March 2012 - Freeradius-Users - lists.freeradius.org

adding additional attribute to dictionary.3pgg2
by lamerson 09 Mar '12

09 Mar '12

Good day folks ! I've installed latest(2.1.12) freeradius. I need to pass '3GPP2-Max-Authorized-Aggr-Bandwidth' and '3GPP2-Inter-User-Priority' attributes in Access-Accept message from AAA to NAS. The default dictionary.3gpp2 that comes with the instalation doesn't have them. So i found and added to config wireshark's updated [wireshark] 2009-07-08 - FreeRadius 2.6.1 dictionary.3gpp2 updated from the 3GPP2 X.S0011-005-D v2.0 spec , wich has needed attributes. but unfortunately debug tells me: rlm_sql: Failed to create the pair: Unknown attribute "Inter-User-Priority" or rlm_sql: Failed to create the pair: Unknown attribute "3GPP2-Max-Authorized-Aggr-Bandwidth" Are there any additional actions i must take to make freeradius recognize additional attributes other than default ones ?? Appriciate, Mikhael. -- View this message in context: http://freeradius.1045715.n5.nabble.com/adding-additional-attribute-to-dict… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Tracing access request chain
by Morris, Andi 09 Mar '12

09 Mar '12

I'm trying to trace an access attempt that occurred today so that I can categorically say to a user that you were successfully connected to our network, or not, whatever the case maybe. However I'm struggling to create a chain of events by going through the logs. I can see by grepping the logs in the radacct folder that the user sent the access-request. The results are in both the auth-detail and the pre-proxy-detail logs. From there I can see in my internal radius servers that the access was accepted, but I cannot find any reference to the user, or the any of the incoming conversation in the outgoing logs like post-proxy, or reply. I was hoping I'd see a reference to the username and Access-Accept or similar. Can someone please help me out by letting me know if there is one common string that will help me trace one request incoming and outgoing? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o'r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

4 4

RE: freeradius + ntlm_auth, broken?
by Andres Septer 09 Mar '12

09 Mar '12

> Check the winbind log files, Did that already. Nothing interesting there, only lines like [2012/03/08 14:32:17.115991, 3] winbindd/winbindd_misc.c:417(winbindd_priv_pipe_dir) [25675]: request location of privileged pipe [2012/03/08 14:32:17.117136, 6] winbindd/winbindd.c:840(winbind_client_request_read) closing socket 26, client exited > and perhaps try using "strace -f -p <freerad.pid> -o log" to > watch process execution. I already did that to get the command line. When I run that line manually I get "login failed". T try to figure out how to capture actual ntlm_auth output from within freerad process. Also, where freeradd gets the values for parameters MS-CHAP-Challenge = 0xd50bd065d4215da9 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000001e7c77d05691cb2822a6670bf0b458e251c4ef170a2c2fff ? Those seem to be wrong. When I use them manually from command line I get "login failed" A.

3 2

How do I stop reading of detail file after a certain threshold is reached
by Vivek Mehrotra 08 Mar '12

08 Mar '12

Hello, We are using Freeradius2 with MySQL at the backend. I understand that the buffered sql takes care of buffering queries. What is the best way to stop querying MySQL altogether and return a negative response, after a certain threshold of processing is reached by the server? Thanks in advance.. vivek

3 6

rlm_perl, aaa, dialup admin
by Fabricio Flores 08 Mar '12

08 Mar '12

Hi... I have a lot of problems configuring freeRadius. First I have a web service and a perl client to obtain users and password from an external database. I used with rlm_perl with an script perl in the authetication func and it works... but i need to implement dialup admin (or daloradius) to account... but i read that dialup admin works with a mysql database.... so... what i need to use to works dialup admin? and what archives i need to edit (users, radiusd.conf, etc) to authentication with rlm_perl and authorize and accounting with mysql? -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

