July 2013 - Freeradius-Users - lists.freeradius.org

Freeradius won't bind to port if running as user AND started as root, but works fine if started as the radius user.
by Matthew Schumacher 02 Aug '13

02 Aug '13

List, This is odd, I can't seem to figure out what the deal is with this. This works: As root user; /usr/sbin/radius -X As root user; /usr/sbin/radius (when user= and group= is commented out and running as root) As radius user; /usr/sbin/radius -X As radius user; /usr/sbin/radius (when user=radius and group=user) This doesn't work: As root user; /usr/sbin/radius (when user=radius and group=user) I don't think this is a permissions issue as it works fine when invoked as the radius user in daemon mode (so we can read the config and write to logs), but starting as root and letting radius switch to the radius user doesn't work. What is interesting is that the logs show: ....... Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server When running as root user; /usr/sbin/radiusd -xx (when user=radius and group=user) So it stops just shy of thread pool and binding to the port. The same command and config run as the radius user shows: ....... Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server thread pool { start_servers = 10 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 } Thread spawned new child 1. Total threads in pool: 1 Thread 1 waiting to be assigned a request Thread spawned new child 2. Total threads in pool: 2 Thread 2 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 5 waiting to be assigned a request Thread spawned new child 6. Total threads in pool: 6 Thread 6 waiting to be assigned a request Thread spawned new child 7. Total threads in pool: 7 Thread 7 waiting to be assigned a request Thread spawned new child 8. Total threads in pool: 8 Thread 8 waiting to be assigned a request Thread spawned new child 9. Total threads in pool: 9 Thread 9 waiting to be assigned a request Thread spawned new child 10. Total threads in pool: 10 Thread pool initialized Thread 10 waiting to be assigned a request radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1645 } listen { type = "acct" ipaddr = * port = 1646 } Listening on authentication address * port 1645 Listening on accounting address * port 1646 Ready to process requests. Any ideas? Thanks, schu

2 2

WiMAX TLV value correct in debug but not correct in packet capture
by James Leavitt 01 Aug '13

