May 2012 - Freeradius-Users - lists.freeradius.org

fail to start server
by jerry kwajaffa 07 May '12

07 May '12

Gd day, please i need your help, i install freeradius 2.1.12 on centOS 6.2, when ever i try to strart that server o debug, i.e radius -X it gives the following Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory am i to create the file on that path ? pls i need help

2 1

Re: Freeradius-Users Digest, Vol 85, Issue 14 - Use case Radclient
by ulrich ramassamy 07 May '12

07 May '12

Hello everybody, I have one problem with an options of raclient tool's: I have create a little script: (I have one file named "file1") and in this file, I have 3 columns (IP, MSISDN,Acct-Session-Id): IP MSISDN Acct-Session-Id 1.1.1.1 3368894XXXX 500A02B2382F3D8E 2.2.2.2 3368739XXXX 500A02B5383F27D9 ###### BEGIN ###### old_IFS=$IFS IFS=$'\n' for i in `cat file1` do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient *-p 100* -r 2 -x 3.3.3.3:3799 disconnect ''secret'' done IFS=$old_IFS ###### END ###### But in this script the parameter *-p *is not used!!!! root@ulrich-Pod1:/etc/freeradius# old_IFS=$IFS root@ulrich-Pod1:/etc/freeradius# IFS=$'\n' root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# for i in `cat file1` > do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient -p 100 -r 2 -x 3.3.3.3:3799 disconnect ''secret'' > done Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 radclient: no response from server for ID 127 socket 3 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 radclient: no response from server for ID 206 socket 3 root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# IFS=$old_IFS The problem "radclient: no response from server" it's normal because it's just a test and the "disconnect server" it's not configure!! But the problem is that I specify in the script that we can send up to 100 requests in parallel but I see that the script sends only one request at a time, and if there is no answer two other requests is sent In the man of radclient i have this: -p num_requests_in_parallel Send num_requests_in_parallel, without waiting for a response for each one. By default, radclient sends the first request it has read, waits for the response, and once the response is received, sends the second request in its list. This option allows you to send many requests at simultaneously. Once num_requests_in_parallel are sent, radclient waits for all of the responses to arrive (or for the requests to time out), before sending any more packets. This option permits you to discover the maximum load accepted by a RADIUS server. I thins it's the same problem with option -n! It's a Bug!!!!!!!???? Best Regards Ulrich 2012/5/7 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. radclient (ulrich ramassamy) > 2. Re: multiple ldap servers::solved:: (jeff donovan) > 3. Sync ldap-group with sql profiles (Mohsen Saeedi) > 4. NAS Client (Shawky Skaff) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 6 May 2012 19:46:06 +0200 > From: ulrich ramassamy <ramassamy.ulrich(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: radclient > Message-ID: > <CAKYkJTp9Fi6kZAwSptUBZZXCq3To1B6jSrkTWvw5SRP=ZW_STw(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > I am writing you because I need your help on using the tool "radclient". > I need to send Packet Of Disconnect (POD). I have one file (for example > name "file1") and in this file, I have 3 columns (IP, MSISDN, > Acct-Session-Id): > > IP MSISDN Acct-Session-Id > 1.1.1.1 3368894XXXX 500A02B2382F3D8E > 2.2.2.2 3368739XXXX 500A02B5383F27D9 > > I read on this site: "http://wiki.freeradius.org/Disconnect-Messages" and > the proposed solution tells us to insert in a file "packet.txt" the > attributes that we wish send. In this method we have to create one file for > one POD. :( > > Now I want to use the file "file1" by selecting the attibutes to send POD > one to one in one command (linux command) like this : > > Sending Disconnect-Request of id 214 to 1.1.1.1 port 3799 > Framed-IP-Address=1.1.1.1 > Acct-Session-ID=500A02B2382F3D8E > rad_recv: Disconnect-ACK packet from host 1.1.1.1 port 3799, id= 214, > length=20 > > Sending Disconnect-Request of id 215 to 2.2.2.2 port 3799 > Framed-IP-Address=2.2.2.2 > Acct-Session-ID=500A02B5383F27D9 > rad_recv: Disconnect-ACK packet from host 2.2.2.2 port 3799, id=215, > length=20 > > I need to know if It's possible to do this (I think by using a loop > "for"!!!)? Can you please help me? > > Thanks for your help. > > Best regards, > > Ulrich RAMASSAMY > T?l: +33671783501 > > PS: Sorry for my english^^ >

