November 2012 - Freeradius-Users - lists.freeradius.org

Re: Git master branch & Debian build
by Zenon Mousmoulas 05 Dec '12

05 Dec '12

Hi, I am also trying to build Debian packages from git master. On Fri Nov 23 20:52:32 CET 2012, Olivier Beytrison wrote: > I also noticed the following messages during package creation : > > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap_peap.so (ELF > format: 'elf64-x86-64'; RPATH: '/usr/lib/ > freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius/usr/sbin/radmin (ELF format: 'elf64-x86-64'; > RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap.so (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap_tls.so (ELF > format: 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius/usr/sbin/freeradius (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-eap.so > needed by debian/freeradius/usr/lib/freeradius/rlm_eap_ttls.so (ELF > format: 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/radwho (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/smbencrypt (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/radclient (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/rlm_dbm_parser (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/radsniff (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). > dpkg-shlibdeps: warning: couldn't find library libfreeradius-radius.so > needed by debian/freeradius-utils/usr/bin/rlm_ippool_tool (ELF format: > 'elf64-x86-64'; RPATH: '/usr/lib/freeradius'). The packages are built but I also see the warnings the OP noted above. The freeradius binary installed by this package does not run: /usr/sbin/freeradius: error while loading shared libraries: build/lib/.libs/rlm_acctlog.so: cannot open shared object file: No such file or directory # ldd /usr/sbin/freeradius linux-vdso.so.1 => (0x00007fff85fff000) libfreeradius-radius.so => /usr/lib/freeradius/libfreeradius-radius.so (0x00007faff937b000) build/lib/.libs/rlm_acctlog.so => not found build/lib/.libs/rlm_always.so => not found build/lib/.libs/rlm_attr_filter.so => not found build/lib/.libs/rlm_attr_rewrite.so => not found build/lib/.libs/rlm_cache.so => not found build/lib/.libs/rlm_chap.so => not found build/lib/.libs/rlm_checkval.so => not found build/lib/.libs/rlm_counter.so => not found build/lib/.libs/rlm_cram.so => not found build/lib/.libs/rlm_dbm.so => not found build/lib/.libs/rlm_detail.so => not found build/lib/.libs/rlm_dhcp.so => not found build/lib/.libs/rlm_digest.so => not found build/lib/.libs/rlm_dynamic_clients.so => not found build/lib/.libs/rlm_eap.so => not found build/lib/.libs/rlm_eap_gtc.so => not found build/lib/.libs/rlm_eap_leap.so => not found build/lib/.libs/rlm_eap_md5.so => not found build/lib/.libs/rlm_eap_mschapv2.so => not found build/lib/.libs/rlm_eap_peap.so => not found build/lib/.libs/rlm_eap_pwd.so => not found build/lib/.libs/rlm_eap_tls.so => not found build/lib/.libs/rlm_eap_ttls.so => not found build/lib/.libs/rlm_exec.so => not found build/lib/.libs/rlm_expiration.so => not found build/lib/.libs/rlm_expr.so => not found build/lib/.libs/rlm_fastusers.so => not found build/lib/.libs/rlm_files.so => not found build/lib/.libs/rlm_ippool.so => not found build/lib/.libs/rlm_jradius.so => not found build/lib/.libs/rlm_krb5.so => not found build/lib/.libs/rlm_ldap.so => not found build/lib/.libs/rlm_linelog.so => not found build/lib/.libs/rlm_logintime.so => not found build/lib/.libs/rlm_mschap.so => not found build/lib/.libs/rlm_otp.so => not found build/lib/.libs/rlm_pam.so => not found build/lib/.libs/rlm_pap.so => not found build/lib/.libs/rlm_passwd.so => not found build/lib/.libs/rlm_perl.so => not found build/lib/.libs/rlm_policy.so => not found build/lib/.libs/rlm_preprocess.so => not found build/lib/.libs/rlm_python.so => not found build/lib/.libs/rlm_radutmp.so => not found build/lib/.libs/rlm_realm.so => not found build/lib/.libs/rlm_replicate.so => not found build/lib/.libs/rlm_sim_files.so => not found build/lib/.libs/rlm_soh.so => not found build/lib/.libs/rlm_sometimes.so => not found build/lib/.libs/rlm_sql.so => not found build/lib/.libs/rlm_sql_iodbc.so => not found build/lib/.libs/rlm_sql_mysql.so => not found build/lib/.libs/rlm_sql_null.so => not found build/lib/.libs/rlm_sql_postgresql.so => not found