01 Aug '13

Version info: radiusd: FreeRADIUS Version 2.2.0, for host i686-redhat-linux-gnu, built on Oct 9 2012 at 17:47:30 Copyright (C) 1999-2011 The FreeRADIUS server project and contributors. Hello Everyone, I've probably missed something or buggered an option, but I've searched and searched and cannot find an answer to this. This is for a WiMAX deployment and am using the built in dictionaries. The issue is with the WiMAX-Packet-Flow-Descriptor tlv . Below is what's configured in my DB: id | groupname | attribute | op | value -----+-----------+----------------------------+----+------- 100 | Business | Session-Timeout | := | 86400 101 | Business | Acct-Interim-Interval | := | 60 110 | Business | WiMAX-Packet-Data-Flow-Id | := | 14 111 | Business | WiMAX-Service-Data-Flow-Id | := | 14 112 | Business | WiMAX-Service-Profile-Id | := | 14 120 | Business | WiMAX-Packet-Data-Flow-Id | += | 17 121 | Business | WiMAX-Service-Data-Flow-Id | += | 17 122 | Business | WiMAX-Service-Profile-Id | += | 17 >From a debug I get this (relevant section): Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [ttls] Using saved attributes from the original Access-Accept Session-Timeout := 86400 Acct-Interim-Interval := 60 WiMAX-Packet-Data-Flow-Id := 14 WiMAX-Service-Data-Flow-Id := 14 WiMAX-Service-Profile-Id := 14 WiMAX-Packet-Data-Flow-Id += 17 WiMAX-Service-Data-Flow-Id += 17 WiMAX-Service-Profile-Id += 17 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop [wimax] MIP-RK = 0x00b0ce41e978a30ec9b196bdea7bd74def743761ddc81add6cb19ca577056e59ea814c5b54891482a045773e861657260658939502a9babd7c0a59a92a99cf87 [wimax] MIP-SPI = 42f4fa35 [wimax] WARNING: WiMAX-MN-NAI was not found in the request or in the reply. [wimax] WARNING: We cannot calculate MN-HA keys. [wimax] WARNING: WiMAX-IP-Technology not found in reply. [wimax] WARNING: Not calculating MN-HA keys ++[wimax] returns updated Sending Access-Accept of id 2 to 10.199.20.240 port 6219 Session-Timeout := 86400 Acct-Interim-Interval := 60 WiMAX-Packet-Data-Flow-Id := 14 WiMAX-Service-Data-Flow-Id := 14 WiMAX-Service-Profile-Id := 14 WiMAX-Packet-Data-Flow-Id += 17 WiMAX-Service-Data-Flow-Id += 17 WiMAX-Service-Profile-Id += 17 MS-MPPE-Recv-Key = 0x6b033615247e78ea0e225bea745bba8c33634e0bf28ea0388174965a980b1642 MS-MPPE-Send-Key = 0x1a21679697b923cc88f4b4ba4fa37ded7f00c035811cd6ff18b4fb4e64956077 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" Finished request 14. Everything looks good but on a pcap / radsniff I get this: Access-Accept Id 2 10.199.10.14:1812 -> 10.199.20.240:6219 +31.411 Session-Timeout = 86400 Acct-Interim-Interval = 60 WiMAX-Packet-Data-Flow-Id = 17079 <--???? WiMAX-Service-Data-Flow-Id = 13496 <--???? WiMAX-Service-Profile-Id = 918034516 <--???? WiMAX-Packet-Data-Flow-Id = 17079 <--???? WiMAX-Service-Data-Flow-Id = 17079 <--???? WiMAX-Service-Profile-Id = 884473856 <--???? Microsoft-Attr-17 = 0x812038c3de66aec29f91928f3e5346f5911aa110d4c33dfd5556b1aebeb7c637b53c2420b3cd73763eb7c06f5386e6cef612 MS-MPPE-Send-Key = 0x1be2107278 EAP-Message = 0x03070004 Message-Authenticator = 0x70f2a2f9037b10be87a6ad954a205159 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" As can be seen, Session-Timeout and Acct-Interim-Interval all match up, but the others don't, and even change from time to time without anything other than a restart of radiusd. I see the definition in the wimax dictionary is "short" Anyhow, if there's a bug / solution / setting that I've blatantly missed, please let me know. I am attaching more debug below. Thanks, James Going to the next request Ready to process requests. rad_recv: Access-Request packet from host 10.199.20.240 port 6216, id=0, length=274 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020000320131333230434437333737444342314141364241434242414431413233414545354078706c6f726e65742e636f6d Message-Authenticator = 0x624b00fa55a8e8df65355066f4257c1a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 0 length 50 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> 1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com [sql] sql_set_user escaped user --> '1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 1 [sql] User 1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 10.199.20.240 port 6216 EAP-Message = 0x010100160410c8f730871835d03c590829b8055f149a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe3d1a26c4e21bc6380caaf462 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6217, id=0, length=248 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe3d1a26c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020100060315 Message-Authenticator = 0xc216081e84e230c02e8da5c94ef5f567 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> 1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com [sql] sql_set_user escaped user --> '1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 0 [sql] User 1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.199.20.240 port 6217 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe3c1937c4e21bc6380caaf462 Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6218, id=0, length=336 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe3c1937c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x0202005e150016030100530100004f030151f6843e3ba9c0e04d448b5995f9376ddeeb021c600b2c88fd4c4f067d8472e200002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100 Message-Authenticator = 0x8d3b616e15c812e5046a994903eb4c55 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 2 length 94 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0053], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.199.20.240 port 6218 EAP-Message = 0x0103040015c000000aad160301002a02000026030151f6843ea7a068fcf005cd02ab7c253e507ec85b627c50a9dbbb09dad980eb8800003900160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3132303932373230323931365a170d3132313132363230323931365a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c4c5b27c8989fbe23730ed64c341b3eec198c4f61c849694879bb5682e817a3bd36ee0f288703cdd2d01afad09eaa3094a530fd50b1c3051f1578f89033e