2 1

Re: Freeradius-Users Digest, Vol 85, Issue 14 - Use Case Radclient (correction)
by ulrich ramassamy 07 May '12

07 May '12

Hello everybody, I have one problem with an options of raclient tool's: I have create a little script: (I have one file named "file1") and in this file, I have 3 columns (IP, MSISDN,Acct-Session-Id): IP MSISDN Acct-Session-Id 1.1.1.1 3368894XXXX 500A02B2382F3D8E 2.2.2.2 3368739XXXX 500A02B5383F27D9 ###### BEGIN ###### old_IFS=$IFS IFS=$'\n' for i in `cat file1` do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient -p 100 -x 3.3.3.3:3799 disconnect ''secret'' done IFS=$old_IFS ###### END ###### But in this script the parameter -p is not used!!!! root@ulrich-Pod1:/etc/freeradius# old_IFS=$IFS root@ulrich-Pod1:/etc/freeradius# IFS=$'\n' root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# for i in `cat file1` > do echo $i | gawk '{print "Acct-Session-Id="$3"\n""NAS-IP-Address="$1}' | radclient -p 100 -x 3.3.3.3:3799 disconnect ''secret'' > done Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 Sending Disconnect-Request of id 127 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B2382F3D8E" NAS-IP-Address = 1.1.1.1 radclient: no response from server for ID 127 socket 3 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 Sending Disconnect-Request of id 206 to 3.3.3.3 port 3799 Acct-Session-Id = "500A02B5383F27D9" NAS-IP-Address = 2.2.2.2 radclient: no response from server for ID 206 socket 3 root@ulrich-Pod1:/etc/freeradius# root@ulrich-Pod1:/etc/freeradius# IFS=$old_IFS The problem "radclient: no response from server" it's normal because it's just a test and the "disconnect server" it's not configure!! But the problem is that I specify in the script that we can send up to 100 requests in parallel but I see that the script sends only one request at a time, and if there is no answer two other requests is sent In the man of radclient i have this: -p num_requests_in_parallel Send num_requests_in_parallel, without waiting for a response for each one. By default, radclient sends the first request it has read, waits for the response, and once the response is received, sends the second request in its list. This option allows you to send many requests at simultaneously. Once num_requests_in_parallel are sent, radclient waits for all of the responses to arrive (or for the requests to time out), before sending any more packets. This option permits you to discover the maximum load accepted by a RADIUS server. I thins it's the same problem with option -n! It's a Bug!!!!!!!???? Best Regards Ulrich 2012/5/7 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. radclient (ulrich ramassamy) > 2. Re: multiple ldap servers::solved:: (jeff donovan) > 3. Sync ldap-group with sql profiles (Mohsen Saeedi) > 4. NAS Client (Shawky Skaff) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 6 May 2012 19:46:06 +0200 > From: ulrich ramassamy <ramassamy.ulrich(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: radclient > Message-ID: > <CAKYkJTp9Fi6kZAwSptUBZZXCq3To1B6jSrkTWvw5SRP=ZW_STw(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > > I am writing you because I need your help on using the tool "radclient". > I need to send Packet Of Disconnect (POD). I have one file (for example > name "file1") and in this file, I have 3 columns (IP, MSISDN, > Acct-Session-Id): > > IP MSISDN Acct-Session-Id > 1.1.1.1 3368894XXXX 500A02B2382F3D8E > 2.2.2.2 3368739XXXX 500A02B5383F27D9 > > I read on this site: "http://wiki.freeradius.org/Disconnect-Messages" and > the proposed solution tells us to insert in a file "packet.txt" the > attributes that we wish send. In this method we have to create one file for > one POD. :( > > Now I want to use the file "file1" by selecting the attibutes to send POD > one to one in one command (linux command) like this : > > Sending Disconnect-Request of id 214 to 1.1.1.1 port 3799 > Framed-IP-Address=1.1.1.1 > Acct-Session-ID=500A02B2382F3D8E > rad_recv: Disconnect-ACK packet from host 1.1.1.1 port 3799, id= 214, > length=20 > > Sending Disconnect-Request of id 215 to 2.2.2.2 port 3799 > Framed-IP-Address=2.2.2.2 > Acct-Session-ID=500A02B5383F27D9 > rad_recv: Disconnect-ACK packet from host 2.2.2.2 port 3799, id=215, > length=20 > > I need to know if It's possible to do this (I think by using a loop > "for"!!!)? Can you please help me? > > Thanks for your help. > > Best regards, > > Ulrich RAMASSAMY > T?l: +33671783501 > > PS: Sorry for my english^^ >

