnu, built on Apr 21 2011 at 12:50:54 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "freeradius" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/freeradius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/freeradius/freeradius.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" } client 192.168.2.1/32 { require_message_authenticator = no secret = "testing123" shortname = "freeRadius" } client 192.168.2.88/32 { require_message_authenticator = no secret = "testing123" shortname = "hotspotAP" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "reply_log" from file /usr/local/etc/raddb/modules/detail.log detail reply_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Instantiating module "auth_log" from file /usr/local/etc/raddb/modules/detail.log detail auth_log { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_ippool Module: Instantiating module "lowpool" from file /usr/local/etc/raddb/modules/ippool ippool lowpool { session-db = "/usr/local/etc/raddb/db.lowippool" ip-index = "/usr/local/etc/raddb/db.lowipindex" key = "%{NAS-IP-Address} %{NAS-Port}" range-start = 192.168.188.1 range-stop = 192.168.188.254 netmask = 255.255.255.0 cache-size = 800 override = no maximum-timeout = 0 } Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/freeradius/freeradius.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/freeradius/freeradius.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ################################################# When I try to login: rad_recv: Access-Request packet from host 192.168.2.88 port 34881, id=2, length=138 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000801626f6f Message-Authenticator = 0x4876fa4982588ed7ba6c175a60f6aecc # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry boo at line 1 [files] users: Matched entry DEFAULT at line 35 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.2.88 port 34881 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f215552d1be5738f4b0d4f875 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34882, id=3, length=312 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f215552d1be5738f4b0d4f875 EAP-Message = 0x020300a419800000009a16030100950100009103014db97e5e76dd74cc559d116c7bccdcde68f8641490c1b88691a8348d1de835bc000056c00ac009c007c008c013c014c011c012c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a00170019000101000012000a00080006001700180019000b00020100 Message-Authenticator = 0xff8ee300743754d4ec87a5705ca5ff3b # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 164 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 154 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0095], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.2.88 port 34882 EAP-Message = 0x0104040019c00000089b160301002a0200002603014db97d1e1856dc1db102cdb60379334359c350fd3494b03f5a58ce2f8b1ff0de00002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3131303432313131313832395a170d3132303432303131313832395a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ba7b934ea499f2b2736373422c0982838ae11220f4fba107355d9c302ee14d5bb343fd018fa6bf0f482adad0498cfb111b39cf2ad9ac6b8e5aa6ba3965a5 EAP-Message = 0x51be869a298f1e32fabe2638588fb0ff7503365037a4f58b97302a4ee9b7499adc9bfdc9b15f845cb4344bb4d886699f35cdd25fc96197738b42c09b465b760ab59580f13fa763c44888cc809aefe02d885c2cc00d245a8364604212b497d00b1456906c0b2628fa6ab1a23f44bd4e38fc75953985c3e5f4776013d6cb52a45351871872b78e223bb1518d7ce70f38aa0aaf85b0668ee2a82925755b78d54bd4ff0deb5c0000554a7d2bbac1398a892e77a67244a194caf00700ca2cc1f5c01c05ef0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010087a0f914b4773f8893 EAP-Message = 0x21b931488032bfb518299226902cedb21008a8ba2360ec495cd1dfcee1cee13427005c00d359b1058fc50522a3eb71863d94eec6b2516fd9d457103328c7d1b702f9e436a80db57227ac13aa87729be0d276943a9b8e5909751c55e15f07a040be10383a9694e51b14425d4272338807fc8a01230323f19b616816902a4ae373ded5851950d17ecd6a41c7147c304cdf5afba9a8fd56c74693a218bda99ffd577bc791670ae3702af2d854535ff0c193ffe3259443cb4a222d2a613f465c560843a1f9c7fa98b874e22c81dc6e93c6a1ed8479f7615c4638310f6134ee34009e6be8a53e19ec7dbaf144a08457026ec4642f90e8e3e99f0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f205252d1be5738f4b0d4f875 