January 2012 - Freeradius-Users - lists.freeradius.org

Help with proxy settings please
by lmgo5991 12 Jan '12

12 Jan '12

Hi, Could someone please shed some light on the where we are going wrong. We have followed the documentation provided however it is unclear where to reference our internal ad servers. I have attached the output from our radiusd -X:- Ready to process requests. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=134, length=256 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x0202001a017261646c64617075736572406763752e61632e756b Message-Authenticator = 0x5499ecdd3317903a396087c244b3242f # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 134 to 10.1.5.4 port 32768 EAP-Message = 0x0103001604101c5f6a48076abb9c734e38981c7217e2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba7ac260d5c80b69f521e95f1c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=135, length=254 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020300060319 State = 0x7ac164ba7ac260d5c80b69f521e95f1c Message-Authenticator = 0xa525aaece160f6dbfacf7cdb4b93c3a5 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 135 to 10.1.5.4 port 32768 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba7bc57dd5c80b69f521e95f1c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=136, length=353 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x0204006919800000005f160301005a0100005603014f0edd9d5db5b4c865a2f751dfae8b6187fcb5cbfc5719ebf587861508615770000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0x7ac164ba7bc57dd5c80b69f521e95f1c Message-Authenticator = 0x03b789c11ed6d11218b952f2e5f5758e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 136 to 10.1.5.4 port 32768 EAP-Message = 0x0105040019c0000008a216030100310200002d03014f0edd9d03560cec979059501c8cb223202dcbe9f787e3323f05325b9821b97c00002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3132303131303133343330395a170d3133303130393133343330395a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c117ba859c40ab6c9df33856b7985dc37a8b1895739aeaab7157d5ea2e9351258e3c0d9c0c3efe2c4b0033f03974114c216727611cc0f5 EAP-Message = 0xf881e7b997bc7fa59faa23ddf197215fefca1c31fe9d7c5b910313f578cbd74a6a5e3725977373fa7d52d49e9e5bb230fd8884c70fa161daa1aa41d3f2f3f2772373c6ff597f3b875ac653726f1cd9c5fbcbe15e3edf868382a06faf9b1e2a6047a07bbc44cc6cf936c0eac3b8e02598a425acb8497dd0671f28f5c1c3d34b3ef96d3cdacfd9e67943886fdbd11a1f5e9ccb7782ea91590fcdf102206af05203318829e68284c56cf60c6b4c41dd8542c0ffd6fb4cb079e33d7a333823706fa8e08c312b02470207990203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101009a8e EAP-Message = 0x0d156b951e3e1c68fde3e69734c9dc4c59e4c6893458c4d7f3d7c620d73016d610fb769485229a62c864b8d131f09a8ea41497de055dc2a23f8b2543c2d3df122c157c0de2b92ef98c7c4daceb55ec911af59c0cb6f6dfdfa6a51a0949b12497cd4468de4acfe75e18b1bf0529f8e6d1d280039bc7db3cfcfd92711264d06ab670639a90241e869fb80a0b169525739fd89956a23f0892f1160f18e61dd19ccde9d13a07181fc8c49d245f8e18d0e0377d74d9a825706eb72a07de786844b4583e3fa436142ef00d7455b0b5abccbacbf5472f01acbb90f31a62cbc6fac632c10b2207320714cba517085a86fff56fa65942146ec3e3cdb4ebc7b4e873 EAP-Message = 0x920004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba78c47dd5c80b69f521e95f1c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=137, length=254 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020500061900 State = 0x7ac164ba78c47dd5c80b69f521e95f1c Message-Authenticator = 0x7892f991b7fd777154282e08a9b81237 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 137 to 10.1.5.4 port 32768 EAP-Message = 0x010603fc1940a003020102020900ef2b35f9535b384c300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3132303131303133343330395a170d3133303130393133343330395a308193310b3009060355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f4164566b7242c5321d0372720b25fa2508bb0e0e69fa4200d5a45bb8321f3fc3d589eb314e096337df2d466fbccdc53468a9f64b6c3875cea83aeedeec1a2dc982ac3e28c76a006800bc899e4e74ba3c30ae3edb6838f74899c0879436d75cdb43dbff784cc9faa EAP-Message = 