build/lib/.libs/rlm_sqlcounter.so => not found build/lib/.libs/rlm_sqlippool.so => not found build/lib/.libs/rlm_unix.so => not found build/lib/.libs/rlm_utf8.so => not found build/lib/.libs/rlm_wimax.so => not found libfreeradius-eap.so => /usr/lib/freeradius/libfreeradius-eap.so (0x00007faff915a000) libnsl.so.1 => /lib/libnsl.so.1 (0x00007faff8f3d000) libresolv.so.2 => /lib/libresolv.so.2 (0x00007faff8d27000) libdl.so.2 => /lib/libdl.so.2 (0x00007faff8b22000) libpthread.so.0 => /lib/libpthread.so.0 (0x00007faff8906000) libreadline.so.6 => /lib/libreadline.so.6 (0x00007faff86c2000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007faff848a000) libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0x00007faff80e9000) libssl.so.0.9.8 => /usr/lib/libssl.so.0.9.8 (0x00007faff7e94000) libc.so.6 => /lib/libc.so.6 (0x00007faff7b31000) /lib64/ld-linux-x86-64.so.2 (0x00007faff95ad000) libncurses.so.5 => /lib/libncurses.so.5 (0x00007faff78eb000) libz.so.1 => /usr/lib/libz.so.1 (0x00007faff76d4000) It looks like something is wrong with the ELF attributes in the binaries: # objdump -p /usr/sbin/freeradius | grep NEEDED NEEDED libfreeradius-radius.so NEEDED build/lib/.libs/rlm_acctlog.so NEEDED build/lib/.libs/rlm_always.so NEEDED build/lib/.libs/rlm_attr_filter.so NEEDED build/lib/.libs/rlm_attr_rewrite.so NEEDED build/lib/.libs/rlm_cache.so NEEDED build/lib/.libs/rlm_chap.so NEEDED build/lib/.libs/rlm_checkval.so NEEDED build/lib/.libs/rlm_counter.so NEEDED build/lib/.libs/rlm_cram.so NEEDED build/lib/.libs/rlm_dbm.so NEEDED build/lib/.libs/rlm_detail.so NEEDED build/lib/.libs/rlm_dhcp.so NEEDED build/lib/.libs/rlm_digest.so NEEDED build/lib/.libs/rlm_dynamic_clients.so NEEDED build/lib/.libs/rlm_eap.so NEEDED build/lib/.libs/rlm_eap_gtc.so NEEDED build/lib/.libs/rlm_eap_leap.so NEEDED build/lib/.libs/rlm_eap_md5.so NEEDED build/lib/.libs/rlm_eap_mschapv2.so NEEDED build/lib/.libs/rlm_eap_peap.so NEEDED build/lib/.libs/rlm_eap_pwd.so NEEDED build/lib/.libs/rlm_eap_tls.so NEEDED build/lib/.libs/rlm_eap_ttls.so NEEDED build/lib/.libs/rlm_exec.so NEEDED build/lib/.libs/rlm_expiration.so NEEDED build/lib/.libs/rlm_expr.so NEEDED build/lib/.libs/rlm_fastusers.so NEEDED build/lib/.libs/rlm_files.so NEEDED build/lib/.libs/rlm_ippool.so NEEDED build/lib/.libs/rlm_jradius.so NEEDED build/lib/.libs/rlm_krb5.so NEEDED build/lib/.libs/rlm_ldap.so NEEDED build/lib/.libs/rlm_linelog.so NEEDED build/lib/.libs/rlm_logintime.so NEEDED build/lib/.libs/rlm_mschap.so NEEDED build/lib/.libs/rlm_otp.so NEEDED build/lib/.libs/rlm_pam.so NEEDED build/lib/.libs/rlm_pap.so NEEDED build/lib/.libs/rlm_passwd.so NEEDED build/lib/.libs/rlm_perl.so NEEDED build/lib/.libs/rlm_policy.so NEEDED build/lib/.libs/rlm_preprocess.so NEEDED build/lib/.libs/rlm_python.so NEEDED build/lib/.libs/rlm_radutmp.so NEEDED build/lib/.libs/rlm_realm.so NEEDED build/lib/.libs/rlm_replicate.so NEEDED build/lib/.libs/rlm_sim_files.so NEEDED build/lib/.libs/rlm_soh.so NEEDED build/lib/.libs/rlm_sometimes.so NEEDED build/lib/.libs/rlm_sql.so NEEDED build/lib/.libs/rlm_sql_iodbc.so NEEDED build/lib/.libs/rlm_sql_mysql.so NEEDED build/lib/.libs/rlm_sql_null.so NEEDED build/lib/.libs/rlm_sql_postgresql.so NEEDED build/lib/.libs/rlm_sqlcounter.so NEEDED build/lib/.libs/rlm_sqlippool.so NEEDED build/lib/.libs/rlm_unix.so NEEDED build/lib/.libs/rlm_utf8.so NEEDED build/lib/.libs/rlm_wimax.so NEEDED libfreeradius-eap.so NEEDED libnsl.so.1 NEEDED libresolv.so.2 NEEDED libdl.so.2 NEEDED libpthread.so.0 NEEDED libreadline.so.6 NEEDED libcrypt.so.1 NEEDED libcrypto.so.0.9.8 NEEDED libssl.so.0.9.8 NEEDED libc.so.6 # objdump -p /usr/lib/freeradius/libfreeradius-radius.so | grep SONAME # objdump -p /usr/lib/freeradius/libfreeradius-eap.so | grep SONAME Compared to Debian's freeradius 2.1.10+dfsg-2+squeeze1: # objdump -p /usr/sbin/freeradius | grep NEEDED NEEDED libfreeradius-radius-2.1.10.so NEEDED libnsl.so.1 NEEDED libresolv.so.2 NEEDED libpthread.so.0 NEEDED libcrypt.so.1 NEEDED libltdl.so.7 NEEDED libssl.so.0.9.8 NEEDED libcrypto.so.0.9.8 NEEDED libc.so.6 # objdump -p /usr/lib/freeradius/libfreeradius-radius-2.1.10.so | grep SONAME SONAME libfreeradius-radius-2.1.10.so # objdump -p /usr/lib/freeradius/libfreeradius-eap-2.1.10.so | grep SONAME SONAME libfreeradius-eap-2.1.10.so Any ideas? Thanks, Z.