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34883, id=4, length=154 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f205252d1be5738f4b0d4f875 EAP-Message = 0x020400061900 Message-Authenticator = 0xccf21f87cc15a1696d8dcee766ed27fb # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.2.88 port 34883 EAP-Message = 0x010503fc194000abc71f33573e3fde300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303432313131313832395a170d3132303432303131313832395a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a2d198e35bf353e8a6b75d29e1cea897998fdacf40b9328cf84a7ff6ca0d03d3ee11864836b4f43a7cfb4b06cdd2d9e4a4b0f4e93f6ecac75a63229e53dff975dfa2e18b44c49c5bfbc9cdab97ca9d2215908ec6dc0cf041b02202424f4dceaf331f85a9bcda3c7db89a5f0a46b8e1 EAP-Message = 0x965131641bc6a7402647041af554d0f0105f86614f35f1849b00a6a9f068ab233d25a2a2e42e5c7f04be27386de260ea1608c69aa57c4bbf107a5ef765835a36f77c02ebddad36f49733886f98c62a00fd66ebdd67118a9652cd9fe63303b8ea4d85a4b4eeeaa1434f81d10270ab02700d1dbf73313f930d79c3fb05e6fbcf17d2206b55806368897c5d84cae3d215dd8b0203010001a381fb3081f8301d0603551d0e04160414752dd439d6e5377b7ec304e788fb9a1dc7c6c6683081c80603551d230481c03081bd8014752dd439d6e5377b7ec304e788fb9a1dc7c6c668a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900abc71f33573e3fde300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100017d1dd439df54d86d72b4d890d1a3f25cd5382e6f4464fbae1e922b3e48c041d6fbfbf759b89e8b65f7ab37ac5c0f7806c5a21ef8946eb13dc40739face77fb6015b46197254fba2cc42e202b699be9ab6b EAP-Message = 0x94f19ec8c3e9828c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f235352d1be5738f4b0d4f875 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34884, id=5, length=154 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f235352d1be5738f4b0d4f875 EAP-Message = 0x020500061900 Message-Authenticator = 0x0737e559ac7aca02525f81a36a74ff09 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.2.88 port 34884 EAP-Message = 0x010600b51900a4d2aa9097ff1df73961157c8680b7d2d222fa071ad58b9fca37a8a973d37fd64e99856c900bee026b84ee5cf875aa97036dda3b3fe893dbe469f5954c1efe1fbf0b579d3a8c50b2b56fc312c956f9a676a0ff9062bcb3430cb5fe6a344855261a4ac3c3a35b4fac6c197a2868adde65e595adc8aab2091b9793e9d9cec0698fbee4029caecf271efedea75de52f7f064f3c4e78f5f4632ea06342417f5f54295d67749f1a1a16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f225052d1be5738f4b0d4f875 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34885, id=6, length=407 User-Name = "boo" NAS-IP-Address = 0.0.0.0 State = 0x21564b2f225052d1be5738f4b0d4f875 EAP-Message = 0x0206015019800000014616030101061000010201006ca46f309f60a272907b09742bbd6100ff1d97597bc5a6ba73d3600812ff5b85589637985667847f7c3da60ef6cd233db473a7100ce780a9515d9c2415e7ef02ed7769ccbf0e209887d8692aa307d3ce6c2b8acfd1695ac9e27ccca4b2f15589e3bb3ac84c957221144a69890bdde0be8f6839089e216a59d0336247bcc851b508774114bb5e122dec2da2924afa5d7103ac50fc694eed3ae1655d361c2d34d6b092bd2cf4066cf3e442f5092fd73f0d04a6b37d9d46cc2d7e7205e29302821b920352dd74dcaa2f5c6df2dbaf164a2cea2cab0b13b1c8aa5973a75d71209525b4350441b349575f EAP-Message = 0x609eababb6acaac76f6919caba347c9564a944d571c47e361403010001011603010030e0f817eccd6b1e3d3dbb4a155b54615f54e28d57e1ed59f028ffbe79f74bbaa05cc8389a4c225f8f680df2db29ade738 Message-Authenticator = 0x7bbe6e979530ef41b057bc2375596b5d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.2.88 port 34885 EAP-Message = 0x0107004119001403010001011603010030ce12d6807d88bab2980e98b0f283310fee7d98d752c5b6e402e42e470eee21cca886ddf5e8e52d9b875365d199bad24c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f255152d1be5738f4b0d4f875 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34886, id=7, length=154 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f255152d1be5738f4b0d4f875 EAP-Message = 0x020700061900 Message-Authenticator = 0xf2bdb6c7a41e68097e6a008123ae0f00 