EAP-Message = 0x9294b51efc7988e06054e1b2db74c33354f26e32d65a208a4f2919a133bf9f1ab8b210deb180f16ebce470e38bd51865630e59fa15fedb01d3b58dcbf3029a01b2e3c21f2ebd3d2e410824d1a8655bfc171fa834c0f4e4ceaf1d9f0aa76f3fd2349fda57a65d785b106a5faecb3520b3fa5b32b07785d466b1f91e2d695126b043b804f5326f55981922a1eeaf4d6565ade837cf4fbe86f276f0d0913f0a5878a1f0f45202cd32bbbae72c923b6b171e81ab9b03c4713ad95c6aba20e61764214b4f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000382010100adecc8bc38709cc6cb EAP-Message = 0x650791e1531ca63c113770c53ab08e0da3decd3e2807b4ab1c602bbc3e04a4259e50dcc583170bf0cfa7720cd57a8e6982017deb231253b4d7de4497af9cee50dd48e34db2af5a318f9969319313b488af1e6576f18000b26f146cf3fa5fb434cd9f5657feb79ca0c46eb156d2f797b6e4325015052adcc7dde58b8ef9f8d8f2e9695d3e26d7802a2c5f69ca1106a082c8b4f6b5cd84873db14e847b2e95a711658d8477c4a53e3531778a09f7feac12b58bd19836b619cbc454920e3c17550eaa47b2986758c41a5059dfe4dbc3eac5653b84b4978da6fb0de56d2bee0a79bbabe09f3c79441bd198d2fd87aa1f21b47cae4add220e9b0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe3f1837c4e21bc6380caaf462 Finished request 9. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6219, id=1, length=248 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe3f1837c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020300061500 Message-Authenticator = 0xb874df56087b707cfc085595cef29766 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.199.20.240 port 6219 EAP-Message = 0x0104040015c000000aad00f69a36800c93c0e9300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3132303932373230323931365a170d3132313132363230323931365a308193310b3009060355040613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d9416f4a53fae50a7026bb1ca7127d27924843f1f61433e89abd8c00a1d41a4eb95ae44df2c49ac28c3a5492d9f751e91e4648b3fc28130d65e57a6ed7b4c9da2c094f55c7dabafef975d013112a4b4b335aac29fd325d7befc35ecc083e4d914e83043699b04add11ec8e EAP-Message = 0xb285b7c47c0cf057bd6fea3fab8c2b184489a5bf8ace00b216ce27c01a066f92c28bb1688cd7a085b2ef1e548cbc7f07fdb8d37b65ede2a6b39d2e5c28010fa22220ac4148277f2c183851c02c4b93d719ddc25b764fc2dd3230f11c24bd8a5d82e25129b7758ea6ed17fd3b0f748a2c56c5b30ea43e64642b850bf791c833d9de05445bceb00bf78c12f21a6eba2a333cca0c7ad90203010001a381fb3081f8301d0603551d0e04160414fae95dc6e57d9997440f8c45a9360970a8a5c2843081c80603551d230481c03081bd8014fae95dc6e57d9997440f8c45a9360970a8a5c284a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900f69a36800c93c0e9300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007abe5079ce7fc50a7960020c5ee7e33191e24c14d469f00ce6b22c16ab8d9e6cb16e3add64e352094e45ffda438e92a39d47ef639b6594240ab3a0e101138e279660c1083d7cffef6f01923fb674 EAP-Message = 0x51cc96f02f1763e5388aaa08 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe3e1f37c4e21bc6380caaf462 Finished request 10. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6216, id=1, length=248 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe3e1f37c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020400061500 Message-Authenticator = 0x4b4a3e988fdc78cb60e7fc872f0291ec # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.199.20.240 port 6216 EAP-Message = 0x010502cb158000000aad921ee4f1071e8d4860225e19af0554bde1421a6647aa33e46d9f9691aff69c875e8229e1baac4394bc1e1f2e857e474b5d181ae344d260691d845bcad5a4ee58b2bdfe0cb103335c0a642b6ecf4ea630836a22c41dd506a930b32544e00486d264bfdb49fc26cf00e96598911d2569ad3d7d10f9a1be2941bb56f8b684d6f08fc5cd3834cf8006f80638cb34fc65f38811592256d8b7fcfaa87301f958e056d943f621ec10b7160301020d0c0002090080ab08979de861c27c1e0ddf489d2a715a6362fdcabac2ba673e46a96be8209efaa298dff3532c0ca4fc593a6fa0cf7eb6959fcc17447028de57788e84644ec5e4d6ad EAP-Message = 0xd7ed1c67c5006738d3b00aa2bd6921a2dacda4dba0eb2cfe668b7eb60dde719053f7b92f55f8bda32784dc0a5cec065fb3e233969cbfc47662576a44c8e300010200802e479e29f0f795052aff8a81b01b5673343d287e439aad873fe9ee0133262c123e48fdc4344c9fa2f5e169609796a1e180f34aa0e932b4e69ae7cbee22362a3a0704b515774883d97dc9723c9e9e08fed3f2658abe681f51e0ce14bac33284fdfe0910295155c6c145e9b3d1495c19fa8d3ff7176a1c08fb5dd63b2d119b0229010052587f03ecb2cf51f55b0bdf8aaff7d7140b19f79ee6fe27e7f971c63c99902625587503d9f7f5f21f7cfb71ec9befa7336d290840c0a8d1 EAP-Message = 0x3d04b449eb53f890f1939d6d270d30742f3a6c98c4562b2f9f982838b358cf520d24ed6925026050f0621c930e766d0669965ba2dde17673b9cae7931ff7cca15f85c8ab6f7973b70db1bb3f548d7eea7994f9332f333bdd29e12b5ae7667abdf94c95bbf5a56df10714938ae43e9f34c1fbe9f5628fa0455f6f7883ad0cc7d2f8b75c6c9572a814ededb5158c9435a8ff47240696cc155788f8d5397aa5388867d3f08cc9fcb9c62d9d368658a8c0b71774055bd23ff3f0d50b03422f5dec055516afce6b16d31516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe391e37c4e21bc6380caaf462 Finished request 11. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6217, id=1, length=446 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe391e37c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020500cc150016030100861000008200805bf0ee4eff60c428c48178565c479d314285d7e56b92715d94000a39febd071764f7d993ad7bf536e6045d9c7d939e5a7ca26db24ae358123b274a762bebb91398543c9696fb166c37e4acc90ece7156e2e785c35792ac2497a2275d79816c54f420fb0b0ef368ceaa6ff732dc7ab700d1594a4f53eb722fd670c324c2f74b7814030100010116030100303fb2196d56b8c5db3a8d286d13a3e7be1525c540e847b03753ff8dcd44b722a22eaebbfdae4733e348234f2c79332fa6 Message-Authenticator = 0xd9c5455c464de79980b501e138efcbc3 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 5 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.199.20.240 port 6217 EAP-Message = 0x0106004515800000003b14030100010116030100300d420f69ee784d90337c123e3ad17333f33afd4785266a8495af2cd5bd00c57f9b5250ab81d6abacad9f0a3b06a6a76a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe381d37c4e21bc6380caaf462 