August 2011 - Freeradius-Users - lists.freeradius.org

Using multiple authentication modules.
by Mrinal K 09 Aug '11

09 Aug '11

Hello everyone, I am trying to authenticate users using client certificates and when that is verified I intend to use perl module for checking other attributes and verify that from database. Till now I was trying to configure freeradius to do EAP-TLS and then execute the perl module(rlm_perl). Both of them work perfectly fine independently but I donot know if we can put them together. I believe I can do something similar(checking certificate using EAP and then execute a script) using exec-program-wait but considering its depricability and per thread overhead will like the rlm_perl. Any help is appreciated. Regards, Kumar Mrinal

2 2

AW: User Problem with Cisco Nexus 4.x
by Jan.Gnepper＠t-systems.com 09 Aug '11

09 Aug '11

Hi, I found the problem on my own. Cisco Nexus with NXOS Version older than 4.2 (4.0 and 4.1) don´t like the entry "Vendor-Specific = 9". It seems that freeradius add this automatically if it´s not within the config. But, when i put it in the config, the dump shows "bad udp checksum", wireshark "AVP too long". When i remove this line from the config, "vendor-specific=9" is also transmitted, but without checksum/avp too long error. Is this behavior documented anywhere? I didn´t found this. Jan

2 1

Re: radutmp - key change
by Alan Buxey 08 Aug '11

08 Aug '11

As per my initial email then ;) alan ----- Reply message ----- From: "Daniel Hurran" <daniel.hurran(a)bglobalmetering.com> Date: Mon, Aug 8, 2011 16:00 Subject: radutmp - key change To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Fixed! I had: key = %{Calling-Station-Id} instead of: username = %{Calling-Station-Id} in: /etc/freeradius/modules/radutmp Many thanks. -----Original Message----- From: freeradius-users-bounces+daniel.hurran=bglobalmetering.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+daniel.hurran=bglobalmetering.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: 08 August 2011 15:04 To: FreeRadius users mailing list Subject: Re: radutmp - key change Hi, > Hi Alan, > > Whatever I change it to, it still prints out at debug, username = "%{User-Name}". Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{Calling-Station-Id}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } thats with username = %{Calling-Station-Id} in modules/radutmp are you editing the RIGHT directory and file? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Make Energy Count - that's what we do. Visit Bglobal's website at www.bglobalmetering.com<http://www.bglobalmetering.com> to find out how our smart meter service delivers 100% accurate bills for our customers and helps them cut costs, drive down consumption and reduce their carbon footprint. This message is private and confidential. If you have received this in error, please notify us at info(a)bglobalmetering.com and remove it from your system. The recipient should check this email and any attachments for the presence of viruses. Bglobal accepts no liability for any damage caused by any virus transmitted by this email. ----------------------------------------------------------------------------------------------------------------------------------------- This email message has been delivered safely and archived online by Mimecast. For more information please visit http://www.mimecast.co.uk ----------------------------------------------------------------------------------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

radutmp - key change
by Daniel Hurran 08 Aug '11

08 Aug '11

Hi all, I am trying to change the key in the radutmp module from username to calling-station-id. I have made the change in the radutmp file, but I try freeradius -X the debug says that username = "%{User-Name}". I was expecting username= %{Calling-Station-Id}. Is this correct? Whatever I put in the key, the debug says username. Dan -- FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu radutmp radutmp_CSID { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} key = %{Calling-Station-Id} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp_CSID" from file /etc/freeradius/modules/radutmp radutmp radutmp_CSID { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Make Energy Count - that's what we do. Visit Bglobal's website at www.bglobalmetering.com to find out how our smart meter service delivers 100% accurate bills for our customers and helps them cut costs, drive down consumption and reduce their carbon footprint. This message is private and confidential. If you have received this in error, please notify us at info(a)bglobalmetering.com and remove it from your system. The recipient should check this email and any attachments for the presence of viruses. Bglobal accepts no liability for any damage caused by any virus transmitted by this email. ----------------------------------------------------------------------------------------------------------------------------------------- This email message has been delivered safely and archived online by Mimecast. For more information please visit http://www.mimecast.co.uk -----------------------------------------------------------------------------------------------------------------------------------------

2 4

Freeradius closes
by john 08 Aug '11

08 Aug '11

The radiusd keeps closing and i have to restart it. I am running 2.1.11 on this server but i have recently upgraded to this and it was happening before. The program uses up all the memory on the computer which is 4GB and I have enclosed a picture of this. I can send what ever config files you need to help me discover this problem. We are using a MySql database to keep track of customer accounts and usage. free -m total used free shared buffers cached Mem: 3291 1462 1829 0 123 331 -/+ buffers/cache: 1006 2284 Swap: 6427 0 6427 -- John Babineaux Network Admin Radio Communications Service Crowley, Louisiana

4 11

Cleanup Stale Sessions - needed?
by Paolo Di Francesco 08 Aug '11

08 Aug '11

Hi Radius Gurus I have a problem with one not-so-typical situation. First of all, I am running daloradius on top of Freeradius: [root@radman ~]# radiusd -v radiusd: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. I have just update my network topology and therefore I moved some NASes from one server to another. When I did this change, obviously I did it without worrying what could happen to the radiusd. So I simply moved the NASes on new IPs/servers and restarted the radiusd. Now I have the users trying to get into the network but they look "online" to radiusd on the old NASes. In few words the connection is refused because radiusd thinks that the user is ALREADY online on the "old NAS" (not true) and it does not permit the user to get into the network. So I have this teasing menu option in daloradius which is called "Cleanup Stale Sessions". I think it does exactly what I need but: 1) I do not want to break the radiusd 2) I do not want to loose my radius logs ("who had that IP that day..") 3) I do not know if this is the right "button" to click So I am asking you if you have any idea of how to solve this issue and if I should click that button Thank you in advance (radiusd log follows) ----------------------------------------------------------------------- Auth: Multiple logins (max 1) [MPP attempt]: [myuser(a)mynet.org] (from client xyz port 45118 cli 00:15:6D:5E:0A:82) ----------------------------------------------------------------------- -- Ing. Paolo Di Francesco Level7 s.r.l. unipersonale Sede operativa: Largo Montalto, 5 - 90144 Palermo C.F. e P.IVA 05940050825 Fax : +39-091-8772072 assistenza: (+39) 091-8776432 web: http://www.level7.it