1 0

FreeRadius Logrotate settings for FreeBSD
by Selcuk Yazar 08 Mar '12

08 Mar '12

Hi, we are using FreeRADIUS Version 2.1.12 In FREEBSD v.9. our logrotate settings like below. /var/log/freeradius/radius.log { daily rotate 8 create missingok compress postrotate kill -HUP `cat /var/run/freeradius/freeradius.pid` endscript } after rotate log radius.log file remain 0 lenght what is correnct settings of postrotate section of freeradius ? thanks in advance. -- Selçuk YAZAR

3 2

freeradius + ntlm_auth, broken?
by Andres Septer 08 Mar '12

08 Mar '12

Hello I try to set up AD as freeradius authentication oracle. My system: ohv:/etc/raddb/modules # radiusd -v radiusd: FreeRADIUS Version 2.1.12, for host x86_64-suse-linux-gnu, built on Oct 19 2011 at 13:55 I followed this guidelines http://deployingradius.com/documents/configuration/active_directory.html and everything went great (user logons OK, all the tests decribed in howto went OK) until the last part MS-CHAP + ntlm_auth OK, what happens when I try to authenticate via MS-CHAP ohv:/etc/samba # radtest -t mschap freeradius.test passwordschmassword localhost 0 testing123 Sending Access-Request of id 11 to 127.0.0.1 port 1812 User-Name = "freeradius.test" NAS-IP-Address = 10.128.160.4 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x7c68b9721c3a0b46 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000013e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=11, length=38 MS-CHAP-Error = "\000E=691 R=1" Lets see freeradius log Thu Mar 8 13:42:03 2012 : Info: Found Auth-Type = MSCHAP Thu Mar 8 13:42:03 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Mar 8 13:42:03 2012 : Info: +- entering group MS-CHAP {...} Thu Mar 8 13:42:03 2012 : Info: [mschap] Told to do MS-CHAPv1 with NT-Password Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=freeradius.test Thu Mar 8 13:42:03 2012 : Info: [mschap] No NT-Domain was found in the User-Name. Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: %{mschap:NT-Domain} -> Thu Mar 8 13:42:03 2012 : Info: [mschap] ... expanding second conditional Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --domain=%{%{mschap:NT-Domain}:-LOCAL} -> --domain=LOCAL Thu Mar 8 13:42:03 2012 : Info: [mschap] mschap1: 7c Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=7c68b9721c3a0b46 Thu Mar 8 13:42:03 2012 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a Thu Mar 8 13:42:03 2012 : Debug: Exec-Program output: Reading winbind reply failed! (0xc0000001) Thu Mar 8 13:42:03 2012 : Debug: Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Thu Mar 8 13:42:03 2012 : Debug: Exec-Program: returned: 1 Thu Mar 8 13:42:03 2012 : Info: [mschap] External script failed. Thu Mar 8 13:42:03 2012 : Info: [mschap] MS-CHAP-Response is incorrect. Thu Mar 8 13:42:03 2012 : Info: ++[mschap] returns reject OK, lets strace this and find the actual command line sent to freeradius and try it out on command line (edited to follow correct syntax!) Command line looks like this: /usr/bin/ntlm_auth "--request-nt-key", "--username=freeradius.test", "--domain=LOCAL", "--challenge=0x7c68b9721c3a0b46", "--nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a" Logon failure (0xc000006d) Wait, what? Let's re-check ntlm_auth --request-nt-key --domain=local --username=freeradius.test --password=passwordschmassword NT_STATUS_OK: Success (0x0) Seems that values for "challenge" and "response" are getting filled incorrectly. I also tried to turn with_ntdomain_hack aprameter on and off, but no avail. Is freeradius at all responsible to fill those parameters or how can I fix this behaviour? Andres Septer Systems Administrator Navirec Software OÜ Tallinn, Estonia http://navirec.com

2 1

High Avaibility
by Anto 08 Mar '12

08 Mar '12

Hello In the coming days I will set up a freeradius server for access control and accounting. I've been looking for information on freeradius and high availability, since my idea is to have two servers in case one fails, continue to operate with the other, but I just found information. So I turn to the list, in case I can recommend someone with experience on stage. I do not know if it is feasible to have a server as master and one slave, when the main falls, the other up the interface. If there is some kind of balancer radius and use both servers, etc.. Any ideas?. Thank you very much. Best regards Anto