Finished request 12. Going to the next request Waking up in 3.6 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6218, id=1, length=450 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe381d37c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020600d0150017030100202efd8b68040fc99d7215fc82ddb19fcc9d5d7db5d6bf00feab83065c3c66904e17030100a08d9c6735ac0f310c1a1b40fc8b8b830001ad22a156e365fb7c7a3a172bb37b2936605498f2249045b9e90b8d078a50b9308ccc874344e52912a6ef295c7ab21e6a110effee3fe5fdb09aa3340455e22b5c29903d4cbc38b91756b75e551f21f71b9a3f73655188839f65cc8d01ed3fa072b892d664b5a82caed9fd110f88727b00321d304fe9f0d62ff61bb07eacde6670bc8f3fe688820431254c4fe8ca8493 Message-Authenticator = 0xba312fe00908947881503e3743208d95 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "002682671370(a)undisclosed.com" MS-CHAP-Challenge = 0xc919ad25030747b5b148f0012fe58cb6 MS-CHAP2-Response = 0x4a004b1aed39e592b691d44948ff62f2e0af00000000000000005c32a2d43a9b7763656058b7685e4fff541653c66a69e82c FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "002682671370(a)undisclosed.com" MS-CHAP-Challenge = 0xc919ad25030747b5b148f0012fe58cb6 MS-CHAP2-Response = 0x4a004b1aed39e592b691d44948ff62f2e0af00000000000000005c32a2d43a9b7763656058b7685e4fff541653c66a69e82c FreeRADIUS-Proxied-To = 127.0.0.1 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "00-26-82-67-13-70" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "002682671370(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 002682671370(a)undisclosed.com [sql] sql_set_user escaped user --> '002682671370(a)undisclosed.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '002682671370(a)undisclosed.com' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '002682671370(a)undisclosed.com' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='002682671370(a)undisclosed.com' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 [sql] expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'Business' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] User found in group Business [sql] expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'Business' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 8 , fields = 5 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: 002682671370(a)undisclosed.com [mschap] Client is using MS-CHAPv2 for 002682671370(a)undisclosed.com, we need NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel } # server inner-tunnel [ttls] Got tunneled reply code 2 Session-Timeout := 86400 Acct-Interim-Interval := 60 WiMAX-Packet-Data-Flow-Id := 14 WiMAX-Service-Data-Flow-Id := 14 WiMAX-Service-Profile-Id := 14 WiMAX-Packet-Data-Flow-Id += 17 WiMAX-Service-Data-Flow-Id += 17 WiMAX-Service-Profile-Id += 17 MS-CHAP2-Success = 0x4a533d30353933303244453938323444463545414642463738433642313742443639433239343131363541 MS-MPPE-Recv-Key = 0xe47e60276cf546b4d154c7a4312fed43 MS-MPPE-Send-Key = 0xae6450ff89cc6be810f6663c9c64877f MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 1 to 10.199.20.240 port 6218 EAP-Message = 0x0107005f158000000055170301005077724abe9bda2c3ab4c2a5b6e9133fff07ae7a253430c9ffe1670894562729f17314560024cb5e27684002a9cb7ac3d92f5ffed2a5a86acd16452736910513e429e1107846c729aa7475e84238443733 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d1b22fe3b1c37c4e21bc6380caaf462 Finished request 13. Going to the next request Waking up in 3.5 seconds. rad_recv: Access-Request packet from host 10.199.20.240 port 6219, id=2, length=248 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" State = 0x3d1b22fe3b1c37c4e21bc6380caaf462 Chargeable-User-Identity = "null" NAS-IP-Address = 10.199.20.240 NAS-Port = 5 NAS-Port-Type = Wireless-802.16 Framed-MTU = 1400 NAS-Identifier = "test" Calling-Station-Id = "\000&\202g\023p" Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-BS-Id = 0x000083010102 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = 3 WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-Attr-1537 = 0x0000006a WiMAX-Available-In-Client = 67 WiMAX-Attr-36 = 0x000001 EAP-Message = 0x020700061500 Message-Authenticator = 0x59a914ec4b16deb92b5f027659f5c712 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop rlm_wimax: Fixing WiMAX binary Calling-Station-Id to 00-26-82-67-13-70 ++[wimax] returns ok [suffix] Looking up realm "undisclosed.com" for User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" [suffix] No such realm "undisclosed.com" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [ttls] Using saved attributes from the original Access-Accept Session-Timeout := 86400 Acct-Interim-Interval := 60 WiMAX-Packet-Data-Flow-Id := 14 WiMAX-Service-Data-Flow-Id := 14 WiMAX-Service-Profile-Id := 14 WiMAX-Packet-Data-Flow-Id += 17 WiMAX-Service-Data-Flow-Id += 17 WiMAX-Service-Profile-Id += 17 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop [wimax] MIP-RK = 0x00b0ce41e978a30ec9b196bdea7bd74def743761ddc81add6cb19ca577056e59ea814c5b54891482a045773e861657260658939502a9babd7c0a59a92a99cf87 [wimax] MIP-SPI = 42f4fa35 [wimax] WARNING: WiMAX-MN-NAI was not found in the request or in the reply. [wimax] WARNING: We cannot calculate MN-HA keys. [wimax] WARNING: WiMAX-IP-Technology not found in reply. [wimax] WARNING: Not calculating MN-HA keys ++[wimax] returns updated Sending Access-Accept of id 2 to 10.199.20.240 port 6219 Session-Timeout := 86400 Acct-Interim-Interval := 60 WiMAX-Packet-Data-Flow-Id := 14 WiMAX-Service-Data-Flow-Id := 14 WiMAX-Service-Profile-Id := 14 WiMAX-Packet-Data-Flow-Id += 17 WiMAX-Service-Data-Flow-Id += 17 WiMAX-Service-Profile-Id += 17 MS-MPPE-Recv-Key = 0x6b033615247e78ea0e225bea745bba8c33634e0bf28ea0388174965a980b1642 MS-MPPE-Send-Key = 0x1a21679697b923cc88f4b4ba4fa37ded7f00c035811cd6ff18b4fb4e64956077 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1320CD7377DCB1AA6BACBBAD1A23AEE5(a)undisclosed.com" Finished request 14. Going to the next request Waking up in 3.4 seconds.