3 10

FreeRadius Running Error
by QASIM RAO 05 Dec '12

05 Dec '12

Hi,i am facing problem in freeradius i m already using freeradius it was working fine now i re-install radius and now when i start radius with "radiusd -X" command it is giving following error please help me in this Starting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: /usr/local/etc/raddb/proxy.confConfig: including file: /usr/local/etc/raddb/clients.confConfig: including file: /usr/local/etc/raddb/snmp.confConfig: including file: /usr/local/etc/raddb/eap.confConfig: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = yes proxy: default_fallback = no proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0read_config_files: reading dictionaryread_config_files: reading naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clientsread_config_files: reading realmsradiusd: entering modules setupSegmentation fault ragards:Qasim

3 4

Redundant Freeradius
by fknet 04 Dec '12

04 Dec '12

Hello people! Today I've just one FreeBSD server running FreeRadius +MySQL on my network and now I want to put a redundant server to prevent fails. I was thinking to use CARP protocol to have the same IP address of the main server on the backup server and do the MySQL Replication on the backup server but one friend told me that I can't replicate the radacct table for a reason that he doesn't know. My question is: Can I do the full replication of ALL MySQL tables of Freeradius? Will I have some problem if I replicate the radacct table? Thanks Fabrício

2 5

802.1x Issue
by Brekler Custodio 03 Dec '12

03 Dec '12

Hi again people, so a week ago i posted here a problem with 802.1x i had and it turned to be all my users were MD5 password, so that was my problem.Today i created a new DB on a test server, changed on sql.conf and tested.Im getting this error, i tried to understand that, BUT im kinda a newbie on freeradius + linux (i started to learn 1 month ago) and couldnt find the error.I dont know if the error is on MYSQL or freeradius... Appreciate anything you guys can help me!Thanks in advance. nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" }rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to root@localhost:/radiusrlm_sql (sql): starting 0rlm_sql (sql): Attempting to connect rlm_sql_mysql #0rlm_sql_mysql: Starting connect to MySQL server for #0rlm_sql (sql): Connected new DB handle, #0rlm_sql (sql): starting 1rlm_sql (sql): Attempting to connect rlm_sql_mysql #1rlm_sql_mysql: Starting connect to MySQL server for #1rlm_sql (sql): Connected new DB handle, #1rlm_sql (sql): starting 2rlm_sql (sql): Attempting to connect rlm_sql_mysql #2rlm_sql_mysql: Starting connect to MySQL server for #2rlm_sql (sql): Connected new DB handle, #2rlm_sql (sql): starting 3rlm_sql (sql): Attempting to connect rlm_sql_mysql #3rlm_sql_mysql: Starting connect to MySQL server for #3rlm_sql (sql): Connected new DB handle, #3rlm_sql (sql): starting 4rlm_sql (sql): Attempting to connect rlm_sql_mysql #4rlm_sql_mysql: Starting connect to MySQL server for #4rlm_sql (sql): Connected new DB handle, #4rlm_sql (sql): Processing generate_sql_clientsrlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nasrlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Read entry nasname=172.23.54.2,shortname=ruckus-controller,secret=t3st3rlm_sql (sql): Adding client 172.23.54.2 (ruckus-controller, server=<none>) to clients listrlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules} # serverserver { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql_log Module: Instantiating module "sql_log" from file /etc/freeradius/modules/sql_log sql_log { path = "/var/log/freeradius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = no safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules} # serverradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0}listen { type = "acct" ipaddr = * port = 0}listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnelListening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host 172.23.54.2 port 32777, id=52, length=206 User-Name = "user" Calling-Station-Id = "00-22-43-09-43-BD" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x020000090175736572 Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x53dcd42dc46e9bee1e5538df27c8ae45# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop++[digest] returns noop[suffix] No '@' in User-Name = "user", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] EAP packet type response id 0 length 9[eap] No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop[sql] expand: %{User-Name} -> user[sql] sql_set_user escaped user --> 'user'rlm_sql (sql): Reserving sql socket id: 3[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY idrlm_sql_mysql: MYSQL check_error: 1054 receivedrlm_sql_getvpdata: database query error[sql] SQL query error; rejecting userrlm_sql (sql): Released sql socket id: 3++[sql] returns failInvalid user: [user/<via Auth-Type = EAP>] (from client ruckus-controller port 1 cli 00-22-43-09-43-BD)Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 0 for 1 secondsGoing to the next requestWaking up in 0.9 seconds.Sending delayed reject for request 0Sending Access-Reject of id 52 to 172.23.54.2 port 32777Waking up in 4.9 seconds.Cleaning up request 0 ID 52 with timestamp +205Ready to process requests.

8 20

Sending authentication-requests to multiple radius-servers
by Stefan Kuegler 02 Dec '12

02 Dec '12

Hello. I have a short question: Is it possible to send an authentication-request from a client to multiple servers simultaneously ? +----------+ /----->| radius A | +--------+ +--------------+ / +----------+ | client |--->| radius proxy |X +--------+ +--------------+ \ +----------+ \----->| radius B | +----------+ We now authenticate with HMAC-based One Time Password Token (aka event-based token) from a Cisco ASA via radius to only one freeradius-server. But we want to establish a second authentication server for failover reasons. When using event based tokens, it's absolute necessary that every server receives the same authentication request simultaneously from the client to trigger the next "event" on the server side. Best Regards, Stefan Kuegler

4 8

802.1X PEAP / MSCHAPv2 (with nt-password)
by Thomas Dupas 30 Nov '12

30 Nov '12

Dear, at the risk of falling in a known trap. I've read enough statements that one can't do mschapv2 with openldap, unless you store the passwords in clear-text. I know that But those same sources also state that this isn't true when you have a (MS) hash available for those users, like NT-/LM-PASSWORD, which I have. Yet my configuration still seems to expect clear-text passwords. >From the debug output (cleaned): [ldap] looking for check items in directory... [ldap] userPassword -> User-Password == "{crypt}<cryptpasswd>" [ldap] userPassword -> Password-With-Header == "{crypt}<cryptpasswd>" [ldap] sambaNTPassword -> NT-Password == 0x<hash> [ldap] sambaLMPassword -> LM-Password == 0x<hash> [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: <userid> [mschap] Told to do MS-CHAPv2 for <userid> with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject What am I missing in the configuration? It has the hashed passwords, seamingly mapped to the correct attributes, yet it still says it doesn't have them. config is as stock as possible, using http://vuksan.com/linux/dot1x/802-1x-LDAP.html and http://tldp.org/HOWTO/html_single/8021X-HOWTO/#confradius as guidelines. See pastebin for the entire configuration, since one can't post attachments to a mailing list. http://pastebin.com/d6FWVS1F Br, Thomas