5 5

Max-Daily-Session - User session termination
by pamela pomary 07 Mar '12

07 Mar '12

Hello once again, Thank you for your help in resolving this problem so far. I have counters increasing now after defining Max-Daily-Session for DEFAULT user in the users file like below and adding the line aaa accounting dot1x default start-stop group radius suggested by Alan Buxey to config on my Cisco 2960 switch NAS. DEFAULT Service-Type == Login-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Max-Daily-Session = 240, I found the following in the log ### Debug log ### rlm_counter: Entering module authorize code rlm_counter: Searching the database for key 'clare' rlm_counter: Key Found. rlm_counter: Check item = 240, Count = 2386 rlm_counter: Rejected user clare, check_item=240, counter=2386 modcall[authorize]: module "daily" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Invalid user (rlm_counter: Maximum hourly usage time reached): [clare] (from client C2960_NOC_LAN1 port 50009 cli 00-1E-33-D5-7A-68) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 230 to 10.1.5.4 port 1645 Reply-Message = "Your maximum hourly usage time has been reached" I realise user clare is rejected only when user login after cable is unplugged and plugged back into the computer. What it means is that when a user login and is granted access, user's counter keeps increasing beyond the Max-Daily-Session until cable is unplugged from the computer.When cable is plugged back into the computer and user is prompted to login, user is rejected because he/she has exceeded the maximum daily session. What I want to achieve is to get user session disconnected/timeout automatically while cable is still plugged in and user reaching his/her maximum daily session set for the day. I hope it is possible to do :) I have the following config on my NAS- Cisco 2960 switch aaa authentication login default group radius local aaa authentication dot1x default group radius aaa authorization exec default group radius if-authenticated aaa authorization network default group radius aaa accounting suppress null-username aaa accounting session-duration ntp-adjusted aaa accounting update newinfo periodic 1 aaa accounting dot1x default start-stop group radius aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa accounting connection default start-stop group radius aaa accounting resource default start-stop-failure group radius interface FastEthernet0/9 switchport access vlan 6 switchport mode access authentication host-mode multi-auth authentication port-control auto authentication periodic authentication timer reauthenticate 60 authentication violation protect dot1x pae both dot1x max-req 3 spanning-tree portfast ---------- Pamela Pomary University of Ghana, ICT Directorate skype:ppomary