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.2.88 port 34886 EAP-Message = 0x0108002b19001703010020d0cee21eb335a040d6bd754aa615cef1948b2cde3e3c7b2ccc5f13d671ebf9fb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f245e52d1be5738f4b0d4f875 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34887, id=8, length=191 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f245e52d1be5738f4b0d4f875 EAP-Message = 0x0208002b19001703010020405e092a1d2516394fa461fb0ba74d4a16dbfbf28910f65768172f9cb7794a36 Message-Authenticator = 0xa812767590aef81207611d0a42284e50 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - boo [peap] Got inner identity 'boo' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0208000801626f6f server { [peap] Setting User-Name to boo Sending tunneled request EAP-Message = 0x0208000801626f6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "boo" server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry boo at line 1 [files] users: Matched entry DEFAULT at line 35 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 EAP-Message = 0x0109001d1a010900181075bbc07ced4c612749e0e8e0386b7ee1626f6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b052bf57b0c31153b0f177e7b600567 [peap] Got tunneled reply RADIUS code 11 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 EAP-Message = 0x0109001d1a010900181075bbc07ced4c612749e0e8e0386b7ee1626f6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b052bf57b0c31153b0f177e7b600567 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.2.88 port 34887 EAP-Message = 0x0109003b190017030100301c4beaf4f10b88ae58ea76a9ad2005383cedae18fa55caea3b8800d4b505f75fd8f2f9f2b3045b6b4d1cf9f71389b0d4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f275f52d1be5738f4b0d4f875 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34888, id=9, length=239 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f275f52d1be5738f4b0d4f875 EAP-Message = 0x0209005b190017030100503da01a62411430004d35d925f057c5b0e201cfdaf1e5355f65830c4cf9ba1248fd7204b918c71d5b10ac9b0790dafc5188b26cbc3f0669ffbc58986a3bb370549f1b0a8c5344993960f5641f973113ba Message-Authenticator = 0x78c509cbc9fff3c74d8f6c9d85b30826 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209003e1a0209003931de52063462a94106e57f7099d8e0773f000000000000000063e989f957274b81934fa1ea116e083291dad00b70d09f3000626f6f server { [peap] Setting User-Name to boo Sending tunneled request EAP-Message = 0x0209003e1a0209003931de52063462a94106e57f7099d8e0773f000000000000000063e989f957274b81934fa1ea116e083291dad00b70d09f3000626f6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "boo" State = 0x7b052bf57b0c31153b0f177e7b600567 server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 62 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry boo at line 1 [files] users: Matched entry DEFAULT at line 35 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: boo [mschap] Told to do MS-CHAPv2 for boo with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 EAP-Message = 0x010a00331a0309002e533d45313233383738423637303137354532443645443430354133413235374436333433344145343233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b052bf57a0f31153b0f177e7b600567 [peap] Got tunneled reply RADIUS code 11 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 EAP-Message = 0x010a00331a0309002e533d45313233383738423637303137354532443645443430354133413235374436333433344145343233 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b052bf57a0f31153b0f177e7b600567 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 9 to 192.168.2.88 port 34888 EAP-Message = 0x010a005b190017030100509b93bf40fa19ae992fdfa3eae3312a4a932c5a88207d36acffc7806b19f955a09542dd5937a922b690d579406985db74cee8ebc94b5c2627588866c271d4325cce1fe1b440eaafc855a1565833055a0b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f265c52d1be5738f4b0d4f875 Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34889, id=10, length=191 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f265c52d1be5738f4b0d4f875 EAP-Message = 