1 0

Sync ldap-group with sql profiles
by Mohsen Saeedi 06 May '12

06 May '12

Hi I read more and more about my problem. but i didn't find any useful answer. I have freeradius-2.1.10 and i configured it with Active Directory. I know about openldap and radius profile and good attributes is exist under openldap for radius purpose. Now i'm able to find ldap-group with rlm_file module and with correct ldap module configuration. but i want to move our configuration from users to sql. i set everything on sql. such as nas configuration or profile definition. i defined some profile with needed attribute such as attribute is suitable for hotspot(coovachilli for example). but i'm not able to query ldap-group when i'm using rlm_sql and not rlm_file. how can i configure radius to get ldap-group query from AD to map AD group to sql profile? I know about unlang too. is it possible to write some unlang query for map ldap-group to sql profile? It's urget for me. please explain everything you know. I'm waiting for your answer man. Thanks

1 0

multiple ldap servers
by jeff donovan 06 May '12

06 May '12

Greetings I'm new to radius but have been reading. I have a freeradius server running on ubuntu 11, my users file is an ldap server which works great. My question is, how can i search and alternate LDAP server for user credentials ? If the first LDAP search fails try the next server in line. I found some documentation- * http://freeradius.org/radiusd/doc/ldap_howto.txt does not mention a second server. *http://freeradius.org/radiusd/doc/configurable_failover explains the redundant setup for sql accounting. so far I tried adding the second ldap server, it's info is read during module load -- no errors. The problem is,.. only one of the ldap systems contains the correct info. So one WILL fail and the other will pass. with that being said,.. How do i configure my server to Pass if either system returns " ok " ? currently it will fail even if one LDAP system returns good. authorize { preprocess chap mschap digest suffix eap { ok = return } files redundant { ldap1 ldap2 } expiration logintime pap # Autz-Type Status-Server { # # } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest # # Pluggable Authentication Modules. # pam unix Auth-Type LDAP { ldap1 ldap2 } eap # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } Any Assistance would be helpful. -j

3 12

radclient
by ulrich ramassamy 06 May '12

06 May '12

Hello, I am writing you because I need your help on using the tool "radclient". I need to send Packet Of Disconnect (POD). I have one file (for example name "file1") and in this file, I have 3 columns (IP, MSISDN, Acct-Session-Id): IP MSISDN Acct-Session-Id 1.1.1.1 3368894XXXX 500A02B2382F3D8E 2.2.2.2 3368739XXXX 500A02B5383F27D9 I read on this site: "http://wiki.freeradius.org/Disconnect-Messages" and the proposed solution tells us to insert in a file "packet.txt" the attributes that we wish send. In this method we have to create one file for one POD. :( Now I want to use the file "file1" by selecting the attibutes to send POD one to one in one command (linux command) like this : Sending Disconnect-Request of id 214 to 1.1.1.1 port 3799 Framed-IP-Address=1.1.1.1 Acct-Session-ID=500A02B2382F3D8E rad_recv: Disconnect-ACK packet from host 1.1.1.1 port 3799, id= 214, length=20 Sending Disconnect-Request of id 215 to 2.2.2.2 port 3799 Framed-IP-Address=2.2.2.2 Acct-Session-ID=500A02B5383F27D9 rad_recv: Disconnect-ACK packet from host 2.2.2.2 port 3799, id=215, length=20 I need to know if It's possible to do this (I think by using a loop "for"!!!)? Can you please help me? Thanks for your help. Best regards, Ulrich RAMASSAMY Tél: +33671783501 PS: Sorry for my english^^