1 0

EAP-TTLS/PAP with OpenLDAP user store
by Stefano Zanmarchi 07 Mar '12

07 Mar '12

Hi, my aim is to to have eap-ttls/pap working using an openldap user database with MD5 hashed passwords. I got it working configuring ldap parameters in /etc/raddb/modules/ldap and applying two changes in /etc/raddb/sites-available/inner-tunnel: 1) uncommented "ldap" in the authorize section 2) uncommented these lines in the authenticate section: Auth-Type LDAP { ldap } Am I doing it right? What puzzles me is the following comment in the authenticate section that seems to warn me not to do what I have done ("EAP wont'work"): # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Thanks a lot for your time and help, Stefano Here's the very long of the debug output (test done with JRadusSimulator with EAP-TTLS/PAP Authentication Protocol): rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=204, length=95 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" EAP-Message = 0x0200001701616e6f6e796d6f757340756e6970642e6974 Message-Authenticator = 0x4a6c7626f1ae57fabb14be50dbc07a24 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 0 length 23 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 204 to 192.168.100.11 port 41898 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd7901eacd78148a4b2cea7aabcc02f2 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=205, length=162 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" State = 0xcd7901eacd78148a4b2cea7aabcc02f2 EAP-Message = 0x020100481500160301003d0100003903014f5645254671b784085849aa6dd6e3f818aa3e40e058b087ba535933b62b721a0000120039003800330032001600130035002f000a0100 Message-Authenticator = 0x19b7441b270f62ebbc9d4840c09bdb7a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 1 length 72 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 003d], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 205 to 192.168.100.11 port 41898 EAP-Message = 0x0102040015c000000aad160301002a0200002603014f56452532ed154126bed11870476c01d7f373c20ad3d9c68ac6e05dd629561700003900160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3132303132343135303735395a170d3133303132333135303735395a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100fa0f3e1ceaf9177f2eb634acd46fb39abe162dcc17f73b8a79fa0b159fb608379beb9cca6a68546fb4395d33c847c667a01a87f28829d7fb310080eca9f8 EAP-Message = 0x3458e66496b02ae443acf293f00ef76f4cc9e5ccfa418d10fff27cf43821b8ad462578a67e42dc0b6f3fc2014334dd79a599d45e64c626341605bf4126f773cf813ab0fb340f5b48f5210d6848fb6e054e105c8d94eb70fb7c8a886539414ede92e9c4b726fd4283b5bce1e0bfbb35531fc4b0bffd7bb4bd2867bca48145af082ee78032331f3edf63fb6ba6c0d79855250469c60ad8e38ab5b2954e29cafc5979bb3c10575a1c1d221cf47d98a4db79da5840c45a431b7025b9b807aefefd0881e10203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100bc3332769e2ecff294 EAP-Message = 0x0a42a153dde30c127fc17b73cb994937130670488c983419461531cd82f99acf032930dfd2f5e1b23f0f61bb18f1c05c9a548fcfc365c1b38733b12a4229002cca44c9c3442d5f021e708806d8c5c378f01191ca86481c3f0654f7fa14b992ffd7541f68d57e5fb3116b142a5e12f6e2bf7554e0c008e6490dacfa62427787c4190b3e95abb39018767f92fa131dd729f778a6787f0ac4fcd940c0c42c9fdd6e31e0d9a93230130cad702cf7d081a0d0240a745bfa00527d6aa0846b5205f03f899fddc7b6dff5fbfbaedc29d09bd0aa602dfc4faa99ed24f320ac09069df43e36b971c3c73edb793dd8e4747963f3cc6add7def77934b0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd7901eacc7b148a4b2cea7aabcc02f2 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=206, length=96 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" State = 0xcd7901eacc7b148a4b2cea7aabcc02f2 EAP-Message = 0x020200061500 Message-Authenticator = 0xa2c22a1a2e8fa392e6f8babe34a8a605 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 206 to 192.168.100.11 port 41898 EAP-Message = 