0x04fa999054d652fcc983323e947facaa0995377e18f4346c7f18aeb4e668c8efa63fd90711ee0d562dd92ed9f41243589b24157e3c27ba4a10f3721b091375ff5a9665ed876e97f3a2f682bb1ec64d6e760b7a7013b82c55eaec4f1bccd7fce7fef196042328993f84cb6c8c9e5dbafca5e67d5eb30cc9bdda8944148674e17b30d20c17701ce8edf0e72cff4d44d88291093bdb753e79130203010001a381fb3081f8301d0603551d0e0416041429a311aa3d3d8cd2c10255f7397c9b0d2fda2b1b3081c80603551d230481c03081bd801429a311aa3d3d8cd2c10255f7397c9b0d2fda2b1ba18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900ef2b35f9535b384c300c0603551d13040530030101ff300d06092a864886f70d010105050003820101004a8f28098c96a3b0fd243f8dbcc988d21bcea65a3cd7a25e942c7098eb87fdc988638a1cda11ceb07c697cae9bb0f7418e68cb203c7b74c83b206fba51f94f1248b134cd0800c7bcbc9757 EAP-Message = 0x710a4c17dd921848 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba79c77dd5c80b69f521e95f1c Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=138, length=254 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020600061900 State = 0x7ac164ba79c77dd5c80b69f521e95f1c Message-Authenticator = 0x73ed972e163dc4c11fa01ec993089b67 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 138 to 10.1.5.4 port 32768 EAP-Message = 0x010700bc1900a9b1e8772b2c313f49e39433ff8946473b1c7735aeee9122316edd5eaeee17df8e2e28d2b24eb023fec1dda7fb5a827ce37c90bc0a8c65e430ad395c05233bcbcddc48e210be210608d35d8c52c0a3e9a083cbc3800521b24478c9eb9c5d30242a6acd250d94aaf05b1e9b5576cd738e4c15b33eac2dc3debb676dd14f93e053fcabf4eb05ee243f18d59fa89cbd8a34831f9bcb7095ad1839c70ecd9f99fb28a7c2d269ac6635398ad8df96c716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba7ec67dd5c80b69f521e95f1c Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=139, length=586 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020701501980000001461603010106100001020100a7152cd57ec079fae3650588277422a1016560e87f6575a85b94d333aaf270504d1c07b01660f5ad8f883be6885704ce1ad4410218a114c8cae3b968d0e374e37d2c0e50ef0cc0149e432f7f0b100dad12c87c44e7e5fc587367d2a7c2fa76dc68bb3ff8bbfcd897ea92383c2e6852ed0b69149a1423a8e599f87d754764eb20e016a8b58cf558fad666fac3f584a6f7aa1dc1214f791005d5582e716cece4b8badf01a9cc0ea32d64a8110b4f54b409028c97bb4eb8ade9639e04f3ecce83175f5c1703362587f4308adfe7f6ae5c54777631a032c0597ee8e9faff8c4219a480bbe430cece324b EAP-Message = 0xe865b8252b9e5557e6bc3d46bf66bbf3c8b7cbbf2dc42f641403010001011603010030e0b46052ab8a4da1b135f6f5e578f82d2e6f4b048e266b69ba54e05ae42356d0cc519a6955905703427428e7532cc6cc State = 0x7ac164ba7ec67dd5c80b69f521e95f1c Message-Authenticator = 0xc7fc61b4c3a2bbe4457d446834e40761 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 139 to 10.1.5.4 port 32768 EAP-Message = 0x0108004119001403010001011603010030fbedfd1da06a9cdcb52184ddf667e4b93afc8e272607ecd4871ea47424226641e0202a8a0d7f26466f25af01993c68d6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba7fc97dd5c80b69f521e95f1c Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=140, length=254 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020800061900 State = 0x7ac164ba7fc97dd5c80b69f521e95f1c Message-Authenticator = 0x85455c0b6137e3ebac0d29171c9d12ed # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 140 to 10.1.5.4 port 32768 EAP-Message = 0x0109002b19001703010020923f894cbac0014e859657b96e37111fe7cae95914b3150e3ed33da67a5ac794 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba7cc87dd5c80b69f521e95f1c Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=141, length=307 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x0209003b1900170301003037487b34fb7a37ea8a6fea8a7261897f8b237f51856360d5060faf8162fe68e53d4ccbfcb7ed9ae34099fa05f8147aee State = 0x7ac164ba7cc87dd5c80b69f521e95f1c Message-Authenticator = 0x9c731ef70cc9623d9805ac8f901da10b # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 9 length 59 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - radldapuser(a)gcu.ac.uk [peap] Got inner identity 'radldapuser(a)gcu.ac.uk' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0209001a017261646c64617075736572406763752e61632e756b server { [peap] Setting User-Name to radldapuser(a)gcu.ac.uk Sending tunneled request EAP-Message = 0x0209001a017261646c64617075736572406763752e61632e756b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "radldapuser(a)gcu.ac.uk" server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 