2 1

Freeradius like WPA2-PSK
by Paulo 30 Nov '12

30 Nov '12

Hello, Is there any way that freeradius act as WPA-PSK?? What i am trying to deploy is a wi-fi network with only one password that is changed every week. Right now I have a open wireless signal distributed over 20 wi-fi routers. This signal is used by all the clients of the hotel, so there is no way to distribute certificate to the clients. -- Paulo Marcon. -------------------------------------------------- “Não sabendo que era impossível, foi lá e fez.” Jean Cocteau --------------------------------------------------

3 3

Transfer Limit
by Alexandre J. Correa - Onda Internet 30 Nov '12

30 Nov '12

Hello !! How i can measure bandwidth quota monthly, when it exceeds, execute a program.. only for active users (online). My NASes doesn´t accept CoA packets (only PoD).. i will need to run external program to 'change' session info.. Regards, -- Sds. Alexandre Jeronimo Correa Socio-Administrador Onda Internet www.onda.net.br IPV6 Ready !

2 1

Re: 802.1x Issue
by Alan Buxey 29 Nov '12

29 Nov '12

Problem with the query. Run that query with mysql client and see what the output shows...and tell us what that entry for user looks like in radcheck table. Default sql configuration works alan

1 0

Problems with 802.1x
by Brekler Custodio 29 Nov '12

29 Nov '12

I did this question yesterday, but since im new i did a lot of wrong things, like no subject, etc etc.So here is the deal, we use freeradius on a hotspot service with wireless and it works all fine, but we are trying to put 802.1x (its better)So the thing is, it always say "login/pass incorrect" So i did the debug thing, and i couldnt find the error (im new on linux) I did the radtest and the results are the following: radtest -t mschap <user> <pass> 127.0.0.1:1812 0 t3st3 (our pass)and i got this Sending Access-Request of id 193 to 127.0.0.1 port 1812 User-Name = "1085" NAS-IP-Address = 192.168.80.2 NAS-Port = 0 MS-CHAP-Challenge = 0x826bf8043e1d4ecf MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000cb7fdf6848ca0b2df86e5060da2c2b8e80329c405855233a rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=193, length=20 " so i did another test like this: radtest -t eap-md5 <user> <pass> 127.0.0.1:1812 0 t3st3 and i got this Sending Access-Request packet to host 127.0.0.1 port 1812, id=54, length=0 User-Name = "1085" User-Password = "XXXXXXX" NAS-IP-Address = 192.168.80.2 NAS-Port = 0 EAP-Code = Response EAP-Type-Identity = "1085" Message-Authenticator = 0x00 EAP-Message = 0x023500090131303835Received Access-Challenge packet from host 127.0.0.1 port 1812, id=54, length=64 EAP-Message = 0x013600061520 Message-Authenticator = 0x56eff2711d27219b78bc42ad7db31808 State = 0x028cb41e02baa1b18a40110649d7000f EAP-Id = 54 EAP-Code = Request EAP-Type-LEAP = 0x20 I dont know what is wrong, i THINK its our SQL BD that is not accepting mschap.I would appreciate that people dont answer like "read this, read that, its all explained", like i said, im new on linux, i read everything i found, but didnt got the problemAppreciate any help. Below is my debug trying to access by the wireless. [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 179 to 172.23.54.2 port 32784 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa52ffbdea42de2a3ddda2e08b2ef9a8e Finished request 17. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.54.2 port 32784, id=180, length=320 User-Name = "1085" Calling-Station-Id = "00-1E-64-27-2F-52" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x0202006919800000005f160301005a010000560301509d3fc22ba4ec181253508b1a9031d084a6ab63dfc0f57196d85dccbddd6bb0000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0xa52ffbdea42de2a3ddda2e08b2ef9a8e Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0xb15471a260ff863b5df11a42d1b7ffaf # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02a8], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 180 to 172.23.54.2 port 32784 EAP-Message = 