0x0103040015c000000aad00e8494b90642e746f300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3132303132343135303735395a170d3133303132333135303735395a308193310b3009060355040613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100cd77ec7086dbc07f34f7cae3b3872f281bbb836151b0dc6723bb1c027715d93053050e0f43b8c0d9105565cdad4a780737970a5a420e0d597d900d60278e7376cd4a9fa1a04dd69486098a1c9300d0705ad547341553e146513a06936d96b24314c29649e16e46283b2ab2 EAP-Message = 0xc02e488785b05212fbdb5593a67c081b5760d7c8ece614ca379a329ad870dce6ac78e1c5383ed4797aebfec23530572a5298b40a5686805317b03da9663c694b98d925e489eb6ca695cf3b0628c028c6fe88e83e37e125f005583b0f7c58936d4645b91a569b95df9aafed8d11b7b2b3165279e297a17622f96e2dc4a23415bd249fbc1ebd09103ae493d7adfb359f3fd7b03e9a390203010001a381fb3081f8301d0603551d0e04160414da070c5228c57bbee0cc49e2c4b12cf1720dabf73081c80603551d230481c03081bd8014da070c5228c57bbee0cc49e2c4b12cf1720dabf7a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900e8494b90642e746f300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100ba35653daf0e4c3b6cc689ebd67f3cbfd3f368f9827a6791587584ba9c9e19b9e4466f291e7d61ee59fcc4d255c4b1bddbf5a2b5e347e86285470bd3c6ec4e13fb8d790432bef10f0f04ae5d57db EAP-Message = 0x95aabab449a37124b01f7d23 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd7901eacf7a148a4b2cea7aabcc02f2 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=207, length=96 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" State = 0xcd7901eacf7a148a4b2cea7aabcc02f2 EAP-Message = 0x020300061500 Message-Authenticator = 0x7de069de52a18aaf03a8a63845bb52ab +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 207 to 192.168.100.11 port 41898 EAP-Message = 0x010402cb158000000aad2e32d34b73b029470cf489eed7f1dc989b9157a2c04d5d03791d618440aac34bebfa42cf0c52e516af7013aaf2093662be0201215cd5cfa43f570e827fcdcd68a9c10e77250179332e1844a5533e9f06ca5ff640c1f2a12a4f0ea6e63063b1091818c094ea5412575c9a80fc69f817711017550c5fec771b9551c9e0767161fde2cf39e938c4284698c459769b117678303aa015621f3c54c249d2d52985afd1390507efec33160301020d0c0002090080f09039993098ab5b7cfc785f08528979fc0525e868a74d8283896c088865610862093c47d49077eb9916d8c87c9c6d1e77153e9a7abace55f4d0b205a74f38b4191d EAP-Message = 0x114b0910b3a08dab17b65fe08eb9f564c1328fff3a299045398adb4a08f20c0c5e071e08172b5659e60964029beaaf23158643cf635bb2283f8ede606003000102008015e952d5ccf37e61fb8ee23373c3e5bf9a953e82cfd17f82fa78aec2202e1e13dab27035c72f9fea4bd170db65cd75ba77d5a8bdc99ce16e0f1dc6add5547d23e9b70d01f98a0ec44f8e8a6d7bec73b2f97cbf350adff04760906b9dc13a7fd3df3519e7b2cc81173b913cc6a00d7f90bedff8b942a3b9f91661c78bc7c1afd00100805befbdf25cf595abcb8b6701c75654d6eddb95b7e61194a9bc38cdc385d39f528b7576d74dbcd80de5668fe61f582c659db4727e2e3704 EAP-Message = 0x2087d41ebd9420008136d668d0a9345721d00a5c6c3a0bb6600b13a1a601053d08d52ebd022540403d6a74f0822b70f0ad2b78013a222c87ef720d6a399e988cad506981fdfa51b2be0d77c7845aa9ef540533a3834c76e754e7946dc388d40a72b237acd9f7db0160ab6d14be7ac11a2495d106db5a3490298d7e7d5db912e68ea7a45be2333c3cdfffa3773fa35df4236b04d183c87cbedef9428934302510dd6543a090fbc6586647d8064a67eb40a63f0717ba10a8dbd48ef054215302f6bc220c4b315fe40d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd7901eace7d148a4b2cea7aabcc02f2 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=208, length=310 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" State = 0xcd7901eace7d148a4b2cea7aabcc02f2 EAP-Message = 0x020400dc150016030100861000008200805fbeedad3d5af155f4c45f2410d3c02ec13fc5d3df27374d07e8c6684ec7356d99cafc892fc0e753551c1a74a425bb70161d0cd34fe326fe961ea1c9f027419bdb819329e5644b34dff39ca0c3d77ae8d8acdba6aaac53b7606985db292ea50c6f237bf90725a1ce53caf91f2428cb25d54e7e4bb7ffe6c2cd6df7c8a0d1fec814030100010116030100406e4ca038ddf976b6a0f080487c316d44684af947febc7432eba1209c637219ee06fdf4391e43753763be7d6237a01d7fd9e23854300e2d3c73e6cb79f13dfdf1 Message-Authenticator = 0x3f0e85870f20ce1a998879c107f38832 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 4 length 220 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 208 to 192.168.100.11 port 41898 EAP-Message = 0x0105004515800000003b14030100010116030100301ba0ec36ea8a4181d9b5b4d526ae533f3ea22fb31b29a8cf34824f52dfaf12589a6239eff19952d02b1d5a67ba056129 