9 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a002f1a010a002a10bd3c8890bc23da511e37ca5fec98739e7261646c64617075736572406763752e61632e756b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xff362c18ff3c36b5f2b64db14083f710 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a002f1a010a002a10bd3c8890bc23da511e37ca5fec98739e7261646c64617075736572406763752e61632e756b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xff362c18ff3c36b5f2b64db14083f710 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 141 to 10.1.5.4 port 32768 EAP-Message = 0x010a004b1900170301004061ed8cb4cf38f7cf13ef4ad3aa9cf3c5935cb84d24c96cca8e584bdddfdff337ddd120844d64379a5dc6d33586a31439389764f3e2c438be5025a26111634334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba7dcb7dd5c80b69f521e95f1c Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=142, length=371 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020a007b190017030100704c2199bf1d81341c6096220d061bf1b5cd1da35100eb4beeaa39b81708be66ef899509483141d7d1929d28ab1b76d772dcea676dbccb0b849fb838c1d6e8adb0be3951ef6d4a0869738c62f47a47efab30beab42bf9e3db812221c44ed60a1b6a747193f65b8dfbc811e9844a69a259d State = 0x7ac164ba7dcb7dd5c80b69f521e95f1c Message-Authenticator = 0x44ad26aeac4f41bf70316f3663d0c9a0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 123 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00501a020a004b317c3f214b10b27f29753acc6d42f57139000000000000000076c36f51916f66cde9fcb4e85c89c21d89710096cb80ad54007261646c64617075736572406763752e61632e756b server { [peap] Setting User-Name to radldapuser(a)gcu.ac.uk Sending tunneled request EAP-Message = 0x020a00501a020a004b317c3f214b10b27f29753acc6d42f57139000000000000000076c36f51916f66cde9fcb4e85c89c21d89710096cb80ad54007261646c64617075736572406763752e61632e756b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "radldapuser(a)gcu.ac.uk" State = 0xff362c18ff3c36b5f2b64db14083f710 server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 10 length 80 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: radldapuser(a)gcu.ac.uk [mschap] Told to do MS-CHAPv2 for radldapuser(a)gcu.ac.uk with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 142 to 10.1.5.4 port 32768 EAP-Message = 0x010b002b190017030100203f674d96b6c9b1c4d556badd2e95018be8b7d76ef19096513bb0fcc442edcb2a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7ac164ba72ca7dd5c80b69f521e95f1c Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.1.5.4 port 32768, id=143, length=291 User-Name = "radldapuser(a)gcu.ac.uk" Calling-Station-Id = "00:24:2c:7a:d8:7d" Called-Station-Id = "00:26:cb:80:33:20:eduroam" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a0105040000025f4f0edac4" NAS-IP-Address = 10.1.5.4 NAS-Identifier = "CLIC_WiSM_A" Airespace-Wlan-Id = 9 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "914" EAP-Message = 0x020b002b190017030100202f0f420fda76a7ad73b12963caead406e813362b7a25b49616b772582cca7083 State = 0x7ac164ba72ca7dd5c80b69f521e95f1c Message-Authenticator = 0x15128e7f4d056ad5a975f35d8851cfbc # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "gcu.ac.uk" for User-Name = "radldapuser(a)gcu.ac.uk" [suffix] Found realm "GCU.AC.UK" [suffix] Adding Stripped-User-Name = "radldapuser" [suffix] Adding Realm = "GCU.AC.UK" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> radldapuser(a)gcu.ac.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 143 to 10.1.5.4 port 32768 EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 134 with timestamp +16 Cleaning up request 1 ID 135 with timestamp +16 Cleaning up request 2 ID 136 with timestamp +16 Cleaning up request 3 ID 137 with timestamp +16 Cleaning up request 4 ID 138 with timestamp +17 Cleaning up request 5 ID 139 with timestamp +17 Cleaning up request 6 ID 140 with timestamp +17 Cleaning up request 7 ID 141 with timestamp +17 Cleaning up request 8 ID 142 with timestamp +17 Waking up in 1.0 seconds. Cleaning up request 9 ID 143 with timestamp +17 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-with-proxy-settings-please-tp5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