3 18

Freeradius won't bind to port if running as user AND started as root, but works fine if started as the radius user.
by Matthew Schumacher 31 Jul '13

31 Jul '13

List, This is odd, I can't seem to figure out what the deal is with this. This works: As root user; /usr/sbin/radius -X As root user; /usr/sbin/radius (when user= and group= is commented out and running as root) As radius user; /usr/sbin/radius -X As radius user; /usr/sbin/radius (when user=radius and group=user) This doesn't work: As root user; /usr/sbin/radius (when user=radius and group=user) I don't think this is a permissions issue as it works fine when invoked as the radius user in daemon mode (so we can read the config and write to logs), but starting as root and letting radius switch to the radius user doesn't work. What is interesting is that the logs show: ....... Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server When running as root user; /usr/sbin/radiusd -xx (when user=radius and group=user) So it stops just shy of thread pool and binding to the port. The same command and config run as the radius user shows: ....... Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server thread pool { start_servers = 10 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 } Thread spawned new child 1. Total threads in pool: 1 Thread 1 waiting to be assigned a request Thread spawned new child 2. Total threads in pool: 2 Thread 2 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 3 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 5 waiting to be assigned a request Thread spawned new child 6. Total threads in pool: 6 Thread 6 waiting to be assigned a request Thread spawned new child 7. Total threads in pool: 7 Thread 7 waiting to be assigned a request Thread spawned new child 8. Total threads in pool: 8 Thread 8 waiting to be assigned a request Thread spawned new child 9. Total threads in pool: 9 Thread 9 waiting to be assigned a request Thread spawned new child 10. Total threads in pool: 10 Thread pool initialized Thread 10 waiting to be assigned a request radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1645 } listen { type = "acct" ipaddr = * port = 1646 } Listening on authentication address * port 1645 Listening on accounting address * port 1646 Ready to process requests. Any ideas? Thanks, schu

1 0

Simultaneous-Use oddness.
by Matthew Schumacher 31 Jul '13

31 Jul '13

List, I'm bumping this odd issue with Simultaneous-Use: When I have a session that didn't get expired in a SQL database, and the user tries to connect then freeradius correctly checks the nas using the checkrad script *UNLESS* the nas is no longer defined in the clients. If the nas is missing, radius doesn't bother to call checkrad, and rejects the login as a multiple login. Perhaps this has something to do with the fact that my clients are defined in SQL using the nas_query option. So if I deprecate a nas, remove it from the db, then restart freeradius, the next request comes in, free radius finds the session to be open, but then neither checks checkrad or accepts the user. The user is now unable to authenticate until I close the session in the SQL database. Shouldn't freeradius call checkrad anyway and pass it the ip/session/user/port for the non-existent nas and let the checkrad script return 0, then let the user on? That's what I would have though should have happened. Thanks, schu