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd7901eac97c148a4b2cea7aabcc02f2 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=209, length=96 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" State = 0xcd7901eac97c148a4b2cea7aabcc02f2 EAP-Message = 0x020500061500 Message-Authenticator = 0x5bee6ebbb1f0dfb633b2c47db5deb0af +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 ++[eap] returns handled Sending Access-Challenge of id 209 to 192.168.100.11 port 41898 EAP-Message = 0x0106000a158000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd7901eac87f148a4b2cea7aabcc02f2 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.100.11 port 41898, id=210, length=250 NAS-Port = 100 NAS-IP-Address = 123.123.123.123 User-Name = "anonymous(a)unipd.it" State = 0xcd7901eac87f148a4b2cea7aabcc02f2 EAP-Message = 0x020600a015001703010030545053644b5cc5c386d17396a5b1fc38c717302eb5e26f5322df1a9c323793c233cb6e4effe95ab464a808910a93a8ea17030100604de78b46dbf0dd777446d710071eee3eb6b3a8f8728ac83280a4dad02e364e7e8c70dabaa49a0b5d887bb296b060546890c98623d8642229ae757dc61eb989fb6340807fb449fdedde56c40951d7a48e2a51c995364f1e6f49c3d8bd8463cef6 Message-Authenticator = 0x60c9bcb9cdef0bee42e5b4ccec949aed +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "unipd.it" for User-Name = "anonymous(a)unipd.it" [suffix] No such realm "unipd.it" ++[suffix] returns noop [eap] EAP packet type response id 6 length 160 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "test.user(a)studenti.unipd.it" User-Password = "XXX" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "test.user(a)studenti.unipd.it" User-Password = "XXX" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] Looking up realm "studenti.unipd.it" for User-Name = "test.user(a)studenti.unipd.it" [suffix] No such realm "studenti.unipd.it" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for test.user(a)studenti.unipd.it [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> test.user(a)studenti.unipd.it [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test.user(a)studenti.unipd.it) [ldap] expand: dc=unipd,dc=it -> dc=unipd,dc=it rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to mytestingdirectory.it:389, authentication 0 rlm_ldap: bind as uid=ldapconnect.user(a)studenti.unipd.it,ou=students,dc=unipd,dc=it/XXX to mytestingdirectory.it:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=unipd,dc=it, with filter (uid=test.user(a)studenti.unipd.it) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user test.user(a)studenti.unipd.it authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "test.user(a)studenti.unipd.it" with password "XXX" [ldap] user DN: uid=test.user(a)studenti.unipd.it,ou=students,dc=unipd,dc=it rlm_ldap: (re)connect to mytestingdirectory.it:389, authentication 1 rlm_ldap: bind as uid=test.user(a)studenti.unipd.it,ou=students,dc=unipd,dc=it/XXX to mytestingdirectory.it:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user test.user(a)studenti.unipd.it authenticated succesfully ++[ldap] returns ok WARNING: Empty section. Using default return values. } # server inner-tunnel [ttls] Got tunneled reply code 2 [ttls] Got tunneled Access-Accept [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 210 to 192.168.100.11 port 41898 MS-MPPE-Recv-Key = 0x7e3008da04efccfd6c7be689ff4b9f936c80c49e65c3ca620ebe67043037fb4e MS-MPPE-Send-Key = 0x37248e65b82a594d264cc1f03d9a1cb55addc7e916ec0c035bbe98c183bf5548 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous(a)unipd.it" Finished request 6. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 204 with timestamp +12 Cleaning up request 1 ID 205 with timestamp +12 Cleaning up request 2 ID 206 with timestamp +12 Cleaning up request 3 ID 207 with timestamp +12 Cleaning up request 4 ID 208 with timestamp +12 Cleaning up request 5 ID 209 with timestamp +12 Cleaning up request 6 ID 210 with timestamp +12 Ready to process requests.

2 5