VPMS and logging
by Patrick M. Hausen 12 Jan '12

12 Jan '12

Hi, all, I have set up VMPS with FreeRADIUS 2.1.12 to use with our internal Cisco switches. After finding the sample files and some documentation with Google, I'm quite satisfied with the result. At least everything seems to work as designed. Besides … ;-) logging seems to be somewhat inconsistent. Here's what radiusd -X outputs when I connect my personal workstation to the network: (addresses anonymised) -------------------------------------------------- VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 892 VMPS-Client-IP-Address = 1.2.3.4 VMPS-Port-Name = "Fa0/21" VMPS-VLAN-Name = "--NONE--" VMPS-Domain-Name = "Hausnetz" VMPS-Unknown = 0x00 VMPS-Ethernet-Frame = 0x0050…… server vmps { Doing VMPS +- entering group vmps {...} ++? if (!VMPS-Mac) ? Evaluating !(VMPS-Mac) -> TRUE ++? if (!VMPS-Mac) -> TRUE ++- entering if (!VMPS-Mac) {...} +++? if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) ? Evaluating (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) -> TRUE +++? if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) -> TRUE +++- entering if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) {...} expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> xx:xx:xx:xx:xx:xx ++++[request] returns noop +++- if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) returns noop +++ ... skipping else for request 0: Preceding "if" was taken ++- if (!VMPS-Mac) returns noop [mac2vlan] Added VMPS-VLAN-Name: 'default' to reply_items ++[mac2vlan] returns ok expand: %{VMPS-Mac} -> xx:xx:xx:xx:xx:xx ++[reply] returns ok ++? if (VMPS-Packet-Type == VMPS-Reconfirm-Request) ? Evaluating (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE ++? if (VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE [linelog] expand: /var/log/vmps.log -> /var/log/vmps.log [linelog] expand: %S %C %{VMPS-Port-Name} %{VMPS-Mac} %{VMPS-VLAN-Name} -> 2012-01-12 16:06:34 Switch1 Fa0/21 xx:xx:xx:xx:xx:xx --NONE-- ++[linelog] returns ok Done VMPS } # server vmps VMPS-VLAN-Name = "default" VMPS-Cookie = xx:xx:xx:xx:xx:xx Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 892 with timestamp +11 Ready to process requests. -------------------------------------------------- So, the last lines seem to imply that I am to be put into VLAN "default" which is just the name of VLAN 1 on Cisco gear. And indeed the switch does precisely that. So far, so good. Then, why does FreeRADIUS log this? "2012-01-12 16:06:34 Switch1 Fa0/21 xx:xx:xx:xx:xx:xx --NONE--" Note the "--NONE--" for the VLAN name. I'm about to implement this throughout our entire office and of course the log will be essential for daily administration tasks, like adding/removing/fixing MAC address entries and the like. I get completely inconsistent results here - for some workstations it's "default" and for some "--NONE--". Here's the detailled config, "guests" is the name of the default VLAN for all unknown MAC addresses. The rest is more or less copied from the examples. I omitted all the basic radiusd config that I had already in place. We use FreeRADIUS for Enterprise WPA2 in our WLAN. I added VMPS as a virtual server. -------------------------------------------------- mac2vlan: xx:xx:xx:xx:xx:xx,default radiusd.conf: modules { passwd mac2vlan { filename = ${confdir}/mac2vlan format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," } linelog { filename = ${logdir}/vmps.log format = "%S %C %{VMPS-Port-Name} %{VMPS-Mac} %{VMPS-VLAN-Name}" } } $INCLUDE vmps.conf vmps.conf: server vmps { listen { ipaddr = * port = 1589 type = vmps } client 1.2.3.4 { secret = dontmind shortname = Switch1 } vmps { if (!VMPS-Mac) { if (VMPS-Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) { update request { VMPS-Mac = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } else { update request { VMPS-Mac = "%{VMPS-Cookie}" } } } mac2vlan update reply { VMPS-Packet-Type = VMPS-Join-Response VMPS-Cookie = "%{VMPS-Mac}" VMPS-VLAN-Name = "guests" } if (VMPS-Packet-Type == VMPS-Reconfirm-Request){ update reply { VMPS-Packet-Type := VMPS-Reconfirm-Response } } linelog } } -------------------------------------------------- Thanks and kind regards Patrick -- punkt.de GmbH * Kaiserallee 13a * 76133 Karlsruhe Tel. 0721 9109 0 * Fax 0721 9109 100 info(a)punkt.de http://www.punkt.de Gf: Jürgen Egeling AG Mannheim 108285

2 2

optimize sqlippool scheme
by Alexander Kosykh 12 Jan '12

12 Jan '12

hi Is anyone have a success story of optimizing ippool sql table to make it work faster? The default scheme is very slow, and then you have about 25000 subscribers it's not work. I trying to add indexes to this table. It make fast selects, but slow updates. [code] CREATE TABLE `radippool` ( `id` int(11) unsigned NOT NULL AUTO_INCREMENT, `pool_name` varchar(30) NOT NULL, `framedipaddress` varchar(15) NOT NULL DEFAULT '', `nasipaddress` varchar(15) NOT NULL DEFAULT '', `calledstationid` varchar(30) NOT NULL, `callingstationid` varchar(30) NOT NULL, `expiry_time` datetime DEFAULT NULL, `username` varchar(64) NOT NULL DEFAULT '', `pool_key` varchar(30) NOT NULL, PRIMARY KEY (`id`), KEY `allocate-find` (`pool_name`,`expiry_time`,`callingstationid`) ) ENGINE=MyISAM AUTO_INCREMENT=34817 DEFAULT CHARSET=utf8 [/code] Next I tried to make table from the begin. Here it is [code] CREATE TABLE `radippool_new` ( `id` int(4) unsigned NOT NULL AUTO_INCREMENT, `pool_name` tinyint(1) unsigned NOT NULL, `framedipaddress` int(4) unsigned NOT NULL, `nasipaddress` int(4) unsigned DEFAULT NULL, `calledstationid` bigint(8) unsigned NOT NULL, `callingstationid` bigint(8) unsigned NOT NULL, `expiry_time` timestamp NULL DEFAULT NULL, `username` varchar(64) NOT NULL, `pool_key` int(5) unsigned NOT NULL DEFAULT '0', PRIMARY KEY (`id`), KEY `allocate-find` (`pool_name`,`expiry_time`,`callingstationid`) USING BTREE ) ENGINE=InnoDB AUTO_INCREMENT=34817 DEFAULT CHARSET=utf8 ROW_FORMAT=COMPACT COMMENT='Ip pool for customers' CREATE TABLE `radippool_names` ( `id` tinyint(1) unsigned NOT NULL AUTO_INCREMENT, `pool_name` varchar(64) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=MyISAM AUTO_INCREMENT=5 DEFAULT CHARSET=utf8 [/code] It's working two time faster, than default with updates queries. But two time slower with selects queries. Maybe some one have a good modification of ippool table or another changes of default scheme, and could share it? *Regards,* Alexander