6 11

Devices in more than one huntgroup
by Jan.Gnepper＠t-systems.com 08 Aug '11

08 Aug '11

Hi, I have a little problem with devices in multiple huntgroups. By now i kno that this is not possible (rtfm helped ;-) What i wanted to do is the following: Two Teams, but with diffenrent rights. Users: ==================== DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", LDAP-Group == "<Team-1-Group>" Login-Service = Telnet, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" DEFAULT Auth-Type := LDAP, Huntgroup-Name == "readonly-nexus", LDAP-Group == "<Team-2-Group>" Login-Service = Telnet, Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\"" Huntgroups: ==================== readonly-nexus NAS-IP-Address == 192.168.11.123 Nexus NAS-IP-Address == 192.168.11.123 Since only the first match within the huntgroups is checked, team-2 always gets "access-reject". For checking only the NAS-IP-Adress makes sense in our environment. I already found a hint to use rlm-passwd, but i can´t get this run. So i tried the following: ======================= Users: DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", My-Device-Group "Nexus-readonly", LDAP-Group == "<Team-2-Group>" Login-Service = Telnet, Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\"" modules/passwd: passwd Groups_local { filename = /etc/raddb/groups_local format = "My-Device-Group:*NAS-IP-Address" hashsize = 50 ignorenislike = no allowmultiplekeys = no delimiter = ":" } groups_local: Nexus-readonly:192.168.11.123 dictionary: ATTRIBUTE My-Device-Group 3000 string ======================= Groups_local was placed in authorize section, after preprocess. Debug shows: Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.123 port 48910, id=20, length=62 User-Name = "test" User-Password = "test" NAS-Port-Type = Virtual NAS-Port = 3000 NAS-IP-Address = 192.168.11.123 +- entering group authorize {...} ++[preprocess] returns ok ++[groups_local] returns notfound Any Idea? Or is there a big bug in my config (and my mind)? Thanks! Jan

1 0

Accept a number of MAC address per login
by ShR3K 07 Aug '11

07 Aug '11

Hello, I would like to authorize a user to connect to the freeradius server with a maximum of 3 PC. I added a counter, an attribute for the check-name and a line in radcheck table but for my counter I'd like a query like this : select (COUNT(distinct CallingStationId)) FROM radcheck WHERE UserName='user_login' AND CallingStationId !='MAC_client' But there is I think, only one key and I need two. How can I do it ? Thank for your help ! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Accept-a-number-of-MAC-address-per-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

CISCO Freeradius Qouta
by Student University 07 Aug '11

07 Aug '11

Hi , Can any one please point me of how i can configure cisco freeradius prepaid billing and download capping . Best Regards ,,, Lily

3 3

Certificate problems? Freeradius 2.1.10 on Debian squeeze
by John Dunning 05 Aug '11

05 Aug '11

Greetings all, We've been running freeradius 1.x on Debian Lenny for some time with great success authenticating against Novell eDirectory/LDAP. Our Linux guru has moved on to exciting new opportunities and while the rest of us are decent at linux we're certainly missing his input here :) We're trying to update the system to Squeeze and move from eDirectory to Active Directory authentication to stay more easily within the debian package scope. I think I largely have the system setup to do EAP-TLS/PEAP/MS-CHAPv2 with Windows 7 supplicant but for some reason I can't seem to get the EAP-TLS tunnel to fire up. I've tried going through http://wiki.freeradius.org/Certificate_Compatibility with the delivered certs (which are evidently supposed to be compatible) but I seem to be missing something. I've got NTLM_AUTH working correctly (once I actually get that far), so I'm hoping that if I can get this cert issue figured out I'll be good to go. Using a Cisco AIR1220 AP and have tried both Windows 7 and android supplicants and get the same problem (see -X log below). Thanks in advance!! JD FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.45.0.11 { require_message_authenticator = no secret = "foobar21" shortname = "4404-mgmt.wsc.edu" } client 10.47.249.248 { require_message_authenticator = no secret = "foobarness" shortname = "WsC_Test" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs/demoCA" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/freeradius/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=AD --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca451c31ca4605d06e0c9d5ff0a7f534 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 8 with timestamp +13 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xca451c31ca4605d0 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2bf8e8132bfbf120b4d5c62002395e36 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 8 with timestamp +18 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2bf8e8132bfbf120 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9188c59f918bdc2d1221f68a8a03e034 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 8 with timestamp +23 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x9188c59f918bdc2d did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 10.47.249.248 port 1645, id=8, length=125 User-Name = "jodunni1" Framed-MTU = 1400 Called-Station-Id = "0017.9581.ba20" Calling-Station-Id = "0016.eaa1.ef80" Service-Type = Login-User Message-Authenticator = 0xcc8120a7ee5b558f37b713574d223cee EAP-Message = 0x0202000d016a6f64756e6e6931 NAS-Port-Type = Wireless-802.11 NAS-Port = 281 NAS-IP-Address = 10.47.249.248 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 70 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.47.249.248 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc5d30e4fc5d01719fb9e549c1d6ae390 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 8 with timestamp +29 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xc5d30e4fc5d01719 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests.

2 1