0x010302f2190016030100310200002d0301509d3ef1415eda32ffcebd3266fe173cbfff89917ae81eda6972831a026a39a700002f000005ff0100010016030102a80b0002a40002a100029e3082029a30820182020900bd56242da73748dd300d06092a864886f70d0101050500300f310d300b0603550403130464617274301e170d3132303632383139343531345a170d3232303632363139343531345a300f310d300b060355040313046461727430820122300d06092a864886f70d01010105000382010f003082010a0282010100ca6b2f404628ab86daf42a6fc6bf84841fc22515227dff73a183a6f51a2a22db61143afc8486ff59813449b110 EAP-Message = 0x463c624fe05f1a79e5f347cc1a4ae49a551195f31db873c60037978a2873ec1b990d3c3508d0a5380dd2c013755ba5771905a9e6b9e119a7d58981e7125f745ec893c416a2299c44dfac6ce81ff226ea6154b601a56285572c4658a045b8e160ff29ada8bf9fbd3aab84f6988155b52bf1e8691d7629e7d77cdf1bacf0fb062a7a826d02726fadace6d3ccdb84338d2e05a7867a6bc236f942bf2109a41b8289a9b1214571007a84a0ec2835dfac79beca7faf858ddf2b0483398effde1112e04540a8b83c6f4f3464aec1f10d66ffec7c837b0203010001300d06092a864886f70d010105050003820101000310c2505daf381e21004471bf7cf5ae8a EAP-Message = 0xe16a72c80fb15970c51859f996942e88e6a675834788ab9aa5a57af1a335b4513acd5c39cf3b63151368dac86c6ad0ba965a52636b998d220534d3c913a6f2d64baa46a14d877a6f1a1afdedd7dcc9f990b0ba6b0181cc15abbcab5de4ae2adf002de566cac739b11c770b727a104b4359905dbbf0889cad18af0f31e5be5f28b6619edefff2edc1a5ea6683805b51d1cbeb05c250d23a402de0f4443f01d4a7ddc4bf4ea950151f42aee22dc1c9a81f18aa219499adff4095f9fb6dc2e44f89fe14c0e2f30007748bd4deba341982af01ed8d09dad9bbfcc0ceaa2f4b3d3d94add25259cba48886d837b49af75a8f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa52ffbdea72ce2a3ddda2e08b2ef9a8e Finished request 18. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.54.2 port 32784, id=181, length=553 User-Name = "1085" Calling-Station-Id = "00-1E-64-27-2F-52" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x020301501980000001461603010106100001020100406f5aabae4fb470053ee7cb8a80f8c8dc8f30040d4466009eca6d20f732623e0b4e1e9f8e9a675b81a68adbbdc8a9f05e460f841eea9234efbc9ae86e1c2d5f7de46b73718103e4d495253e86b9d945d1a97fc5ca13b14ca421b5b4f032f65567a027b202a18591d2bf3d5f05bc08dd2c7314c5d3291b55d255135cd1e08bdfb81e37e23bed31b6ef9bbc20face7f65b9679030f889cf3b7fcc3c5b442372b46b50744c8ae4d28bf1417b45900aed22e1f76d0f679bc83186008c10902140b38de9e40ac8b9074c4438479cfba8ecc58fb1c0eca7581fdfb2fc2221ca3cccfd3c379bd0415f0523 EAP-Message = 0x469ea987e74a634ffd9f974fd85c4cf550cfc184882b10d31403010001011603010030c7823f5df8656cb4ecee2830f2dd532e33febb88329d8078398bcf9fc3729371e6acabeeee9022d11176d95facb50e26 State = 0xa52ffbdea72ce2a3ddda2e08b2ef9a8e Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x6b79b9cd6b15dfedbf49ba57b7edcc45 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 181 to 172.23.54.2 port 32784 EAP-Message = 0x01040041190014030100010116030100305da09efb263d6a8e920ffd363a784a928bc392a6b80309b6f3f3d78becca6e3f7f2f20b3fb0b62520e46decd844eafec Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa52ffbdea62be2a3ddda2e08b2ef9a8e Finished request 19. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.54.2 port 32784, id=182, length=221 User-Name = "1085" Calling-Station-Id = "00-1E-64-27-2F-52" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x020400061900 State = 0xa52ffbdea62be2a3ddda2e08b2ef9a8e Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x21e270d06fa3b618166b474599d92c03 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 182 to 172.23.54.2 port 32784 EAP-Message = 0x0105002b190017030100209c58a55d01f6f8ea2ebd4dcf6b707ac1854afc0ae1184210876df755426cdebb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa52ffbdea12ae2a3ddda2e08b2ef9a8e Finished request 20. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.54.2 port 32784, id=183, length=258 User-Name = "1085" Calling-Station-Id = "00-1E-64-27-2F-52" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x0205002b1900170301002045585f4e63ddae7a1c000e31e0a2eeece7eaa624f2806a9e70e2d046f1391fc7 State = 0xa52ffbdea12ae2a3ddda2e08b2ef9a8e Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x69f09f61ebca4c76283b5dca004e7ef0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - 1085 [peap] Got inner identity '1085' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x020500090131303835 server { PEAP: Setting User-Name to 1085 Sending tunneled request EAP-Message = 0x020500090131303835 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "1085" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 5 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0106001e1a0106001910fe55d9294cefdac440362e653915a34d31303835 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ae4ec900ae2f69ac6f652def380e816 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0106001e1a0106001910fe55d9294cefdac440362e653915a34d31303835 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ae4ec900ae2f69ac6f652def380e816 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 183 to 172.23.54.2 port 32784 EAP-Message = 0x0106003b190017030100301000c355cc2c2884bf2f175908e52361b9e5f41b4a0e9a0435c322c46fe8a3c1bc2ddc42ac866a83ae30421b91059630 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa52ffbdea029e2a3ddda2e08b2ef9a8e Finished request 21. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.54.2 port 32784, id=184, length=306 User-Name = "1085" Calling-Station-Id = "00-1E-64-27-2F-52" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x0206005b19001703010050ae4fea85f3a5973a84f9b5e1abc47fb5a19be28af5e27780d39c7c29b91526c26e3972a03bee2657e96c715084bd5a5cf5da7d84cda132385eaa3a0d1733b5618ee6286e6e3670119927319542bcb7d2 State = 0xa52ffbdea029e2a3ddda2e08b2ef9a8e Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x687b1f3b1c9e04fc75d21d0f741b661f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0206003f1a0206003a312198129fe508198faceab807ca41f5580000000000000000bb3261067e2d36651cf535d4d562658d61830fcce9f2a88f0031303835 server { PEAP: Setting User-Name to 1085 Sending tunneled request EAP-Message = 0x0206003f1a0206003a312198129fe508198faceab807ca41f5580000000000000000bb3261067e2d36651cf535d4d562658d61830fcce9f2a88f0031303835 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "1085" State = 0x0ae4ec900ae2f69ac6f652def380e816 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: 1085 [mschap] Told to do MS-CHAPv2 for 1085 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [1085/<via Auth-Type = EAP>] (from client ruckus-controller port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 184 to 172.23.54.2 port 32784 EAP-Message = 0x0107002b19001703010020712d9a3c89066e09d12514449c4e4e166e62bd3626ba278d1cb473bacd1b31aa Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa52ffbdea328e2a3ddda2e08b2ef9a8e Finished request 22. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.54.2 port 32784, id=185, length=258 User-Name = "1085" Calling-Station-Id = "00-1E-64-27-2F-52" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x0207002b190017030100205bce9ac93410e019700dbd986065e5a9a84301906e4611ad246471a284fc7e81 State = 0xa52ffbdea328e2a3ddda2e08b2ef9a8e Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x71c3a73b038b1f0a51e530baba2afc96 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1085", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [1085/<via Auth-Type = EAP>] (from client ruckus-controller port 1 cli 00-1E-64-27-2F-52) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1085 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 23 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 23 Sending Access-Reject of id 185 to 172.23.54.2 port 32784 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 16 ID 178 with timestamp +2309 Cleaning up request 17 ID 179 with timestamp +2309 Cleaning up request 18 ID 180 with timestamp +2309 Cleaning up request 19 ID 181 with timestamp +2309 Cleaning up request 20 ID 182 with timestamp +2309 Cleaning up request 21 ID 183 with timestamp +2309 Cleaning up request 22 ID 184 with timestamp +2309 Waking up in 1.0 seconds. Cleaning up request 23 ID 185 with timestamp +2309 Ready to process requests.

6 18