1 0

FreeRadius - IIS & Outlook Web Access (OWA)
by udptelecom 04 May '12

04 May '12

Hi, Anyone know of an ISAPI filter that understands RADIUS that can be used to authenticate to FreeRadius. This would be used to authenticate access to Outlook Web Access (OWA) running under IIS. I know of one provider http://www.tcpdata.com - but they're site is currently down and all my calls & emails have gone unanswered. Thanks! Abedi

2 2

[EAP-TLS Windows 7] Problem with chain certificate on the client side
by jinx_20 04 May '12

04 May '12

Hi all, My PKI infrastructure is hierarchical, meaning that client certificate path looks like below: ROOT_CA->Sub1_CA->Sub2_CA->Client_Cert Client_Cert & Sub2_CA purposes are set correctly. After I import client certificate (client.p12) into the Windows Cert Store the following events occur: -Root CA cert is imported into the Trusted Root CAs, -every sub CA cert (Sub1 CA & Sub2 CA) is imported into the Intermediate CAs, -user's cert is imported into Personal Certificates, I can't connect.... As soon as I delete Sub2 CA (that is, the CA certificate of the certificate authority which issued client's certificate) I am able to connect successfully. I suspect that Windows 7 supplicant sends entire chain of client certificate to FreeRadius server what makes it confused. I suppose that FreeRadius cannot verify Sub2_CA certificate received from the client because its purpose is not "Client Auth". As a result FreeRadius outputs the following message: *--> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation* Below you can find two debug outputs. First one represents situation when Sub2 CA is present in the Intermediate CAs Store and another one shows the case when Sub2 CA was deleted. Additionally, CA_file in the eap.conf is set to ${cadir}/Sub2_CA_*entire_chain*.pem When I try to connect from linux machine everything works great (wpa supplicant doesn't send entire client's certificate chain toward radius server, it sends only client cert - the last cert from the chain). The problem arised while connecting from Windows 7 machine. Is there any way to configure FreeRadius server to explicitly accept intermediate CAs received from the client supplicant? Appreciate any hints. Gabriel ############################################### ################## FAILD ###################### ################## FAILD ###################### ############################################### rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=182, length=193 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 182 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=183, length=298 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 105 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0578], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00f9], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 183 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=184, length=199 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 184 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=185, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 5695 [tls] Received EAP-TLS First Fragment of the message [tls] eaptls_verify returned 9 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 185 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=186, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] More fragments to follow [tls] eaptls_verify returned 10 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 186 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=187, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] More fragments to follow [tls] eaptls_verify returned 10 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 187 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=188, length=1448 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 13f3], Certificate --> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 2762_hd.test6 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 188 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF Waking up in 3.9 seconds. Cleaning up request 0 ID 182 with timestamp +23 Cleaning up request 1 ID 183 with timestamp +23 Cleaning up request 2 ID 184 with timestamp +23 Cleaning up request 3 ID 185 with timestamp +23 Cleaning up request 4 ID 186 with timestamp +23 Cleaning up request 5 ID 187 with timestamp +23 Waking up in 1.0 seconds. Cleaning up request 6 ID 188 with timestamp +23 Ready to process requests. ############################################### ################## ACCEPT ###################### ################## ACCEPT ###################### ############################################### rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=189, length=193 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 189 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=190, length=298 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 105 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 