2 2

RE: Freeradius-Users Digest, Vol 99, Issue 94
by Koka Krishna 31 Jul '13

31 Jul '13

3. Re: only 2 dynamic IPs are allocated even the ip pool has many IPs (Alan DeKok) Hi Alan, Can you help me what changes do I need to do to get the new dynamic IP addresses for new sessions instead of duplicate IP addresses. I am not able to understand your answer fully. # key: # The key to use for the session database (which # holds the allocated ip's) normally it should # just be the nas ip/port (which is the default). # # If your NAS sends the same value of NAS-Port # all requests, the key should be based on some # other attribute that is in ALL requests, AND # is unique to each machine needing an IP address. # key = "%{NAS-IP-Address} %{NAS-Port}"<<<<<<<<<<<<<<<<<<<<<<<<<<<< Thanks Venkata Krishna Message: 3 Date: Tue, 30 Jul 2013 08:00:24 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: only 2 dynamic IPs are allocated even the ip pool has many IPs Message-ID: <51F7AAD8.90004(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Koka Krishna wrote:> I am using the freeradius 2.2.0 on ubuntu. > When I try to use the dynamic IP pool allocation, RADIUS server is > allocating only 2 IPs . afterwards those 2 IPs repeated for other > subscribers as well. So that I am not able to create more than 2 sessions. > May I know how to resolve this issue? Read raddb/modules/ippool. Look for the "key" attribute. Both the problem and the solution are documented there. i.e. if you're using a module, it helps to read the module configuration. > ippool main_pool { So... you posted the stock module configuration to the list. Why? Did you think we don't have a copy of it? And you didn't bother reading it. <sigh> Alan DeKok. ------------------------------

2 1

OCSP http requests
by Beltramini Francesco 31 Jul '13

31 Jul '13

Dear all, at the moment we are facing a small issue since our OCSP responders are behind a traffic manager. As explained in the eap.conf file, the freeradius' HTTP requests sent to the responder does not contain the "Host:" information and therefore the traffic manager can't handle it properly (unless we use for it a separate vIP, making the host field unnecessary). Is there any plan in the next releases to include this information in the HTTP requests ? Kind Regards, Francesco Beltramini ________________________________________________________________________ This e-mail has been scanned for all known viruses by European Medicines Agency. ________________________________________________________________________

2 1

DB hundler, a big problem to me
by Antonio Fernández Pérez 30 Jul '13

30 Jul '13

Hi everybody, I have FreeRADIUS 2.1.10 in Debian 6. I contact with you because we are checking log file of FreeRADIUS and we are encountering a lot of messages of "Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0". I have read in the forum and it is caused because database is broken but, are there any option to adjust in FreeRADIUS server to optimize db handlers? We have 12 sockets configured, we have adjust max_request to 3072 ( ... In our environment we are creating a lots of users in radcheck table. Could help us to execute an OPTIMIZE over radcheck table? (It's not common but in some cases users are removed) Any suggestion? Thanks in advance. Best regards, Antonio.

2 3

only 2 dynamic IPs are allocated even the ip pool has many IPs
by Koka Krishna 30 Jul '13