3 8

authentic by chap (pppoe) and mac
by asgzl 12 Jan '12

12 Jan '12

Dear FR users, I am using FR 2.1.7, mysql as DB. I want to realize the scenario that the pppoe client will be authentic by pppoe username, password and mac address. And at the user's first login, MAC will be remembered (not check at first time). Of course at necessary time the radius admin can remove the MAC remembered so new MAC can be learn. I searched the forum, there are similar topics before, but either too "old" on 1.0.x or not in detail. Anybody can help? Appreciated. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/authentic-by-chap-pppoe-and-mac-tp5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

How to use "Classic" CRL?
by Christ Schlacta 12 Jan '12

12 Jan '12

Is it possible yet to configure freeradius TLS to use a classic CRL, as in a single file that's downloaded from the authority every once in a while that is a.. well, CRL, rather than a directory with hashed stuff in it? I'm not in front of my fr right now, so I don't know the exact terminology used in the config, but you know what I'm talking about. This hashed folder of stuff makes it very difficult to maintain a CRL with freeradius, because, at least in part, it adds an additional level of complexity not present in every other openssl application.

3 3

Documentation of Setting up dialupadmin
by McSparin, Joe 11 Jan '12

11 Jan '12

Does anyone where some documentation could be found for setting up dialup admin on FreeBSD. Thanks, Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 2

[Patch] rlm_ldap: Allow users to match more than one group
by Graham Leggett 11 Jan '12

11 Jan '12

Hi all, If you set up groups in the rlm_ldap module, and a user is found to match more than one group, that user is currently denied access. For example, you might have a "staff" and "student" group, and a staff member comes along and enrolls as a part time student, suddenly they unexpectedly lose access to radius because they are a member of both groups. The following patch adds the groupmembership_limit option, defaulting to 1 (the current behavior). It allows you to limit the number of groups a user might be a member of, or remove the limit entirely (set to zero). Regards, Graham --