95 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 005a], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0578], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00f9], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 190 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=191, length=199 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 191 to 172.16.16.1 port 32770 EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=192, length=1695 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 2193 [tls] Received EAP-TLS First Fragment of the message [tls] eaptls_verify returned 9 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 192 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=193, length=914 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF EAP-Message = 0xFF EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0645], Certificate [tls] chain-depth=3, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = SNAKE OIL ROOT CA [tls] --> subject = /CN=SNAKE OIL ROOT CA/OU=Digital Certificate Services/O=Snake Oil Company/C=PL [tls] --> issuer = /CN=SNAKE OIL ROOT CA/OU=Digital Certificate Services/O=Snake Oil Company/C=PL [tls] --> verify return:1 [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = SNAKE OIL CA [tls] --> subject = /CN=SNAKE OIL CA/O=Snake Oil Company 2/C=PL [tls] --> issuer = /CN=SNAKE OIL ROOT CA/OU=Digital Certificate Services/O=Snake Oil Company/C=PL [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = SNAKE OIL WIFI CA [tls] --> subject = /CN=SNAKE OIL WIFI CA/O=Snake Oil Company 2/C=PL [tls] --> issuer = /CN=SNAKE OIL CA/O=Snake Oil Company 2/C=PL [tls] --> verify return:1 [tls] Verifying client certificate: /etc/freeradius/geppetto.sh %{TLS-Client-Cert-Filename} %{Called-Station-Id} [tls] expand: %{TLS-Client-Cert-Filename} -> /tmp/radiusd/freeradius.client.XXnI1oCe [tls] expand: %{Called-Station-Id} -> XX-XX-XX-XX-XX-XX:SSID + GREP=/bin/grep + LDAP=/usr/bin/ldapsearch + OPENSSL=/usr/bin/openssl + cp /tmp/radiusd/freeradius.client.XXnI1oCe /tmp/ + exit 0 Exec-Program output: Exec-Program: returned: 0 [tls] Client certificate CN 2762_hd.test6 passed external validation [tls] chain-depth=0, [tls] error=0 [tls] --> User-Name = 2762_hd.test6 [tls] --> BUF-Name = 2762_hd.test6 [tls] --> subject = /emailAddress=2762_hd.test6@snakeoil.com/CN=2762_hd.test6/GN=HD/SN=Test6/OU=Operations/OU=HelpDesk/O=Snake Oil Company [tls] --> issuer = /CN=SNAKE OIL WIFI CA/O=Snake Oil Company 2/C=PL [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 193 to 172.16.16.1 port 32770 EAP-Message = 0xFF Message-Authenticator = 0xFF State = 0xFF Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.16.1 port 32770, id=194, length=199 User-Name = "2762_hd.test6" Calling-Station-Id = "AA-AA-AA-AA-AA-AA" Called-Station-Id = "XX-XX-XX-XX-XX-XX:SSID" NAS-Port = 1 NAS-IP-Address = 172.16.16.1 NAS-Identifier = "wlc.intra" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" EAP-Message = 0xFF State = 0xFF Message-Authenticator = 0xFF # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "2762_hd.test6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake is finished [tls] eaptls_verify returned 3 [tls] eaptls_process returned 3 [tls] Adding user data to cached session [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 194 to 172.16.16.1 port 32770 MS-MPPE-Recv-Key = 0xFF MS-MPPE-Send-Key = 0xFF EAP-Message = 0xFF Message-Authenticator = 0xFF User-Name = "2762_hd.test6" Finished request 5. Going to the next request Waking up in 4.9 seconds. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-TLS-Windows-7-Problem-with-chai… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 13

SHA-256,384,512?
by Stefan Winter 04 May '12

04 May '12

Hi, I'm trying to figure out if FreeRADIUS supports SHA-2 (256,384,512 variants) or just SHA1. Some attributes have only "SSHA" in their name, without a "-1" so I thought they could do more than SHA-1. Looking at the source code of 2.1.12, it doesn't look like it though, SHA seems to be synonymous for SHA-1. Can I get a quick confirmation that the SHA-2 family is not supported for password hashes? Anything coming up in that regard in 3.0? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 1

Very huge Acct-Session-Time
by Sharad P 04 May '12

04 May '12

Hello, I'm analyzing Radius accounting data from my AP(access point). Found some unusual behavior. The Acct-Session-Time is very huge, about 42 years. Also the Acct-Status-Type is set to Interim-Update. Some additional info NAS-Port-Type = Wireless-802.11 User-Name = "Unknown" Acct-Session-Time = 1335709914 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Any ideas regarding such a huge active session time? Thanks in advance. Regards, Sharad Panicker -- View this message in context: http://freeradius.1045715.n5.nabble.com/Very-huge-Acct-Session-Time-tp56797… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 11