30 Jul '13

Hi all, I am using the freeradius 2.2.0 on ubuntu. When I try to use the dynamic IP pool allocation, RADIUS server is allocating only 2 IPs . afterwards those 2 IPs repeated for other subscribers as well. So that I am not able to create more than 2 sessions. May I know how to resolve this issue? I am planning to do the performance and scaling tests on PGW. rad_recv: Access-Request packet from host 104.104.1.1 port 20001, id=4, length=394 User-Name = "1995599718" Framed-IP-Netmask = 255.255.255.255 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Called-Station-Id = "automittarit.jklaluetaksi.fi" Calling-Station-Id = "1995599718" Acct-Session-Id = "C80758010000000012000802" 3GPP-IMSI = "244216858318774" 3GPP-IMEISV = "1122334455667798" 3GPP-Charging-ID = 301991938 3GPP-PDP-Type = 0 3GPP-GPRS-Negotiated-QoS-profile = "08-0408FFFFFFFFFFFFFFFF" 3GPP-SGSN-Address = 200.11.1.19 3GPP-GGSN-Address = 200.7.88.1 3GPP-IMSI-MCC-MNC = "24421" 3GPP-GGSN-MCC-MNC = "24405" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-Characteristics = "0400" 3GPP-SGSN-MCC-MNC = "24421" 3GPP-RAT-Type = 6 3GPP-Location-Info = 0x8142f4120003b9f7 3GPP-Allocate-IP-Type = Allocate-IPv4-Address User-Password = "sec" NAS-IP-Address = 104.104.1.1 NAS-Identifier = "mobst480k-ams-0" # Executing section authorize from file ./sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1995599718", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 9 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file ./sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "sec" [pap] Using clear text password "sec" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file ./sites-enabled/default +- entering group post-auth {...} [main_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 104.104.1.1 [main_pool] MD5 on 'key' directive maps to: 4435e8fd24a8846262d436c1c72e6d12 [main_pool] Searching for an entry for key: '4435e8fd24a8846262d436c1c72e6d12' rlm_ippool: Allocating ip to key: '4435e8fd24a8846262d436c1c72e6d12' [main_pool] num: 1 [main_pool] Allocated ip 60.60.59.113 to client key: 4435e8fd24a8846262d436c1c72e6d12 ++[main_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 4 to 104.104.1.1 port 20001 Framed-IP-Address = 60.60.59.113<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<1st access-accept Framed-IP-Netmask = 255.255.0.0 Finished request 98. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 104.104.1.1 port 20004, id=4, length=391 User-Name = "1995599718" Framed-IP-Address = 60.60.59.113 Event-Timestamp = "Jul 30 2013 11:58:38 IST" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Called-Station-Id = "automittarit.jklaluetaksi.fi" Calling-Station-Id = "1995599718" Acct-Session-Id = "C80758010000000012000802" 3GPP-IMSI = "244216858318774" 3GPP-IMEISV = "1122334455667798" 3GPP-Charging-ID = 301991938 3GPP-PDP-Type = 0 3GPP-GPRS-Negotiated-QoS-profile = "08-0408FFFFFFFFFFFFFFFF" 3GPP-SGSN-Address = 200.11.1.19 3GPP-GGSN-Address = 200.7.88.1 3GPP-IMSI-MCC-MNC = "24421" 3GPP-GGSN-MCC-MNC = "24405" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-Characteristics = "0400" 3GPP-SGSN-MCC-MNC = "24421" 3GPP-RAT-Type = 6 3GPP-Location-Info = 0x8142f4120003b9f7 Acct-Status-Type = Start Acct-Authentic = RADIUS NAS-Port-Type = Virtual NAS-IP-Address = 104.104.1.1 NAS-Identifier = "mobst480k-ams-0" Acct-Delay-Time = 0 # Executing section preacct from file ./sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',NAS-Identifier = "mobst480k-ams-0",NAS-IP-Address = 104.104.1.1,Acct-Session-Id = "C80758010000000012000802",User-Name = "1995599718"' [acct_unique] Acct-Unique-Session-ID = "907d8e5f3b56b4e1". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "1995599718", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file ./sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 104.104.1.1 [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/104.104.1.1/detail-20130730 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/104.104.1.1/detail-20130730 [detail] expand: %t -> Tue Jul 30 11:58:00 2013 ++[detail] returns ok [main_pool] This is not an Accounting-Stop. Return NOOP. ++[main_pool] returns noop ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 1995599718 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 4 to 104.104.1.1 port 20004 Finished request 99. Cleaning up request 99 ID 4 with timestamp +353975 Going to the next request Waking up in 4.8 seconds. Cleaning up request 98 ID 4 with timestamp +353975 Ready to process requests. rad_recv: Access-Request packet from host 104.104.1.1 port 20001, id=5, length=394 User-Name = "1995599719" Framed-IP-Netmask = 255.255.255.255 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Called-Station-Id = "automittarit.jklaluetaksi.fi" Calling-Station-Id = "1995599719" Acct-Session-Id = "C80758010000000012001C00" 3GPP-IMSI = "244216858318775" 3GPP-IMEISV = "1122334455667799" 3GPP-Charging-ID = 301997056 3GPP-PDP-Type = 0 3GPP-GPRS-Negotiated-QoS-profile = "08-0408FFFFFFFFFFFFFFFF" 3GPP-SGSN-Address = 200.11.1.19 3GPP-GGSN-Address = 200.7.88.1 3GPP-IMSI-MCC-MNC = "24421" 3GPP-GGSN-MCC-MNC = "24405" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-Characteristics = "0400" 3GPP-SGSN-MCC-MNC = "24421" 3GPP-RAT-Type = 6 3GPP-Location-Info = 0x8142f4120003b9f7 3GPP-Allocate-IP-Type = Allocate-IPv4-Address User-Password = "sec" NAS-IP-Address = 104.104.1.1 NAS-Identifier = "mobst480k-ams-0" # Executing section authorize from file ./sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1995599719", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 9 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file ./sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "sec" [pap] Using clear text password "sec" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file ./sites-enabled/default +- entering group post-auth {...} [main_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 104.104.1.1 [main_pool] MD5 on 'key' directive maps to: 4435e8fd24a8846262d436c1c72e6d12 [main_pool] Searching for an entry for key: '4435e8fd24a8846262d436c1c72e6d12' [main_pool] Found a stale entry for ip: 60.60.59.113 [main_pool] num: 0 rlm_ippool: Allocating ip to key: '4435e8fd24a8846262d436c1c72e6d12' [main_pool] num: 1 [main_pool] Allocated ip 60.60.173.112 to client key: 4435e8fd24a8846262d436c1c72e6d12 ++[main_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 5 to 104.104.1.1 port 20001 Framed-IP-Address = 60.60.173.112<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<2nd access-accept Framed-IP-Netmask = 255.255.0.0 Finished request 100. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 104.104.1.1 port 20008, id=0, length=391 User-Name = "1995599719" Framed-IP-Address = 60.60.173.112 Event-Timestamp = "Jul 30 2013 11:58:59 IST" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Called-Station-Id = "automittarit.jklaluetaksi.fi" Calling-Station-Id = "1995599719" Acct-Session-Id = "C80758010000000012001C00" 3GPP-IMSI = "244216858318775" 3GPP-IMEISV = "1122334455667799" 3GPP-Charging-ID = 301997056 3GPP-PDP-Type = 0 3GPP-GPRS-Negotiated-QoS-profile = "08-0408FFFFFFFFFFFFFFFF" 3GPP-SGSN-Address = 200.11.1.19 3GPP-GGSN-Address = 200.7.88.1 3GPP-IMSI-MCC-MNC = "24421" 3GPP-GGSN-MCC-MNC = "24405" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-Characteristics = "0400" 3GPP-SGSN-MCC-MNC = "24421" 3GPP-RAT-Type = 6 3GPP-Location-Info = 0x8142f4120003b9f7 Acct-Status-Type = Start Acct-Authentic = RADIUS NAS-Port-Type = Virtual NAS-IP-Address = 104.104.1.1 NAS-Identifier = "mobst480k-ams-0" Acct-Delay-Time = 0 # Executing section preacct from file ./sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing ',NAS-Identifier = "mobst480k-ams-0",NAS-IP-Address = 104.104.1.1,Acct-Session-Id = "C80758010000000012001C00",User-Name = "1995599719"' [acct_unique] Acct-Unique-Session-ID = "ee7bc74f7735f7df". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "1995599719", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file ./sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 104.104.1.1 [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/104.104.1.1/detail-20130730 [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/104.104.1.1/detail-20130730 [detail] expand: %t -> Tue Jul 30 11:58:21 2013 ++[detail] returns ok [main_pool] This is not an Accounting-Stop. Return NOOP. ++[main_pool] returns noop ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 1995599719 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 0 to 104.104.1.1 port 20008 Finished request 101. Cleaning up request 101 ID 0 with timestamp +353996 Going to the next request Waking up in 4.8 seconds. Cleaning up request 100 ID 5 with timestamp +353996 Ready to process requests. rad_recv: Access-Request packet from host 104.104.1.1 port 20007, id=1, length=394 User-Name = "1995599720" Framed-IP-Netmask = 255.255.255.255 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Called-Station-Id = "automittarit.jklaluetaksi.fi" Calling-Station-Id = "1995599720" Acct-Session-Id = "C80758010000000012002000" 3GPP-IMSI = "244216858318776" 3GPP-IMEISV = "1122334455667800" 3GPP-Charging-ID = 301998080 3GPP-PDP-Type = 0 3GPP-GPRS-Negotiated-QoS-profile = "08-0408FFFFFFFFFFFFFFFF" 3GPP-SGSN-Address = 200.11.1.19 3GPP-GGSN-Address = 200.7.88.1 3GPP-IMSI-MCC-MNC = "24421" 3GPP-GGSN-MCC-MNC = "24405" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-Characteristics = "0400" 3GPP-SGSN-MCC-MNC = "24421" 3GPP-RAT-Type = 6 3GPP-Location-Info = 0x8142f4120003b9f7 3GPP-Allocate-IP-Type = Allocate-IPv4-Address User-Password = "sec" NAS-IP-Address = 104.104.1.1 NAS-Identifier = "mobst480k-ams-0" # Executing section authorize from file ./sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1995599720", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 9 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file ./sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "sec" [pap] Using clear text password "sec" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file ./sites-enabled/default +- entering group post-auth {...} [main_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 104.104.1.1 [main_pool] MD5 on 'key' directive maps to: 4435e8fd24a8846262d436c1c72e6d12 [main_pool] Searching for an entry for key: '4435e8fd24a8846262d436c1c72e6d12' [main_pool] Found a stale entry for ip: 60.60.173.112 [main_pool] num: 0 rlm_ippool: Allocating ip to key: '4435e8fd24a8846262d436c1c72e6d12' [main_pool] num: 1 [main_pool] Allocated ip 60.60.59.113 to client key: 4435e8fd24a8846262d436c1c72e6d12 ++[main_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 1 to 104.104.1.1 port 20007 Framed-IP-Address = 60.60.59.113<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<3rd access-accept. But the IP address is same as 1st access-accept. Framed-IP-Netmask = 255.255.0.0 Finished request 102. Going to the next request Waking up in 4.9 seconds. Cleaning up request 102 ID 1 with timestamp +354003 Ready to process requests. ippool main_pool { # range-start,range-stop: # The start and end ip addresses for this pool. # range-start = 192.168.1.1 # range-stop = 192.168.3.254 range-start = 60.60.0.1 range-stop = 60.60.255.252 netmask = 255.255.0.0 # netmask: # The network mask used for this pool. # netmask = 255.255.255.0 # cache-size: # The gdbm cache size for the db files. Should # be equal to the number of ip's available in # the ip pool cache-size = 800 # session-db: # The main db file used to allocate addresses. session-db = ${db_dir}/db.ippool # ip-index: # Helper db index file used in multilink ip-index = ${db_dir}/db.ipindex # override: # If set, the Framed-IP-Address already in the # reply (if any) will be discarded, and replaced # with a Framed-IP-Address assigned here. override = no # maximum-timeout: # Specifies the maximum time in seconds that an # entry may be active. If set to zero, means # "no timeout". The default value is 0 maximum-timeout = 0 # key: # The key to use for the session database (which # holds the allocated ip's) normally it should # just be the nas ip/port (which is the default). # # If your NAS sends the same value of NAS-Port # all requests, the key should be based on some # other attribute that is in ALL requests, AND # is unique to each machine needing an IP address. #key = "%{NAS-IP-Address} %{NAS-Port}"