2 2

Framed-IP-Address Problem
by Tawanda Kavayi 11 Jan '12

11 Jan '12

Hi, I am using Freeradius 2.1.12 with mysql and Daloradius GUI. My setup is a Wimax network with AAA for the ASN gateway being handled by Freeradius. My problem is that I have configured FR to assign framed ip addresses to authenticated clients, but instead the IP's are being assigned from the IP pool on the ASN gateway, ignoring the configured framed IP's. After authentication, mysql returns the correct framed-ip-address 192.168.15.230 as seen below: [chap] login attempt by "test(a)domain.com" with CHAP password [chap] Using clear text password "test123" for user test(a)domain.com authentication. [chap] chap user test(a)domain.com authenticated succesfully ++[chap] returns ok Login OK: [test(a)domain.com] (from client domain-asn port 0 via TLS tunnel) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group post-auth {...} [sql] expand: %{User-Name} -> test(a)domain.com [sql] sql_set_user escaped user --> 'test(a)domain.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0xc5b5adb448177f060c8a0ce8e2f5d9825b [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '0xc5b5adb448177f060c8a0ce8e2f5d9825b', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '0xc5b5adb448177f060c8a0ce8e2f5d9825b', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Framed-IP-Address == 192.168.15.230 [ttls] Got tunneled Access-Accept [eap] Freeing handler ++[eap] returns ok Login OK: [test(a)domain.com] (from client domain-asn port 0 cli 00-1f-fb-20-77-36) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} [main_pool] Could not find Pool-Name attribute. ++[main_pool] returns noop [sql] expand: %{User-Name} -> test(a)domain.com [sql] sql_set_user escaped user --> 'test(a)domain.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop [wimax] MIP-RK = 0x47f3a3de8d92cc0321d93ba416a996bca3a05be28ce5f7fafe1bb8e5e808502314441d13c050e63812309136c0ec1146892dcea4d50314eb4b72a465bdcf7bb9 [wimax] MIP-SPI = 8cac90f1 [wimax] WARNING: WiMAX-MN-NAI was not found in the request or in the reply. [wimax] WARNING: We cannot calculate MN-HA keys. [wimax] WARNING: WiMAX-IP-Technology not found in reply. [wimax] WARNING: Not calculating MN-HA keys ++[wimax] returns updated However, a different IP address, 192.168.15.229, is seen when the Accounting-Request packet is sent by the NAS: rad_recv: Accounting-Request packet from host 192.168.12.214 port 24048, id=90, length=256 User-Name = "test(a)domain.com" Calling-Station-Id = "\000\037\373 w6" NAS-IP-Address = 192.168.12.214 Acct-Status-Type = Start Acct-Session-Id = "01B43771" NAS-Identifier = "domain-asn" Service-Type = Framed-User NAS-Port-Type = Wireless-802.16 WiMAX-BS-Id = 0x000010000001 Chargeable-User-Identity = "NUL" Acct-Authentic = RADIUS Vendor-Specific = 0x00001fe4340600000000 Vendor-Specific = 0x00001fe40506294f0c02 Vendor-Specific = 0x00001fe40606294f0c03 Vendor-Specific = 0x00001fe4020c41505449435354455354 Vendor-Specific = 0x00001fe4010600000007 WiMAX-PDFID = 1 WiMAX-Beginning-Of-Session = 1 WiMAX-IP-Technology = Reserved-1 Event-Timestamp = "Jan 10 2012 16:34:36 CAT" Framed-IP-Address = 192.168.15.229 Framed-IP-Netmask = 255.255.255.255 Vendor-Specific = 0x00001fe4180600000008 What should I be looking at to resolve this? Regards, Tawanda

2 1

Changing MTU value for EAP Session error
by Sallee, Stephen (Jake) 11 Jan '12

11 Jan '12

I have read on the list and the FR wiki that decreasing the MTU value for the tunnel can help alleviate the pesky EAP session did not finish problem. I would like to try this as I am getting the same issue on IOS and Android based phones using the default certs FR ships with. However I cannot find where to specify the MTU value, I assume it is in the inner-tunnel virtual server, but my google-fu is weak today and cannot find any instructions. I see several messages on the list saying that is should be done but none actually explaining HOW. Someone please point me in the correct direction. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221

2 1

Ignoring failed module in post-auth
by Michal Bruncko 10 Jan '12

10 Jan '12

Hello list I am using freeradius server as the authenicator for our WPA2 wifi network. We are using loggining of result for every authentication request from clients to sql database through sql module in post auth section. but in case that the central mysql server (for many radius servers) is unreachable, the loggining of request was failed and the module executions returns with "++[sql] returns fail" and also whole autentication procedure fails with REJCT even if the user was successufully authenticated inside the "authenticate" section. and my question is: how is possible to make change in radiusd configuration, that in case of mysql server unreachability the user reqested access will be authenicated even of failing sql module. sql logging is the only used module in post-auth section. thanks for help -- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic

4 6