0x020a002b1900170301002053bcaf27a58802b86c8d5b6777ef0296385e5be23e396c40ed305ed77ea2e9b8 Message-Authenticator = 0x224760a4c0364af7397d0559fab335fd # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { [peap] Setting User-Name to boo Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "boo" State = 0x7b052bf57a0f31153b0f177e7b600567 server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry boo at line 1 [files] users: Matched entry DEFAULT at line 35 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [boo/<via Auth-Type = EAP>] (from client hotspotAP port 0 via TLS tunnel) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group post-auth {...} [reply_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/reply-detail-20110428 [reply_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/reply-detail-20110428 [reply_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[reply_log] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 MS-MPPE-Send-Key = 0x20a3e5676c77a165281a401a34715be3 MS-MPPE-Recv-Key = 0xcd5b9a0f61b4689c50b6135da431ca10 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "boo" [peap] Got tunneled reply RADIUS code 2 Service-Type = Framed-User Framed-IP-Address = 192.168.182.25 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 MS-MPPE-Send-Key = 0x20a3e5676c77a165281a401a34715be3 MS-MPPE-Recv-Key = 0xcd5b9a0f61b4689c50b6135da431ca10 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "boo" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 10 to 192.168.2.88 port 34889 EAP-Message = 0x010b002b19001703010020e67ea9a01196c47891598997b944844d8f4208aadc79901497e7418404c87379 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21564b2f295d52d1be5738f4b0d4f875 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.2.88 port 34890, id=11, length=191 User-Name = "boo" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "88-25-2C-AD-86-F2:EasyBox-AD86\000" Calling-Station-Id = "00-26-08-ED-A8-99" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x21564b2f295d52d1be5738f4b0d4f875 EAP-Message = 0x020b002b19001703010020bc0e31f31297bb2ab862ef71e87d0173d659ab263723f83f80e3ab05ef3f0f07 Message-Authenticator = 0x068a9407a2d2daef5f3e4d9763f6af35 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.88/auth-detail-20110428 [auth_log] expand: %t -> Thu Apr 28 16:43:42 2011 ++[auth_log] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "boo", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [boo/<via Auth-Type = EAP>] (from client hotspotAP port 29 cli 00-26-08-ED-A8-99) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} [lowpool] Could not find Pool-Name attribute. ++[lowpool] returns noop ++[exec] returns noop Sending Access-Accept of id 11 to 192.168.2.88 port 34890 MS-MPPE-Recv-Key = 0xa9247a3f9ba78f9650cb12fe6d5e296c4a0cdda99d3a66e0e2956ebeed60438c MS-MPPE-Send-Key = 0xed10d0e4228c99f5dd75e8da1e5e94ee85960cdfc6a2c877ecce79948038a0b1 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "boo" Finished request 9. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 2 with timestamp +171 Cleaning up request 1 ID 3 with timestamp +171 Cleaning up request 2 ID 4 with timestamp +171 Cleaning up request 3 ID 5 with timestamp +171 Cleaning up request 4 ID 6 with timestamp +171 Cleaning up request 5 ID 7 with timestamp +171 Cleaning up request 6 ID 8 with timestamp +171 Cleaning up request 7 ID 9 with timestamp +171 Cleaning up request 8 ID 10 with timestamp +171 Cleaning up request 9 ID 11 with timestamp +171 Ready to process requests. ############################################### user: "boo" Cleartext-Password := "boo" Service-Type = Framed-User, Framed-IP-Address = 192.168.182.25, Fall-Through = yes "blu" Cleartext-Password := "blu" Service-Type = Framed-User, Fall-Through = yes DEFAULT Pool-Name := "lowpool" Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP Can somebody help my?? Thanks in advance -- View this message in context: http://freeradius.1045715.n5.nabble.com/IPs-will-not-be-assigned-tp4346701p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5