2 1

restricting users using huntgroup
by Alan Kong 30 Jul '13

30 Jul '13

Hi, I want to use huntgroup to restrict users connecting. If the user is added in huntgroup and login and clear password was entered in users file, the user has no problem in accessing. When I add another user in huntgroup but using Unix password file to authenticate, I keep getting invalid user in radius log. Could you please advise on possible solution. "huntgroups" file: erg-rbs NAS-Identifier == ERG-RBS User-Name == csetest, (No problem) User-Name == akong "users" file: csetest NAS-Identifier == "ERG-RBS", Cleartext-Password := "test" Fall-Through = No #DEFAULT Auth-Type == PAP, Huntgroup-Name == "erg-rbs" DEFAULT Auth-Type == System, Huntgroup-Name == "erg-rbs" Thank you. Regards Alan -- "Happy people say Thank You! They Live with a Feeling of Gratitude."

2 1

EAP-SIM authentication problem at 2nd stage
by johan firdianto 30 Jul '13

30 Jul '13

dear guest, i have problem in eap-sim authentication. I'm using freeradius 2.2.0, blackberry 9220 here my simtripletsdat. file 1510012660372465,AF6876E748BD46bf853A99DC2032F0A7,95762655,449177635B92bc00 1510012660372465,A1A9AC744E8D49819D27A79B067BCA69,257b31c6,64ff9467DEa1e400 1510012660372465,603906BFD8DC404197BAC35FF1274EB3,4F41eb06,F3ce89b4FCbc0000 1510080332618369,23A95DB79B644a4299463F0342069A11,7775d266,B10f3eba2Bc5ed2b 1510080332618369,FDCE8E4F2B0B4b3086BEF230076EAD58,D9e080d9,E2aad63f711e1324 1510080332618369,238100571AD1495fBCE2AD5505634E41,A40e1656,66a098a750d9cd13 here content of users file 1510080332618369 Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 := 0x23A95DB79B644a4299463F0342069A11, EAP-Sim-SRES1 := 0x7775d266, EAP-Sim-KC1 := 0xB10f3eba2Bc5ed2b, EAP-Sim-Rand2 := 0xFDCE8E4F2B0B4b3086BEF230076EAD58, EAP-Sim-SRES2 := 0xD9e080d9, EAP-Sim-KC2 := 0xE2aad63f711e1324, EAP-Sim-Rand3 := 0x238100571AD1495fBCE2AD5505634E41, EAP-Sim-SRES3 := 0xA40e1656, EAP-Sim-KC3 := 0x66a098a750d9cd13, 1510012660372465 Auth-Type := EAP, EAP-Type := sim EAP-Sim-Rand1 := 0xAF6876E748BD46bf853A99DC2032F0A7, EAP-Sim-SRES1 := 0x95762655, EAP-Sim-KC1 := 0x449177635B92bc00, EAP-Sim-Rand2 := 0xA1A9AC744E8D49819D27A79B067BCA69, EAP-Sim-SRES2 := 0x257b31c6, EAP-Sim-KC2 := 0x64ff9467DEa1e400, EAP-Sim-Rand3 := 0x603906BFD8DC404197BAC35FF1274EB3, EAP-Sim-SRES3 := 0x4F41eb06, EAP-Sim-KC3 := 0xF3ce89b4FCbc0000, 1510080332618369 at wlan.mnc080.mcc510.3gppnetwork.org Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 := 0x23A95DB79B644a4299463F0342069A11, EAP-Sim-SRES1 := 0x7775d266, EAP-Sim-KC1 := 0xB10f3eba2Bc5ed2b, EAP-Sim-Rand2 := 0xFDCE8E4F2B0B4b3086BEF230076EAD58, EAP-Sim-SRES2 := 0xD9e080d9, EAP-Sim-KC2 := 0xE2aad63f711e1324, EAP-Sim-Rand3 := 0x238100571AD1495fBCE2AD5505634E41, EAP-Sim-SRES3 := 0xA40e1656, EAP-Sim-KC3 := 0x66a098a750d9cd13 Already included sim_files in modules and sim { } in eap.conf. I analyze in debug , the firsth authorization success (sim_files return ok status) , the first authenticating success , the second authorization success also, but the problem the second authenticating is failed. Already read in the past list archive, but no clue . Here debug of radius Ready to process requests. rad_recv: Access-Request packet from host 192.168.111.72 port 34647, id=129, length=250 User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.88.52 Called-Station-Id = "FA-1A-67-9F-E4-68:NOLSPOT-Secure" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "70-AA-B2-EF-8E-9D" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x02100038013135313030383033333236313833363940776c616e2e6d6e633038302e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xf0b7f7c3d39dd64797e1ffa08c3c078e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc080.mcc510.3gppnetwork.org" for User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Found realm "wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Adding Stripped-User-Name = "1510080332618369" [suffix] Adding Realm = "wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry 1510080332618369 at line 206 ++[files] returns ok rlm_sim_files: authorized user/imsi 1510080332618369 rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 16 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org [sql] sql_set_user escaped user --> ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop Found Auth-Type = EAP Found Auth-Type = EAP Warning: Found 2 auth-types on request for user '1510080332618369' # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 182 ++[eap] returns handled Sending Access-Challenge of id 129 to 192.168.111.72 port 34647 EAP-Message = 0x01b60014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x876b64d687dd7613c1482e3b4d19abaa Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.111.72 port 34647, id=130, length=300 User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.88.52 Called-Station-Id = "FA-1A-67-9F-E4-68:NOLSPOT-Secure" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "70-AA-B2-EF-8E-9D" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x02b60058120a000007050000c6fb9b6adcacba2f73e0dec777302196100100010e0e00333135313030383033333236313833363940776c616e2e6d6e633038302e6d63633531302e336770706e6574776f726b2e6f726700 State = 0x876b64d687dd7613c1482e3b4d19abaa Message-Authenticator = 0xf06c219eca5af618cf61099f2f79f3a4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc080.mcc510.3gppnetwork.org" for User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Found realm "wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Adding Stripped-User-Name = "1510080332618369" [suffix] Adding Realm = "wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry 1510080332618369 at line 206 ++[files] returns ok rlm_sim_files: authorized user/imsi 1510080332618369 rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 182 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org [sql] sql_set_user escaped user --> ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop Found Auth-Type = EAP Found Auth-Type = EAP Warning: Found 2 auth-types on request for user '1510080332618369' # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.88.52 Called-Station-Id = "FA-1A-67-9F-E4-68:NOLSPOT-Secure" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "70-AA-B2-EF-8E-9D" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x02b60058120a000007050000c6fb9b6adcacba2f73e0dec777302196100100010e0e00333135313030383033333236313833363940776c616e2e6d6e633038302e6d63633531302e336770706e6574776f726b2e6f726700 State = 0x876b64d687dd7613c1482e3b4d19abaa Message-Authenticator = 0xf06c219eca5af618cf61099f2f79f3a4 Stripped-User-Name = "1510080332618369" Realm = "wlan.mnc080.mcc510.3gppnetwork.org" EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000c6fb9b6adcacba2f73e0dec777302196 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333135313030383033333236313833363940776c616e2e6d6e633038302e6d63633531302e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 183 ++[eap] returns handled Sending Access-Challenge of id 130 to 192.168.111.72 port 34647 EAP-Message = 0x01b70050120b0000010d000023a95db79b644a4299463f0342069a11fdce8e4f2b0b4b3086bef230076ead58238100571ad1495fbce2ad5505634e410b0500002fe3b8c33af56aa2dc9e873f71c4b691 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x876b64d686dc7613c1482e3b4d19abaa Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.111.72 port 34647, id=131, length=224 User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.88.52 Called-Station-Id = "FA-1A-67-9F-E4-68:NOLSPOT-Secure" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "70-AA-B2-EF-8E-9D" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x02b7000c120e000016010000 State = 0x876b64d686dc7613c1482e3b4d19abaa Message-Authenticator = 0xeb64a094fea2ddbf458b0cac3e47686d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc080.mcc510.3gppnetwork.org" for User-Name = "1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Found realm "wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Adding Stripped-User-Name = "1510080332618369" [suffix] Adding Realm = "wlan.mnc080.mcc510.3gppnetwork.org" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry 1510080332618369 at line 206 ++[files] returns ok rlm_sim_files: authorized user/imsi 1510080332618369 rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 183 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org [sql] sql_set_user escaped user --> ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = ' 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User 1510080332618369(a)wlan.mnc080.mcc510.3gppnetwork.org not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop Found Auth-Type = EAP Found Auth-Type = EAP Warning: Found 2 auth-types on request for user '1510080332618369' # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT

1 0